CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 621:

  An attacker crafts a message that appears to be from a trusted source, but in reality it redirects the recipient to a malicious site where information is harvested. The message is narrowly tailored so it is effective on only a small number of victims. This describes which of the following?

  A. Spear phishing
  B. Phishing
  C. Smurf attack
  D. Vishing
  A. Spear phishing

  ---

  Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority.

• Question 622:

  Ann a security technician receives a report from a user that is unable to access an offsite SSN server. Ann checks the firewall and sees the following rules:

  Allow TCP 80

  Allow TCP 443

  Deny TCP 23

  Deny TCP 20

  Deny TCP 21

  Which of the following is preventing the users from accessing the SSH server?

  A. Deny TCP 20
  B. Deny TCP 21
  C. Deny TCP 23
  D. Implicit deny
  D. Implicit deny

• Question 623:

  Which of the following is the LEAST secure hashing algorithm?

  A. SHA-1
  B. RIPEMD
  C. MD5
  D. DES
  C. MD5

• Question 624:

  In order to secure additional budget, a security manager wants to quantify the financial impact of a one-time compromise. Which of the following is MOST important to the security manager?

  A. Impact
  B. SLE
  C. ALE
  D. ARO
  B. SLE

  ---

  SLE is a monetary value, and it represents how much you expect to lose at any one time:

  the single loss expectancy. SLE can be divided into two components: AV (asset value) and the EF (exposure factor). Thus a one-time compromise would resort under the SLE for the security manager.

• Question 625:

  Which of the following concepts is used by digital signatures to ensure integrity of the data?

  A. Non-repudiation
  B. Hashing
  C. Transport encryption
  D. Key escrow
  B. Hashing

  ---

  Most digital signature implementations also use a hash to verify that the message has not been altered, intentionally or accidently, in transit.

• Question 626:

  Which of the following is the FIRST step in a forensics investigation when a breach of a client's workstation has been confirmed?

  A. Transport the workstation to a secure facility
  B. Analyze the contents of the hard drive
  C. Restore any deleted files and / or folders
  D. Make a bit-for-bit copy of the system
  D. Make a bit-for-bit copy of the system

• Question 627:

  After a network outage, a PC technician is unable to ping various network devices. The network administrator verifies that those devices are working properly and can be accessed securely. Which of the following is the MOST likely reason the PC technician is unable to ping those devices?

  A. ICMP is being blocked
  B. SSH is not enabled
  C. DNS settings are wrong
  D. SNMP is not configured properly
  A. ICMP is being blocked

  ---

  ICMP is a protocol that is commonly used by tools such as ping, traceroute, and pathping. ICMP offers no information If ICMP request queries go unanswered, or ICMP replies are lost or blocked.

• Question 628:

  Ann, the software security engineer, works for a major software vendor. Which of the following practices should be implemented to help prevent race conditions, buffer overflows, and other similar vulnerabilities prior to each production release?

  A. Product baseline report
  B. Input validation
  C. Patch regression testing
  D. Code review
  D. Code review

  ---

  The problems listed in this question can be caused by problems with the application code. Reviewing the code will help to prevent the problems. The purpose of code review is to look at all custom written code for holes that may exist. The review needs also to examine changes that the code--most likely in the form of a finished application--may make: configuration files, libraries, and the like. During this examination, look for threats such as opportunities for injection to occur (SQL, LDAP, code, and so on), cross-site request forgery, and authentication. Code review is often conducted as a part of gray box testing. Looking at source code can often be one of the easiest ways to find weaknesses within the application. Simply reading the code is known as manual assessment, whereas using tools to scan the code is known as automated assessment.

• Question 629:

  Given the log output:

  Max 15 00:15:23.431 CRT: #SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: msmith] [Source: 10.0.12.45]

  [localport: 23] at 00:15:23:431 CET Sun Mar 15 2015

  Which of the following should the network administrator do to protect data security?

  A. Configure port security for logons
  B. Disable telnet and enable SSH
  C. Configure an AAA server
  D. Disable password and enable RSA authentication
  B. Disable telnet and enable SSH

• Question 630:

  A company has several public conference room areas with exposed network outlets. In the past, unauthorized visitors and vendors have used the outlets for internet access. The help desk manager does not want the outlets to be disabled due to the number of training sessions in the conference room and the amount of time it takes to get the ports either patched in or enabled. Which of the following is the best option for meeting this goal?

  A. Flood guards
  B. Port security
  C. 802.1x
  D. Loop protection
  E. IPSec
  C. 802.1x