CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 631:

  A company's application is hosted at a data center. The data center provides security controls for the infrastructure. The data center provides a report identifying serval vulnerabilities regarding out of date OS patches. The company recommends the data center assumes the risk associated with the OS vulnerabilities. Which of the following concepts is being implemented?

  A. Risk Transference
  B. Risk Acceptance
  C. Risk Avoidance
  D. Risk Deterrence
  A. Risk Transference

• Question 632:

  In intrusion detection system vernacular, which account is responsible for setting the security policy for an organization?

  A. Supervisor
  B. Administrator
  C. Root
  D. Director
  B. Administrator

  ---

  The administrator is the person responsible for setting the security policy for an organization and is responsible for making decisions about the deployment and configuration of the IDS.

• Question 633:

  Which of the following is BEST utilized to identify common misconfigurations throughout the enterprise?

  A. Vulnerability scanning
  B. Port scanning
  C. Penetration testing
  D. Black box
  A. Vulnerability scanning

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates.

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security.

• Question 634:

  Company A sends a PGP encrypted file to company B. If company A used company B's public key to encrypt the file, which of the following should be used to decrypt data at company B?

  A. Registration
  B. Public key
  C. CRLs
  D. Private key
  D. Private key

  ---

  In a PKI the sender encrypts the data using the receiver's public key. The receiver decrypts the data using his own private key.

  PKI is a two-key, asymmetric system with four main components: certificate authority (CA), registration authority (RA), RSA (the encryption algorithm), and digital certificates. Messages are encrypted with a public key and decrypted with a

  private key.

  A PKI example:

  You want to send an encrypted message to Jordan, so you request his public key.

  Jordan responds by sending you that key.

  You use the public key he sends you to encrypt the message.

  You send the message to him.

  Jordan uses his private key to decrypt the message.

• Question 635:

  Which of the following malware types may require user interaction, does not hide itself, and is commonly identified by marketing pop-ups based on browsing habits?

  A. Botnet
  B. Rootkit
  C. Adware
  D. Virus
  C. Adware

  ---

  Adware is free software that is supported by advertisements. Common adware programs are toolbars, games and utilities. They are free to use, but require you to watch advertisements as long as the programs are open. Adware typically requires an active Internet connection to run.

• Question 636:

  Which of the following metrics is important for measuring the extent of data required during backup and recovery?

  A. MOU
  B. ARO
  C. ALE
  D. RPO
  C. ALE

• Question 637:

  Which of the following is replayed during wireless authentication to exploit a weak key infrastructure?

  A. Preshared keys
  B. Ticket exchange
  C. Initialization vectors
  D. Certificate exchange
  B. Ticket exchange

• Question 638:

  Company XYZ's laptops was recently stolen from a user which led to the exposure if confidential information. Which of the following should the security team implement on laptops to prevent future compromise?

  A. Cipher locks
  B. Strong passwords
  C. Biometrics
  D. Full Disk Encryption
  D. Full Disk Encryption

• Question 639:

  A network administrator recently updated various network devices to ensure redundancy throughout the network. If an interface on any of the Layer 3 devices were to go down, traffic will still pass through another interface and the production environment would be unaffected. This type of configuration represents which of the following concepts?

  A. High availability
  B. Load balancing
  C. Backout contingency plan
  D. Clustering
  A. High availability

  ---

  High availability (HA) refers to the measures used to keep services and systems operational during an outage. In short, the goal is to provide all services to all users, where they need them and when they need them. With high availability, the goal is to have key services available 99.999 percent of the time (also known as five nines availability).

• Question 640:

  A security administrator at a company which implements key escrow and symmetric encryption only, needs to decrypt an employee's file. The employee refuses to provide the decryption key to the file. Which of the following can the administrator do to decrypt the file?

  A. Use the employee's private key
  B. Use the CA private key
  C. Retrieve the encryption key
  D. Use the recovery agent
  C. Retrieve the encryption key

  ---

  Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question.