CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1781:

  In order to enter a high-security data center, users are required to speak the correct password into a voice recognition system. Ann, a member of the sales department, overhears the password and later speaks it into the system. The system denies her entry and alerts the security team. Which of the following is the MOST likely reason for her failure to enter the data center?

  A. An authentication factor
  B. Discretionary Access
  C. Time of Day Restrictions
  D. Least Privilege Restrictions
  A. An authentication factor

• Question 1782:

  A project team is developing requirements of the new version of a web application used by internal and external users. The application already features username and password requirements for login, but the organization is required to implement multifactor authentication to meet regulatory requirements. Which of the following would be added requirements will satisfy the regulatory requirement? (Select THREE.)

  A. Digital certificate
  B. Personalized URL
  C. Identity verification questions
  D. Keystroke dynamics
  E. Tokenized mobile device
  F. Time-of-day restrictions
  G. Increased password complexity
  H. Rule-based access control
  A. Digital certificate
  C. Identity verification questions
  E. Tokenized mobile device

• Question 1783:

  A security administrator needs to implement a system that detects possible intrusions based upon a vendor provided list. Which of the following BEST describes this type of IDS?

  A. Signature based
  B. Heuristic
  C. Anomaly-based
  D. Behavior-based
  A. Signature based

• Question 1784:

  How must user accounts for exiting employees be handled?

  A. Disabled, regardless of the circumstances
  B. Disabled if the employee has been terminated
  C. Deleted, regardless of the circumstances
  D. Deleted if the employee has been terminated
  A. Disabled, regardless of the circumstances

  ---

  You should always disable an employee's account as soon as they leave. The employee knows the username and password of the account and could continue to log in for potentially malicious purposes. Disabling the account will ensure that no one can log in using that account.

• Question 1785:

  Which of the following steps of incident response does a team analyze the incident and determine steps to prevent a future occurrence?

  A. Mitigation
  B. Identification
  C. Preparation
  D. Lessons learned
  D. Lessons learned

• Question 1786:

  While working on a new project a security administrator wants to verify the integrity of the data in the organizations archive library. Which of the following is the MOST secure combination to implement to meet this goal? (Select TWO)

  A. Hash with SHA
  B. Encrypt with Diffie-Hellman
  C. Hash with MD5
  D. Hash with RIPEMD
  E. Encrypt with AES
  C. Hash with MD5
  D. Hash with RIPEMD

• Question 1787:

  Which of the following helps to apply the proper security controls to information?

  A. Data classification
  B. Deduplication
  C. Clean desk policy
  D. Encryption
  A. Data classification

  ---

  Information classification is done by confidentiality and comprises of three categories, namely: public use, internal use and restricted use. These categories make applying the appropriate policies and security controls practical.

• Question 1788:

  After analyzing and correlating activity from multiple sensors, the security administrator has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the company network, through the use of very sophisticated and targeted attacks. Which of the following is this an example of?

  A. Privilege escalation
  B. Advanced persistent threat
  C. Malicious insider threat
  D. Spear phishing
  B. Advanced persistent threat

  ---

  Definitions of precisely what an APT is can vary widely, but can best be summarized by their named requirements: Advanced ?Criminal operators behind the threat utilize the full spectrum of computer intrusion technologies and techniques. While individual components of the attack may not be classed as particularly "advanced" (e.g. malware components generated from commonly available DIY construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They combine multiple attack methodologies and tools in order to reach and compromise their target. Persistent ?Criminal operators give priority to a specific task, rather than opportunistically seeking immediate financial gain. This distinction implies that the attackers are guided by external entities. The attack is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. Threat ?means that there is a level of coordinated human involvement in the attack, rather than a mindless and automated piece of code. The criminal operators have a specific objective and are skilled, motivated, organized and well funded.

• Question 1789:

  Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites?

  A. Spam filter
  B. URL filter
  C. Content inspection
  D. Malware inspection
  B. URL filter

  ---

  The question asks how to prevent access to peer-to-peer file sharing websites. You access a website by browsing to a URL using a Web browser or peer-to-peer file sharing client software. A URL filter is used to block URLs (websites) to prevent users accessing the website.

  Incorrect Answer:

  A: A spam filter is used for email. All inbound (and sometimes outbound) email is passed through the spam filter to detect spam emails. The spam emails are then discarded or tagged as potential spam according to the spam filter configuration. Spam filters do not prevent users accessing peer-to-peer file sharing websites.

  C: Content inspection is the process of inspecting the content of a web page as it is downloaded. The content can then be blocked if it doesn't comply with the company's web policy. Content-control software determines what content will be available or perhaps more often what content will be blocked. Content inspection does not prevent users accessing peer-to-peer file sharing websites (although it could block the content of the sites as it is downloaded).

  D: Malware inspection is the process of scanning a computer system for malware. Malware inspection does not prevent users accessing peer-to-peer file sharing websites.

  References: http://www.provision.ro/threat-management/web-application-security/url-filtering#pagei- 1|pagep-1| Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 18, 19