CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1581:

  Which of the following wireless protocols could be vulnerable to a brute-force password attack? (Select TWO).

  A. WPA2-PSK
  B. WPA - EAP - TLS
  C. WPA2-CCMP
  D. WPA -CCMP
  E. WPA - LEAP
  F. WEP
  A. WPA2-PSK
  E. WPA - LEAP

  ---

  A brute force attack is an attack that attempts to guess a password. WPA2-PSK and WEP both use a "Pre-Shared Key". The pre-shared key is a password and therefore is susceptible to a brute force attack.

• Question 1582:

  A malicious user is sniffing a busy encrypted wireless network waiting for an authorized client to connect to it. Only after an authorized client has connected and the hacker was able to capture the client handshake with the AP can the hacker begin a brute force attack to discover the encryption key. Which of the following attacks is taking place?

  A. IV attack
  B. WEP cracking
  C. WPA cracking
  D. Rogue AP
  C. WPA cracking

  ---

  There are three steps to penetrating a WPA-protected network. Sniffing Parsing Attacking

• Question 1583:

  A security administrator discovers that an attack has been completed against a node on the corporate network. All available logs were collected and stored.

  You must review all network logs to discover the scope of the attack, check the box of the node(s) that have been compromised and drag and drop the appropriate actions to complete the incident response on the network. The environment is

  a critical production environment; perform the LEAST disruptive actions on the network, while still performing the appropriate incident responses.

  Instructions: The web server, database server, IDS, and User PC are clickable. Check the box of the node(s) that have been compromised and drag and drop the appropriate actions to complete the incident response on the network. Not all

  actions may be used, and order is not important. If at anytime you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit.

  Once the simulation is submitted, please select the Next button to continue.

  

  Correct Answer. Check the answer below
  Check the answer below

  ---

  Database server was attacked; actions should be to capture network traffic and Chain of Custody.

  (The database server logs shows the Audit Failure and Audit Success attempts)It is only logical that all the logs will be stored on the database server and the least disruption action on the network to take as a response to the incident would be

  to check the logs (since these are already collected and stored) and maintain a chain of custody of those logs.

  

  

  IDS Server Log:

  

  Web Server Log:

  

  

  Database Server Log:

  

  Users PC Log:

• Question 1584:

  Matt, an administrator, is concerned about the wireless network being discovered by war driving.

  Which of the following can be done to mitigate this?

  A. Enforce a policy for all users to authentic through a biometric device.
  B. Disable all SSID broadcasting.
  C. Ensure all access points are running the latest firmware.
  D. Move all access points into public access areas.
  B. Disable all SSID broadcasting.

  ---

  B: War driving is the act of using a detection tool to look for wireless networking signals. The setting making a wireless network closed (or at least hidden) is the disabling of service set identifier (SSID) broadcasting. Thus by disabling all SSID broadcasting you can mitigate the risk of war driving.

• Question 1585:

  An administrator wants to provide onboard hardware based cryptographic processing and secure key storage for full-disk encryption. Which of the following should the administrator use to fulfil the requirements?

  A. AES
  B. TPM
  C. FDE
  D. PAM
  B. TPM

• Question 1586:

  An employee uses RDP to connect back to the office network. If RDP is misconfigured, which of the of the following security exposures would this lead to?

  A. A virus on the administrator desktop would be able to sniff the administrator's username and password
  B. Result in an attacker being able to phish the employee's username and password
  C. A social engineering arrack could occur, resulting in the employee's password being extracted
  D. A man in the middle attack could occur, resulting the employee's username and password being captured
  D. A man in the middle attack could occur, resulting the employee's username and password being captured

• Question 1587:

  Which of the following is the term for a fix for a known software problem?

  A. Skiff
  B. Patch
  C. Slipstream
  D. Upgrade
  B. Patch

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities.

• Question 1588:

  A security administrator working for a law enforcement organization is asked to secure a computer system at the scene of a crime for transport to the law enforcement forensic facility. In order to capture as mush evidence as possible, the computer system has been left running. The security administrator begins information by image which of the following system components FIRST?

  A. NVRAM
  B. RAM
  C. TPM
  D. SSD
  B. RAM

• Question 1589:

  A software developer wants to prevent stored passwords from being easily decrypted. When the password is stored by the application, additional text is added to each password before the password is hashed. This technique is known as:

  A. Symmetric cryptography.
  B. Private key cryptography.
  C. Salting.
  D. Rainbow tables.
  C. Salting.

  ---

  Salting can be used to strengthen the hashing when the passwords were encrypted. Though hashing is a one-way algorithm it does not mean that it cannot be hacked. One method to hack a hash is though rainbow tables and salt is the counter measure to rainbow tables. With salt a password that you typed in and that has been encrypted with a hash will yield a letter combination other than what you actually types in when it is rainbow table attacked.

• Question 1590:

  An attacker attempted to compromise a web form by inserting the following input into the username field: admin)(|(password=*))

  Which of the following types of attacks was attempted?

  A. SQL injection
  B. Cross-site scripting
  C. Command injection
  D. LDAP injection
  D. LDAP injection

  ---

  LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy.

  This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree. The same advanced exploitation techniques available in SQL Injection can be

  similarly applied in LDAP Injection. In a page with a user search form, the following code is responsible to catch input value and generate a LDAP query that will be used in LDAP database. Insert

  the username The LDAP query is narrowed down for performance and the underlying code for this function might be the following:

  String ldapSearchQuery = "(cn=" + $userName + ")"; System.out.println(ldapSearchQuery);

  If the variable $userName is not validated, it could be possible accomplish LDAP injection, as follows:

  If a user puts "*" on box search, the system may return all the usernames on the LDAP base

  If a user puts "jonys) (| (password = * ) )", it will generate the code bellow revealing jonys' password ( cn = jonys ) ( | (password = * ) )