CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 821:

  Which of the following is a measure of biometrics performance which rates the ability of a system to correctly authenticate an authorized user?

  A. Failure to capture
  B. Type II
  C. Mean time to register
  D. Template capacity
  B. Type II

  ---

  Type II, or false acceptance rate (FAR), is the measure of the likelihood that the biometric security system will incorrectly accept an access attempt by an unauthorized user.

• Question 822:

  A security administrator is tasked with calculating the total ALE on servers. In a two year period of time, a company has to replace five servers. Each server replacement has cost the company $4,000 with downtime costing $3,000. Which of the following is the ALE for the company?

  A. $7,000
  B. $10,000
  C. $17,500
  D. $35,000
  C. $17,500

  ---

  SLE ?ARO = ALE, where SLE is equal to asset value (AV) times exposure factor (EF); and ARO is the annualized rate of occurrence. SLE =($4000 + $3000) x 5 = $35000 ARO = 2 years Thus per year it would be 50% = 0,5 The ALE is thus $35000 x 0.5 = $17500

• Question 823:

  An IT auditor tests an application as an authenticated user. This is an example of which of the following types of testing?

  A. Penetration
  B. White box
  C. Black box
  D. Gray box
  D. Gray box

  ---

  In this question, the tester is testing the application as an authenticated user. We can assume from this that the tester has at least limited knowledge of the application. This meets the criteria of a grey-box test. Gray box testing, also called gray box analysis, is a strategy for software debugging in which the tester has limited knowledge of the internal details of the program. A gray box is a device, program or system whose workings are partially understood. Gray box testing can be contrasted with black box testing, a scenario in which the tester has no knowledge or access to the internal workings of a program, or white box testing, a scenario in which the internal particulars are fully known. Gray box testing is commonly used in penetration tests. Gray box testing is considered to be non-intrusive and unbiased because it does not require that the tester have access to the source code. With respect to internal processes, gray box testing treats a program as a black box that must be analyzed from the outside. During a gray box test, the person may know how the system components interact but not have detailed knowledge about internal program functions and operation. A clear distinction exists between the developer and the tester, thereby minimizing the risk of personnel conflicts.

• Question 824:

  A company has recently allowed employees to take advantage of BYOD by installing WAPs throughout the corporate office. An employee, Joe, has recently begun to view inappropriate material at work using his personal laptop. When confronted, Joe indicated that he was never told that he could not view that type of material on his personal laptop. Which of the following should the company have employees acknowledge before allowing them to access the corporate WLAN with their personal devices?

  A. Privacy Policy
  B. Security Policy
  C. Consent to Monitoring Policy
  D. Acceptable Use Policy
  D. Acceptable Use Policy

  ---

  Acceptable use policies (AUPs) describe how the employees in an organization can use company systems and resources, both software and hardware.

• Question 825:

  In order to maintain oversight of a third party service provider, the company is going to implement a Governance, Risk, and Compliance (GRC) system. This system is promising to provide overall security posture coverage. Which of the following is the MOST important activity that should be considered?

  A. Continuous security monitoring
  B. Baseline configuration and host hardening
  C. Service Level Agreement (SLA) monitoring
  D. Security alerting and trending
  A. Continuous security monitoring

  ---

  The company is investing in a Governance, Risk, and Compliance (GRC) system to provide overall security posture coverage. This is great for testing the security posture. However, to be effective and ensure the company always has a good

  security posture, you need to monitor the security continuously.

  Once a baseline security configuration is documented, it is critical to monitor it to see that this baseline is maintained or exceeded. A popular phrase among personal trainers is "that which gets measured gets improved." Well, in network

  security, "that which gets monitored gets secure."

  Continuous monitoring means exactly that: ongoing monitoring. This may involve regular measurements of network traffic levels, routine evaluations for regulatory compliance, and checks of network security device configurations.

• Question 826:

  Which of the following should be performed to increase the availability of IP telephony by prioritizing traffic?

  A. Subnetting
  B. NAT
  C. Quality of service
  D. NAC
  C. Quality of service

  ---

  Quality of Service (QoS) facilitates the deployment of media-rich applications, such as video conferencing and Internet Protocol (IP) telephony, without adversely affecting network throughput.

• Question 827:

  On a train, an individual is watching a proprietary video on Joe's laptop without his knowledge. Which of the following does this describe?

  A. Tailgating
  B. Shoulder surfing
  C. Interference
  D. Illegal downloading
  B. Shoulder surfing

  ---

  Looking at information on a computer screen without the computer user's knowledge is known as shoulder surfing.

  Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to

  someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To

  prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand.

• Question 828:

  A password audit has revealed that a significant percentage if end-users have passwords that are easily cracked. Which of the following is the BEST technical control that could be implemented to reduce the amount of easily "crackable" passwords in use?

  A. Credential management
  B. Password history
  C. Password complexity
  D. Security awareness training
  C. Password complexity

• Question 829:

  Ann has taken over as the new head of the IT department. One of her first assignments was to implement AAA in preparation for the company's new telecommuting policy. When she takes inventory of the organizations existing network infrastructure, she makes note that it is a mix of several different vendors. Ann knows she needs a method of secure centralized access to the company's network resources. Which of the following is the BEST service for Ann to implement?

  A. RADIUS
  B. LDAP
  C. SAML
  D. TACACS+
  A. RADIUS

  ---

  The Remote Authentication Dial In User Service (RADIUS) networking protocol offers centralized Authentication, Authorization, and Accounting (AAA) management for users who make use of a network service.

• Question 830:

  XYZ company has a database containing personally identifiable information for all its customers. Which of the following options would Best ensure employees are only viewing information associated to the customers they support?

  A. Auditing
  B. Access Control
  C. Encryption
  D. Data Ownership
  A. Auditing