CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 31:

  When a new network drop was installed, the cable was run across several fluorescent lights. The users of the new network drop experience intermittent connectivity. Which of the following environmental controls was MOST likely overlooked during installation?

  A. Humidity sensors
  B. EMI shielding
  C. Channel interference
  D. Cable kinking
  B. EMI shielding

  ---

  Shielding refers to the process of preventing electronic emissions from your computer systems from being used to gather intelligence and preventing outside electronic emissions from disrupting your information-processing abilities. In this case you are experiencing intermittent connectivity since Electro Magnetic Interference (EMI) was not taken into account when running the cables over fluorescent lighting.

• Question 32:

  Which of the following should Matt, a security administrator, include when encrypting smartphones? (Select TWO).

  A. Steganography images
  B. Internal memory
  C. Master boot records
  D. Removable memory cards
  E. Public keys
  B. Internal memory
  D. Removable memory cards

  ---

  All useable data on the device should be encrypted. This data can be located on the hard drive, or removable drives, such as USB devices and memory cards, and on internal memory.

• Question 33:

  Which of the following would a security administrator use to verify the integrity of a file?

  A. Time stamp
  B. MAC times
  C. File descriptor
  D. Hash
  D. Hash

  ---

  Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables and it is a one-way transformation in order to validate the integrity of data.

• Question 34:

  Which of the following is characterized by an attacker attempting to map out an organization's staff hierarchy in order to send targeted emails?

  A. Whaling
  B. Impersonation
  C. Privilege escalation
  D. Spear phishing
  A. Whaling

  ---

  A whaling attack is targeted at company executives. Mapping out an organization's staff hierarchy to determine who the people at the top are is also part of a whaling attack. Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top- level executives in business and government to stay vigilant about the possibility of cyber threats.

• Question 35:

  The help desk is experiencing a higher than normal amount of calls from users reporting slow response from the application server. After analyzing the data from a packet capturing tool, the head of the network engineering department determines that the issue is due, in part from the increase of personnel recently hired to perform application development. Which of the following would BEST assist in correcting this issue?

  A. Load balancer
  B. Spam filter
  C. VPN Concentrator
  D. NIDS
  A. Load balancer

• Question 36:

  The Chief Information Officer (CIO) has asked a security analyst to determine the estimated costs associated with each potential breach of their database that contains customer information. Which of the following is the risk calculation that the CIO is asking for?

  A. Impact
  B. SLE
  C. ARO
  D. ALE
  B. SLE

• Question 37:

  During the information gathering stage of a deploying role-based access control model, which of the following information is MOST likely required?

  A. Conditional rules under which certain systems may be accessed
  B. Matrix of job titles with required access privileges
  C. Clearance levels of all company personnel
  D. Normal hours of business operation
  B. Matrix of job titles with required access privileges

  ---

  Role-based access control is a model where access to resources is determines by job role rather than by user account.

  Within an organization, roles are created for various job functions. The permissions to perform certain operations are assigned to specific roles. Members or staff (or other system users) are assigned particular roles, and through those role assignments acquire the computer permissions to perform particular computer-system functions. Since users are not assigned permissions directly, but only acquire them through their role (or roles), management of individual user rights becomes a matter of simply assigning appropriate roles to the user's account; this simplifies common operations, such as adding a user, or changing a user's department.

  To configure role-based access control, you need a list (or matrix) of job titles (roles) and the access privileges that should be assigned to each role.

• Question 38:

  When Ann an employee returns to work and logs into her workstation she notices that, several desktop configuration settings have changed. Upon a review of the CCTV logs, it is determined that someone logged into Ann's workstation. Which of the following could have prevented this from happening?

  A. Password complexity policy
  B. User access reviews
  C. Shared account prohibition policy
  D. User assigned permissions policy
  A. Password complexity policy

  ---

  The most important countermeasure against password crackers is to use long, complex passwords, which are changed regularly. Since changes were made to Ann's desktop configuration settings while she was not at work, means that her password was compromised.

• Question 39:

  A technician has been tasked with installing and configuring a wireless access point for the engineering department. After the AP has been installed, there have been reports the employees from other departments have been connecting to it without approval. Which of the following would BEST address these concerns?

  A. Change the SSID of the AP so that it reflects a different department, obscuring its ownership
  B. Implement WPA2 encryption in addition to WEP to protect the data-in-transit
  C. Configure the AP to allow only to devices with pre-approved hardware addresses
  D. Lower the antenna's power so that it only covers the engineering department's offices
  D. Lower the antenna's power so that it only covers the engineering department's offices

• Question 40:

  End-user awareness training for handling sensitive personally identifiable information would include secure storage and transmission of customer:

  A. Date of birth.
  B. First and last name.
  C. Phone number.
  D. Employer name.
  A. Date of birth.

  ---

  Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. Date of birth is personally identifiable information.