CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 771:

  After installing a new Linux system the administrator runs a command that records the size, permissions, and MD5 sum of all the files on the system. Which of the following describes what the administrator is doing?

  A. Identifying vulnerabilities
  B. Design review
  C. Host software baselining
  D. Operating system hardening
  C. Host software baselining

• Question 772:

  In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Select TWO).

  A. Take hashes
  B. Begin the chain of custody paperwork
  C. Take screen shots
  D. Capture the system image
  E. Decompile suspicious files
  A. Take hashes
  D. Capture the system image

  ---

  A: Take Hashes. NIST (the National Institute of Standards and Technology) maintains a National Software Reference Library (NSRL). One of the purposes of the NSRL is to collect "known, traceable software applications" through their hash values and store them in a Reference Data Set (RDS). The RDS can then be used by law enforcement, government agencies, and businesses to determine which fi les are important as evidence in criminal investigations.

  D: A system image is a snapshot of what exists. Capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it.

• Question 773:

  Users report that after downloading several applications, their systems' performance has noticeably decreased. Which of the following would be used to validate programs prior to installing them?

  A. Whole disk encryption
  B. SSH
  C. Telnet
  D. MD5
  D. MD5

  ---

  MD5 can be used to locate the data which has changed. The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

• Question 774:

  A security administrator needs to determine which system a particular user is trying to login to at various times of the day. Which of the following log types would the administrator check?

  A. Firewall
  B. Application
  C. IDS
  D. Security
  D. Security

  ---

  The security log records events such as valid and invalid logon attempts, as well as events related to resource use, such as the creating, opening, or deleting of files. For example, when logon auditing is enabled, an event is recorded in the security log each time a user attempts to log on to the computer. You must be logged on as Administrator or as a member of the Administrators group in order to turn on, use, and specify which events are recorded in the security log.

• Question 775:

  A Company transfers millions of files a day between their servers. A programmer for the company has created a program that indexes and verifies the integrity of each file as it is replicated between servers. The programmer would like to use the fastest algorithm to ensure integrity. Which of the following should the programmer use?

  A. SHA1
  B. RIPEMD
  C. DSA
  D. MD5
  D. MD5

• Question 776:

  After an assessment, auditors recommended that an application hosting company should contract with additional data providers for redundant high speed Internet connections. Which of the following is MOST likely the reason for this recommendation? (Select TWO).

  A. To allow load balancing for cloud support
  B. To allow for business continuity if one provider goes out of business
  C. To eliminate a single point of failure
  D. To allow for a hot site in case of disaster
  E. To improve intranet communication speeds
  B. To allow for business continuity if one provider goes out of business
  C. To eliminate a single point of failure

  ---

  A high-speed internet connection to a second data provider could be used to keep an up- to-date replicate of the main site. In case of problem on the first site, operation can quickly switch to the second site. This eliminates the single point of failure and allows the business to continue uninterrupted on the second site. Note: Recovery Time Objective The recovery time objective (RTO) is the maximum amount of time that a process or service is allowed to be down and the consequences still be considered acceptable. Beyond this time, the break in business continuity is considered to affect the business negatively. The RTO is agreed on during BIA creation.

• Question 777:

  A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by camouflaging data inside of other files?

  A. Integrity
  B. Confidentiality
  C. Steganography
  D. Availability
  C. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video.

  Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse

  interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a

  secret message is being sent, as well as concealing the contents of the message.

• Question 778:

  Which of the following types of technologies is used by security and research personnel for identification and analysis of new security threats in a networked environment by using false data/hosts for information collection?

  A. Honeynet
  B. Vulnerability scanner
  C. Port scanner
  D. Protocol analyzer
  A. Honeynet

  ---

  A honeynet is a network set up with intentional vulnerabilities; its purpose is to invite attack, so that an attacker's activities and methods can be studied and that information used to increase network security. A honeynet contains one or more honey pots, which are computer systems on the Internet expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. Although the primary purpose of a honeynet is to gather information about attackers' methods and motives, the decoy network can benefit its operator in other ways, for example by diverting attackers from a real network and its resources. The Honeynet Project, a non-profit research organization dedicated to computer security and information sharing, actively promotes the deployment of honeynets. In addition to the honey pots, a honeynet usually has real applications and services so that it seems like a normal network and a worthwhile target. However, because the honeynet doesn't actually serve any authorized users, any attempt to contact the network from without is likely an illicit attempt to breach its security, and any outbound activity is likely evidence that a system has been compromised. For this reason, the suspect information is much more apparent than it would be in an actual network, where it would have to be found amidst all the legitimate network data. Applications within a honeynet are often given names such as "Finances" or "Human Services" to make them sound appealing to the attacker.

• Question 779:

  Everyone in the accounting department has the ability to print and sign checks. Internal audit has asked that only one group of employees may print checks while only two other employees may sign the checks. Which of the following concepts would enforce this process?

  A. Separation of Duties
  B. Mandatory Vacations
  C. Discretionary Access Control
  D. Job Rotation
  A. Separation of Duties

  ---

  Separation of duties means that users are granted only the permissions they need to do their work and no more.

• Question 780:

  The Chief Executive Officer (CEO) of a major defense contracting company a traveling overseas for a conference. The CEO will be taking a laptop. Which of the following should the security administrator implement to ensure confidentiality of the data if the laptop were to be stolen or lost during the trip?

  A. Remote wipe
  B. Full device encryption
  C. BIOS password
  D. GPS tracking
  B. Full device encryption