CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 711:

  A web administrator has just implemented a new web server to be placed in production. As part of the company's security plan, any new system must go through a security test before it is placed in production. The security team runs a port scan resulting in the following data: 21 tcp open FTP 23 tcp open Telnet 22 tcp open SSH 25 UDP open smtp 110 tcp open pop3 443 tcp open https Which of the following is the BEST recommendation for the web administrator?

  A. Implement an IPS
  B. Disable unnecessary services
  C. Disable unused accounts
  D. Implement an IDS
  E. Wrap TELNET in SSL
  B. Disable unnecessary services

• Question 712:

  Which of the following describes a type of malware which is difficult to reverse engineer in a virtual lab?

  A. Armored virus
  B. Polymorphic malware
  C. Logic bomb
  D. Rootkit
  A. Armored virus

  ---

  An armored virus is a type of virus that has been designed to thwart attempts by analysts from examining its code by using various methods to make tracing, disassembling and reverse engineering more difficult. An Armored Virus may also protect itself from antivirus programs, making it more difficult to trace. To do this, the Armored Virus attempts to trick the antivirus program into believing its location is somewhere other than where it really is on the system.

• Question 713:

  While opening an email attachment, Pete, a customer, receives an error that the application has encountered an unexpected issue and must be shut down. This could be an example of which of the following attacks?

  A. Cross-site scripting
  B. Buffer overflow
  C. Header manipulation
  D. Directory traversal
  B. Buffer overflow

  ---

  When the user opens an attachment, the attachment is loaded into memory. The error is caused by a memory issue due to a buffer overflow attack.

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.

• Question 714:

  The internal audit group discovered that unauthorized users are making unapproved changes to various system configuration settings. This issue occurs when previously authorized users transfer from one department to another and maintain the same credentials. Which of the following controls can be implemented to prevent such unauthorized changes in the future?

  A. Periodic access review
  B. Group based privileges
  C. Least privilege
  D. Account lockout
  C. Least privilege

• Question 715:

  Which of the following describes the implementation of PAT?

  A. Translating the source and destination IPS, but not the source and destination ports
  B. A one to one persistent mapping between on private IP and one Public IP
  C. Changing the priority of a TCP stream based on the source address
  D. Associating multiple public IP addresses with one private address
  D. Associating multiple public IP addresses with one private address

• Question 716:

  Which of the following ports is used to securely transfer files between remote UNIX systems?

  A. 21
  B. 22
  C. 69
  D. 445
  B. 22

  ---

  SCP copies files securely between hosts on a network. It uses SSH for data transfer, and uses the same authentication and provides the same security as SSH. Unlike RCP, SCP will ask for passwords or passphrases if they are needed for authentication. SSH uses TCP port 22. All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22.

• Question 717:

  A company has 5 users. Users 1, 2 and 3 need access to payroll and users 3, 4 and 5 need access to sales. Which of the following should be implemented to give the appropriate access while enforcing least privilege?

  A. Assign individual permissions to users 1 and 2 for payroll. Assign individual permissions to users 4 and 5 for sales. Make user 3 an administrator.
  B. Make all users administrators and then restrict users 1 and 2 from sales. Then restrict users 4 and 5 from payroll.
  C. Create two additional generic accounts, one for payroll and one for sales that users utilize.
  D. Create a sales group with users 3, 4 and 5. Create a payroll group with users 1, 2 and 3.
  D. Create a sales group with users 3, 4 and 5. Create a payroll group with users 1, 2 and 3.

  ---

  Assigning permissions to a group requires less effort than assigning permissions to individual users. When you have groups configured with the appropriate permissions, you can grant the permissions to individual users by adding the users to the groups. Users can be members of multiple groups and therefore have multiple sets of permissions assigned to them. In this answer, user 3 is a member of both groups which grants the user permission to both Sales and Payroll.

• Question 718:

  Which of the following would prevent a user from installing a program on a company-owned mobile device?

  A. White-listing
  B. Access control lists
  C. Geotagging
  D. Remote wipe
  A. White-listing

  ---

  Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list.

• Question 719:

  A chief Financial Officer (CFO) has asked the Chief Information Officer (CISO) to provide responses to a recent audit report detailing deficiencies in the organization security controls. The CFO would like to know ways in which the organization can improve its authorization controls. Given the request by the CFO, which of the following controls should the CISO focus on in the report? (Select Three)

  A. Password complexity policies
  B. Hardware tokens
  C. Biometric systems
  D. Role-based permissions
  E. One time passwords
  F. Separation of duties
  G. Multifactor authentication
  H. Single sign-on
  I. Lease privilege
  D. Role-based permissions
  F. Separation of duties
  I. Lease privilege

• Question 720:

  A security administrator must implement a firewall rule to allow remote employees to VPN onto the company network. The VPN concentrator implements SSL VPN over the standard HTTPS port. Which of the following is the MOST secure ACL to implement at the company's gateway firewall?

  A. PERMIT TCP FROM ANY 443 TO 199.70.5.25 443
  B. PERMIT TCP FROM ANY ANY TO 199.70.5.23 ANY
  C. PERMIT TCP FROM 199.70.5.23 ANY TO ANY ANY
  D. PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443
  D. PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443

  ---

  The default HTTPS port is port 443. When configuring SSL VPN you can change the default port for HTTPS to a port within the 1024-65535 range. This ACL will allow traffic from VPNs using the 1024-65535 port range to access the company network via company's gateway firewall on port 443.