CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 741:

  Which of the following passwords is the LEAST complex?

  A. MyTrain!45
  B. Mytr@in!!
  C. MyTr@in12
  D. MyTr@in#8
  B. Mytr@in!!

  ---

  Password policies often enforce a minimum of three out of four standard character types, which includes uppercase and lowercase letters, numbers, and symbols. Although this option includes three of the four character types, it does not include numbers, which makes it less complex than the other options.

• Question 742:

  A user has received an email from an external source which asks for details on the company's new product line set for release in one month. The user has a detailed spec sheet but it is marked "Internal Proprietary Information". Which of the following should the user do NEXT?

  A. Contact their manager and request guidance on how to best move forward
  B. Contact the help desk and/or incident response team to determine next steps
  C. Provide the requestor with the email information since it will be released soon anyway
  D. Reply back to the requestor to gain their contact information and call them
  B. Contact the help desk and/or incident response team to determine next steps

  ---

  This is an incident that has to be responded to by the person who discovered it- in this case the user. An incident is any attempt to violate a security policy, a successful penetration, a compromise of a system, or any unauthorized access to information. It's important that an incident response policy establish at least the following items: Outside agencies that should be contacted or notified in case of an incident Resources used to deal with an incident Procedures to gather and secure evidence List of information that should be collected about an incident Outside experts who can be used to address issues if needed Policies and guidelines regarding how to handle an incident

  Since the spec sheet has been marked Internal Proprietary Information the user should refer the incident to the incident response team.

• Question 743:

  A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Which of the following should be implemented to secure the devices without risking availability?

  A. Host-based firewall
  B. IDS
  C. IPS
  D. Honeypot
  B. IDS

  ---

  An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every organization. IDPSes typically record information related to observed events, notify security administrators of important observed events and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall) or changing the attack's content.

• Question 744:

  Ann, a college professor, was recently reprimanded for posting disparaging remarks re- grading her coworkers on a web site. Ann stated that she was not aware that the public was able to view her remakes. Which of the following security-related trainings could have made Ann aware of the repercussions of her actions?

  A. Data Labeling and disposal
  B. Use of social networking
  C. Use of P2P networking
  D. Role-based training
  B. Use of social networking

• Question 745:

  Which of the following practices is used to mitigate a known security vulnerability?

  A. Application fuzzing
  B. Patch management
  C. Password cracking
  D. Auditing security logs
  B. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from new attacks and vulnerabilities that have recently become known.

• Question 746:

  Which of the following can only be mitigated through the use of technical controls rather that user security training?

  A. Shoulder surfing
  B. Zero-day
  C. Vishing
  D. Trojans
  B. Zero-day

  ---

  A zero day vulnerability is an unknown vulnerability in a software application. This cannot be prevented by user security training.

  A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day

  attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the

  vulnerability becomes known, a race begins for the developer, who must protect users.

• Question 747:

  After a security incident involving a physical asset, which of the following should be done at the beginning?

  A. Record every person who was in possession of assets, continuing post-incident.
  B. Create working images of data in the following order: hard drive then RAM.
  C. Back up storage devices so work can be performed on the devices immediately.
  D. Write a report detailing the incident and mitigation suggestions.
  A. Record every person who was in possession of assets, continuing post-incident.

  ---

  Asset tracking is the process of maintaining oversight over inventory, and ensuring that a device is still in the possession of the assigned authorized user.

• Question 748:

  A security manager is discussing change in the security posture of the network, if a proposed application is approved for deployment. Which of the following is the MOST important the security manager must rely upon to help make this determination?

  A. Ports used by new application
  B. Protocols/services used by new application
  C. Approved configuration items
  D. Current baseline configuration
  B. Protocols/services used by new application

• Question 749:

  Which of the following would be MOST appropriate if an organization's requirements mandate complete control over the data and applications stored in the cloud?

  A. Hybrid cloud
  B. Community cloud
  C. Private cloud
  D. Public cloud
  C. Private cloud

  ---

  A private cloud is a cloud service for internal use only and is located within a corporate network rather than on the Internet. It is usually owned, managed, and operated by the company, which gives the company full control over the data and applications stored in the cloud.

• Question 750:

  A programmer must write a piece of code to encrypt passwords and credit card information used by an online shopping cart. The passwords must be stored using one-way encryption, while credit card information must be stored using reversible encryption. Which of the following should be used to accomplish this task? (Select TWO)

  A. SHA for passwords
  B. 3DES for passwords
  C. RC4 for passwords
  D. AES for credit cards
  E. MD5 for credit cards
  F. HMAC for credit cards
  B. 3DES for passwords
  D. AES for credit cards