CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 511:

  A new application needs to be deployed on a virtual server. The virtual server hosts a SQL server that is used by several employees.

  Which of the following is the BEST approach for implementation of the new application on the virtual server?

  A. Take a snapshot of the virtual server after installing the new application and store the snapshot in a secure location.
  B. Generate a baseline report detailing all installed applications on the virtualized server after installing the new application.
  C. Take a snapshot of the virtual server before installing the new application and store the snapshot in a secure location.
  D. Create an exact copy of the virtual server and store the copy on an external hard drive after installing the new application.
  C. Take a snapshot of the virtual server before installing the new application and store the snapshot in a secure location.

  ---

  Snapshots are backups of virtual machines that can be used to quickly recover from poor updates, and errors arising from newly installed applications. However, the snapshot should be taken before the application or update is installed.

• Question 512:

  Joe, a network security engineer, has visibility to network traffic through network monitoring tools.

  However, he's concerned that a disgruntled employee may be targeting a server containing the company's financial records. Which of the following security mechanism would be MOST appropriate to confirm Joe's suspicion?

  A. HIDS
  B. HIPS
  C. NIPS
  D. NIDS
  A. HIDS

  ---

  A host-based IDS (HIDS) is an intrusion detection system that runs as a service on a host computer system. It is used to monitor the machine logs, system events, and application activity for signs of intrusion. It is useful for detecting attacks that originate outside the organization as well as attacks by internal users logged on to the system.

• Question 513:

  Which of the following types of wireless attacks would be used specifically to impersonate another WAP in order to gain unauthorized information from mobile users?

  A. IV attack
  B. Evil twin
  C. War driving
  D. Rogue access point
  B. Evil twin

  ---

  An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits.

• Question 514:

  Ann works at a small company and she is concerned that there is no oversight in the finance department; specifically, that Joe writes, signs and distributes paycheques, as well as other expenditures. Which of the following controls can she implement to address this concern?

  A. Mandatory vacations
  B. Time of day restrictions
  C. Least privilege
  D. Separation of duties
  D. Separation of duties

  ---

  Separation of duties divides administrator or privileged tasks into separate groupings, which in turn, is individually assigned to unique administrators. This helps in fraud prevention, error reduction, as well as conflict of interest prevention. For example, those who configure security should not be the same people who test security. In this case, Joe should not be allowed to write and sign paycheques.

• Question 515:

  Which of the following ports and protocol types must be opened on a host with a host- based firewall to allow incoming SFTP connections?

  A. 21/UDP
  B. 21/TCP
  C. 22/UDP
  D. 22/TCP
  D. 22/TCP

  ---

  SSH uses TCP port 22. All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22.

• Question 516:

  An administrator was asked to review user accounts. Which of the following has the potential to cause the MOST amount of damage if the account was compromised?

  A. A password that has not changed in 180 days
  B. A single account shared by multiple users
  C. A user account with administrative rights
  D. An account that has not been logged into since creation
  C. A user account with administrative rights

  ---

  A user account with administrative rights has the same rights as an administrator account on a computer.

  An administrator account is a user account that lets you make changes that will affect other users. Administrators can change security settings, install software and hardware, and access all files on the computer. Administrators can also make

  changes to other user accounts.

  This compares to a standard user (non-administrative) account which has limited rights on a computer. For example, a standard user account cannot install software, cannot make system changes that would affect other users and cannot

  access other users' files. Therefore, a compromised user account with administrative rights has the potential for the most damage.

• Question 517:

  In order to gain an understanding of the latest attack tools being used in the wild, an administrator puts a Unix server on the network with the root users password to set root. Which of the following best describes this technique?

  A. Pharming
  B. Honeypot
  C. Gray box testing
  D. phishing
  B. Honeypot

• Question 518:

  Which of the following attacks impact the availability of a system? (Select TWO).

  A. Smurf
  B. Phishing
  C. Spim
  D. DDoS
  E. Spoofing
  A. Smurf
  D. DDoS

  ---

  A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network.

  A Distributed Denial of Service (DDoS) attack is an attack from several different computers targeting a single computer. One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such attacks usually lead to a server overload. A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This after all will end up completely crashing a website for periods of time.

• Question 519:

  An administrator performs a risk calculation to determine if additional availability controls need to be in place. The administrator estimates that a server fails and needs to be replaced once every 2 years at a cost of $8,000. Which of the following represents the factors that the administrator would use to facilitate this calculation?

  A. ARO= 0.5; SLE= $4,000; ALE= $2,000
  B. ARO=0.5; SLE=$8,000; ALE=$4,000
  C. ARO=0.5; SLE= $4,000; ALE=$8,000
  D. ARO=2; SLE= $4,000; ALE=$8,000
  E. ARO=2; SLE= $8,000; ALE= $16,000
  B. ARO=0.5; SLE=$8,000; ALE=$4,000

• Question 520:

  An organization does not want the wireless network name to be easily discovered. Which of the following software features should be configured on the access points?

  A. SSID broadcast
  B. MAC filter
  C. WPA2
  D. Antenna placement
  A. SSID broadcast

  ---

  Numerous networks broadcast their name (known as an SSID broadcast) to reveal their presence.