CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 351:

  A recent audit has revealed that all employees in the bookkeeping department have access to confidential payroll information, while only two members of the bookkeeping department have job duties that require access to the confidential information. Which of the following can be implemented to reduce the risk of this information becoming compromised in this scenario? (Select TWO)

  A. Rule-based access control
  B. Role-based access control
  C. Data loss prevention
  D. Separation of duties E. Group-based permissions
  B. Role-based access control

• Question 352:

  A trojan was recently discovered on a server. There are now concerns that there has been a security breach that allows unauthorized people to access data. The administrator should be looking for the presence of a/an:

  A. Logic bomb.
  B. Backdoor.
  C. Adware application.
  D. Rootkit.
  B. Backdoor.

  ---

  There has been a security breach on a computer system. The security administrator should now check for the existence of a backdoor.

  A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain

  undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit.

  A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system.

  Although the number of backdoors in systems using proprietary software (software whose source code is not publicly available) is not widely credited, they are nevertheless frequently exposed. Programmers have even succeeded in secretly

  installing large amounts of benign code as Easter eggs in programs, although such cases may involve official forbearance, if not actual permission.

  Many computer worms, such as Sobig and Mydoom, install a backdoor on the affected computer (generally a PC on broadband running Microsoft Windows and Microsoft Outlook). Such backdoors appear to be installed so that spammers can

  send junk e-mail from the infected machines. Others, such as the Sony/BMG rootkit distributed silently on millions of music CDs through late 2005, are intended as DRM measures--and, in that case, as data gathering agents, since both

  surreptitious programs they installed routinely contacted central servers.

• Question 353:

  One of the system administrators at a company is assigned to maintain a secure computer lab. The administrator has rights to configure machines, install software, and perform user account maintenance. However, the administrator cannot add new computers to the domain, because that requires authorization from the Information Assurance Officer. This is an example of which of the following?

  A. Mandatory access
  B. Rule-based access control
  C. Least privilege
  D. Job rotation
  C. Least privilege

  ---

  A least privilege policy should be used when assigning permissions. Give users only the permissions that they need to do their work and no more.

• Question 354:

  The security administrator receives an email on a non-company account from a coworker stating that some reports are not exporting correctly. Attached to the email was an example report file with several customers' names and credit card numbers with the PIN. Which of the following is the BEST technical controls that will help mitigate this risk of disclosing sensitive data?

  A. Configure the mail server to require TLS connections for every email to ensure all transport data is encrypted
  B. Create a user training program to identify the correct use of email and perform regular audits to ensure compliance
  C. Implement a DLP solution on the email gateway to scan email and remove sensitive data or files
  D. Classify all data according to its sensitivity and inform the users of data that is prohibited to share
  C. Implement a DLP solution on the email gateway to scan email and remove sensitive data or files

• Question 355:

  In an effort to reduce data storage requirements, a company devices to hash every file and eliminate duplicates. The data processing routines are time sensitive so the hashing algorithm is fast and supported on a wide range of systems. Which of the following algorithms is BEST suited for this purpose?

  A. MD5
  B. SHA
  C. RIPEMD
  D. AES
  B. SHA

• Question 356:

  A quality assurance analyst is reviewing a new software product for security, and has complete access to the code and data structures used by the developers. This is an example of which of the following types of testing?

  A. Black box
  B. Penetration
  C. Gray box
  D. White box
  D. White box

  ---

  White box testing is the process of testing an application when you have detailed knowledge of the inner workings of the application. White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural

  testing) is a method of testing software that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing an internal perspective of the system, as well as programming skills,

  are used to design test cases. The tester chooses inputs to exercise paths through the code and determine the appropriate outputs. This is analogous to testing nodes in a circuit, e.g.

  in-circuit testing (ICT).

  White-box testing can be applied at the unit, integration and system levels of the software testing process. Although traditional testers tended to think of white-box testing as being done at the unit level, it is used for integration and system

  testing more frequently today. It can test paths within a unit, paths between units during integration, and between subsystems during a system璴evel test.

• Question 357:

  Which of the following functions provides an output which cannot be reversed and converts data into a string of characters?

  A. Hashing
  B. Stream ciphers
  C. Steganography
  D. Block ciphers
  A. Hashing

  ---

  Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables one of its characteristics is that it must be one-way ?it is not reversible.

• Question 358:

  Which of the following controls would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks?

  A. 802.1x
  B. Data encryption
  C. Password strength
  D. BGP
  A. 802.1x

  ---

  IEEE 802.1X (also known as Dot1x) is an IEEE Standard for Port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

  802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server. The supplicant is a client device (such as a laptop) that wishes to attach to the LAN/WLAN - though the term 'supplicant' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software supporting the RADIUS and EAP protocols. The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. An analogy to this is providing a valid visa at the airport's arrival immigration before being allowed to enter the country. With 802.1X port-based authentication, the supplicant provides credentials, such as user name/password or digital certificate, to the authenticator, and the authenticator forwards the credentials to the authentication server for verification. If the authentication server determines the credentials are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network.

• Question 359:

  A video surveillance audit recently uncovered that an employee plugged in a personal laptop and used the corporate network to browse inappropriate and potentially malicious websites after office hours. Which of the following could BEST prevent a situation like this form occurring again?

  A. Intrusion detection
  B. Content filtering
  C. Port security
  D. Vulnerability scanning
  C. Port security

• Question 360:

  A supervisor in your organization was demoted on Friday afternoon. The supervisor had the ability to modify the contents of a confidential database, as well as other managerial permissions. On Monday morning, the database administrator reported that log files indicated that several records were missing from the database. Which of the following risk mitigation startegies should have been implemented when the supervisor was demoted?

  A. Incident management
  B. Routine auditing
  C. IT governance
  D. Monthly user rights reviews
  D. Monthly user rights reviews