CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1601:

  Which of the following is an indication of an ongoing current problem?

  A. Alert
  B. Trend
  C. Alarm
  D. Trap
  C. Alarm

  ---

  An alarm indicates that something is wrong and needs to be resolved as soon as possible. Alarms usually continue to sound until the problem is resolved or the alarm is manually silenced.

• Question 1602:

  Which of the following BEST describes a demilitarized zone?

  A. A buffer zone between protected and unprotected networks.
  B. A network where all servers exist and are monitored.
  C. A sterile, isolated network segment with access lists.
  D. A private network that is protected by a firewall and a VLAN.
  A. A buffer zone between protected and unprotected networks.

  ---

  A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

• Question 1603:

  Acme Corp has selectively outsourced proprietary business processes to ABC Services. Due to some technical issues, ABC services wants to send some of Acme Corp's debug data to a third party vendor for problem resolution. Which of the following MUST be considered prior to sending data to a third party?

  A. The data should be encrypted prior to transport
  B. This would not constitute unauthorized data sharing
  C. This may violate data ownership and non-disclosure agreements
  D. Acme Corp should send the data to ABC Services' vendor instead
  C. This may violate data ownership and non-disclosure agreements

  ---

  With sending your data to a third party is already a risk since the third party may have a different policy than yours. Data ownership and non-disclosure is already a risk that you will have to accept since the data will be sent for debugging / troubleshooting purposes which will result in definite disclosure of the data.

• Question 1604:

  A company determines a need for additional protection from rogue devices plugging into physical ports around the building. Which of the following provides the highest degree of protection from unauthorized wired network access?

  A. Intrusion Prevention Systems
  B. MAC filtering
  C. Flood guards
  D. 802.1x
  D. 802.1x

  ---

  IEEE 802.1x is an IEEE Standard for Port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols and provides an authentication mechanism to wireless devices connecting to a LAN or WLAN.

• Question 1605:

  Who should be contacted FIRST in the event of a security breach?

  A. Forensics analysis team
  B. Internal auditors
  C. Incident response team
  D. Software vendors
  C. Incident response team

  ---

  A security breach is an incident and requires a response. The incident response team would be better equipped to deal with any incident insofar as all their procedures are concerned. Their procedures in addressing incidents are: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control.

• Question 1606:

  An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network security, the administrator desires to provide network access for this group only. Which of the following would BEST address this desire?

  A. Install a proxy server between the users' computers and the switch to filter inbound network traffic.
  B. Block commonly used ports and forward them to higher and unused port numbers.
  C. Configure the switch to allow only traffic from computers based upon their physical address.
  D. Install host-based intrusion detection software to monitor incoming DHCP Discover requests.
  C. Configure the switch to allow only traffic from computers based upon their physical address.

  ---

  Configuring the switch to allow only traffic from computers based upon their physical address is known as MAC filtering. The physical address is known as the MAC address. Every network adapter has a unique MAC address hardcoded into the adapter. You can configure the ports of a switch to allow connections from computers with specific MAC addresses only and block all other MAC addresses. MAC filtering is commonly used in wireless networks but is considered insecure because a MAC address can be spoofed. However, in a wired network, it is more secure because it would be more difficult for a rogue computer to sniff a MAC address.

• Question 1607:

  Users have been reporting that their wireless access point is not functioning. They state that it allows slow connections to the internet, but does not provide access to the internal network. The user provides the SSID and the technician logs into the company's access point and finds no issues. Which of the following should the technician do?

  A. Change the access point from WPA2 to WEP to determine if the encryption is too strong
  B. Clear all access logs from the AP to provide an up-to-date access list of connected users
  C. Check the MAC address of the AP to which the users are connecting to determine if it is an imposter
  D. Reconfigure the access point so that it is blocking all inbound and outbound traffic as a troubleshooting gap
  C. Check the MAC address of the AP to which the users are connecting to determine if it is an imposter

  ---

  The users may be connecting to a rogue access point. The rogue access point could be hosting a wireless network that has the same SSID as the corporate wireless network. The only way to tell for sure if the access point the users are connecting to is the correct one is to check the MAC address. Every network card has a unique 48-bit address assigned. A media access control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used as a network address for most IEEE 802 network technologies, including Ethernet and WiFi. Logically, MAC addresses are used in the media access control protocol sublayer of the OSI reference model. MAC addresses are most often assigned by the manufacturer of a network interface controller (NIC) and are stored in its hardware, such as the card's read-only memory or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address (BIA). It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. This can be contrasted to a programmed address, where the host device issues commands to the NIC to use an arbitrary address. A network node may have multiple NICs and each NIC must have a unique MAC address. MAC addresses are formed according to the rules of one of three numbering name spaces managed by the Institute of Electrical and Electronics Engineers (IEEE): MAC-48, EUI-48, and EUI-64.

• Question 1608:

  The security administrator generates a key pair and sends one key inside a rest file to a third party. The third party sends back a signed file. In this scenario, the file sent by the administrator is a:

  A. CA
  B. CRL
  C. KEK
  D. PKI
  E. CSR
  E. CSR

• Question 1609:

  Which of the following can be mitigated with proper secure coding techniques?

  A. Input validation
  B. Error handling
  C. Header manipulation
  D. Cross-site scripting
  A. Input validation

• Question 1610:

  A security administrator suspects that an increase in the amount of TFTP traffic on the network is due to unauthorized file transfers, and wants to configure a firewall to block all TFTP traffic.

  Which of the following would accomplish this task?

  A. Deny TCP port 68
  B. Deny TCP port 69
  C. Deny UDP port 68
  D. Deny UDP port 69
  D. Deny UDP port 69

  ---

  Trivial File Transfer Protocol (TFTP) is a simple file-exchange protocol that doesn't require authentication. It operates on UDP port 69.