CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 531:

  Pete, the system administrator, wants to restrict access to advertisements, games, and gambling web sites. Which of the following devices would BEST achieve this goal?

  A. Firewall
  B. Switch
  C. URL content filter
  D. Spam filter
  C. URL content filter

  ---

  URL filtering, also known as web filtering, is the act of blocking access to a site based on all or part of the URL used to request access. URL filtering can focus on all or part of a fully qualified domain name (FQDN), specific path names, specific filenames, specific fi le extensions, or entire specific URLs. Many URL-filtering tools can obtain updated master URL block lists from vendors as well as allow administrators to add or remove URLs from a custom list.

• Question 532:

  A company wants to ensure that all credentials for various systems are saved within a central database so that users only have to login once for access to all systems. Which of the following would accomplish this?

  A. Multi-factor authentication
  B. Smart card access
  C. Same Sign-On
  D. Single Sign-On
  D. Single Sign-On

  ---

  Single sign-on means that once a user (or other subject) is authenticated into a realm, re- authentication is not required for access to resources on any realm entity. Single sign-on is able to internally translate and store credentials for the various mechanisms, from the credential used for original authentication.

• Question 533:

  Security administrator receives reports from various organizations that a system on the company network is port scanning hosts on various networks across the internet. The administrator determines that the compromised system is a Linux host and notifies the owner that the system will be quarantined and isolated from the network. The system does not contain confidential data, and the root user was not compromised. The administrator would like to know how the system was compromised, what the attackers did, and what remnants he attackers may have left behind. Which of the following are the administrator's NEXT steps in the investigation? (Select Two)

  A. Reinstall the procps package in case system utilities were modified
  B. Look for recent modified files in user and tmp directions
  C. Switch SELinux to enforcing mode and reboot
  D. Monitor perimeter firewall for suspicious traffic from the system
  E. Check running processes and kernel modules
  F. Remove unnecessary accounts and services
  C. Switch SELinux to enforcing mode and reboot
  D. Monitor perimeter firewall for suspicious traffic from the system

• Question 534:

  An administrator wants to configure a switch port so that it separates voice and data traffic. Which of the following MUST be configured on the switch port to enforce separation of traffic?

  A. DMZ
  B. VLAN
  C. Subnetting
  D. NAC
  B. VLAN

• Question 535:

  An administrator discovers the following log entry on a server.

  Nov 12 2013 00:23:45 httpd[2342]: /app2/prod/process.php?input=change.cd%20./././ect: cat%20shadow

  Which of the following attacks is being attempted?

  A. Command injection
  B. Password attack
  C. Buffer overflow
  D. Cross-site scripting
  B. Password attack

• Question 536:

  The chief Security Officer (CSO) has reported a rise in data loss but no break ins have occurred. By doing which of the following is the CSO most likely to reduce the number of incidents?

  A. Implement protected distribution
  B. Empty additional firewalls
  C. Conduct security awareness training
  D. Install perimeter barricades
  A. Implement protected distribution

• Question 537:

  Which of the following design components is used to isolate network devices such as web servers?

  A. VLAN
  B. VPN
  C. NAT
  D. DMZ
  D. DMZ

• Question 538:

  Pete, the system administrator, wishes to monitor and limit users' access to external websites.

  Which of the following would BEST address this?

  A. Block all traffic on port 80.
  B. Implement NIDS.
  C. Use server load balancers.
  D. Install a proxy server.
  D. Install a proxy server.

  ---

  A proxy is a device that acts on behalf of other(s). In the interest of security, all internal user interaction with the Internet should be controlled through a proxy server. The proxy server should automatically block known malicious sites. The proxy server should cache often-accessed sites to improve performance.

• Question 539:

  A security administrator must implement a wireless security system, which will require users to enter a 30 character ASCII password on their accounts. Additionally the system must support 3DS wireless encryption. Which of the following should be implemented?

  A. WPA2-CCMP with 802.1X
  B. WPA2-PSK
  C. WPA2-CCMP
  D. WPA2-Enterprise
  D. WPA2-Enterprise

  ---

  D: WPA-Enterprise is also referred to as WPA-802.1X mode, and sometimes just WPA (as opposed to WPA-PSK), this is designed for enterprise networks and requires a RADIUS authentication server. This requires a more complicated setup, but provides additional security (e.g. protection against dictionary attacks on short passwords). Various kinds of the Extensible Authentication Protocol (EAP) are used for authentication. RADIUS can be managed centrally, and the servers that allow access to a network can verify with a RADIUS server whether an incoming caller is authorized. Thus the RADIUS server can perform all authentications. This will require users to use their passwords on their user accounts.

• Question 540:

  An administrator finds that non-production servers are being frequently compromised, production servers are rebooting at unplanned times and kernel versions are several releases behind the version with all current security fixes. Which of the following should the administrator implement?

  A. Snapshots
  B. Sandboxing
  C. Patch management
  D. Intrusion detection system
  C. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities.