CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 391:

  Key elements of a business impact analysis should include which of the following tasks?

  A. Develop recovery strategies, prioritize recovery, create test plans, post-test evaluation, and update processes.
  B. Identify institutional and regulatory reporting requirements, develop response teams and communication trees, and develop press release templates.
  C. Employ regular preventive measures such as patch management, change management, antivirus and vulnerability scans, and reports to management.
  D. Identify critical assets systems and functions, identify dependencies, determine critical downtime limit, define scenarios by type and scope of impact, and quantify loss potential.
  D. Identify critical assets systems and functions, identify dependencies, determine critical downtime limit, define scenarios by type and scope of impact, and quantify loss potential.

  ---

  The key components of a Business impact analysis (BIA) include: Identifying Critical Functions Prioritizing Critical Business Functions Calculating a Timeframe for Critical Systems Loss Estimating the Tangible and Intangible Impact on the Organization

• Question 392:

  The security officer is preparing a read-only USB stick with a document of important personal phone numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At which of the following points in an incident should the officer instruct employees to use this information?

  A. Business Impact Analysis
  B. First Responder
  C. Damage and Loss Control
  D. Contingency Planning
  B. First Responder

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. In this scenario the security officer is carrying out an incident response measure that will address and be of benefit to those in the vanguard, i.e. the employees and they are the first responders.

• Question 393:

  Two organizations want to share sensitive data with one another from their IT systems to support a mutual customer base. Both organizations currently have secure network and security policies and procedures. Which of the following should be the PRIMARY security considerations by the security managers at each organization prior to sharing information? (Select THREE)

  A. Physical security controls
  B. Device encryption
  C. Outboarding/Offboarding
  D. Use of digital signatures
  E. SLA/ISA
  F. Data ownership
  G. Use of smartcards or common access cards
  H. Patch management
  B. Device encryption
  E. SLA/ISA
  F. Data ownership

• Question 394:

  Which of the following is used to certify intermediate authorities in a large PKI deployment?

  A. Root CA
  B. Recovery agent
  C. Root user
  D. Key escrow
  A. Root CA

  ---

  The root CA certifies other certification authorities to publish and manage certificates within the organization.

  In a hierarchical trust model, also known as a tree, a root CA at the top provides all of the information. The intermediate CAs are next in the hierarchy, and they trust only information provided by the root CA. The root CA also trusts

  intermediate CAs that are in their level in the hierarchy and none that aren't. This arrangement allows a high level of control at all levels of the hierarchical tree. .

• Question 395:

  Joe, the Chief Technical Officer (CTO), is concerned about new malware being introduced into the corporate network. He has tasked the security engineers to implement a technology that is capable of alerting the team when unusual traffic is on the network. Which of the following types of technologies will BEST address this scenario?

  A. Application Firewall
  B. Anomaly Based IDS
  C. Proxy Firewall
  D. Signature IDS
  B. Anomaly Based IDS

  ---

  Anomaly-based detection watches the ongoing activity in the environment and looks for abnormal occurrences. An anomaly-based monitoring or detection method relies on definitions of all valid forms of activity. This database of known valid activity allows the tool to detect any and all anomalies. Anomaly-based detection is commonly used for protocols. Because all the valid and legal forms of a protocol are known and can be defined, any variations from those known valid constructions are seen as anomalies.

• Question 396:

  Review the following diagram depicting communication between PC1 and PC2 on each side of a router. Analyze the network traffic logs which show communication between the two computers as captured by the computer with IP 10.2.2.10. DIAGRAM PC1 PC2 [192.168.1.30]--------[INSIDE 192.168.1.1 router OUTSIDE 10.2.2.1]---------[10.2.2.10] LOGS 10:30:22, SRC 10.2.2.1:3030, DST 10.2.2.10:80, SYN 10:30:23, SRC 10.2.2.10:80, DST 10.2.2.1:3030, SYN/ACK 10:30:24, SRC 10.2.2.1:3030, DST 10.2.2.10:80, ACK Given the above information, which of the following can be inferred about the above environment?

  A. 192.168.1.30 is a web server.
  B. The web server listens on a non-standard port.
  C. The router filters port 80 traffic.
  D. The router implements NAT.
  D. The router implements NAT.

  ---

  Network address translation (NAT) allows you to share a connection to the public Internet via a single interface with a single public IP address. NAT maps the private addresses to the public address. In a typical configuration, a local network uses one of the designated "private" IP address subnets. A router on that network has a private address (192.168.1.1) in that address space, and is also connected to the Internet with a "public" address (10.2.2.1) assigned by an Internet service provider.

• Question 397:

  A company has a BYOD policy that includes tablets and smart phones. In the case of a legal investigation, which of the following poses the greatest security issues?

  A. Recovering sensitive documents from a device if the owner is unable or unwilling to cooperate
  B. Making a copy of all of the files on the device and hashing them after the owner has provided the PIN
  C. Using GPS services to locate the device owner suspected in the investigation
  D. Wiping the device from a remote location should it be identified as a risk in the investigation
  A. Recovering sensitive documents from a device if the owner is unable or unwilling to cooperate

• Question 398:

  Which of the following are unique to white box testing methodologies? (Select two)

  A. Application program interface API testing
  B. Bluesnarfing
  C. External network penetration testing
  D. Function, statement and code coverage
  E. Input fuzzing
  A. Application program interface API testing
  D. Function, statement and code coverage

• Question 399:

  After a recent security breach, the network administrator has been tasked to update and backup all router and switch configurations. The security administrator has been tasked to enforce stricter security policies. All users were forced to undergo additional user awareness training. All of these actions are due to which of the following types of risk mitigation strategies?

  A. Change management
  B. Implementing policies to prevent data loss
  C. User rights and permissions review
  D. Lessons learned
  D. Lessons learned

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Described in the question is a situation where a security breach had occurred and its response which shows that lessons have been learned and used to put in place measures that will prevent any future security breaches of the same kind.

• Question 400:

  Speaking a passphrase into a voice print analyzer is an example of which of the following security concepts?

  A. Two factor authentication
  B. Identification and authorization
  C. Single sign-on
  D. Single factor authentication
  A. Two factor authentication

  ---

  Two-factor authentication is when two different authentication factors are provided for authentication purposes.

  Speaking (Voice) ?something they are.

  Passphrase ?something they know.