CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1751:

  Which of the following is a best practice for error and exception handling?

  A. Log detailed exception but display generic error message
  B. Display detailed exception but log generic error message
  C. Log and display detailed error and exception messages
  D. Do not log or display error or exception messages
  A. Log detailed exception but display generic error message

  ---

  A detailed explanation of the error is not helpful for most end users but might provide information that is useful to a hacker. It is therefore better to display a simple but helpful message to the end user and log the detailed information to an access-restricted log file for the administrator and programmer who would need as much information as possible about the problem in order to rectify it.

• Question 1752:

  Pete, a security auditor, has detected clear text passwords between the RADIUS server and the authenticator. Which of the following is configured in the RADIUS server and what technologies should the authentication protocol be changed to?

  A. PAP, MSCHAPv2
  B. CHAP, PAP
  C. MSCHAPv2, NTLMv2
  D. NTLM, NTLMv2
  A. PAP, MSCHAPv2

  ---

  PAP transmits the username and password to the authentication server in plain text. MSCHAPv2 is utilized as an authentication option for RADIUS servers that are used for Wi- Fi security using the WPA-Enterprise protocol.

• Question 1753:

  In order to enter a high-security datacenter, users are required to speak the password into a voice recognition system. Ann a member if the sales department over hears the password and upon speaks it into the system. The system denies her entry and alerts the security team. Which of the following is the MOST likely reason for her failure to enter the data center?

  A. An authentication factor
  B. Discretionary access
  C. Time of day restrictions
  D. Least privilege restrictions
  A. An authentication factor

• Question 1754:

  An administrator notices an unusual spike in network traffic from many sources. The administrator suspects that:

  A. it is being caused by the presence of a rogue access point.
  B. it is the beginning of a DDoS attack.
  C. the IDS has been compromised.
  D. the internal DNS tables have been poisoned.
  B. it is the beginning of a DDoS attack.

  ---

  A Distributed Denial of Service (DDoS) attack is an attack from several different computers targeting a single computer.

  One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such

  attacks usually lead to a server overload.

  A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for

  example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are

  that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and

  shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply

  add more attack machines. This after all will end up completely crashing a website for periods of time. Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered

  on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack.

• Question 1755:

  Joe, a network administrator, is able to manage the backup software console by using his network login credentials. Which of the following authentication services is the MOST likely using?

  A. SAML
  B. LDAP
  C. iSCSI
  D. Two-factor authentication
  B. LDAP

  ---

  Joe is able to manage the backup system by logging into the network. This is an example of Single Sign-on.

  A common usage of LDAP is to provide a "single sign on" where one password for a user is shared between many services, such as applying a company login code to web pages (so that staff log in only once to company computers, and then

  are automatically logged into the company intranet).

  The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services

  play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any

  organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

• Question 1756:

  In order to prevent and detect fraud, which of the following should be implemented?

  A. Job rotation
  B. Risk analysis
  C. Incident management
  D. Employee evaluations
  A. Job rotation

  ---

  A job rotation policy defines intervals at which employees must rotate through positions. Similar in purpose to mandatory vacations, it helps to ensure that the company does not become too dependent on one person and it does afford the company with the opportunity to place another person in that same job and in this way the company can potentially uncover any fraud perhaps committed by the incumbent.

• Question 1757:

  An IT security manager is asked to provide the total risk to the business. Which of the following calculations would he security manager choose to determine total risk?

  A. (Threats X vulnerability X asset value) x controls gap
  B. (Threats X vulnerability X profit) x asset value
  C. Threats X vulnerability X control gap
  D. Threats X vulnerability X asset value
  D. Threats X vulnerability X asset value

  ---

  Threats X vulnerability X asset value is equal to asset value (AV) times exposure factor (EF). This is used to calculate a risk.

• Question 1758:

  A security administrator is tackling issues related to authenticating users at a remote site. There have been a large number of security incidents that resulted from either tailgating or impersonation of authorized users with valid credentials. The security administrator has been told to implement multifactor authentication in order to control facility access. To secure access to the remote facility, which of the following could be implemented without increasing the amount of space required at the entrance?

  A. MOTD challenge and PIN pad
  B. Retina scanner and fingerprint reader
  C. Voice recognition and one-time PIN token
  D. One-time PIN token and proximity reader
  C. Voice recognition and one-time PIN token

  ---

  Authentication systems or methods are based on one or more of these five factors:

  Something you know, such as a password or PIN

  Something you have, such as a smart card, token, or identification device Something you are, such as your fingerprints or retinal pattern (often called biometrics) Something you do, such as an action you must take to complete authentication

  Somewhere you are (this is based on geolocation)

  Multifactor authentication is authentication that uses two of more of the authentication factors listed above.

  In this question, we can use voice recognition (something you are) and a one-time PIN token (something you have) to provide two factors of authentication. The one-time PIN token is a small device that generates a one-time PIN to enable

  access.

• Question 1759:

  A company provides secure wireless Internet access for visitors and vendors working onsite. Some of the vendors using older technology report that they are unable to access the wireless network after entering the correct network information. Which of the following is the MOST likely reason for this issue?

  A. The SSID broadcast is disabled.
  B. The company is using the wrong antenna type.
  C. The MAC filtering is disabled on the access point.
  D. The company is not using strong enough encryption.
  A. The SSID broadcast is disabled.

  ---

  When the SSID is broadcast, any device with an automatic detect and connect feature is able to see the network and can initiate a connection with it. The fact that they cannot access the network means that they are unable to see it.

• Question 1760:

  Upper management decides which risk to mitigate based on cost. This is an example of:

  A. Qualitative risk assessment
  B. Business impact analysis
  C. Risk management framework
  D. Quantitative risk assessment
  D. Quantitative risk assessment

  ---

  Quantitative analysis / assessment is used to the show the logic and cost savings in replacing a server for example before it fails rather than after the failure. Quantitative assessments assign a dollar amount.