CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1641:

  Ann is concerned that the application her team is currently developing is vulnerable to unexpected user input that could lead to issues within the memory is affected in a detrimental manner leading to potential exploitation. Which of the following describes this application threat?

  A. Replay attack
  B. Zero-day exploit
  C. Distributed denial of service
  D. Buffer overflow
  C. Distributed denial of service

• Question 1642:

  FTP/S uses which of the following TCP ports by default?

  A. 20 and 21
  B. 139 and 445
  C. 443 and 22
  D. 989 and 990
  D. 989 and 990

  ---

  Explanation: FTPS uses ports 989 and 990.

• Question 1643:

  Which of the following is a penetration testing method?

  A. Searching the WHOIS database for administrator contact information
  B. Running a port scanner against the target's network
  C. War driving from a target's parking lot to footprint the wireless network
  D. Calling the target's helpdesk, requesting a password reset
  D. Calling the target's helpdesk, requesting a password reset

  ---

  A penetration test is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely attempting to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and even risky

  end-user behavior. Such assessments are also useful in validating the efficacy of defensive mechanisms, as well as end-users' adherence to security policies.

  Penetration testing evaluates an organization's ability to protect its networks, applications, endpoints and users from external or internal attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets.

  Test results validate the risk posed by specific security vulnerabilities or flawed processes, enabling IT management and security professionals to prioritize remediation efforts. By embracing more frequent and comprehensive penetration

  testing, organizations can more effectively anticipate emerging security risks and prevent unauthorized access to critical systems and valuable information. Penetration tests are not always technically clever attempts to access a network. By

  calling the target's helpdesk and requesting a password reset, if they reset the password without requiring proof that you are authorized to request a password change, you can easily gain access to the network.

• Question 1644:

  Which of the following are examples of detective controls?

  A. Biometrics, motion sensors and mantraps.
  B. Audit, firewall, anti-virus and biometrics.
  C. Motion sensors, intruder alarm and audit.
  D. Intruder alarm, mantraps and firewall.
  C. Motion sensors, intruder alarm and audit.

  ---

  Detective controls are those that operate afterward so as to discover that has happened. Detective controls include security guards, motion detectors, recording and reviewing of events captured by security cameras or CCTV, job rotation, mandatory vacations, audit trails, honeypots or honeynets, IDSs, violation reports, supervision and reviews of users, and incident investigations.

• Question 1645:

  A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD users and 2 web servers without wireless access. Which of the following should the company configure to protect the servers from the user devices? (Select TWO).

  A. Deny incoming connections to the outside router interface.
  B. Change the default HTTP port
  C. Implement EAP-TLS to establish mutual authentication
  D. Disable the physical switch ports
  E. Create a server VLAN
  F. Create an ACL to access the server
  E. Create a server VLAN
  F. Create an ACL to access the server

  ---

  We can protect the servers from the user devices by separating them into separate VLANs (virtual local area networks).

  The network device in the question is a router/switch. We can use the router to allow access from devices in one VLAN to the servers in the other VLAN. We can configure an ACL (Access Control List) on the router to determine who is able to

  access the server.

  In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers; such a domain is referred to

  as a virtual local area network, virtual LAN or VLAN.

  This is usually achieved on switch or router devices. Simpler devices only support partitioning on a port level (if at all), so sharing VLANs across devices requires running dedicated cabling for each VLAN. More sophisticated devices can mark

  packets through tagging, so that a single interconnect (trunk) may be used to transport data for multiple VLANs.

  Grouping hosts with a common set of requirements regardless of their physical location by VLAN can greatly simplify network design. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be

  grouped together more easily even if they are not on the same network switch. The network described in this question is a DMZ, not a VLAN.

• Question 1646:

  Joe, a security administrator, believes that a network breach has occurred in the datacenter as a result of a misconfigured router access list, allowing outside access to an SSH server. Which of the following should Joe search for in the log files?

  A. Failed authentication attempts
  B. Network ping sweeps
  C. Host port scans
  D. Connections to port 22
  D. Connections to port 22

  ---

  Log analysis is the art and science of reviewing audit trails, log files, or other forms of computer-generated records for evidence of policy violations, malicious events, downtimes, bottlenecks, or other issues of concern. SSH uses TCP port 22. All protocols encrypted by SSH also use TCP port 22, such as SFTP, SHTTP, SCP, SExec, and slogin.

• Question 1647:

  Highly sensitive data is stored in a database and is accessed by an application on a DMZ server. The disk drives on all servers are fully encrypted. Communication between the application server and end-users is also encrypted. Network ACLs prevent any connections to the database server except from the application server. Which of the following can still result in exposure of the sensitive data in the database server?

  A. SQL Injection
  B. Theft of the physical database server
  C. Cookies
  D. Cross-site scripting
  A. SQL Injection

  ---

  The question discusses a very secure environment with disk and transport level encryption and access control lists restricting access. SQL data in a database is accessed by SQL queries from an application on the application server. The data can still be compromised by a SQL injection attack. SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 1648:

  The system administrator is tasked with changing the administrator password across all 2000 computers in the organization. Which of the following should the system administrator implement to accomplish this task?

  A. A security group
  B. A group policy
  C. Key escrow
  D. Certificate revocation
  B. A group policy

  ---

  Group policy is used to manage Windows systems in a Windows network domain environment by means of a Group Policy Object (GPO). GPO's include a number of settings related to credentials, such as password complexity requirements, password history, password length, account lockout settings.

• Question 1649:

  Which of the following should Pete, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from their company?

  A. Privacy Policy
  B. Least Privilege
  C. Acceptable Use
  D. Mandatory Vacations
  D. Mandatory Vacations

  ---

  A mandatory vacation policy requires all users to take time away from work to refresh. But not only does mandatory vacation give the employee a chance to refresh, but it also gives the company a chance to make sure that others can fill in any gaps in skills and satisfies the need to have replication or duplication at all levels as well as an opportunity to discover fraud.

• Question 1650:

  Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the temporary credentials being passed to Joe's browser. The attacker later uses the credentials to impersonate Joe and creates SPAM messages. Which of the following attacks allows for this impersonation?

  A. XML injection
  B. Directory traversal
  C. Header manipulation
  D. Session hijacking
  D. Session hijacking

  ---

  In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer.