CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 51:

  Joe has hired several new security administrators and have been explaining the4 design of the company's network. He has described the position and descriptions of the company's firewalls, IDS sensors, antivirus server, DMZs, and HIPS. Which of the following best describes the incorporation of these elements?

  A. Load balancers
  B. Defense in depth
  C. Network segmentation
  D. UTM security appliance
  B. Defense in depth

• Question 52:

  A company's BYOD policy requires the installation of a company provide mobile agent on their on their personally owned devices which would allow auditing when an employee wants to connect a device to the corporate email system. Which of the following concerns will MOST affect the decision to use a personal device to receive company email?

  A. Personal privacy
  B. Email support
  C. Data ownership
  D. Service availability
  A. Personal privacy

• Question 53:

  A network administrator has purchased two devices that will act as failovers for each other. Which of the following concepts does this BEST illustrate?

  A. Authentication
  B. Integrity
  C. Confidentiality
  D. Availability
  D. Availability

  ---

  Failover refers to the process of reconstructing a system or switching over to other systems when a failure is detected. In the case of a server, the server switches to a redundant server when a fault is detected. This strategy allows service to continue uninterrupted until the primary server can be restored. In the case of a network, this means processing switches to another network path in the event of a network failure in the primary path. This means availability.

• Question 54:

  A user Ann has her assigned token but she forgotten her password. Which of the following appropriately categorizes the authentication factor that will fail in this scenario?

  A. Something you do
  B. Something you know
  C. Something you are
  D. Something you have
  B. Something you know

• Question 55:

  Which of the following would provide the MOST objective results when performing penetration testing for an organization?

  A. An individual from outside the organization would be more familiar with the system
  B. AN inside support staff member would know more about how the system could be compromised
  C. An outside company would be less likely to skew the results in favor if the organization
  D. An outside support staff member would be more likely to report accurate results due to familiarity with the system
  C. An outside company would be less likely to skew the results in favor if the organization

• Question 56:

  Joe, the security administrator, sees this in a vulnerability scan report:

  'The server 10.1..2.232 is running Apache 2.2.20 which may be vulnerabel to a mod_cgi exploit."

  Joe verifies that mod_cgi module is not enabled on 10.1.2.232. This message is an example of

  A. a threat
  B. a risk
  C. a false negative
  D. a false positive
  D. a false positive

• Question 57:

  An administrator notices that former temporary employees' accounts are still active on a domain.

  Which of the following can be implemented to increase security and prevent this from happening?

  A. Implement a password expiration policy.
  B. Implement an account expiration date for permanent employees.
  C. Implement time of day restrictions for all temporary employees.
  D. Run a last logon script to look for inactive accounts.
  D. Run a last logon script to look for inactive accounts.

  ---

  You can run a script to return a list of all accounts that haven't been used for a number of days, for example 30 days. If an account hasn't been logged into for 30 days, it's a safe bet that the user the account belonged to is no longer with the company. You can then disable all the accounts that the script returns. A disabled account cannot be used to log in to a system. This is a good security measure. As soon as an employee leaves the company, the employees account should always be disabled.

• Question 58:

  A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.

  Select and Place:

  

  

  ---

  When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone.

  Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and

  printouts.

  Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and

  expenses associated with the investigation.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, p. 453

• Question 59:

  Users need to exchange a shared secret to begin communicating securely. Which of the following is another name for this symmetric key?

  A. Session Key
  B. Public Key
  C. Private Key
  D. Digital Signature
  C. Private Key

  ---

  Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. A symmetric key, sometimes referred to as a secret key or private key, is a key that isn't disclosed to people who aren't authorized to use the encryption system.

• Question 60:

  Pete, the security administrator, has been notified by the IDS that the company website is under attack. Analysis of the web logs show the following string, indicating a user is trying to post a comment on the public bulletin board.

  INSERT INTO message `

  This is an example of which of the following?

  A. XSS attack
  B. XML injection attack
  C. Buffer overflow attack
  D. SQL injection attack
  A. XSS attack

  ---

  The tags indicate that script is being inserted. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access- privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user.