CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 281:

  A company has been attacked and their website has been altered to display false information. The security administrator disables the web server service before restoring the website from backup. An audit was performed on the server and no other data was altered. Which of the following should be performed after the server has been restored?

  A. Monitor all logs for the attacker's IP
  B. Block port 443 on the web server
  C. Install and configure SSL to be used on the web server
  D. Configure the web server to be in VLAN 0 across the network
  B. Block port 443 on the web server

• Question 282:

  A company has just deployed a centralized event log storage system. Which of the following can be used to ensure the integrity of the logs after they are collected?

  A. Write-once drives
  B. Database encryption
  C. Continuous monitoring
  D. Role-based access controls
  A. Write-once drives

  ---

  A write-once drive means that the disk cannot be overwritten once data is written to the disk; and thus the integrity of the logs, if they are written to a write-once drives will ensure integrity of those logs.

• Question 283:

  An organization is moving its human resources system to a cloud services provider. The company plans to continue using internal usernames and passwords with the service provider, but the security manager does not want the service provider to have a company of the passwords. Which of the following options meets all of these requirements?

  A. Two-factor authentication
  B. Account and password synchronization
  C. Smartcards with PINS
  D. Federated authentication
  D. Federated authentication

• Question 284:

  Users can authenticate to a company's web applications using their credentials from a popular social media site. Which of the following poses the greatest risk with this integration?

  A. Malicious users can exploit local corporate credentials with their social media credentials
  B. Changes to passwords on the social media site can be delayed from replicating to the company
  C. Data loss from the corporate servers can create legal liabilities with the social media site
  D. Password breaches to the social media site affect the company application as well
  D. Password breaches to the social media site affect the company application as well

  ---

  Social networking and having you company's application authentication `linked' to users' credential that they use on social media sites exposes your company's application exponentially more than is necessary. You should strive to practice risk avoidance.

• Question 285:

  A user has plugged in a wireless router from home with default configurations into a network jack at the office. This is known as: A. an evil twin.

  B. an IV attack.
  C. a rogue access point.
  D. an unauthorized entry point.
  C. a rogue access point.

  ---

  A rogue access point is a wireless access point that should not be there. In this question, the wireless router has been connected to the corporate network without authorization.

  Therefore, it is a rogue access point.

  A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non- maliciously) an inexpensive wireless

  router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction

  with a rogue RADIUS server, depending on security configuration of the target network.

  To prevent the installation of rogue access points, organizations can install wireless intrusion prevention systems to monitor the radio spectrum for unauthorized access points.

• Question 286:

  Ann a new security specialist is attempting to access the internet using the company's open wireless network. The wireless network is not encrypted: however, once associated, ANN cannot access the internet or other company resources. In an attempt to troubleshoot, she scans the wireless network with NMAP, discovering the only other device on the wireless network is a firewall. Which of the following BEST describes the company's wireless network solution?

  A. The company uses VPN to authenticate and encrypt wireless connections and traffic
  B. The company's wireless access point is being spoofed
  C. The company's wireless network is unprotected and should be configured with WPA2
  D. The company is only using wireless for internet traffic so it does not need additional encryption
  A. The company uses VPN to authenticate and encrypt wireless connections and traffic

• Question 287:

  Which of the following preventative controls would be appropriate for responding to a directive to reduce the attack surface of a specific host?

  A. Installing anti-malware
  B. Implementing an IDS
  C. Taking a baseline configuration
  D. Disabling unnecessary services
  D. Disabling unnecessary services

  ---

  Preventive controls are to stop something from happening. These can include locked doors that keep intruders out, user training on potential harm (to keep them vigilant and alert), or even biometric devices and guards that deny access until authentication has occurred. By disabling all unnecessary services you would be reducing the attack surface because then there is less opportunity for risk incidents to happen. There are many risks with having many services enabled since a service can provide an attack vector that someone could exploit against your system. It is thus best practice to enable only those services that are absolutely required.

• Question 288:

  A recent review of accounts on various systems has found that after employees' passwords are required to change they are recycling the same password as before. Which of the following policies should be enforced to prevent this from happening? (Select TWO).

  A. Reverse encryption
  B. Minimum password age
  C. Password complexity
  D. Account lockouts
  E. Password history
  F. Password expiration
  B. Minimum password age
  E. Password history

  ---

  E: Password history determines the number of previous passwords that cannot be used when a user changes his password. For example, a password history value of 5 would disallow a user from changing his password to any of his previous 5 passwords.

  B: When a user is forced to change his password due to a maximum password age period expiring, he could change his password to a previously used password. Or if a password history value of 5 is configured, the user could change his password six times to cycle back round to his original password. This is where the minimum password age comes in. This is the period that a password must be used for. For example, a minimum password age of 30 would determine that when a user changes his password, he must continue to use the same password for at least 30 days.

• Question 289:

  If Organization A trusts Organization B and Organization B trusts Organization C, then Organization A trusts Organization C. Which of the following PKI concepts is this describing?

  A. Transitive trust
  B. Public key trust
  C. Certificate authority trust
  D. Domain level trust
  A. Transitive trust

  ---

  In transitive trusts, trust between a first party and a third party flows through a second party that is trusted by both the first party and the third party.

• Question 290:

  Joe, the systems administrator, is setting up a wireless network for his team's laptops only and needs to prevent other employees from accessing it. Which of the following would BEST address this?

  A. Disable default SSID broadcasting.
  B. Use WPA instead of WEP encryption.
  C. Lower the access point's power settings.
  D. Implement MAC filtering on the access point.
  D. Implement MAC filtering on the access point.

  ---

  If MAC filtering is turned off, any wireless client that knows the values looked for (MAC addresses) can join the network. When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so.