CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 291:

  Determine the types of attacks below by selecting an option from the dropdown list. Determine the types of Attacks from right to specific action.

  Select and Place:

  

  

  ---

  A. Phishing.

  B. Whaling.

  C. Vishing.

  D. Spim.

  E. Social engineering.

  A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

  Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website,

  however, is bogus and set up only to steal the information the user enters on the page.

  B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In

  whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles.

  Hackers who engage in whaling often describe these efforts as "reeling in a big fish,"applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may,

  for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that

  hackers can pursue whaling, leading C-level or toplevel executives in business and government to stay vigilant about the possibility of cyber threats.

  C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he

  or she will profit.

  D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant

  messaging service, which can include Short Message Service (SMS).

  E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations

  today encounter.

  A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that

  compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires

  immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.

  References:

  http://www.webopedia.com/TERM/P/phishing.html

  http://www.techopedia.com/definition/28643/whaling

  http://www.webopedia.com/TERM/V/vishing.html

  http://searchsecurity.techtarget.com/definition/social-engineering

• Question 292:

  RC4 is a strong encryption protocol that is general used with which of the following?

  A. WPA2 CCMP
  B. PEAP
  C. WEP
  D. EAP-TLS
  C. WEP

• Question 293:

  Which of the following is a best practice when a mistake is made during a forensics examination?

  A. The examiner should verify the tools before, during, and after an examination.
  B. The examiner should attempt to hide the mistake during cross-examination.
  C. The examiner should document the mistake and workaround the problem.
  D. The examiner should disclose the mistake and assess another area of the disc.
  C. The examiner should document the mistake and workaround the problem.

  ---

  Every step in an incident response should be documented, including every action taken by end users and the incident-response team.

• Question 294:

  Which of the following would satisfy wireless network implementation requirements to use mutual authentication and usernames and passwords?

  A. EAP-MD5
  B. WEP
  C. PEAP-MSCHAPv2
  D. EAP-TLS
  C. PEAP-MSCHAPv2

  ---

  PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS or PEAP-TLS because user authentication is accomplished via password-base credentials (user name and password) rather than digital certificates or smart cards.

• Question 295:

  A security administrator is reviewing the company's data backup plan. The plan implements nightly offsite data replication to a third party company. Which of the following documents specifies how much data can be stored offsite, and how quickly the data can be retrieved by the company from the third party?

  A. MTBF
  B. SLA
  C. RFQ
  D. ALE
  B. SLA

• Question 296:

  Pete, a security administrator, is informed that people from the HR department should not have access to the accounting department's server, and the accounting department should not have access to the HR department's server. The network is separated by switches. Which of the following is designed to keep the HR department users from accessing the accounting department's server and vice-versa?

  A. ACLs
  B. VLANs
  C. DMZs
  D. NATS
  B. VLANs

  ---

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function.

• Question 297:

  Protecting the confidentiality of a message is accomplished by encrypting the message with which of the following?

  A. Sender's private key
  B. Recipient's public key
  C. Sender's public key
  D. Recipient's private key
  B. Recipient's public key

  ---

  To achieve both authentication and confidentiality, the sender should include the recipient's name in the message, sign it using his private key, and then encrypt both the message and the signature using the recipient's public key.

• Question 298:

  Which of the following can be used as an equipment theft deterrent?

  A. Screen locks
  B. GPS tracking
  C. Cable locks
  D. Whole disk encryption
  C. Cable locks

  ---

  Cable locks are theft deterrent devices that can be used to tether a device to a fixed point keep smaller devices from being easy to steal.

• Question 299:

  A Chief Information Security Officer (CISO) wants to implement two-factor authentication within the company. Which of the following would fulfill the CISO's requirements?

  A. Username and password
  B. Retina scan and fingerprint scan
  C. USB token and PIN
  D. Proximity badge and token
  C. USB token and PIN

  ---

  Multi-factor authentication (MFA) is a method of computer access control which a user can pass by successfully presenting authentication factors from at least two of the three categories:

  knowledge factors ("things only the user knows"), such as passwords possession factors ("things only the user has"), such as ATM cards inherence factors ("things only the user is"), such as biometrics

  In this question, a USB token is a possession factor (something the user has) and a PIN is a knowledge factor (something the user knows).

• Question 300:

  Which of the following devices is used for the transparent security inspection of network traffic by redirecting user packets prior to sending the packets to the intended destination?

  A. Proxies
  B. Load balancers
  C. Protocol analyzer
  D. VPN concentrator
  A. Proxies

  ---

  A proxy is a device that acts on behalf of other(s). A commonly used proxy in computer networks is a web proxy. Web proxy functionality is often combined into a proxy firewall.

  A proxy firewall can be thought of as an intermediary between your network and any other network. Proxy firewalls are used to process requests from an outside network; the proxy firewall examines the data and makes rule-based decisions about whether the request should be forwarded or refused. The proxy intercepts all of the packets and reprocesses them for use internally. This process includes hiding IP addresses. The proxy firewall provides better security than packet filtering because of the increased intelligence that a proxy firewall offers. Requests from internal network users are routed through the proxy. The proxy, in turn, repackages the request and sends it along, thereby isolating the user from the external network. The proxy can also offer caching, should the same request be made again, and it can increase the efficiency of data delivery.