CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 521:

  A network administrator, Joe, arrives at his new job to find that none of the users have changed their network passwords since they were initially hired. Joe wants to have everyone change their passwords immediately. Which of the following policies should be enforced to initiate a password change?

  A. Password expiration
  B. Password reuse
  C. Password recovery
  D. Password disablement
  A. Password expiration

  ---

  The Maximum password age policy setting determines the number of days that a password can be used before the system requires the user to change it. The password expiration setting determines that a user will not be able to log into a system without changing their password after the maximum password age has been reached.

• Question 522:

  An administrator has successfully implemented SSL on srv4.comptia.com using wildcard certificate *.comptia.com, and now wishes to implement SSL on srv5.comptia.com. Which of the following files should be copied from srv4 to accomplish this?

  A. certificate, private key, and intermediate certificate chain
  B. certificate, intermediate certificate chain, and root certificate
  C. certificate, root certificate, and certificate signing request
  D. certificate, public key, and certificate signing request
  A. certificate, private key, and intermediate certificate chain

  ---

  a wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. In public-key cryptography, the receiver has a private key known only to them; a public key corresponds to it, which they make known to others. The public key can be sent to all other parties; the private key is never divulged. A symmetric algorithm requires that receivers of the message use the same private key. Thus you should copy the certificate, the private key and the intermediate certificate chain from srv4 to srv5.

• Question 523:

  The security administrator at ABC company received the following log information from an external party:

  10:45:01 EST, SRC 10.4.3.7:3056, DST 8.4.2.1:80, ALERT, Directory traversal

  10:45:02 EST, SRC 10.4.3.7:3057, DST 8.4.2.1:80, ALERT, Account brute force

  10:45:03

  EST, SRC 10.4.3.7:3058, DST 8.4.2.1:80, ALERT, Port scan

  The external party is reporting attacks coming from abc-company.com. Which of the following is the reason the ABC company's security administrator is unable to determine the origin of the attack?

  A. A NIDS was used in place of a NIPS.
  B. The log is not in UTC.
  C. The external party uses a firewall.
  D. ABC company uses PAT.
  D. ABC company uses PAT.

  ---

  PAT would ensure that computers on ABC's LAN translate to the same IP address, but with a different port number assignment. The log information shows the IP address, not the port number, making it impossible to pin point the exact source.

• Question 524:

  A security administrator wishes to implement a secure a method of file transfer when communicating with outside organizations. Which of the following protocols would BEST facilitate secure file transfers? (Select TWO)

  A. SCP
  B. TFTP
  C. SNMP
  D. FTP
  E. SMTP
  F. FTPS
  A. SCP
  F. FTPS

• Question 525:

  During an office move a sever containing the employee information database will be shut down and transported to a new location. Which of the following would BEST ensure the availability of the employee database should happen to the server during the move?

  A. The contents of the database should be encrypted; the encryption key should be stored off-site
  B. A hash of the database should be taken and stored on an external drive prior to the move
  C. The database should be placed on a drive that consists of a RAID array prior to the move
  D. A backup of the database should be stored on an external hard drive prior to the move
  D. A backup of the database should be stored on an external hard drive prior to the move

• Question 526:

  A supervisor in the human resources department has been given additional job duties in the accounting department. Part of their new duties will be to check the daily balance sheet calculations on spreadsheets that are restricted to the accounting group. In which of the following ways should the account be handled?

  A. The supervisor should be allowed to have access to the spreadsheet files, and their membership in the human resources group should be terminated.
  B. The supervisor should be removed from the human resources group and added to the accounting group.
  C. The supervisor should be added to the accounting group while maintaining their membership in the human resources group.
  D. The supervisor should only maintain membership in the human resources group.
  C. The supervisor should be added to the accounting group while maintaining their membership in the human resources group.

  ---

  You can assign permissions to access resources either to a user or a group. The most efficient way is to assign permissions to a group (group based privileges). By assigning the human resources supervisor's user account to the group means the supervisor will inherit the permissions of that group, and allow him to carry out the new duties. Because the new duties are being added to his normal duties, maintaining membership in the human resources group will allow the supervisor to continue performing his normal duties.

• Question 527:

  Which of the following devices would be MOST useful to ensure availability when there are a large number of requests to a certain website?

  A. Protocol analyzer
  B. Load balancer
  C. VPN concentrator
  D. Web security gateway
  B. Load balancer

  ---

  Load balancing refers to shifting a load from one device to another. A load balancer can be implemented as a software or hardware solution, and it is usually associated with a device--a router, a firewall, NAT appliance, and so on. In its most common implementation, a load balancer splits the traffic intended for a website into individual requests that are then rotated to redundant servers as they become available.

• Question 528:

  The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as which of the following?

  A. Stream ciphers
  B. Transport encryption
  C. Key escrow
  D. Block ciphers
  B. Transport encryption

  ---

  Transport encryption is the process of encrypting data ready to be transmitted over an insecure network. A common example of this would be online banking or online purchases where sensitive information such as account numbers or credit card numbers is transmitted.

  Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL).

• Question 529:

  Ann, a security administrator, wishes to replace their RADIUS authentication with a more secure protocol, which can utilize EAP. Which of the following would BEST fit her objective?

  A. CHAP
  B. SAML
  C. Kerberos
  D. Diameter
  D. Diameter

  ---

  Diameter is an authentication, authorization, and accounting protocol that replaces the RADIUS protocol. Diameter Applications extend the base protocol by including new commands and/or attributes, such as those for use of the Extensible Authentication Protocol (EAP).

• Question 530:

  The sales force in an organization frequently travel to remote sites and requires secure access to an internal server with an IP address of 192.168.0.220. Assuming services are using default ports, which of the following firewall rules would accomplish this objective? (Select Two)

  A. Permit TCP 20 any 192.168.0.200
  B. Permit TCP 21 any 192.168.0.200
  C. Permit TCP 22 any 192.168.0.200
  D. Permit TCP 110 any 192.168.0.200
  E. Permit TCP 139 any 192.168.0.200
  F. Permit TCP 3389 any 192.168.0.200
  C. Permit TCP 22 any 192.168.0.200
  F. Permit TCP 3389 any 192.168.0.200