CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 421:

  Company XYZ has encountered an increased amount of buffer overflow attacks. The programmer has been tasked to identify the issue and report any findings. Which of the following is the FIRST step of action recommended in this scenario?

  A. Baseline Reporting
  B. Capability Maturity Model
  C. Code Review
  D. Quality Assurance and Testing
  C. Code Review

  ---

  A buffer overflow attack attacks a vulnerability caused by poor coding in an application. Reviewing the code of the application will enable you to identify code that is vulnerable to buffer overflow.

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.

• Question 422:

  Matt, a systems security engineer, is determining which credential-type authentication to use within a planned 802.1x deployment. He is looking for a method that does not require a client certificate, has a server side certificate, and uses TLS tunnels for encryption. Which credential type authentication method BEST fits these requirements?

  A. EAP-TLS
  B. EAP-FAST
  C. PEAP-CHAP
  D. PEAP-MSCHAPv2
  D. PEAP-MSCHAPv2

  ---

  PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS or PEAP-TLS because user authentication is accomplished via password-base credentials (user name and password) rather than digital certificates or smart cards. Only servers running Network Policy Server (NPS) or PEAP-MS-CHAP v2 are required to have a certificate.

• Question 423:

  Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that these were false indicators. Which of the following security devices needs to be configured to disable future false alarms?

  A. Signature based IPS
  B. Signature based IDS
  C. Application based IPS
  D. Anomaly based IDS
  D. Anomaly based IDS

  ---

  Most intrusion detection systems (IDS) are what is known as signature-based. This means that they operate in much the same way as a virus scanner, by searching for a known identity - or signature - for each specific intrusion event. And, while signature-based IDS is very efficient at sniffing out known s of attack, it does, like anti-virus software, depend on receiving regular signature updates, to keep in touch with variations in hacker technique. In other words, signature-based IDS is only as good as its database of stored signatures. Any organization wanting to implement a more thorough - and hence safer - solution, should consider what we call anomaly-based IDS. By its nature, anomaly-based IDS is a rather more complex creature. In network traffic terms, it captures all the headers of the IP packets running towards the network. From this, it filters out all known and legal traffic, including web traffic to the organization's web server, mail traffic to and from its mail server, outgoing web traffic from company employees and DNS traffic to and from its DNS server.

  There are other equally obvious advantages to using anomaly-based IDS. For example, because it detects any traffic that is new or unusual, the anomaly method is particularly good at identifying sweeps and probes towards network hardware. It can, therefore, give early warnings of potential intrusions, because probes and scans are the predecessors of all attacks. And this applies equally to any new service installed on any item of hardware - for example, Telnet deployed on a network router for maintenance purposes and forgotten about when the maintenance was finished. This makes anomaly-based IDS perfect for detecting anything from port anomalies and web anomalies to mis-formed attacks, where the URL is deliberately mis-typed.

• Question 424:

  An incident response team member needs to perform a forensics examination but does not have the required hardware. Which of the following will allow the team member to perform the examination with minimal impact to the potential evidence?

  A. Using a software file recovery disc
  B. Mounting the drive in read-only mode
  C. Imaging based on order of volatility
  D. Hashing the image after capture
  B. Mounting the drive in read-only mode

  ---

  Mounting the drive in read-only mode will prevent any executable commands from being executed. This is turn will have the least impact on potential evidence using the drive in question.

• Question 425:

  Which of the following presents the STRONGEST access control?

  A. MAC
  B. TACACS
  C. DAC
  D. RBAC
  A. MAC

  ---

  A: With Mandatory Access Control (MAC) all access is predefined. This makes it the strongest access control of the options presented in the question.

• Question 426:

  A system administrator is using a packet sniffer to troubleshoot remote authentication. The administrator detects a device trying to communicate to TCP port 49. Which of the following authentication methods is MOST likely being attempted?

  A. RADIUS
  B. TACACS+
  C. Kerberos
  D. LDAP
  B. TACACS+

  ---

  TACACS makes use of TCP port 49 by default.

• Question 427:

  A system administrator is conducting baseline audit and determines that a web server is missing several critical updates. Which of the following actions should the administrator perform first to correct the issue?

  A. Open a service ticket according to the patch management plan
  B. Disconnect the network interface and use the administrative management console to perform the updates
  C. Perform a backup of the server and install the require patches
  D. Disable the services for the web server but leave the server alone pending patch updates
  A. Open a service ticket according to the patch management plan

• Question 428:

  What is a system that is intended or designed to be broken into by an attacker?

  A. Honeypot
  B. Honeybucket
  C. Decoy
  D. Spoofing system
  A. Honeypot

  ---

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

  According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:

  The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the

  system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.

  There are two main types of honeypots:

  Production - A production honeypot is one used within an organization's environment to help mitigate risk.

  Research ?A research honeypot add value to research in computer security by providing a platform to study the threat.

• Question 429:

  A customer service department has a business need to send high volumes of confidential information to customers electronically. All emails go through a DLP scanner. Which of the following is the BEST solution to meet the business needs and protect confidential information?

  A. Automatically encrypt impacted outgoing emails
  B. Automatically encrypt impacted incoming emails
  C. Monitor impacted outgoing emails
  D. Prevent impacted outgoing emails
  A. Automatically encrypt impacted outgoing emails

  ---

  Encryption is done to protect confidentiality and integrity of data. It also provides authentication, nonrepudiation and access control to the data. Since all emails go through a DLP scanner and it is outgoing main that requires protection then the best option is to put a system in place that will encrypt the outgoing emails automatically.

• Question 430:

  A company is exploring the option of letting employees use their personal laptops on the internal network. Which of the following would be the MOST common security concern in this scenario?

  A. Credential management
  B. Support ownership
  C. Device access control
  D. Antivirus management
  D. Antivirus management