CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1611:

  A security administrator would like the corporate webserver to select perfect forward secrecy ciphers first. Which of the following cipher suites should the administrator select to accomplish this goal?

  A. DH-DSS-CAMELLA256-SHA
  B. ECDHE-RSA-AES1280SHA
  C. DH-RSA-AES128-SHA256
  D. ADH-AES256-SHA
  B. ECDHE-RSA-AES1280SHA

• Question 1612:

  ABC company has a lot of contractors working for them. The provisioning team does not always get notified that a contractor has left the company. Which of the following policies would prevent contractors from having access to systems in the event a contractor has left?

  A. Annual account review
  B. Account expiration policy
  C. Account lockout policy
  D. Account disablement
  B. Account expiration policy

  ---

  Account expiration is a secure feature to employ on user accounts for temporary workers, interns, or consultants. It automatically disables a user account or causes the account to expire at a specific time and on a specific day.

• Question 1613:

  Joe, an employee is taking a taxi through a busy city and starts to receive unsolicited files sent to his Smartphone. Which of the following is this an example of?

  A. Vishing
  B. Bluejacking
  C. War Driving
  D. SPIM
  E. Bluesnarfing
  B. Bluejacking

  ---

  Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth-enabled device via the OBEX protocol. Bluetooth has a very limited range, usually around 10 metres (32.8 ft) on mobile phones, but laptops can reach up to 100 metres (328 ft) with powerful (Class 1) transmitters. Bluejacking is usually harmless, but because bluejacked people generally don't know what has happened, they may think that their phone is malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it's possible to send images or sounds as well. Bluejacking has been used in guerrilla marketing campaigns to promote advergames.

• Question 1614:

  Which of the following, if properly implemented, would prevent users from accessing files that are unrelated to their job duties? (Select TWO).

  A. Separation of duties
  B. Job rotation
  C. Mandatory vacation
  D. Time of day restrictions
  E. Least privilege
  A. Separation of duties
  E. Least privilege

  ---

  Separation of duties means that users are granted only the permissions they need to do their work and no more. More so it means that you are employing best practices. The segregation of duties and separation of environments is a way to reduce the likelihood of misuse of systems or information. A separation of duties policy is designed to reduce the risk of fraud and to prevent other losses in an organization. A least privilege policy should be used when assigning permissions. Give users only the permissions that they need to do their work and no more.

• Question 1615:

  To ensure compatibility with their flagship product, the security engineer is tasked to recommend an encryption cipher that will be compatible with the majority of third party software and hardware vendors. Which of the following should be recommended?

  A. SHA
  B. MD5
  C. Blowfish
  D. AES
  D. AES

  ---

  AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. AES is used to encrypt data, not to verify data integrity.

• Question 1616:

  An organizations' security policy requires that users change passwords every 30 days. After a security audit, it was determined that users were recycling previously used passwords. Which of the following password enforcement policies would have mitigated this issue?

  A. Password history
  B. Password complexity
  C. Password length
  D. Password expiration
  A. Password history

  ---

  Password history determines the number of previous passwords that cannot be used when a user changes his password. For example, a password history value of 5 would disallow a user from changing his password to any of his previous 5 passwords. However, without a minimum password age setting, the user could change his password six times and cycle back to his original password.

• Question 1617:

  An attacker impersonates a fire marshal and demands access to the datacenter under the threat of a fine. Which of the following reasons make this effective? (Select two.)

  A. Consensus
  B. Authority
  C. Intimidation
  D. Trust
  E. Scarcity
  B. Authority
  E. Scarcity

• Question 1618:

  Which of the following disaster recovery strategies has the highest cost and shortest recovery time?

  A. Warm site
  B. Hot site
  C. Cold site
  D. Co-location site
  B. Hot site

  ---

  A hot site is a location that can provide operations within hours of a failure. This type of site would have servers, networks, and telecommunications equipment in place to reestablish service in a short time. Hot sites provide network connectivity, systems, and preconfigured software to meet the needs of an organization. Databases can be kept up-to-date using network connections. These types of facilities are expensive, and they're primarily suitable for short-term situations.

• Question 1619:

  The security manager must store a copy of a sensitive document and needs to verify at a later point that the document has not been altered. Which of the following will accomplish the security manager's objective?

  A. RSA
  B. AES
  C. MD5
  D. SHA
  C. MD5

• Question 1620:

  A Security technician would like that to obscure sensitive data within a file so that can be transferred without causing suspicion. Which of the following technologies would BEST be suited to accomplish this?

  A. Transport Encryption
  B. Stream Encryption
  C. Digital Signature
  D. Steganography
  D. Steganography