CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 441:

  Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident is opened. Which of the following should have been done first?

  A. Notify the incident response team lead
  B. Document chain of custody
  C. Take a copy of volatile memory
  D. Make an image of the hard drive
  A. Notify the incident response team lead

• Question 442:

  A new network administrator is setting up a new file server for the company. Which of the following would be the BEST way to manage folder security?

  A. Assign users manually and perform regular user access reviews
  B. Allow read only access to all folders and require users to request permission
  C. Assign data owners to each folder and allow them to add individual users to each folder
  D. Create security groups for each folder and assign appropriate users to each group
  D. Create security groups for each folder and assign appropriate users to each group

  ---

  Creating a security group for each folder and assigning necessary users to each group would only allow users belonging to the folder's security group access to the folder. It will make assigning folder privileges much easier, while also being more secure.

• Question 443:

  A network manager needs a cost-effective solution to allow for the restoration of information with a RPO of 24 hours. The disaster recovery plan also requires that backups occur within a restricted timeframe during the week and be take offsite weekly. Which of the following should the manager choose to BEST address these requirements?

  A. Daily incremental backup to tape
  B. Disk-to-disk hourly server snapshots
  C. Replication of the environment at a hot site
  D. Daily differential backup to tape
  E. Daily full backup to tape
  A. Daily incremental backup to tape

• Question 444:

  While previously recommended as a security measure, disabling SSID broadcast is not effective against most attackers because network SSIDs are:

  A. no longer used to authenticate to most wireless networks.
  B. contained in certain wireless packets in plaintext.
  C. contained in all wireless broadcast packets by default.
  D. no longer supported in 802.11 protocols.
  B. contained in certain wireless packets in plaintext.

  ---

  The SSID is still required for directing packets to and from the base station, so it can be discovered using a wireless packet sniffer.

• Question 445:

  Pete, a security analyst, has been informed that the development team has plans to develop an application which does not meet the company's password policy. Which of the following should Pete do NEXT?

  A. Contact the Chief Information Officer and ask them to change the company password policy so that the application is made compliant.
  B. Tell the application development manager to code the application to adhere to the company's password policy.
  C. Ask the application development manager to submit a risk acceptance memo so that the issue can be documented.
  D. Inform the Chief Information Officer of non-adherence to the security policy so that the developers can be reprimanded.
  B. Tell the application development manager to code the application to adhere to the company's password policy.

  ---

  Since the application is violating the security policy it should be coded differently to comply with the password policy.

• Question 446:

  A security technician wishes to gather and analyze all Web traffic during a particular time period.

  Which of the following represents the BEST approach to gathering the required data?

  A. Configure a VPN concentrator to log all traffic destined for ports 80 and 443.
  B. Configure a proxy server to log all traffic destined for ports 80 and 443.
  C. Configure a switch to log all traffic destined for ports 80 and 443.
  D. Configure a NIDS to log all traffic destined for ports 80 and 443.
  B. Configure a proxy server to log all traffic destined for ports 80 and 443.

  ---

  A proxy server is in essence a device that acts on behalf of others and in security terms all internal user interaction with the Internet should be controlled through a proxy server. This makes a proxy server the best tool to gather the required data.

• Question 447:

  Ann, a security administrator at a call center, has been experiencing problems with users intentionally installing unapproved and occasionally malicious software on their computers. Due to the nature of their jobs, Ann cannot change their permissions. Which of the following would BEST alleviate her concerns?

  A. Deploy a HIDS suite on the users' computer to prevent application installation
  B. Maintain the baseline posture at the highest OS patch level
  C. Enable the pop-up blockers on the user's browsers to prevent malware
  D. Create an approved application list and block anything not on it
  D. Create an approved application list and block anything not on it

• Question 448:

  Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote sites through a VPN connection. How could Sara BEST accommodate the vendor?

  A. Allow incoming IPSec traffic into the vendor's IP address.
  B. Set up a VPN account for the vendor, allowing access to the remote site.
  C. Turn off the firewall while the vendor is in the office, allowing access to the remote site.
  D. Write a firewall rule to allow the vendor to have access to the remote site.
  D. Write a firewall rule to allow the vendor to have access to the remote site.

  ---

  Firewall rules are used to define what traffic is able pass between the firewall and the internal network. Firewall rules block the connection, allow the connection, or allow the connection only if it is secured. Firewall rules can be applied to inbound traffic or outbound traffic and any type of network.

• Question 449:

  After a few users report problems with the wireless network, a system administrator notices that a new wireless access point has been powered up in the cafeteria. The access point has the same SSID as the corporate network and is set to the same channel as nearby access points. However, the AP has not been connected to the Ethernet network. Which of the following is the MOST likely cause of the user's wireless problems?

  A. AP channel bonding
  B. An evil twin attack
  C. Wireless interference
  D. A rogue access point
  B. An evil twin attack

• Question 450:

  A technician wants to secure communication to the corporate web portal, which is currently using HTTP. Which of the following is the FIRST step the technician should take?

  A. Send the server's public key to the CA
  B. Install the CA certificate on the server
  C. Import the certificate revocation list into the server
  D. Generate a certificate request from the server
  D. Generate a certificate request from the server