CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 481:

  It has been discovered that students are using kiosk tablets intended for registration and scheduling to play games and utilize instant messaging. Which of the following could BEST eliminate this issue?

  A. Device encryption
  B. Application control
  C. Content filtering
  D. Screen-locks
  B. Application control

  ---

  Application control is the process of controlling what applications are installed on a device. This may reduce exposure to malicious software by limiting the user's ability to install applications that come from unknown sources or have no work-related features.

• Question 482:

  Which of the following is an attack designed to activate based on time?

  A. Logic Bomb
  B. Backdoor
  C. Trojan
  D. Rootkit
  A. Logic Bomb

• Question 483:

  Which of the following tools would a security administrator use in order to identify all running services throughout an organization?

  A. Architectural review
  B. Penetration test
  C. Port scanner
  D. Design review
  C. Port scanner

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine.

• Question 484:

  Various network outages have occurred recently due to unapproved changes to network and security devices. All changes were made using various system credentials. The security analyst has been tasked to update the security policy. Which of the following risk mitigation strategies would also need to be implemented to reduce the number of network outages due to unauthorized changes?

  A. User rights and permissions review
  B. Configuration management
  C. Incident management
  D. Implement security controls on Layer 3 devices
  A. User rights and permissions review

  ---

  Reviewing user rights and permissions can be used to determine that all groups, users, and other accounts have the appropriate privileges assigned according to the policies of the corporation and their job descriptions. Also reviewing user rights and permissions will afford the security analyst the opportunity to put the principle of least privilege in practice as well as update the security policy

• Question 485:

  Client computers login at specified times to check and update antivirus definitions using a dedicated account configured by the administrator. One day the clients are unable to login with the account, but the server still responds to ping requests. The administrator has not made any changed. Which of the following most likely happened?

  A. Group policy is blocking the connection attempts
  B. The administrator account has been disabled
  C. The switch port for the server has died
  D. The password on the account has expired
  D. The password on the account has expired

• Question 486:

  Which of the following BEST allows Pete, a security administrator, to determine the type, source, and flags of the packet traversing a network for troubleshooting purposes?

  A. Switches
  B. Protocol analyzers
  C. Routers
  D. Web security gateways
  B. Protocol analyzers

  ---

  A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. By capturing and analyzing the packets, Pete will be able to determine the type, source, and flags of the packets traversing a network for troubleshooting purposes. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal).

• Question 487:

  Which of the following devices is BEST suited for servers that need to store private keys?

  A. Hardware security module
  B. Hardened network firewall
  C. Solid state disk drive
  D. Hardened host firewall
  A. Hardware security module

  ---

  A hardware security module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. By adding a HSM to the server and storing the private keys on HSM, the security of the keys would be improved.

• Question 488:

  Which the following would verify that a threat does exist and security controls can easily be bypassed without actively testing an application?

  A. Protocol analyzer
  B. Vunerability scan
  C. Penetration test
  D. Port scanner
  B. Vunerability scan

  ---

  Explanation: A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers.

  Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

• Question 489:

  A user reports being unable to access a file on a network share. The security administrator determines that the file is marked as confidential and that the user does not have the appropriate access level for that file. Which of the following is being implemented?

  A. Mandatory access control
  B. Discretionary access control
  C. Rule based access control
  D. Role based access control
  A. Mandatory access control

  ---

  Mandatory Access Control (MAC) allows access to be granted or restricted based on the rules of classification. MAC in corporate business environments involve the following four sensitivity levels Public Sensitive Private Confidential

  MAC assigns subjects a clearance level and assigns objects a sensitivity label. The name of the clearance level must be the same as the name of the sensitivity label assigned to objects or resources. In this case the file is marked confidential, and the user does not have that clearance level and cannot access the file.

• Question 490:

  Several employee accounts appear to have been cracked by an attacker. Which of the following should the security administrator implement to mitigate password cracking attacks? (Select TWO).

  A. Increase password complexity
  B. Deploy an IDS to capture suspicious logins
  C. Implement password history
  D. Implement monitoring of logins
  E. Implement password expiration
  F. Increase password length
  A. Increase password complexity
  F. Increase password length

  ---

  The more difficult a password is the more difficult it is to be cracked by an attacker. By increasing the password complexity you make it more difficult. Passwords that are too short can easily be cracked. The more characters used in a password, combined with the increased complexity will mitigate password cracking attacks.