CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 371:

  Which of the following is true about asymmetric encryption?

  A. A message encrypted with the private key can be decrypted by the same key
  B. A message encrypted with the public key can be decrypted with a shared key.
  C. A message encrypted with a shared key, can be decrypted by the same key.
  D. A message encrypted with the public key can be decrypted with the private key.
  D. A message encrypted with the public key can be decrypted with the private key.

  ---

  Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes.

• Question 372:

  Which of the following is commonly used for federated identity management across multiple organizations?

  A. SAML
  B. Active Directory
  C. Kerberos
  D. LDAP
  A. SAML

• Question 373:

  Which of the following relies on the use of shared secrets to protect communication?

  A. RADIUS
  B. Kerberos
  C. PKI
  D. LDAP
  A. RADIUS

  ---

  Obfuscated passwords are transmitted by the RADIUS protocol via a shared secret and the MD5 hashing algorithm.

• Question 374:

  A vulnerability assessment indicates that a router can be accessed from default port 80 and default port 22. Which of the following should be executed on the router to prevent access via these ports? (Select TWO).

  A. FTP service should be disabled
  B. HTTPS service should be disabled
  C. SSH service should be disabled
  D. HTTP service should disabled
  E. Telnet service should be disabled
  C. SSH service should be disabled
  D. HTTP service should disabled

  ---

  Port 80 is used by HTTP. Port 22 is used by SSH. By disabling the HTTP and Telnet services, you will prevent access to the router on ports 80 and 22.

• Question 375:

  A network administrator has recently updated their network devices to ensure redundancy is in place so that:

  A. switches can redistribute routes across the network.
  B. environmental monitoring can be performed.
  C. single points of failure are removed.
  D. hot and cold aisles are functioning.
  C. single points of failure are removed.

  ---

  Redundancy refers to systems that either are duplicated or fail over to other systems in the event of a malfunction. The best way to remove an SPOF from your environment is to add redundancy.

• Question 376:

  Which of the following is a Data Loss Prevention (DLP) strategy and is MOST useful for securing data in use?

  A. Email scanning
  B. Content discovery
  C. Database fingerprinting
  D. Endpoint protection
  D. Endpoint protection

  ---

  Data loss prevention (DLP) systems monitor the contents of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access) and transmitting the data. DLP systems share commonality with network intrusion prevention systems. Endpoint protection provides security and management over both physical and virtual environments.

• Question 377:

  Which of the following is a management control?

  A. Logon banners
  B. Written security policy
  C. SYN attack prevention
  D. Access Control List (ACL)
  B. Written security policy

  ---

  Management control types include risk assessment, planning, systems and Services Acquisition as well as Certification, Accreditation and Security Assessment; and written security policy falls in this category.

• Question 378:

  Which of the following is used to inform users of the repercussions of releasing proprietary information?

  A. OLA
  B. SLA
  C. NDA
  D. MOU
  C. NDA

• Question 379:

  A system administrator has noticed vulnerability on a high impact production server. A recent update was made available by the vendor that addresses the vulnerability but requires a reboot of the system afterwards. Which of the following steps should the system administrator implement to address the vulnerability?

  A. Test the update in a lab environment, schedule downtime to install the patch, install the patch and reboot the server and monitor for any changes
  B. Test the update in a lab environment, backup the server, schedule downtime to install the patch, install the patch, and monitor for any changes
  C. Test the update in a lab environment, backup the server, schedule downtime to install the patch, install the update, reboot the server, and monitor for any changes
  D. Backup the server, schedule downtime to install the patch, installs the patch and monitor for any changes
  C. Test the update in a lab environment, backup the server, schedule downtime to install the patch, install the update, reboot the server, and monitor for any changes

  ---

  We have an update to apply to fix the vulnerability. The update should be tested first in a lab environment, not on the production server to ensure it doesn't cause any other problems with the server. After testing the update, we should backup the server to enable us to roll back any changes in the event of any unforeseen problems with the update. The question states that the server will require a reboot. This will result in downtime so you should schedule the downtime before installing the patch. After installing the update, you should monitor the server to ensure it is functioning correctly.

• Question 380:

  A workstation is exhibiting symptoms of malware and the network security analyst has decided to remove the system from the network. This represents which of the following stages of the Incident Handling Response?

  A. Plan of action
  B. Mitigation
  C. Lesson Learned
  D. Recovery
  A. Plan of action