CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 781:

  A malicious person gained access to a datacenter by ripping the proximity badge reader off the wall near the datacenter entrance. This caused the electronic locks on the datacenter door to release because the:

  A. badge reader was improperly installed.
  B. system was designed to fail open for life-safety.
  C. system was installed in a fail closed configuration.
  D. system used magnetic locks and the locks became demagnetized.
  B. system was designed to fail open for life-safety.

  ---

  It describes a design the lock to fail open for life safety, causing the door to stay open when power is lost ?in this case the proximity badge reader was ripped off the wall.

• Question 782:

  Requiring technicians to report spyware infections is a step in which of the following?

  A. Routine audits
  B. Change management
  C. Incident management
  D. Clean desk policy
  C. Incident management

  ---

  Incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets).

• Question 783:

  Which of the following is described as an attack against an application using a malicious file?

  A. Client side attack
  B. Spam
  C. Impersonation attack
  D. Phishing attack
  A. Client side attack

  ---

  In this question, a malicious file is used to attack an application. If the application is running on a client computer, this would be a client side attack. Attacking a service or application on a server would be a server side attack.

  Client-side attacks target vulnerabilities in client applications interacting with a malicious data. The difference is the client is the one initiating the bad connection. Client-side attacks are becoming more popular. This is because server side attacks are not as easy as they once were according to apache.org. Attackers are finding success going after weaknesses in desktop applications such as browsers, media players, common office applications and e-mail clients. To defend against client-side attacks keep-up the most current application patch levels, keep antivirus software updated and keep authorized software to a minimum.

• Question 784:

  A security analyst has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop they notice several pictures of the employee's pets are on the hard drive and on a cloud storage network. When the analyst hashes the images on the hard drive against the hashes on the cloud network they do not match.

  Which of the following describes how the employee is leaking these secrets?

  A. Social engineering
  B. Steganography
  C. Hashing
  D. Digital signatures
  B. Steganography

  ---

  Steganography is the process of hiding one message in another. Steganography may also be referred to as electronic watermarking. It is also the process of hiding a message in a medium such as a digital image, audio fi le, or other fi le. In theory, doing this prevents analysts from detecting the real message. You could encode your message in another file or message and use that file to hide your message.

• Question 785:

  Connections using point-to-point protocol authenticate using which of the following? (Select TWO).

  A. RIPEMD
  B. PAP
  C. CHAP
  D. RC4
  E. Kerberos
  B. PAP
  C. CHAP

  ---

  B: A password authentication protocol (PAP) is an authentication protocol that uses a password. PAP is used by Point to Point Protocol to validate users before allowing them access to server resources.

  C: CHAP is an authentication scheme used by Point to Point Protocol (PPP) servers to validate the identity of remote clients. CHAP periodically verifies the identity of the client by using a three-way handshake.

• Question 786:

  A security administrator must implement all requirements in the following corporate policy:

  Passwords shall be protected against offline password brute force attacks. Passwords shall be protected against online password brute force attacks. Which of the following technical controls must be implemented to enforce the corporate

  policy? (Select THREE).

  A. Account lockout
  B. Account expiration
  C. Screen locks
  D. Password complexity
  E. Minimum password lifetime
  F. Minimum password length
  A. Account lockout
  D. Password complexity
  F. Minimum password length

  ---

  A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data. Brute force attacks may be used by criminals to crack encrypted data, or by security analysts to test an organization's network security. A brute force attack may also be referred to as brute force cracking. For example, a form of brute force attack known as a dictionary attack might try all the words in a dictionary. Other forms of brute force attack might try commonly-used passwords or combinations of letters and numbers.

  The best defense against brute force attacks strong passwords. The following password policies will ensure that users have strong (difficult to guess) passwords:

  F: Minimum password length. This policy specifies the minimum number of characters a password should have. For example: a minimum password length of 8 characters is regarded as good security practice.

  D: Password complexity determines what characters a password should include. For example, you could require a password to contain uppercase and lowercase letters and numbers. This will ensure that passwords don't consist of dictionary words which are easy to crack using brute force techniques.

  A: Account lockout policy: This policy ensures that a user account is locked after a number of incorrect password entries. For example, you could specify that if a wrong password is entered three times, the account will be locked for a period of time or indefinitely until the account is unlocked by an administrator.

• Question 787:

  The Chief Executive Officer (CEO) Joe notices an increase in the wireless signal in this office and thanks the IT director for the increase in network speed, Upon investigation the IT department finds an access point hidden in the dropped ceiling outside of joe's office. Which of the following types of attack is MOST likely occurring?

  A. Packet sniffing
  B. Bluesnarfing
  C. Man-in-the-middle
  D. Evil twin
  D. Evil twin

• Question 788:

  A system administrator wants to configure a setting that will make offline password cracking more challenging. Currently the password policy allows upper and lower case characters a minimum length of 5 and a lockout after 10 invalid attempts. Which of the following has the GREATEST impact on the time it takes to crack the passwords?

  A. Increase the minimum password length to 8 while keeping the same character set
  B. Implement an additional password history and reuse policy
  C. Allow numbers and special characters in the password while keeping the minimum length at 5
  D. Implement an account lockout policy after three unsuccessful logon attempts
  D. Implement an account lockout policy after three unsuccessful logon attempts

• Question 789:

  After disabling SSID broadcast, a network administrator still sees the wireless network listed in available networks on a client laptop. Which of the following attacks may be occurring?

  A. Evil Twin
  B. ARP spoofing
  C. Disassociation flooding
  D. Rogue access point
  E. TKIP compromise
  A. Evil Twin

• Question 790:

  Which of the following could cause a browser to display the message below?

  "The security certificate presented by this website was issued for a different website's address."

  A. The website certificate was issued by a different CA than what the browser recognizes in its trusted CAs.
  B. The website is using a wildcard certificate issued for the company's domain.
  C. HTTPS://127.0.01 was used instead of HTTPS://localhost.
  D. The website is using an expired self signed certificate.
  C. HTTPS://127.0.01 was used instead of HTTPS://localhost.

  ---

  PKI is a two-key, asymmetric system with four main components: certificate authority (CA), registration authority (RA), RSA (the encryption algorithm), and digital certificates. In typical public key infrastructure (PKI) arrangements, a digital signature from a certificate authority (CA) attests that a particular public key certificate is valid (i.e., contains correct information). Users, or their software on their behalf, check that the private key used to sign some certificate matches the public key in the CA's certificate. Since CA certificates are often signed by other, "higher-ranking," CAs, there must necessarily be a highest CA, which provides the ultimate in attestation authority in that particular PKI scheme. Localhost is a hostname that means this computer and may be used to access the computer's own network services via its loopback network interface. Using the loopback interface bypasses local network interface hardware. In this case the HTTPS://127.0.01 was used and not HTTPS//localhost