CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 691:

  Which of the following is the difference between identification and authentication of a user?

  A. Identification tells who the user is and authentication tells whether the user is allowed to logon to a system.
  B. Identification tells who the user is and authentication proves it.
  C. Identification proves who the user is and authentication is used to keep the users data secure.
  D. Identification proves who the user is and authentication tells the user what they are allowed to do.
  B. Identification tells who the user is and authentication proves it.

  ---

  Identification is described as the claiming of an identity, and authentication is described as the act of verifying or proving the claimed identity.

• Question 692:

  Which of the following controls can be used to prevent the disclosure of sensitive information stored on a mobile device's removable media in the event that the device is lost or stolen?

  A. Hashing
  B. Screen locks
  C. Device password
  D. Encryption
  D. Encryption

  ---

  Encryption is used to ensure the confidentiality of information.

• Question 693:

  A system administrator wants to confidentially send a user name and password list to an individual outside the company without the information being detected by security controls. Which of the following would BEST meet this security goal?

  A. Digital signatures
  B. Hashing
  C. Full-disk encryption
  D. Steganography
  D. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video.

  Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse

  interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a

  secret message is being sent, as well as concealing the contents of the message.

• Question 694:

  A network consists of various remote sites that connect back to two main locations. Pete, the security administrator, needs to block TELNET access into the network. Which of the following, by default, would be the BEST choice to accomplish this goal?

  A. Block port 23 on the L2 switch at each remote site
  B. Block port 23 on the network firewall
  C. Block port 25 on the L2 switch at each remote site
  D. Block port 25 on the network firewall
  B. Block port 23 on the network firewall

  ---

  Telnet is a terminal-emulation network application that supports remote connectivity for executing commands and running applications but doesn't support transfer of fi les. Telnet uses TCP port 23. Because it's a clear text protocol and service, it should be avoided and replaced with SSH.

• Question 695:

  A major medical corporation is investigating deploying a web based portal for patients to access their medical records. The medical corporation has a long history of maintaining IT security but is considering having a third party vendor create the web portal. Which of the following areas is MOST important for the Chief Information Security Officer to focus on when reviewing proposal from vendors interested in creating the web portal?

  A. Contractor background check
  B. Confidentiality and availability
  C. Redundancy and privacy
  D. Integrity and confidentiality
  B. Confidentiality and availability

• Question 696:

  When employing PKI to send signed and encrypted data the individual sending the data must have: (Select TWO)

  A. The receiver's private key
  B. The root certificate
  C. The sender's private key
  D. The sender's public key
  E. The receiver's public key
  C. The sender's private key
  E. The receiver's public key

• Question 697:

  Ann, the system administrator, is installing an extremely critical system that can support ZERO downtime. Which of the following BEST describes the type of system Ann is installing?

  A. High availability
  B. Clustered
  C. RAID
  D. Load balanced
  A. High availability

  ---

  High Availability is he term used to refer to a system that has been secured and set up/configured in such a way so as to be online, active and able to respond and thus have zero downtime as a result.

• Question 698:

  A company exchanges information with a business partner. An annual audit of the business partner is conducted against the SLA in order to verify:

  A. Performance and service delivery metrics
  B. Backups are being performed and tested
  C. Data ownership is being maintained and audited
  D. Risk awareness is being adhered to and enforced
  A. Performance and service delivery metrics

• Question 699:

  An organization has hired a penetration tester to test the security of its ten web servers. The penetration tester is able to gain root/administrative access in several servers by exploiting vulnerabilities associated with the implementation of SMTP, POP, DNS, FTP, Telnet, and IMAP. Which of the following recommendations should the penetration tester provide to the organization to better protect their web servers in the future?

  A. Use a honeypot
  B. Disable unnecessary services
  C. Implement transport layer security
  D. Increase application event logging
  B. Disable unnecessary services

• Question 700:

  Which of the following can be implemented with multiple bit strength?

  A. AES
  B. DES
  C. SHA-1
  D. MD5
  E. MD4
  A. AES

  ---

  AES (a symmetric algorithm) uses key sizes of 128, 192, or 256 bits.