CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 191:

  Ann, a security administrator, is strengthening the security controls of the company's campus. Her goal is to prevent people from accessing open locations that are not supervised, such as around the receiving dock. She is also concerned that employees are using these entry points as a way of bypassing the security guard at the main entrance. Which of the following should Ann recommend that would BEST address her concerns?

  A. Increase the lighting surrounding every building on campus
  B. Build fences around campus with gate entrances
  C. Install cameras to monitor the unsupervised areas
  D. Construct bollards to prevent vehicle entry in non-supervised areas
  B. Build fences around campus with gate entrances

• Question 192:

  An email client says a digital signature is invalid and the sender cannot be verified. The recipient is concerned with which of the following concepts?

  A. Integrity
  B. Availability
  C. Confidentiality
  D. Remediation
  A. Integrity

  ---

  A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. The message is encrypted using the encryption system, and a second piece of information, the digital signature, is added to the message. Digital Signatures is used to validate the integrity of the message and the sender. Integrity means the message can't be altered without detection.

• Question 193:

  When employees that use certificates leave the company they should be added to which of the following?

  A. PKI
  B. CA
  C. CRL
  D. TKIP
  C. CRL

  ---

  The certificates of the leaving employees must be made unusable. This is done by revoking them. The revoke certificates end up in the CRL.

  Note: The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue,

  and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release.

• Question 194:

  Which of the following concepts is a term that directly relates to customer privacy considerations?

  A. Data handling policies
  B. Personally identifiable information
  C. Information classification
  D. Clean desk policies
  B. Personally identifiable information

  ---

  Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. This has a direct relation to customer privacy considerations.

• Question 195:

  An administrator has to determine host operating systems on the network and has deployed a transparent proxy. Which of the following fingerprint types would this solution use?

  A. Packet
  B. Active
  C. Port
  D. Passive
  D. Passive

  ---

  TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote machine's operating system (aka, OS fingerprinting), or incorporated into a device fingerprint. Certain parameters within the TCP protocol definition are left up to the implementation. Different operating systems and different versions of the same operating system set different defaults for these values. By collecting and examining these values, one may differentiate among various operating systems, and implementations of TCP/IP. Just inspecting the Initial TTL and window size TCP/IP fields is often enough in order to successfully identify an operating system, which eases the task of performing manual OS fingerprinting.

  Passive OS fingerprinting is the examination of a passively collected sample of packets from a host in order to determine its operating system platform. It is called passive because it doesn't involve communicating with the host being examined. In this question, the proxy will use passive fingerprinting because the proxy is a `transparent proxy'. It isn't seen by the computer.

• Question 196:

  Which of the following incident response plan steps would MOST likely engaging business professionals with the security team to discuss changes to existing procedures?

  A. Recovery
  B. Incident identification
  C. Isolation / quarantine
  D. Lessons learned
  E. Reporting
  D. Lessons learned

• Question 197:

  A company requires that all wireless communication be compliant with the Advanced encryption standard. The current wireless infrastructure implements WEP + TKIP. Which of the following wireless protocols should be implemented?

  A. CCMP
  B. 802.1x
  C. 802.3
  D. WPA2
  E. AES
  B. 802.1x

• Question 198:

  The system administrator has deployed updated security controls for the network to limit risk of attack. The security manager is concerned that controls continue to function as intended to maintain appropriate security posture.

  Which of the following risk mitigation strategies is MOST important to the security manager?

  A. User permissions
  B. Policy enforcement
  C. Routine audits
  D. Change management
  C. Routine audits

  ---

  After you have implemented security controls based on risk, you must perform routine audits. These audits should include reviews of user rights and permissions as well as specific events. You should pay particular attention to false positives and negatives.

• Question 199:

  A security administrator needs a method to ensure that only employees can get onto the internal network when plugging into a network switch. Which of the following BEST meets that requirement?

  A. NAC
  B. UTM
  C. DMZ
  D. VPN
  A. NAC

• Question 200:

  Two programmers write a new secure application for the human resources department to store personal identifiable information. The programmers make the application available to themselves using an uncommon port along with an ID and password only they know. This is an example of which of the following?

  A. Root Kit
  B. Spyware
  C. Logic Bomb
  D. Backdoor
  D. Backdoor

  ---

  A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain

  undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit.

  A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system.

  Although the number of backdoors in systems using proprietary software (software whose source code is not publicly available) is not widely credited, they are nevertheless frequently exposed. Programmers have even succeeded in secretly

  installing large amounts of benign code as Easter eggs in programs, although such cases may involve official forbearance, if not actual permission.

  Many computer worms, such as Sobig and Mydoom, install a backdoor on the affected computer (generally a PC on broadband running Microsoft Windows and Microsoft Outlook). Such backdoors appear to be installed so that spammers can

  send junk e-mail from the infected machines. Others, such as the Sony/BMG rootkit distributed silently on millions of music CDs through late 2005, are intended as DRM measures--and, in that case, as data gathering agents, since both

  surreptitious programs they installed routinely contacted central servers.