CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 81:

  Joe a user upon arriving to work on Monday morning noticed several files were deleted from the system. There were no records of any scheduled network outages or upgrades to the system. Joe notifies the security department of the anomaly found and removes the system from the network. Which of the following is the NEXT action that Joe should perform?

  A. Screenshots of systems
  B. Call the local police
  C. Perform a backup
  D. Capture system image
  A. Screenshots of systems

• Question 82:

  Which of the following MUST be updated immediately when an employee is terminated to prevent unauthorized access?

  A. Registration
  B. CA
  C. CRL
  D. Recovery agent
  C. CRL

  ---

  Certificates or keys for the terminated employee should be put in the CRL. A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key. By checking the CRL you can check if a particular certificate has been revoked.

• Question 83:

  A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which of the following would BEST prevent the disclosure of customer data in the event that a tablet is lost or stolen?

  A. Application control
  B. Remote wiping
  C. GPS
  D. Screen-locks
  B. Remote wiping

  ---

  Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people.

• Question 84:

  A technician needs to implement a system which will properly authenticate users by their username and password only when the users are logging in from a computer in the office building. Any attempt to authenticate from a location other than the office building should be rejected. Which of the following MUST the technician implement?

  A. Dual factor authentication
  B. Transitive authentication
  C. Single factor authentication
  D. Biometric authentication
  B. Transitive authentication

• Question 85:

  A security administrator looking through IDS logs notices the following entry: (where [email protected] and passwd= `or 1==1')

  Which of the following attacks had the administrator discovered?

  A. SQL injection
  B. XML injection
  C. Cross-site script
  D. Header manipulation
  A. SQL injection

  ---

  The code in the question is an example of a SQL Injection attack. The code `1==1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table.

  SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 86:

  Attempting to inject 50 alphanumeric key strokes including spaces into an application input field that only expects four alpha characters in considered which of the following attacks?

  A. XML injection
  B. Buffer overflow
  C. LDAP Injection
  D. SQL injection
  D. SQL injection

• Question 87:

  The librarian wants to secure the public Internet kiosk PCs at the back of the library. Which of the following would be the MOST appropriate? (Select TWO).

  A. Device encryption
  B. Antivirus
  C. Privacy screen
  D. Cable locks
  E. Remote wipe
  B. Antivirus
  D. Cable locks

  ---

  B: Antivirus software is used to protect systems against viruses, which are a form of malicious code designed to spread from one system to another, consuming network resources. Public systems are particularly prone to viruses.

  D: Cable locks are theft deterrent devices that can be used to tether a device to a fixed point keep devices from being easy to steal.

• Question 88:

  A user has called the help desk to report an enterprise mobile device was stolen. The technician receiving the call accesses the MDM administration portal to identify the device's last known geographic location. The technician determines the device is still communicating with the MDM. After taking note of the last known location, the administrator continues to follow the rest of the checklist. Which of the following identifies a possible next step for the administrator?

  A. Remotely encrypt the device
  B. Identify the mobile carrier's IP address
  C. Reset the device password
  D. Issue a remote wipe command
  D. Issue a remote wipe command

• Question 89:

  Which of the following is considered an environmental control?

  A. Video surveillance
  B. Proper lighting
  C. EMI shielding
  D. Fencing
  C. EMI shielding

• Question 90:

  Which of the following can result in significant administrative overhead from incorrect reporting?

  A. Job rotation
  B. Acceptable usage policies
  C. False positives
  D. Mandatory vacations
  C. False positives

  ---

  False positives are essentially events that are mistakenly flagged and are not really events to be concerned about. This causes a significant administrative overhead because the reporting is what results in the false positives.