CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 171:

  A CRL is comprised of.

  A. Malicious IP addresses.
  B. Trusted CA's.
  C. Untrusted private keys.
  D. Public keys.
  D. Public keys.

  ---

  A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key.

  By checking the CRL you can check if a particular certificate has been revoked. The certificates for which a CRL should be maintained are often X.509/public key certificates, as this format is commonly used by PKI schemes.

• Question 172:

  The manager has a need to secure physical documents every night, since the company began enforcing the clean desk policy. The BEST solution would include: (Select TWO).

  A. Fire- or water-proof safe.
  B. Department door locks.
  C. Proximity card.
  D. 24-hour security guard.
  E. Locking cabinets and drawers.
  A. Fire- or water-proof safe.
  E. Locking cabinets and drawers.

  ---

  Using a safe and locking cabinets to protect backup media, documentation, and any other physical artifacts that could do harm if they fell into the wrong hands would form part of keeping employees desks clean as in a clean desk policy.

• Question 173:

  An intrusion has occurred in an internet facing system. The security administrator would like to gather forensic evidence while the system is still in operation. Which of the following procedures should the administrator perform FIRST on the system?

  A. Make a drive image
  B. Take hashes of system data
  C. Collect information in RAM
  D. Capture network traffic
  D. Capture network traffic

• Question 174:

  Ann a new small business owner decides to implement WiFi access for her customers. There are several other businesses nearby who also have WiFi hot spots. Ann is concerned about security of the wireless network and wants to ensure that only her customers have access. Which of the following choices BEST meets her intent of security and access?

  A. Enable port security
  B. Enable WPA
  C. Disable SSID broadcasting
  D. Enable WEP
  B. Enable WPA

• Question 175:

  Which of the following provides a static record of all certificates that are no longer valid?

  A. Private key
  B. Recovery agent
  C. CRLs
  D. CA
  C. CRLs

  ---

  The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release. When a potential user attempts to access a server, the server allows or denies access based on the CRL entry for that particular user.

• Question 176:

  Joe is exchanging encrypted email with another party. Joe encrypts the initial email with a key. When Joe receives a response, he is unable to decrypt the response with the same key he used initially. Which of the following would explain the situation?

  A. An ephemeral key was used for one of the messages
  B. A stream cipher was used for the initial email, a block cipher was used for the reply
  C. Out-of-band key exchange has taken place
  D. Asymmetric encryption is being used
  D. Asymmetric encryption is being used

• Question 177:

  Which of the following is an authentication service that uses UDP as a transport medium?

  A. TACACS+
  B. LDAP
  C. Kerberos
  D. RADIUS
  D. RADIUS

  ---

  Explanation: RADIUS runs in the application layer and makes use of UDP as transport.

• Question 178:

  A security analyst has a sample of malicious software and needs to know what the sample does. The analyst runs the sample in a carefully-controlled and monitored virtual machine to observe the software's behavior. The approach of malware analysis can BEST be described as:

  A. Static testing
  B. Security control testing
  C. White box testing
  D. Sandboxing
  D. Sandboxing

• Question 179:

  Several employees submit the same phishing email to the administrator. The administrator finds that the links in the email are not being blocked by the company's security device. Which of the following might the administrator do in the short term to prevent the emails from being received?

  A. Configure an ACL
  B. Implement a URL filter
  C. Add the domain to a block list
  D. Enable TLS on the mail server
  C. Add the domain to a block list

  ---

  Blocking e-mail is the same as preventing the receipt of those e-mails and this is done by applying a filter. But the filter must be configured to block it. Thus you should add that specific domain from where the e-mails are being sent to the list of addresses that is to be blocked.

• Question 180:

  Which of the following is the MOST secure protocol to transfer files?

  A. FTP
  B. FTPS
  C. SSH
  D. TELNET
  B. FTPS

  ---

  FTPS refers to FTP Secure, or FTP SSL. It is a secure variation of File Transfer Protocol (FTP).