CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 581:

  A security administrator must implement a system to ensure that invalid certificates are not used by a custom developed application. The system must be able to check the validity of certificates even when internet access is unavailable. Which of the following MUST be implemented to support this requirement?

  A. CSR
  B. OCSP
  C. CRL
  D. SSH
  C. CRL

• Question 582:

  A company is concerned that a compromised certificate may result in a man-in-the-middle attack against backend financial servers. In order to minimize the amount of time a compromised certificate would be accepted by other servers, the company decides to add another validation step to SSL/TLS connections. Which of the following technologies provides the FASTEST revocation capability?

  A. Online Certificate Status Protocol (OCSP)
  B. Public Key Cryptography (PKI)
  C. Certificate Revocation Lists (CRL)
  D. Intermediate Certificate Authority (CA)
  A. Online Certificate Status Protocol (OCSP)

  ---

  CRL (Certificate Revocation List) was first released to allow the CA to revoke certificates, however due to limitations with this method it was succeeded by OSCP. The main advantage to OCSP is that because the client is allowed query the status of a single certificate, instead of having to download and parse an entire list there is much less overhead on the client and network.

• Question 583:

  Joe a computer forensic technician responds to an active compromise of a database server. Joe first collects information in memory, then collects network traffic and finally conducts an image of the hard drive. Which of the following procedures did Joe follow?

  A. Order of volatility
  B. Chain of custody
  C. Recovery procedure
  D. Incident isolation
  A. Order of volatility

• Question 584:

  A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has been removed from the network and an image of the hard drive has been created. However, the system administrator stated that the system was left unattended for several hours before the image was created. In the event of a court case, which of the following is likely to be an issue with this incident?

  A. Eye Witness
  B. Data Analysis of the hard drive
  C. Chain of custody
  D. Expert Witness
  C. Chain of custody

  ---

  Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. The evidence must always be within your custody, or you're open to dispute about possible evidence tampering.

• Question 585:

  A company would like to prevent the use of a known set of applications from being used on company computers. Which of the following should the security administrator implement?

  A. Whitelisting
  B. Anti-malware
  C. Application hardening
  D. Blacklisting
  E. Disable removable media
  D. Blacklisting

• Question 586:

  A process in which the functionality of an application is tested without any knowledge of the internal mechanisms of the application is known as:

  A. Black box testing
  B. White box testing
  C. Black hat testing
  D. Gray box testing
  A. Black box testing

  ---

  Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings. This method of test can be applied to virtually every level of software testing: unit,

  integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well.

  Specific knowledge of the application's code/internal structure and programming knowledge in general is not required. The tester is aware of what the software is supposed to do but is not aware of how it does it. For instance, the tester is

  aware that a particular input returns a certain, invariable output but is not aware of how the software produces the output in the first place.

• Question 587:

  An investigator recently discovered that an attacker placed a remotely accessible CCTV camera in a public area overlooking several Automatic Teller Machines (ATMs). It is also believed that user accounts belonging to ATM operators may have been compromised. Which of the following attacks has MOST likely taken place?

  A. Shoulder surfing
  B. Dumpster diving
  C. Whaling attack
  D. Vishing attack
  A. Shoulder surfing

  ---

  The CCTV camera has recorded people entering their PINs in the ATMs. This is known as shoulder surfing.

  Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand.

• Question 588:

  A new virtual server was created for the marketing department. The server was installed on an existing host machine. Users in the marketing department report that they are unable to connect to the server. Technicians verify that the server has an IP address in the same VLAN as the marketing department users. Which of the following is the MOST likely reason the users are unable to connect to the server?

  A. The new virtual server's MAC address was not added to the ACL on the switch
  B. The new virtual server's MAC address triggered a port security violation on the switch
  C. The new virtual server's MAC address triggered an implicit deny in the switch
  D. The new virtual server's MAC address was not added to the firewall rules on the switch
  A. The new virtual server's MAC address was not added to the ACL on the switch

  ---

  Configuring the switch to allow only traffic from computers based upon their physical address is known as MAC filtering. The physical address is known as the MAC address. Every network adapter has a unique MAC address hardcoded into the adapter. You can configure the ports of a switch to allow connections from computers with specific MAC addresses only and block all other MAC addresses. In computer networking, MAC Filtering (or GUI filtering, or layer 2 address filtering) refers to a security access control method whereby the 48-bit address assigned to each network card is used to determine access to the network. MAC addresses are uniquely assigned to each card, so using MAC filtering on a network permits and denies network access to specific devices through the use of blacklists and whitelists. While the restriction of network access through the use of lists is straightforward, an individual person is not identified by a MAC address, rather a device only, so an authorized person will need to have a whitelist entry for each device that he or she would use to access the network.

• Question 589:

  An SSL/TLS private key is installed on a corporate web proxy in order to inspect HTTPS requests. Which of the following describes how this private key should be stored so that it is protected from theft?

  A. Implement full disk encryption
  B. Store on encrypted removable media
  C. Utilize a hardware security module
  D. Store on web proxy file system
  C. Utilize a hardware security module

  ---

  Hardware Security Module (HSM) hardware-based encryption solution that is usually used in conjunction with PKI to enhance security with certification authorities (CAs). It is available as an expansion card and can cryptographic keys, passwords, or certificates.

• Question 590:

  Which of the following security devices can be replicated on a Linux based computer using IP tables to inspect and properly handle network based traffic?

  A. Sniffer
  B. Router
  C. Firewall
  D. Switch
  C. Firewall

  ---

  Ip tables are a user-space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall and the chains and rules it stores.