CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 601:

  Joe, a technician, is working remotely with his company provided laptop at the coffee shop near his home. Joe is concerned that another patron of the coffee shop may be trying to access his laptop. Which of the following is an appropriate control to use to prevent the other patron from accessing Joe's laptop directly?

  A. full-disk encryption
  B. Host-based firewall
  C. Current antivirus definitions
  D. Latest OS updates
  B. Host-based firewall

• Question 602:

  Which of the following is the MOST intrusive type of testing against a production system?

  A. White box testing
  B. War dialing
  C. Vulnerability testing
  D. Penetration testing
  D. Penetration testing

  ---

  Penetration testing is the most intrusive type of testing because you are actively trying to circumvent the system's security controls to gain access to the system. Penetration testing (also called pen testing) is the practice of testing a computer

  system, network or Web application to find vulnerabilities that an attacker could exploit. Pen tests can be automated with software applications or they can be performed manually. Either way, the process includes gathering information about

  the target before the test (reconnaissance), identifying possible entry points, attempting to break in (either virtually or for real) and reporting back the findings.

  The main objective of penetration testing is to determine security weaknesses. A pen test can also be used to test an organization's security policy compliance, its employees' security awareness and the organization's ability to identify and

  respond to security incidents.

  Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in.

  Pen test strategies include:

  Targeted testing

  Targeted testing is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a "lights-turned-on" approach because everyone can see the test being carried out.

  External testing

  This type of pen test targets a company's externally visible servers or devices including domain name servers (DNS), e-mail servers, Web servers or firewalls. The objective is to find out if an outside attacker can get in and how far they can

  get in once they've gained access.

  Internal testing

  This test mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause.

  Blind testing

  A blind test strategy simulates the actions and procedures of a real attacker by severely limiting the information given to the person or team that's performing the test beforehand. Typically, they may only be given the name of the company.

  Because this type of test can require a considerable amount of time for reconnaissance, it can be expensive.

  Double blind testing

  Double blind testing takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double-blind tests can be useful for testing an organization's

  security monitoring and incident identification as well as its response procedures.

• Question 603:

  A user contacts the help desk after being unable to log in to a corporate website. The user can log into the site from another computer in the next office, but not from the PC. The user's PC was able to connect earlier in the day. The help desk has user restart the NTP service. Afterwards the user is able to log into the website. The MOST likely reason for the initial failure was that the website was configured to use which of the following authentication mechanisms?

  A. Secure LDAP
  B. RADIUS
  C. NTLMv2
  D. Kerberos
  D. Kerberos

• Question 604:

  During a code review a software developer discovers a security risk that may result in hundreds of hours of rework. The security team has classified these issues as low risk. Executive management has decided that the code will not be rewritten. This is an example of:

  A. Risk avoidance
  B. Risk transference
  C. Risk mitigation
  D. Risk acceptance
  D. Risk acceptance

• Question 605:

  A software developer places a copy of the source code for a sensitive internal application on a company laptop to work remotely. Which of the following policies is MOST likely being violated?

  A. Clean desk
  B. Data handling
  C. Chain of custody
  D. Social media
  B. Data handling

• Question 606:

  Which of the following is the LEAST volatile when performing incident response procedures?

  A. Registers
  B. RAID cache
  C. RAM
  D. Hard drive
  D. Hard drive

  ---

  An example of OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts. Of the options stated in the question the hard drive would be the least volatile.

• Question 607:

  Ann, the security administrator, received a report from the security technician, that an unauthorized new user account was added to the server over two weeks ago. Which of the following could have mitigated this event?

  A. Routine log audits
  B. Job rotation
  C. Risk likelihood assessment
  D. Separation of duties
  A. Routine log audits

  ---

  When a new user account is created, an entry is added to the Event Logs. By routinely auditing the event logs, you would know that an account has been created.

• Question 608:

  A server dedicated to the storage and processing of sensitive information was compromised with a rootkit and sensitive data was extracted. Which of the following incident response procedures is best suited to restore the server?

  A. Wipe the storage, reinstall the OS from original media and restore the data from the last known good backup.
  B. Keep the data partition, restore the OS from the most current backup and run a full system antivirus scan.
  C. Format the storage and reinstall both the OS and the data from the most current backup.
  D. Erase the storage, reinstall the OS from most current backup and only restore the data that was not compromised.
  A. Wipe the storage, reinstall the OS from original media and restore the data from the last known good backup.

  ---

  Rootkits are software programs that have the ability to hide certain things from the operating system. With a rootkit, there may be a number of processes running on a system that do not show up in Task Manager or connections established or available that do not appear in a netstat display--the rootkit masks the presence of these items. The rootkit is able to do this by manipulating function calls to the operating system and filtering out information that would normally appear. Theoretically, rootkits could hide anywhere that there is enough memory to reside: video cards, PCI cards, and the like. The best way to handle this situation is to wipe the server and reinstall the operating system with the original installation disks and then restore the extracted data from your last known good backup. This way you can eradicate the rootkit and restore the data.

• Question 609:

  Which of the following use the SSH protocol?

  A. Stelnet
  B. SCP
  C. SNMP
  D. FTPS
  E. SSL
  F. SFTP
  B. SCP
  F. SFTP

• Question 610:

  Which of the following is the GREATEST security concern of allowing employees to bring in their personally owned tablets and connecting to the corporate network?

  A. Tablet network connections are stored and accessible from the corporate network
  B. The company's attack surface increases with the non-corporate devices
  C. Personally purchased media may be available on the network for others to stream
  D. Encrypted tablets are harder to access to determine if they are infected
  C. Personally purchased media may be available on the network for others to stream