CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 161:

  Which of the following should Joe, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from his company?

  A. Privacy Policy
  B. Least Privilege
  C. Acceptable Use
  D. Mandatory Vacations
  D. Mandatory Vacations

  ---

  When one person fills in for another, such as for mandatory vacations, it provides an opportunity to see what the person is doing and potentially uncover any fraud.

• Question 162:

  Which of the following types of trust models is used by a PKI?

  A. Transitive
  B. Open source
  C. Decentralized
  D. Centralized
  D. Centralized

  ---

  PKI uses a centralized trust model. In a simple PKI a single centralized certification authority (CA). In a hierarchical trust model the root CA is the center of the model, with subordinate CAs lower in the hierarchy.

  Note: A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. A trust Model is collection of rules that informs application

  on how to decide the legitimacy of a Digital Certificate.

• Question 163:

  A security analyst must ensure that the company's web server will not negotiate weak ciphers with connecting web browsers. Which of the following supported list of ciphers MUST the security analyst disable? (Select THREE)

  A. SHA
  B. AES
  C. RIPMED
  D. NULL
  E. DES
  F. MD5
  G. TWOFISH
  A. SHA
  E. DES
  F. MD5

• Question 164:

  A security administrator examines a network session to a compromised database server with a packet analyzer. Within the session there is a repeated series of the hex character 90 (x90).

  Which of the following attack types has occurred?

  A. Buffer overflow
  B. Cross-site scripting
  C. XML injection
  D. SQL injection
  A. Buffer overflow

  ---

  Explanation: The hex character 90 (x90) means NOP or No Op or No Operation. In a buffer overflow attack, the buffer can be filled and overflowed with No Op commands. A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.

• Question 165:

  An organization relies heavily on an application that has a high frequency of security updates. At present, the security team only updates the application the security updates are released as often as twice a week. Which of the following would be the BEST method of updating this application?

  A. Configure testing and automate patch management for the application
  B. Configure security control testing for the application
  C. Manually apply updates for application when they are released
  D. Configure a sandbox for testing patches before the scheduled monthly update
  A. Configure testing and automate patch management for the application

• Question 166:

  A security administrator wants to deploy a physical security control to limit an individual's access into a sensitive area. Which of the following should be implemented?

  A. Guards
  B. CCTV
  C. Bollards
  D. Spike strip
  A. Guards

  ---

  A guard can be intimidating and respond to a situation and in a case where you want to limit an individual's access to a sensitive area a guard would be the most effective.

• Question 167:

  Users are utilizing thumb drives to connect to USB ports on company workstations. A technician is concerned that sensitive files can be copied to the USB drives. Which of the following mitigation techniques would address this concern? (Select TWO).

  A. Disable the USB root hub within the OS.
  B. Install anti-virus software on the USB drives.
  C. Disable USB within the workstations BIOS.
  D. Apply the concept of least privilege to USB devices.
  E. Run spyware detection against all workstations.
  A. Disable the USB root hub within the OS.
  C. Disable USB within the workstations BIOS.

  ---

  A: The USB root hub can be disabled from within the operating system.

  C: USB can also be configured and disabled in the system BIOS.

• Question 168:

  Which of the following security concepts can prevent a user from logging on from home during the weekends?

  A. Time of day restrictions
  B. Multifactor authentication
  C. Implicit deny
  D. Common access card
  A. Time of day restrictions

  ---

  Time of day restrictions limit when users can access specific systems based on the time of day or week. It can limit access to sensitive environments to normal business hours when oversight and monitoring can be performed to prevent fraud, abuse, or intrusion.

• Question 169:

  Company XYZ has suffered leaks of internally distributed confidential documents. Ann the network security analyst has been tasked to track down the culprit. She has decided to embed a four letter string of characters in documents containing proprietary information. Which of the following initial steps should Ann implement before sending documents?

  A. Store one of the documents in a honey pot
  B. Start antivirus scan on all the suspected computers
  C. Add a signature to the NIDS containing the four letter string
  D. Ask employees to report suspicious behaviors
  C. Add a signature to the NIDS containing the four letter string

• Question 170:

  Recently clients are stating they can no longer access a secure banking site's webpage. In reviewing the clients' web browser settings, the certificate chain is showing the following:

  Certificate Chain:

  X Digi Cert

  Digi Cert High assurance C3

  *

  banksite.com Certificate Store: Digi Cert ?Others Certificate Store Digi Cert High assurance C3 ?Others Certificate Store Based on the information provided, which of the following is the problem when connecting to the website?

  A. The certificate signature request was invalid
  B. Key escrow is failing for the certificate authority
  C. The certificate authority has revoked the certificate
  D. The clients do not trust the certificate authority
  C. The certificate authority has revoked the certificate