CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1771:

  Which of the following best describes the objectives of succession planning?

  A. To identify and document the successive order in which critical systems should be reinstated following a disaster situation
  B. To ensure that a personnel management plan is in place to ensure continued operation of critical processes during an incident
  C. To determine the appropriate order in which contract internal resources, third party suppliers and external customers during a disaster response
  D. To document the order that systems should be reinstated at the primary site following a failover operation at a backup site.
  A. To identify and document the successive order in which critical systems should be reinstated following a disaster situation

• Question 1772:

  Matt, a developer, recently attended a workshop on a new application. The developer installs the new application on a production system to test the functionality. Which of the following is MOST likely affected?

  A. Application design
  B. Application security
  C. Initial baseline configuration
  D. Management of interfaces
  C. Initial baseline configuration

  ---

  The initial baseline configuration of a computer system is an agreed configuration for the computer. For example, the initial baseline configuration will list what operating system he computer will run, what software applications and patches will be installed and what configuration settings should be applied to the system. In this question, we are installing a new software application on a server. After the installation of the software, the "configuration" of the server (installed software, settings etc) is now different from the initial baseline configuration.

• Question 1773:

  A company hosts its public websites internally. The administrator would like to make some changes to the architecture. The three goals are: reduce the number of public IP addresses in use by the web servers drive all the web traffic through a central point of control mitigate automated attacks that are based on IP address scanning

  Which of the following would meet all three goals?

  A. Firewall
  B. Load balancer
  C. URL filter
  D. Reverse proxy
  D. Reverse proxy

  ---

  The purpose of a proxy server is to serve as a proxy or middle man between clients and servers. Using a reverse proxy you will be able to meet the three stated goals.

• Question 1774:

  Which of the following is BEST described by a scenario where management chooses not to implement a security control for a given risk?

  A. Mitigation
  B. Avoidance
  C. Acceptance
  D. Transference
  C. Acceptance

• Question 1775:

  A server administrator notes that a legacy application often stops running due to a memory error. When reviewing the debugging logs, they notice code being run calling an internal process to exploit the machine. Which of the following attacks does this describe?

  A. Zero-day
  B. Buffer overflow
  C. Cross site scripting
  D. Malicious add-on
  B. Buffer overflow

  ---

  This question describes a buffer overflow attack.

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.

• Question 1776:

  A hospital IT department wanted to secure its doctor's tablets. The IT department wants operating system level security and the ability to secure the data from alteration. Which of the following methods would MOST likely work?

  A. Cloud storage
  B. Removal Media
  C. TPM
  D. Wiping
  C. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

• Question 1777:

  Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment?

  A. Protocol analyzer
  B. Router
  C. Firewall
  D. HIPS
  A. Protocol analyzer

  ---

  A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing and analyzing the packets sent from two systems that are not

  communicating properly could help determine the cause of the issue.

  Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal).

• Question 1778:

  A set of standardized system images with a pre-defined set of applications is used to build end-user workstations. The security administrator has scanned every workstation to create a current inventory of all applications that are installed on active workstations and is documenting which applications are out-of-date and could be exploited. The security administrator is determining the:

  A. attack surface.
  B. application hardening effectiveness.
  C. application baseline.
  D. OS hardening effectiveness.
  A. attack surface.

  ---

  In this question, we have out-of-date applications that could be exploited. The out-of-date applications are security vulnerabilities. The combination of all vulnerabilities that could be exploited (or attacked) is known as the attack surface.

  The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment.

  The basic strategies of attack surface reduction are to reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by relatively few users. One approach to improving information

  security is to reduce the attack surface of a system or software. By turning off unnecessary functionality, there are fewer security risks. By having less code available to unauthorized actors, there will tend to be fewer failures. Although attack

  surface reduction helps prevent security failures, it does not mitigate the amount of damage an attacker could inflict once a vulnerability is found.

• Question 1779:

  Mike, a network administrator, has been asked to passively monitor network traffic to the company's sales websites. Which of the following would be BEST suited for this task?

  A. HIDS
  B. Firewall
  C. NIPS
  D. Spam filter
  C. NIPS

  ---

  Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity.

• Question 1780:

  Sara, a security analyst, is trying to prove to management what costs they could incur if their customer database was breached. This database contains 250 records with PII. Studies show that the cost per record for a breach is $300. The likelihood that their database would be breached in the next year is only 5%. Which of the following is the ALE that Sara should report to management for a security breach?

  A. $1,500
  B. $3,750
  C. $15,000
  D. $75,000
  B. $3,750

  ---

  SLE ?ARO = ALE, where SLE is equal to asset value (AV) times exposure factor (EF); and ARO is the annualized rate of occurrence.

  SLE = 250 x $300; ARO = 5%

  $75000 x 0.05 = $3750