CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 871:

  Which of the following is a programming interface that allows a remote computer to run programs on a local machine?

  A. RPC
  B. RSH
  C. SSH
  D. SSL
  A. RPC

  ---

  Remote Procedure Call (RPC) is a programming interface that allows a remote computer to run programs on a local machine.

• Question 872:

  Which of the following security architecture elements also has sniffer functionality? (Select TWO).

  A. HSM
  B. IPS
  C. SSL accelerator
  D. WAP
  E. IDS
  B. IPS
  E. IDS

  ---

  Sniffer functionality means the ability to capture and analyze the content of data packets as they are transmitted across the network. IDS and IPS systems perform their functions by capturing and analyzing the content of data packets.

  An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every organization. IDPSes typically record information related to observed events, notify security administrators of important observed events and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall) or changing the attack's content.

• Question 873:

  During a review a company was cited for allowing requestors to approve and implement their own change request. Which of the following would resolve the issue? (Select TWO)

  A. Separation duties
  B. Mandatory access
  C. Mandatory vacations
  D. Audit logs
  E. Job Rotation
  F. Time of day restrictions
  A. Separation duties
  E. Job Rotation

• Question 874:

  A vulnerability scan is reporting that patches are missing on a server. After a review, it is determined that the application requiring the patch does not exist on the operating system. Which of the following describes this cause?

  A. Application hardening
  B. False positive
  C. Baseline code review
  D. False negative
  B. False positive

  ---

  False positives are essentially events that are mistakenly flagged and are not really events to be concerned about.

• Question 875:

  During an anonymous penetration test, Jane, a system administrator, was able to identify a shared print spool directory, and was able to download a document from the spool. Which statement BEST describes her privileges?

  A. All users have write access to the directory.
  B. Jane has read access to the file.
  C. All users have read access to the file.
  D. Jane has read access to the directory.
  C. All users have read access to the file.

  ---

  The question states that Jane was able to download a document from the spool directory. To view and download the document, Jane must have at least Read access to the file. The fact that the document belonged to someone else suggests that all users have read access to the file.

• Question 876:

  XYZ Corporation is about to purchase another company to expand its operations. The CEO is concerned about information leaking out, especially with the cleaning crew that comes in at night. The CEO would like to ensure no paper files are leaked. Which of the following is the BEST policy to implement?

  A. Social media policy
  B. Data retention policy
  C. CCTV policy
  D. Clean desk policy
  D. Clean desk policy

  ---

  Clean Desk Policy Information on a desk--in terms of printouts, pads of note paper, sticky notes, and the like--can be easily seen by prying eyes and taken by thieving hands. To protect data and your business, encourage employees to maintain clean desks and to leave out only those papers that are relevant to the project they are working on at that moment. All sensitive information should be put away when the employee is away from their desk.

• Question 877:

  Which of the following security account management techniques should a security analyst implement to prevent staff, who has switched company roles, from exceeding privileges?

  A. Internal account audits
  B. Account disablement
  C. Time of day restriction
  D. Password complexity
  A. Internal account audits

  ---

  Internal account auditing will allow you to switch the appropriate users to the proper accounts required after the switching of roles occurred and thus check that the principle of least privilege is followed.

• Question 878:

  An administrator would like to utilize encryption that has comparable speed and strength to the AES cipher without using AES itself. The cipher should be able to operate in the same modes as AES and utilize the same minimum bit strength. Which of the following algorithms should the administrator select?

  A. RC4
  B. Rijndael
  C. SHA
  D. TwoFish
  E. 3DES
  A. RC4

• Question 879:

  A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. Which of the following would be an appropriate mitigation technique?

  A. Disabling unnecessary accounts
  B. Rogue machine detection
  C. Encrypting sensitive files
  D. Implementing antivirus
  B. Rogue machine detection

  ---

  Rogue machine detection is the process of detecting devices on the network that should not be there. If a user brings in a laptop and plugs it into the network, the laptop is a "rogue machine". The laptop could cause problems on the network. Any device on the network that should not be there is classed as rogue.

• Question 880:

  A software firm posts patches and updates to a publicly accessible FTP site. The software firm also posts digitally signed checksums of all patches and updates. The firm does this to address:

  A. Integrity of downloaded software.
  B. Availability of the FTP site.
  C. Confidentiality of downloaded software.
  D. Integrity of the server logs.
  A. Integrity of downloaded software.

  ---

  Digital Signatures is used to validate the integrity of the message and the sender. In this case the software firm that posted the patches and updates digitally signed the checksums of all patches and updates.