CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 611:

  To ensure proper evidence collection, which of the following steps should be performed FIRST?

  A. Take hashes from the live system
  B. Review logs
  C. Capture the system image
  D. Copy all compromised files
  C. Capture the system image

  ---

  Capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it. This is essential since the collection of evidence process may result in some mishandling and changing the exploited state.

• Question 612:

  Sara, the security administrator, must configure the corporate firewall to allow all public IP addresses on the internal interface of the firewall to be translated to one public IP address on the external interface of the same firewall. Which of the following should Sara configure?

  A. PAT
  B. NAP
  C. DNAT
  D. NAC
  A. PAT

  ---

  Port Address Translation (PAT), is an extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be mapped to a single public IP address. The goal of PAT is to conserve IP addresses.

  Most home networks use PAT. In such a scenario, the Internet Service Provider (ISP) assigns a single IP address to the home network's router. When Computer X logs on the Internet, the router assigns the client a port number, which is appended to the internal IP address. This, in effect, gives Computer X a unique address. If Computer Z logs on the Internet at the same time, the router assigns it the same local IP address with a different port number. Although both computers are sharing the same public IP address and accessing the Internet at the same time, the router knows exactly which computer to send specific packets to because each computer has a unique internal address.

• Question 613:

  Which of the following should an administrator implement to research current attack methodologies?

  A. Design reviews
  B. Honeypot
  C. Vulnerability scanner
  D. Code reviews
  B. Honeypot

  ---

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

  According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:

  The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the

  system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.

  There are two main types of honeypots:

  Production - A production honeypot is one used within an organization's environment to help mitigate risk.

  Research ?A research honeypot add value to research in computer security by providing a platform to study the threat.

• Question 614:

  Joe, the security administrator, has determined that one of his web servers is under attack. Which of the following can help determine where the attack originated from?

  A. Capture system image
  B. Record time offset
  C. Screenshots
  D. Network sniffing
  D. Network sniffing

  ---

  Network sniffing is the process of capturing and analyzing the packets sent between systems on the network. A network sniffer is also known as a Protocol Analyzer. A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing and analyzing the packets sent to the web server will help determine the source IP address of the system sending the packets. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal).

• Question 615:

  When performing the daily review of the system vulnerability scans of the network Joe, the administrator, noticed several security related vulnerabilities with an assigned vulnerability identification number. Joe researches the assigned vulnerability identification number from the vendor website. Joe proceeds with applying the recommended solution for identified vulnerability.

  Which of the following is the type of vulnerability described?

  A. Network based
  B. IDS
  C. Signature based
  D. Host based
  C. Signature based

  ---

  A signature-based monitoring or detection method relies on a database of signatures or patterns of known malicious or unwanted activity. The strength of a signature-based system is that it can quickly and accurately detect any event from its database of signatures.

• Question 616:

  Devices on the SCADA network communicate exclusively at Layer 2. Which of the following should be used to prevent unauthorized systems using ARP-based attacks to compromise the SCADA network?

  A. Application firewall
  B. IPSec
  C. Hardware encryption
  D. VLANS
  B. IPSec

• Question 617:

  Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from someone claiming to be from the helpdesk. The caller is asking to verify her network authentication credentials because her computer is broadcasting across the network. This is MOST likely which of the following types of attacks?

  A. Vishing
  B. impersonation
  C. Spim
  D. Scareware
  A. Vishing

• Question 618:

  A company has two server administrators that work overnight to apply patches to minimize disruption to the company. With the limited working staff, a security engineer performs a risk assessment to ensure the protection controls are in place to monitor all assets including the administrators in case of an emergency. Which of the following should be in place?

  A. NIDS
  B. CCTV
  C. Firewall
  D. NIPS
  B. CCTV

  ---

  CCTV are an excellent way to deter unwanted activity and it records the occurrence of the event, in case it does happen. Cameras can be placed to watch points of entry, to monitor activities around valuable assets as well as provide additional protection in areas such as parking areas and walkways.

• Question 619:

  Which of the following is an application security coding problem?

  A. Error and exception handling
  B. Patch management
  C. Application hardening
  D. Application fuzzing
  A. Error and exception handling

  ---

  Exception handling is an aspect of secure coding. When errors occur, the system should revert back to a secure state. This must be coded into the system by the programmer, and should capture errors and exceptions so that they could be handled by the application.

• Question 620:

  In an environment where availability is critical such as Industrial control and SCADA networks, which of the following technologies in the MOST critical layer of defense for such systems?

  A. Log consolidation
  B. Intrusion Prevention system
  C. Automated patch deployment
  D. Antivirus software
  B. Intrusion Prevention system