CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1511:

  The Chief Technical Officer (CTO) has tasked The Computer Emergency Response Team (CERT) to develop and update all Internal Operating Procedures and Standard Operating Procedures documentation in order to successfully respond to future incidents. Which of the following stages of the Incident Handling process is the team working on?

  A. Lessons Learned
  B. Eradication
  C. Recovery
  D. Preparation
  D. Preparation

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Developing and updating all internal operating and standard operating procedures documentation to handle future incidents is preparation.

• Question 1512:

  Which of the following is the BEST reason for placing a password lock on a mobile device?

  A. Prevents an unauthorized user from accessing owner's data
  B. Enables remote wipe capabilities
  C. Stops an unauthorized user from using the device again
  D. Prevents an unauthorized user from making phone calls
  A. Prevents an unauthorized user from accessing owner's data

  ---

  A password lock on a mobile device is used to prevent an unauthorized user from accessing owner's data. When a device is turned off either by being manually switched off or by automatically turning off after a timeout, the device will automatically lock. When you turn the device on, you are prompted to enter a password or numeric code to gain access to the device.

• Question 1513:

  To help prevent unauthorized access to PCs, a security administrator implements screen savers that lock the PC after five minutes of inactivity. Which of the following controls is being described in this situation?

  A. Management
  B. Administrative
  C. Technical
  D. Operational
  C. Technical

  ---

  controls such as preventing unauthorized access to PC's and applying screensavers that lock the PC after five minutes of inactivity is a technical control type, the same as Identification and Authentication, Access Control, Audit and Accountability as well as System and Communication Protection.

• Question 1514:

  Pete, an employee, needs a certificate to encrypt data. Which of the following would issue Pete a certificate?

  A. Certification authority
  B. Key escrow
  C. Certificate revocation list
  D. Registration authority
  A. Certification authority

  ---

  A certificate authority (CA) is an organization that is responsible for issuing, revoking, and distributing certificates.

• Question 1515:

  Which of the following would a security administrator implement in order to identify a problem between two applications that are not communicating properly?

  A. Protocol analyzer
  B. Baseline report
  C. Risk assessment
  D. Vulnerability scan
  A. Protocol analyzer

  ---

  A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing and analyzing the packets sent between applications on systems that are not communicating properly could help determine the cause of the issue. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal).

• Question 1516:

  A security administrator has been tasked to ensure access to all network equipment is controlled by a central server such as TACACS+. This type of implementation supports which of the following risk mitigation strategies?

  A. User rights and permissions review
  B. Change management
  C. Data loss prevention
  D. Implement procedures to prevent data theft
  A. User rights and permissions review

  ---

  Terminal Access Controller Access-Control System (TACACS, and variations like XTACACS and TACACS+) is a client/server-oriented environment, and it operates in a manner similar to RADIUS. Furthermore TACACS+ allows for credential to be accepted from multiple methods. Thus you can perform user rights and permission reviews with TACACS+.

• Question 1517:

  A security administrator has installed a new KDC for the corporate environment. Which of the following authentication protocols is the security administrator planning to implement across the organization?

  A. LDAP
  B. RADIUS
  C. Kerberos
  D. XTACACS
  C. Kerberos

  ---

  The fundamental component of a Kerberos solution is the key distribution centre (KDC), which is responsible for verifying the identity of principles and granting and controlling access within a network environment through the use of secure cryptographic keys and tickets.

• Question 1518:

  A Windows-based computer is infected with malware and is running too slowly to boot and run a malware scanner. Which of the following is the BEST way to run the malware scanner?

  A. Kill all system processes
  B. Enable the firewall
  C. Boot from CD/USB
  D. Disable the network connection
  C. Boot from CD/USB

  ---

  Antivirus companies frequently create boot discs you can use to scan and repair your computer. These tools can be burned to a CD or DVD or installed onto a USB drive. You can then restart your computer and boot from the removable media. A special antivirus environment will load where your computer can be scanned and repaired.

  Incorrect Options:

  A: Kill all system processes will stop system processes, and could have a negative effect on the system. It is not the BEST way to run the malware scanner

  B: The basic purpose of a firewall is to isolate one network from another. It is not the BEST way to run the malware scanner.

  D: Disabling the network connection will not allow for the BEST way to run the malware scanner.

  Reference:

  http://www.howtogeek.com/187037/how-to-scan-and-repair-a-badly-infected-computer- from-outside-windows/

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, p. 342

• Question 1519:

  A company wants to ensure that its hot site is prepared and functioning. Which of the following would be the BEST process to verify the backup datacenter is prepared for such a scenario?

  A. Site visit to the backup data center
  B. Disaster recovery plan review
  C. Disaster recovery exercise
  D. Restore from backup
  C. Disaster recovery exercise

  ---

  A hot site is a location that can provide operations within hours of a failure. This type of site would have servers, networks, and telecommunications equipment in place to reestablish service in a short time. Hot sites provide network connectivity, systems, and preconfigured software to meet the needs of an organization. This means that an actual exercise run would test the abilities of your hot site best.

• Question 1520:

  Which of the following provides the HIGHEST level of confidentiality on a wireless network?

  A. Disabling SSID broadcast
  B. MAC filtering
  C. WPA2
  D. Packet switching
  C. WPA2

  ---

  The Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) authentication protocols were designed to address the core, easy-to-crack problems of WEP.