CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 311:

  During a routine audit, it is discovered that someone has been using a stale administrator account to log into a seldom used server. The person has been using the server to view inappropriate websites that are prohibited to end users. Which of the following could best prevent this from occurring again?

  A. Credential management
  B. Group policy management
  C. Acceptable use policy
  D. Account expiration policy
  B. Group policy management

• Question 312:

  Which of the following would be used to identify the security posture of a network without actually exploiting any weaknesses?

  A. Penetration test
  B. Code review
  C. Vulnerability scan
  D. Brute Force scan
  C. Vulnerability scan

  ---

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

• Question 313:

  While reviewing the monthly internet usage it is noted that there is a large spike in traffic classified as "unknown" and does not appear to be within the bounds of the organizations Acceptable Use Policy. Which of the following tool or technology would work BEST for obtaining more information on this traffic?

  A. Firewall logs
  B. IDS logs
  C. Increased spam filtering
  D. Protocol analyzer
  B. IDS logs

• Question 314:

  Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?

  A. WAF
  B. NIDS
  C. Routers
  D. Switches
  A. WAF

  ---

  A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as cross-site scripting (XSS) and SQL injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.

  As the protocols used to access a web server (typically HTTP and HTTPS) run in layer 7 of the OSI model, then web application firewall (WAF) is the correct answer.

• Question 315:

  When viewing IPS logs the administrator see systems all over the world scanning the network for servers with port 22 open. The administrator concludes that this traffic is a(N):

  A. Risk
  B. Vulnerability
  C. Exploit
  D. Threat
  D. Threat

• Question 316:

  After an audit, it was discovered that the security group memberships were not properly adjusted for employees' accounts when they moved from one role to another. Which of the following has the organization failed to properly implement? (Select TWO).

  A. Mandatory access control enforcement.
  B. User rights and permission reviews.
  C. Technical controls over account management.
  D. Account termination procedures.
  E. Management controls over account management.
  F. Incident management and response plan.
  B. User rights and permission reviews.
  E. Management controls over account management.

  ---

  Reviewing user rights and permissions can be used to determine that all groups, users, and other accounts have the appropriate privileges assigned according to the policies of the corporation and their job descriptions since they were all moved to different roles. Control over account management would have taken into account the different roles that employees have and adjusted the rights and permissions of these roles accordingly.

• Question 317:

  An insurance company requires an account recovery process so that information created by an employee can be accessed after that employee is no longer with the firm. Which of the following is the BEST approach to implement this process?

  A. Employee is required to share their password with authorized staff prior to leaving the firm
  B. Passwords are stored in a reversible form so that they can be recovered when needed
  C. Authorized employees have the ability to reset passwords so that the data is accessible
  D. All employee data is exported and imported by the employee prior to them leaving the firm
  C. Authorized employees have the ability to reset passwords so that the data is accessible

  ---

  Since a user's password isn't stored on most operating systems (only a hash value is kept), most operating systems allow the administrator (or authorized person in this case) to change the value then the information/files/documents can be accessed. This is the safest way of recovery by an authorized person and is not dependent on those who leave the firm.

• Question 318:

  Which of the following is the GREATEST security risk of two or more companies working together under a Memorandum of Understanding?

  A. Budgetary considerations may not have been written into the MOU, leaving an entity to absorb more cost than intended at signing.
  B. MOUs have strict policies in place for services performed between the entities and the penalties for compromising a partner are high.
  C. MOUs are generally loose agreements and therefore may not have strict guidelines in place to protect sensitive data between the two entities.
  D. MOUs between two companies working together cannot be held to the same legal standards as SLAs.
  C. MOUs are generally loose agreements and therefore may not have strict guidelines in place to protect sensitive data between the two entities.

  ---

  The Memorandum of Understanding This document is used in many settings in the information industry. It is a brief summary of which party is responsible for what portion of the work. For example, Company A may be responsible for maintaining the database server and Company B may be responsible for telecommunications. MOUs are not legally binding but they carry a degree of seriousness and mutual respect, stronger than a gentlemen's agreement. Often, MOUs are the first steps towards a legal contract.

• Question 319:

  Which of the following access controls enforces permissions based on data labeling at specific levels?

  A. Mandatory access control
  B. Separation of duties access control
  C. Discretionary access control
  D. Role based access control
  A. Mandatory access control

  ---

  In a MAC environment everything is assigned a classification marker. Subjects are assigned a clearance level and objects are assigned a sensitivity label.

• Question 320:

  An attacker unplugs the access point at a coffee shop. The attacker then runs software to make a laptop look like an access point and advertises the same network as the coffee shop normally does. Which of the following describes this type of attack?

  A. IV
  B. Xmas
  C. Packet sniffing
  D. Evil twin
  E. Rouge AP
  D. Evil twin