CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1711:

  An internal auditing team would like to strengthen the password policy to support special characters. Which of the following types of password controls would achieve this goal?

  A. Add reverse encryption
  B. Password complexity
  C. Increase password length
  D. Allow single sign on
  B. Password complexity

  ---

  Generally, the minimum password length is considered to be 8 upper and lowercase characters. The use of at least one non-alpha character like punctuation, special characters, or numbers, combined with the password length produces strong passwords. Strong passwords are produced by the combination of a password's length and complexity.

• Question 1712:

  Physical documents must be incinerated after a set retention period is reached. Which of the following attacks does this action remediate?

  A. Shoulder Surfing
  B. Dumpster Diving
  C. Phishing
  D. Impersonation
  B. Dumpster Diving

  ---

  Incinerating documents (or shredding documents) instead of throwing them into a bin will prevent people being able to read the documents to view sensitive information. Dumpster diving is looking for treasure in someone else's trash. (A dumpster is a large trash container.) In the world of information technology, dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. Seemingly innocent information like a phone list, calendar, or organizational chart can be used to assist an attacker using social engineering techniques to gain access to the network. To prevent dumpster divers from learning anything valuable from your trash, experts recommend that your company establish a disposal policy where all paper, including print-outs, is shredded in a cross-cut shredder before being recycled, all storage media is erased, and all staff is educated about the danger of untracked trash.

• Question 1713:

  Which of the following cryptographic algorithms is MOST often used with IPSec?

  A. Blowfish
  B. Twofish
  C. RC4
  D. HMAC
  D. HMAC

  ---

  The HMAC-MD5-96 (also known as HMAC-MD5) encryption technique is used by IPSec to make sure that a message has not been altered.

• Question 1714:

  When implementing a mobile security strategy for an organization which of the following is the MOST influential concern that contributes to that organization's ability to extend enterprise policies to mobile devices?

  A. Support for mobile OS
  B. Support of mobile apps
  C. Availability of mobile browsers
  D. Key management for mobile devices
  D. Key management for mobile devices

• Question 1715:

  A company researched the root cause of a recent vulnerability in its software. It was determined that the vulnerability was the result of two updates made in the last release. Each update alone would not have resulted in the vulnerability. In order to prevent similar situations in the future, the company should improve which of the following?

  A. Change management procedures
  B. Job rotation policies
  C. Incident response management
  D. Least privilege access controls
  A. Change management procedures

• Question 1716:

  Which of the following is a proprietary protocol commonly used for router authentication across an enterprise?

  A. SAML
  B. TACACS
  C. LDAP
  D. RADIUS
  B. TACACS

• Question 1717:

  Matt, a security consultant, has been tasked with increasing server fault tolerance and has been given no budget to accomplish his task. Which of the following can Matt implement to ensure servers will withstand hardware failure?

  A. Hardware load balancing
  B. RAID
  C. A cold site
  D. A host standby
  B. RAID

  ---

  Fault tolerance is the ability of a system to sustain operations in the event of a component failure. Fault-tolerant systems can continue operation even though a critical component, such as a disk drive, has failed. This capability involves overengineering systems by adding redundant components and subsystems. RAID can achieve fault tolerance using software which can be done using the existing hardware and software.

• Question 1718:

  After a company has standardized to a single operating system, not all servers are immune to a well-known OS vulnerability. Which of the following solutions would mitigate this issue?

  A. Host based firewall
  B. Initial baseline configurations
  C. Discretionary access control
  D. Patch management system
  D. Patch management system

  ---

  A patch is an update to a system. Sometimes a patch adds new functionality; in other cases, it corrects a bug in the software. Patch Management can thus be used to fix security problems discovered within the OS thus negating a known OS vulnerability.

• Question 1719:

  Which of the following types of authentication solutions use tickets to provide access to various resources from a central location?

  A. Biometrics
  B. PKI
  C. ACLs
  D. Kerberos
  D. Kerberos

  ---

  The basic process of Kerberos authentication is as follows:

  The subject provides logon credentials.

  The Kerberos client system encrypts the password and transmits the protected credentials to the KDC.

  The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client. The client

  receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm.

  The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC.

  The KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime.

  The client receives the ST.

  The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved.

• Question 1720:

  Joe, a company's network engineer, is concerned that protocols operating at the application layer of the OSI model are vulnerable to exploitation on the network. Which of the following protocols should he secure?

  A. SNMP
  B. SSL
  C. ICMP
  D. NetBIOS
  A. SNMP