CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1561:

  Human Resources (HR) would like executives to undergo only two specific security training programs a year. Which of the following provides the BEST level of security training for the executives? (Select TWO).

  A. Acceptable use of social media
  B. Data handling and disposal
  C. Zero day exploits and viruses
  D. Phishing threats and attacks
  E. Clean desk and BYOD
  F. Information security awareness
  D. Phishing threats and attacks
  F. Information security awareness

  ---

  Managers/ i.e. executives in the company are concerned with more global issues in the organization, including enforcing security policies and procedures. Managers should receive additional training or exposure that explains the issues, threats, and methods of dealing with threats. Management will also be concerned about productivity impacts and enforcement and how the various departments are affected by security policies. Phishing is a form of social engineering in which you ask someone for a piece of information that you are missing by making it look as if it is a legitimate request. An email might look as if it is from a bank and contain some basic information, such as the user's name. Executives an easily fall prey to phishing if they are not trained to lookout for these attacks.

• Question 1562:

  A network technician is trying to determine the source of an ongoing network based attack. Which of the following should the technician use to view IPv4 packet data on a particular internal network segment?

  A. Proxy
  B. Protocol analyzer
  C. Switch
  D. Firewall
  B. Protocol analyzer

• Question 1563:

  A team of firewall administrators have access to a `master password list' containing service account passwords. Which of the following BEST protects the master password list?

  A. File encryption
  B. Password hashing
  C. USB encryption
  D. Full disk encryption
  A. File encryption

  ---

  File encryption can be used to protect the contents of individual files. It uses randomly generated symmetric encryption keys for the file and stores the key in an encrypted form using the user's public key on the encrypted file.

• Question 1564:

  During a recent investigation, an auditor discovered that an engineer's compromised workstation was being used to connect to SCADA systems while the engineer was not logged in. The engineer is responsible for administering the SCADA systems and cannot be blocked from connecting to them. The SCADA systems cannot be modified without vendor approval which requires months of testing.

  Which of the following is MOST likely to protect the SCADA systems from misuse?

  A. Update anti-virus definitions on SCADA systems
  B. Audit accounts on the SCADA systems
  C. Install a firewall on the SCADA network
  D. Deploy NIPS at the edge of the SCADA network
  D. Deploy NIPS at the edge of the SCADA network

  ---

  A supervisory control and data acquisition (SCADA) system is an industrial control system (ICS) that is used to control infrastructure processes, facility-based processes, or industrial processes.

  A network-based IPS (NIPS) is an intrusion detection and prevention system that scans network traffic in real time against a database of attack signatures. It is useful for detecting and responding to network-based attacks originating from

  outside the organization.

• Question 1565:

  Which of the following is considered the MOST effective practice when securing printers or scanners in an enterprise environment?

  A. Routine vulnerability scanning of peripherals
  B. Install in a hardened network segment
  C. Turn off the power to the peripherals at night
  D. Enable print sharing only from workstations
  A. Routine vulnerability scanning of peripherals

• Question 1566:

  A company recently experienced several security breaches that resulted in confidential data being infiltrated form the network. The forensic investigation revealed that the data breaches were caused by an insider accessing files that resided in shared folders who then encrypted the data and sent it to contacts via third party email. Management is concerned that other employees may also be sending confidential files outside of the company to the same organization. Management has requested that the IT department implement a solution that will allow them to:

  Track access and sue of files marked confidential, provide documentation that can be sued for investigations, prevent employees from sending confidential data via secure third party email, identify other employees that may be involved in these activities.

  Which of the following would be the best choice to implement to meet the above requirements?

  A. Web content filtering capable of inspe4cting and logging SSL traffic used by third party webmail providers
  B. Full disk encryption on all computers with centralized event logging and monitoring enabled
  C. Host based firewalls with real time monitoring and logging enabled
  D. Agent-based DLP software with correlations and logging enabled
  D. Agent-based DLP software with correlations and logging enabled

• Question 1567:

  RADIUS provides which of the following?

  A. Authentication, Authorization, Availability
  B. Authentication, Authorization, Auditing
  C. Authentication, Accounting, Auditing
  D. Authentication, Authorization, Accounting
  D. Authentication, Authorization, Accounting

  ---

  The Remote Authentication Dial In User Service (RADIUS) networking protocol offers centralized Authentication, Authorization, and Accounting (AAA) management for users who make use of a network service. It is for this reason that A, B, and C: are incorrect.

  References: http://en.wikipedia.org/wiki/RADIUS

• Question 1568:

  During an application design, the development team specifics a LDAP module for single sign-on communication with the company's access control database. This is an example of which of the following?

  A. Application control
  B. Data in-transit
  C. Identification
  D. Authentication
  D. Authentication

• Question 1569:

  One of the most consistently reported software security vulnerabilities that leads to major exploits is:

  A. Lack of malware detection.
  B. Attack surface decrease.
  C. Inadequate network hardening.
  D. Poor input validation.
  D. Poor input validation.

  ---

  D: With coding there are standards that should be observed. Of these standards the most fundamental is input validation. Attacks such as SQL injection depend on unfiltered input being sent through a web application. This makes for a software vulnerability that can be exploited. There are two primary ways to do input validation: client-side validation and server-side validation. Thus with poor input validation you increase your risk with regard to exposure to major software exploits.

• Question 1570:

  Jane, a security analyst, is reviewing logs from hosts across the Internet which her company uses to gather data on new malware. Which of the following is being implemented by Jane's company?

  A. Vulnerability scanner
  B. Honeynet
  C. Protocol analyzer
  D. Port scanner
  B. Honeynet

  ---

  The Internet hosts used to gather data on new malware are known as honeypots. A collection of honeypots is known as a honeynet. A honeynet is a network set up with intentional vulnerabilities; its purpose is to invite attack, so that an attacker's activities and methods can be studied and that information used to increase network security. A honeynet contains one or more honey pots, which are computer systems on the Internet expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. Although the primary purpose of a honeynet is to gather information about attackers' methods and motives, the decoy network can benefit its operator in other ways, for example by diverting attackers from a real network and its resources. The Honeynet Project, a non-profit research organization dedicated to computer security and information sharing, actively promotes the deployment of honeynets. In addition to the honey pots, a honeynet usually has real applications and services so that it seems like a normal network and a worthwhile target. However, because the honeynet doesn't actually serve any authorized users, any attempt to contact the network from without is likely an illicit attempt to breach its security, and any outbound activity is likely evidence that a system has been compromised. For this reason, the suspect information is much more apparent than it would be in an actual network, where it would have to be found amidst all the legitimate network data. Applications within a honeynet are often given names such as "Finances" or "Human Services" to make them sound appealing to the attacker.

  A virtual honeynet is one that, while appearing to be an entire network, resides on a single server.