CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1661:

  An administrator is instructed to disable IP-directed broadcasts on all routers in an organization. Which of the following attacks does this prevent?

  A. Pharming
  B. Smurf
  C. Replay
  D. Xmas
  B. Smurf

  ---

  A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's Internet connection with ping replies, bringing their entire Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network.

  By disabling IP-directed broadcasts on all routers, we can prevent the smurf attack by blocking the ping requests to broadcast addresses.

• Question 1662:

  A company replaces a number of devices with a mobile appliance, combining several functions.

  Which of the following descriptions fits this new implementation? (Select TWO).

  A. Cloud computing
  B. Virtualization
  C. All-in-one device
  D. Load balancing
  E. Single point of failure
  C. All-in-one device
  E. Single point of failure

  ---

  The disadvantages of combining everything into one include a potential single point of failure, and the dependence on the one vendor. The all 璱n-one device represents a single point of failure risk being taken on.

• Question 1663:

  Which of the following authentication protocols makes use of UDP for its services?

  A. RADIUS
  B. TACACS+
  C. LDAP
  D. XTACACS
  A. RADIUS

• Question 1664:

  A company executive's laptop was compromised, leading to a security breach. The laptop was placed into storage by a junior system administrator and was subsequently wiped and re-imaged. When it was determined that the authorities would need to be involved, there was little evidence to present to the investigators. Which of the following procedures could have been implemented to aid the authorities in their investigation?

  A. A comparison should have been created from the original system's file hashes
  B. Witness testimony should have been taken by the administrator
  C. The company should have established a chain of custody tracking the laptop
  D. A system image should have been created and stored
  D. A system image should have been created and stored

  ---

  A system image is a snapshot of what it and if a system image of the compromised system was created and stored, it is a useful tool when the authorities want to revisit the issue to investigate the incident.

• Question 1665:

  Which of the following IP addresses would be hosts on the same subnet given the subnet mask 255.255.255.224? (Select TWO).

  A. 10.4.4.125
  B. 10.4.4.158
  C. 10.4.4.165
  D. 10.4.4.189
  E. 10.4.4.199
  C. 10.4.4.165
  D. 10.4.4.189

  ---

  With the given subnet mask, a maximum number of 30 hosts between IP addresses 10.4.4.161 and 10.4.4.190 are allowed. Therefore, option C and D would be hosts on the same subnet, and the other options would not.

  References: http://www.subnetonline.com/pages/subnet-calculators/ip-subnet-calculator.php

• Question 1666:

  A company that has a mandatory vacation policy has implemented which of the following controls?

  A. Risk control
  B. Privacy control
  C. Technical control
  D. Physical control
  A. Risk control

  ---

  Risk mitigation is done anytime you take steps to reduce risks. Thus mandatory vacation implementation is done as a risk control measure because it is a step that is taken as risk mitigation.

• Question 1667:

  The Chief Security Officer (CSO) for a datacenter in a hostile environment is concerned about protecting the facility from car bomb attacks. Which of the following BEST would protect the building from this threat? (Select two.)

  A. Dogs
  B. Fencing
  C. CCTV
  D. Guards
  E. Bollards
  F. Lighting
  B. Fencing
  E. Bollards

• Question 1668:

  Which of the following mitigation strategies is established to reduce risk when performing updates to business critical systems?

  A. Incident management
  B. Server clustering
  C. Change management
  D. Forensic analysis
  C. Change management

  ---

  Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company's assets. In this case `performing updates to business critical systems.

• Question 1669:

  A company is installing a new security measure that would allow one person at a time to be authenticated to an area without human interaction. Which of the following does this describe?

  A. Fencing
  B. Mantrap
  C. A guard
  D. Video surveillance
  B. Mantrap

  ---

  Mantraps make use of electronic locks and are designed to allow you to limit the amount of individual allowed access to an area at any one time.

• Question 1670:

  Joe, an administrator, installs a web server on the Internet that performs credit card transactions for customer payments. Joe also sets up a second web server that looks like the first web server.

  However, the second server contains fabricated files and folders made to look like payments were processed on this server but really were not. Which of the following is the second server?

  A. DMZ
  B. Honeynet
  C. VLAN
  D. Honeypot
  D. Honeypot

  ---

  In this scenario, the second web server is a `fake' webserver designed to attract attacks. We can then monitor the second server to view the attacks and then ensure that the `real' web server is secure against such attacks. The second web

  server is a honeypot.

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

  According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:

  The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the

  system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.

  There are two main types of honeypots:

  Production - A production honeypot is one used within an organization's environment to help mitigate risk.

  Research ?A research honeypot add value to research in computer security by providing a platform to study the threat.