CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1551:

  A company plans to expand by hiring new engineers who work in highly specialized areas. Each engineer will have very different job requirements and use unique tools and applications in their job. Which of the following is MOST appropriate to use?

  A. Role-based privileges
  B. Credential management
  C. User assigned privileges
  D. User access
  A. Role-based privileges

  ---

  In this question, we have engineers who require different tools and applications according to their specialized job function. We can therefore use the Role-Based Access Control model.

  Role-Based Access Control (RBAC) models approach the problem of access control based on established roles in an organization. RBAC models implement access by job function or by responsibility. Each employee has one or more roles

  that allow access to specific information. If a person moves from one role to another, the access for the previous role will no longer be available.

  Instead of thinking "Denise needs to be able to edit files," RBAC uses the logic "Editors need to be able to edit files" and "Denise is a member of the Editors group." This model is always good for use in an environment in which there is high

  employee turnover.

• Question 1552:

  An organization has introduced token-based authentication to system administrators due to risk of password compromise. The tokens have a set of numbers that automatically change every 30 seconds. Which of the following type of authentication mechanism is this?

  A. TOTP
  B. Smart card
  C. CHAP
  D. HOTP
  A. TOTP

  ---

  Time-based one-time password (TOTP) tokens are devices or applications that generate passwords at fixed time intervals. In this case, it's every 30 seconds.

• Question 1553:

  An employee's mobile device associates with the company's guest WiFi SSID, but then is unable to retrieve email. The email settings appear to be correct. Which of the following is the MOST likely cause?

  A. The employee has set the network type to WPA instead of WPA2
  B. The network uses a captive portal and requires a web authentication
  C. The administrator has blocked the use of the personal hot spot feature
  D. The mobile device has been placed in airplane mode
  B. The network uses a captive portal and requires a web authentication

• Question 1554:

  A certificate authority takes which of the following actions in PKI?

  A. Signs and verifies all infrastructure messages
  B. Issues and signs all private keys
  C. Publishes key escrow lists to CRLs
  D. Issues and signs all root certificates
  D. Issues and signs all root certificates

  ---

  A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is part of a public key infrastructure (PKI) scheme. The most common commercial variety is based on the ITU-T X.509 standard, which

  normally includes a digital signature from a certificate authority (CA).

  Note: In cryptography and computer security, a root certificate is an unsigned public key certificate (also called self-signed certificate) that identifies the Root Certificate Authority (CA).

• Question 1555:

  A security analyst needs to logon to the console to perform maintenance on a remote server. Which of the following protocols would provide secure access?

  A. SCP
  B. SSH
  C. SFTP
  D. HTTPS
  B. SSH

  ---

  Secure Shell (SSH) is a tunneling protocol originally used on Unix systems. It's now available for both Unix and Windows environments. SSH is primarily intended for interactive terminal sessions. SSH is used to establish a command-line, text-only interface connection with a server, router, switch, or similar device over any distance.

• Question 1556:

  Which of the following attacks could be used to initiate a subsequent man-in-the-middle attack?

  A. ARP poisoning
  B. DoS
  C. Replay
  D. Brute force
  C. Replay

  ---

  A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

  For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice's password (or hash) read from the last session, which Bob accepts thus granting access to Eve.

  Countermeasures: A way to avoid replay attacks is by using session tokens: Bob sends a one-time token to Alice, which Alice uses to transform the password and send the result to Bob (e.g. computing a hash function of the session token appended to the password). On his side Bob performs the same computation; if and only if both values match, the login is successful. Now suppose Eve has captured this value and tries to use it on another session; Bob sends a different session token, and when Eve replies with the captured value it will be different from Bob's computation. Session tokens should be chosen by a (pseudo-) random process. Otherwise Eve may be able to pose as Bob, presenting some predicted future token, and convince Alice to use that token in her transformation. Eve can then replay her reply at a later time (when the previously predicted token is actually presented by Bob), and Bob will accept the authentication. One-time passwords are similar to session tokens in that the password expires after it has been used or after a very short amount of time. They can be used to authenticate individual transactions in addition to sessions. The technique has been widely implemented in personal online banking systems. Bob can also send nonces but should then include a message authentication code (MAC), which Alice should check. Timestamping is another way of preventing a replay attack. Synchronization should be achieved using a secure protocol. For example Bob periodically broadcasts the time on his clock together with a MAC. When Alice wants to send Bob a message, she includes her best estimate of the time on his clock in her message, which is also authenticated. Bob only accepts messages for which the timestamp is within a reasonable tolerance. The advantage of this scheme is that Bob does not need to generate (pseudo-) random numbers, with the trade-off being that replay attacks, if they are performed quickly enough i.e. within that 'reasonable' limit, could succeed.

• Question 1557:

  Identifying a list of all approved software on a system is a step in which of the following practices?

  A. Passively testing security controls
  B. Application hardening
  C. Host software baselining
  D. Client-side targeting
  C. Host software baselining

  ---

  Application baseline defines the level or standard of security that will be implemented and maintained for the application. It may include requirements of hardware components, operating system versions, patch levels, installed applications and their configurations, and available ports and services. Systems can be compared to the baseline to ensure that the required level of security is being maintained.

• Question 1558:

  The chief information officer (CIO) of a major company intends to increase employee connectivity and productivity by issuing employees mobile devices with access to their enterprise email, calendar, and contacts. The solution the CIO intends to use requires a PKI that automates the enrollment of mobile device certificates. Which of the following, when implemented and configured securely, will meet the CIO's requirement?

  A. OCSP
  B. SCEP
  C. SAML
  D. OSI
  B. SCEP

• Question 1559:

  Recently several employees were victims of a phishing email that appeared to originate from the company president. The email claimed the employees would be disciplined if they did not click on a malicious link in the message. Which of the following principles of social engineering mad attack successful?

  A. Authority
  B. Spamming
  C. Social proof
  D. Scarcity
  A. Authority

• Question 1560:

  An administrator needs to submit a new CSR to a CA. Which of the following is a valid FIRST step?

  A. Generate a new private key based on AES.
  B. Generate a new public key based on RSA.
  C. Generate a new public key based on AES.
  D. Generate a new private key based on RSA.
  D. Generate a new private key based on RSA.

  ---

  Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The private key is needed to produce, but it is not part of, the CSR. The private key is an RSA key. The private encryption key that will be used to

  protect sensitive information.

  Note: A CSR or Certificate Signing request is a block of encrypted text that is generated on the server that the certificate will be used on. It contains information that will be included in your certificate such as your organization name, common

  name (domain name), locality, and country. It also contains the public key that will be included in your certificate. A private key is usually created at the same time that you create the CSR.