CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1651:

  When generating a request for a new x.509 certificate for securing a website, which of the following is the MOST appropriate hashing algorithm?

  A. RC4
  B. MD5
  C. HMAC
  D. SHA
  B. MD5

• Question 1652:

  A software developer is responsible for writing the code on an accounting application. Another software developer is responsible for developing code on a system in human resources. Once a year they have to switch roles for several weeks. Which of the following practices is being implemented?

  A. Mandatory vacations
  B. Job rotation
  C. Least privilege
  D. Separation of duties
  B. Job rotation

  ---

  A job rotation policy defines intervals at which employees must rotate through positions.

• Question 1653:

  An organization has a need for security control that identifies when an organizational system has been unplugged and a rouge system has been plugged in. The security control must also provide the ability to supply automated notifications. Which of the following would allow the organization to BEST meet this business requirement?

  A. MAC filtering
  B. ACL
  C. SNMP
  D. Port security
  D. Port security

• Question 1654:

  Which of the following must be kept secret for a public key infrastructure to remain secure?

  A. Certificate Authority
  B. Certificate revocation list
  C. Public key ring
  D. Private key
  D. Private key

  ---

  The private key, which is also called the secret key, must be kept secret.

• Question 1655:

  Which of the following policies is implemented in order to minimize data loss or theft?

  A. PII handling
  B. Password policy
  C. Chain of custody
  D. Zero day exploits
  A. PII handling

  ---

  Although the concept of PII is old, it has become much more important as information technology and the Internet have made it easier to collect PII through breaches of internet security, network security and web browser security, leading to a profitable market in collecting and reselling PII. PII can also be exploited by criminals to stalk or steal the identity of a person, or to aid in the planning of criminal acts. Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. Thus a PII handling policy can be used to protect data.

• Question 1656:

  A security administrator is notified that users attached to a particular switch are having intermittent connectivity issues. Upon further research, the administrator finds evidence of an ARP spoofing attack. Which of the following could be utilized to provide protection from this type of attack?

  A. Configure MAC filtering on the switch.
  B. Configure loop protection on the switch.
  C. Configure flood guards on the switch.
  D. Configure 802.1x authentication on the switch.
  C. Configure flood guards on the switch.

  ---

  ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. Once the attacker's MAC address is connected to an authentic IP address, the attacker will begin receiving any data that is intended for that IP address. ARP spoofing can enable malicious parties to intercept, modify or even stop data in-transit. ARP spoofing attacks can only occur on local area networks that utilize the Address Resolution Protocol. To perform ARP spoofing the attacker floods the network with spoofed ARP packets. As other hosts on the LAN cache the spoofed ARP packets, data that those hosts send to the victim will go to the attacker instead. From here, the attacker can steal data or launch a more sophisticated follow-up attack.

  A flood guard configured on the network switch will block the flood of spoofed ARP packets.

• Question 1657:

  An organization must implement controls to protect the confidentiality of its most sensitive data. The company is currently using a central storage system and group based access control for its sensitive information. Which of the following controls can further secure the data in the central storage system?

  A. Data encryption
  B. Patching the system
  C. Digital signatures
  D. File hashing
  A. Data encryption

  ---

  Data encryption makes data unreadable to anyone who does not have the required key to decrypt the data. The question states that the sensitive data is stored on a central storage system. Group based access control is used to control who can access the sensitive data. However, this offers no physical security for the data. Someone could steal the central storage system or remove the hard disks from it with the plan of placing the hard disks into another system to read the data on the disks. With the data encrypted, the data would be unreadable.

• Question 1658:

  Joe, a user, wants to protect sensitive information stored on his hard drive. He uses a program that encrypted the whole hard drive. Once the hard drive is fully encrypted, he uses the same program to create a hidden volume within the encrypted hard drive and stores the sensitive information within the hidden volume. This is an example of which of the following? (Select TWO).

  A. Multi-pass encryption
  B. Transport encryption
  C. Plausible deniability
  D. Steganography
  E. Transitive encryption
  F. Trust models
  C. Plausible deniability
  D. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. In this case, it is a hidden volume within the encrypted hard drive.

  In cryptography, deniable encryption may be used to describe steganographic techniques, where the very existence of an encrypted file or message is deniable in the sense that an adversary cannot prove that an encrypted message exists.

  This then provides you with plausible deniability.

• Question 1659:

  Matt, the IT Manager, wants to create a new network available to virtual servers on the same hypervisor, and does not want this network to be routable to the firewall. How could this BEST be accomplished?

  A. Create a VLAN without a default gateway.
  B. Remove the network from the routing table.
  C. Create a virtual switch.
  D. Commission a stand-alone switch.
  C. Create a virtual switch.

  ---

  A Hyper-V Virtual Switch implements policy enforcement for security, isolation, and service levels.

• Question 1660:

  A user in the company is in charge of various financial roles but needs to prepare for an upcoming audit. They use the same account to access each financial system. Which of the following security controls will MOST likely be implemented within the company?

  A. Account lockout policy
  B. Account password enforcement
  C. Password complexity enabled
  D. Separation of duties
  D. Separation of duties

  ---

  Separation of duties means that users are granted only the permissions they need to do their work and no more. More so it means that there is differentiation between users, employees and duties per se which form part of best practices.