CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 491:

  A network administrator is looking for a way to automatically update company browsers so they import a list of root certificates from an online source. This online source will then be responsible for tracking which certificates are to be trusted or not trusted. Which of the following BEST describes the service that should be implemented to meet these requirements?

  A. Trust model
  B. Key escrow
  C. OCSP
  D. PKI
  A. Trust model

  ---

  In this scenario we can put a CA in the local network and use an online CA as root CA in a hierarchical trust model.

  A trust Model is collection of rules that informs application on how to decide the legitimacy of a Digital Certificate.

  In a hierarchical trust model, also known as a tree, a root CA at the top provides all of the information. The intermediate CAs are next in the hierarchy, and they trust only information provided by the root CA. The root CA also trusts

  intermediate CAs that are in their level in the hierarchy and none that aren't. This arrangement allows a high level of control at all levels of the hierarchical tree.

• Question 492:

  Which of the following is a common coding error in which boundary checking is not performed?

  A. Input validation
  B. Fuzzing
  C. Secure coding
  D. Cross-site scripting
  A. Input validation

  ---

  Input validation is a defensive technique intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain.

• Question 493:

  Joe processes several requisitions during the day and during the night shift they are approved by Ann. This is an example of which of the following?

  A. Separation of duties
  B. Discretionary access
  C. Mandatory access
  D. Time of day restrictions
  B. Discretionary access

• Question 494:

  A security administrator notices large amounts of traffic within the network heading out to an external website. The website seems to be a fake bank site with a phone number that when called, asks for sensitive information. After further investigation, the security administrator notices that a fake link was sent to several users. This is an example of which of the following attacks?

  A. Vishing
  B. Phishing
  C. Whaling
  D. SPAM
  E. SPIM
  B. Phishing

  ---

  Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

  Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website,

  however, is bogus and set up only to steal the information the user enters on the page. Phishing emails are blindly sent to thousands, if not millions of recipients. By spamming large groups of people, the "phisher" counts on the email being

  read by a percentage of people who actually have an account with the legitimate company being spoofed in the email and corresponding webpage.

  Phishing, also referred to as brand spoofing or carding, is a variation on "fishing," the idea being that bait is thrown out with the hopes that while most will ignore the bait, some will be tempted into biting.

• Question 495:

  A security administrator is reviewing the company's continuity plan. The plan specifies an RTO of six hours and RPO of two days. Which of the following is the plan describing?

  A. Systems should be restored within six hours and no later than two days after the incident.
  B. Systems should be restored within two days and should remain operational for at least six hours.
  C. Systems should be restored within six hours with a minimum of two days worth of data.
  D. Systems should be restored within two days with a minimum of six hours worth of data.
  C. Systems should be restored within six hours with a minimum of two days worth of data.

  ---

  The recovery time objective (RTO) is the maximum amount of time that a process or service is allowed to be down and the consequences still to be considered acceptable. Beyond this time, the break in business continuity is considered to affect the business negatively. The RTO is agreed on during the business impact analysis (BIA) creation. The recovery point objective (RPO) is similar to RTO, but it defines the point at which the system needs to be restored. This could be where the system was two days before it crashed (whip out the old backup tapes) or five minutes before it crashed (requiring complete redundancy). As a general rule, the closer the RPO matches the item of the crash, the more expensive it is to obtain.

• Question 496:

  An organization currently uses FTP for the transfer of large files, due to recent security enhancements, is now required to use a secure method of file transfer and is testing both SFTP and FTPS as alternatives. Which of the following ports should be opened on the firewall in order to test the two alternatives? (Select Two)

  A. TCP 22
  B. TCP 25
  C. TCP 69
  D. UDP 161
  E. TCP 990
  F. TCP 3380
  A. TCP 22
  E. TCP 990

• Question 497:

  Which of the following is the proper way to quantify the total monetary damage resulting from an exploited vulnerability?

  A. Calculate the ALE
  B. Calculate the ARO
  C. Calculate the MTBF
  D. Calculate the TCO
  A. Calculate the ALE

• Question 498:

  Joe a sales employee is connecting to a wireless network and has entered the network information correctly. His computer remains connected to the network but he cannot access any resources on the network. Which of the following is the MOST likely cause of this issue?

  A. The encryption is too strong
  B. The network SSID is disabled
  C. MAC filtering is enabled
  D. The wireless antenna power is set too low
  D. The wireless antenna power is set too low

• Question 499:

  The chief Risk officer is concerned about the new employee BYOD device policy and has requested the security department implement mobile security controls to protect corporate data in the event that a device is lost or stolen. The level of protection must not be compromised even if the communication SIM is removed from the device. Which of the following BEST meets the requirements? (Select TWO)

  A. Asset tracking
  B. Screen-locks
  C. GEO-Tracking
  D. Device encryption
  A. Asset tracking
  D. Device encryption

  ---

  A: Asset tracking is the process of maintaining oversight over inventory, and ensuring that a device is still in the possession of the assigned authorized user.

  D: Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

• Question 500:

  Data execution prevention is a feature in most operating systems intended to protect against which type of attack?

  A. Cross-site scripting
  B. Buffer overflow
  C. Header manipulation
  D. SQL injection
  B. Buffer overflow

  ---

  Data Execution Prevention (DEP) is a security feature included in modern operating systems. It marks areas of memory as either "executable" or "nonexecutable", and allows only data in an "executable" area to be run by programs, services,

  device drivers, etc. It is known to be available in Linux, OS X, Microsoft Windows, iOS and Android operating systems.

  DEP protects against some program errors, and helps prevent certain malicious exploits, especially attacks that store executable instructions in a data area via a buffer overflow.

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has

  to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on

  data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or

  disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.