CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 301:

  Which of the following is a way to implement a technical control to mitigate data loss in case of a mobile device theft?

  A. Disk encryption
  B. Encryption policy
  C. Solid state drive
  D. Mobile device policy
  A. Disk encryption

  ---

  Disk and device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

• Question 302:

  The network administrator is responsible for promoting code to applications on a DMZ web server. Which of the following processes is being followed to ensure application integrity?

  A. Application hardening
  B. Application firewall review
  C. Application change management
  D. Application patch management
  C. Application change management

  ---

  Change management is the structured approach that is followed to secure a company's assets. Promoting code to application on a SMZ web server would be change management.

• Question 303:

  Which of the following attacks involves the use of previously captured network traffic?

  A. Replay
  B. Smurf
  C. Vishing
  D. DDoS
  A. Replay

  ---

  Replay attacks are becoming quite common. They occur when information is captured over a network. A replay attack is a kind of access or modification attack. In a distributed environment, logon and password information is sent between the client and the authentication system. The attacker can capture the information and replay it later. This can also occur with security certificates from systems such as Kerberos: The attacker resubmits the certificate, hoping to be validated by the authentication system and circumvent any time sensitivity.

  If this attack is successful, the attacker will have all of the rights and privileges from the original certificate. This is the primary reason that most certificates contain a unique session identifier and a time stamp. If the certificate has expired, it will be rejected and an entry should be made in a security log to notify system administrators.

• Question 304:

  A security administrator develops a web page and limits input into the fields on the web page as well as filters special characters in output. The administrator is trying to prevent which of the following attacks?

  A. Spoofing
  B. XSS
  C. Fuzzing
  D. Pharming
  B. XSS

  ---

  Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users.

  Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised

  site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts

  into web pages, an attacker can gain elevated access- privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user.

  By validating user input and preventing special characters, we can prevent the injection of client-side scripting code.

• Question 305:

  A network was down for several hours due to a contractor entering the premises and plugging both ends of a network cable into adjacent network jacks. Which of the following would have prevented the network outage? (Select Two)

  A. Port security
  B. Loop Protection
  C. Implicit deny
  D. Log analysis
  E. Mac Filtering
  F. Flood Guards
  A. Port security
  F. Flood Guards

• Question 306:

  While setting up a secure wireless corporate network, which of the following should Pete, an administrator, avoid implementing?

  A. EAP-TLS
  B. PEAP
  C. WEP
  D. WPA
  C. WEP

  ---

  WEP is one of the more vulnerable security protocols. The only time to use WEP is when you must have compatibility with older devices that do not support new encryption.

• Question 307:

  A rogue programmer included a piece of code in an application to cause the program to halt at 2:00 PM on Monday afternoon when the application is most utilized. This is Which of the following types of malware?

  A. Trojan
  B. Virus
  C. Logic Bomb
  D. Botnets
  C. Logic Bomb

• Question 308:

  A security administrator is reviewing the web logs and notices multiple attempts by users to access:http://www.comptia.org/idapsearch?user-*

  Having identified the attack, which of the following will prevent this type of attack on the web server?

  A. Input validation on the web server
  B. Block port 389 on the firewall
  C. Segregate the web server by a VLAN
  D. Block port 3389 on the firewall
  A. Input validation on the web server

• Question 309:

  A load balancer has the ability to remember which server a particular client is using and always directs that client to the same server. This feature is called:

  A. Cookie tracking
  B. URL filtering
  C. Session affinity
  D. Behavior monitoring
  C. Session affinity

• Question 310:

  An internal audit has detected that a number of archived tapes are missing from secured storage. There was no recent need for restoration of data from the missing tapes. The location is monitored by access control and CCTV systems. Review of the CCTV system indicates that it has not been recording for three months. The access control system shows numerous valid entries into the storage location during that time. The last audit was six months ago and the tapes were accounted for at that time. Which of the following could have aided the investigation?

  A. Testing controls
  B. Risk assessment
  C. Signed AUP
  D. Routine audits
  A. Testing controls

  ---

  Testing controls come in three types: Technical, Management and Operational. In this question, the CCTV system has not been recording for three months and no one noticed. Improved testing controls (regular testing to verify the CCTV system is recording) would ensure that the CCTV is recording as expected. The CCTV recordings could have aided the investigation into the missing tapes.