CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 911:

  A security technician is working with the network firewall team to implement access controls at the company's demarc as part of the initiation of configuration management processes. One of the network technicians asks the security technician to explain the access control type found in a firewall. With which of the following should the security technician respond?

  A. Rule based access control
  B. Role based access control
  C. Discretionary access control
  D. Mandatory access control
  A. Rule based access control

  ---

  Rule-based access control is used for network devices, such as firewalls and routers, which filter traffic based on filtering rules.

• Question 912:

  While configuring a new access layer switch, the administrator, Joe, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?

  A. Log Analysis
  B. VLAN Management
  C. Network separation
  D. 802.1x
  D. 802.1x

  ---

  802.1x is a port-based authentication mechanism. It's based on Extensible Authentication Protocol (EAP) and is commonly used in closed-environment wireless networks. 802.1x was initially used to compensate for the weaknesses of Wired Equivalent Privacy (WEP), but today it's often used as a component in more complex authentication and connection- management systems, including Remote Authentication Dial-In User Service (RADIUS), Diameter, Cisco System's Terminal Access Controller Access-Control System Plus (TACACS+), and Network Access Control (NAC).

• Question 913:

  Which of the following file systems is from Microsoft and was included with their earliest operating systems?

  A. NTFS
  B. UFS
  C. MTFS
  D. FAT
  D. FAT

  ---

  File Allocation Table (FAT) is a file system created by Microsoft and used for its earliest DOS operating systems.

• Question 914:

  A security administrator is aware that a portion of the company's Internet-facing network tends to be non-secure due to poorly configured and patched systems. The business owner has accepted the risk of those systems being compromised, but the administrator wants to determine the degree to which those systems can be used to gain access to the company intranet. Which of the following should the administrator perform?

  A. Patch management assessment
  B. Business impact assessment
  C. Penetration test
  D. Vulnerability assessment
  C. Penetration test

  ---

  Penetration testing is the most intrusive type of testing because you are actively trying to circumvent the system's security controls to gain access to the system. It is also used to determine the degree to which the systems can be used to gain

  access to the company intranet (the degree of access to local network resources). Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker

  could exploit. Pen tests can be automated with software applications or they can be performed manually. Either way, the process includes gathering information about the target before the test (reconnaissance), identifying possible entry

  points, attempting to break in (either virtually or for real) and reporting back the findings.

  The main objective of penetration testing is to determine security weaknesses. A pen test can also be used to test an organization's security policy compliance, its employees' security awareness and the organization's ability to identify and

  respond to security incidents.

  Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in.

  Pen test strategies include:

  Targeted testing

  Targeted testing is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a "lights-turned-on" approach because everyone can see the test being carried out.

  External testing

  This type of pen test targets a company's externally visible servers or devices including domain name servers (DNS), e-mail servers, Web servers or firewalls. The objective is to find out if an outside attacker can get in and how far they can

  get in once they've gained access.

  Internal testing

  This test mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause.

  Blind testing

  A blind test strategy simulates the actions and procedures of a real attacker by severely limiting the information given to the person or team that's performing the test beforehand. Typically, they may only be given the name of the company.

  Because this type of test can require a considerable amount of time for reconnaissance, it can be expensive.

  Double blind testing

  Double blind testing takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double-blind tests can be useful for testing an organization's

  security monitoring and incident identification as well as its response procedures.

• Question 915:

  When designing a web based client server application with single application server and database cluster backend, input validation should be performed:

  A. On the client
  B. Using database stored procedures
  C. On the application server
  D. Using HTTPS
  C. On the application server

• Question 916:

  A security administrator has concerns that employees are installing unapproved applications on their company provide smartphones. Which of the following would BEST mitigate this?

  A. Implement remote wiping user acceptance policies
  B. Disable removable storage capabilities
  C. Implement an application whitelist
  D. Disable the built-in web browsers
  C. Implement an application whitelist

• Question 917:

  During a security assessment, an administrator wishes to see which services are running on a remote server. Which of the following should the administrator use?

  A. Port scanner
  B. Network sniffer
  C. Protocol analyzer
  D. Process list
  A. Port scanner

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine.

• Question 918:

  An attacker Joe configures his service identifier to be as an access point advertised on a billboard. Joe then conducts a denial of service attack against the legitimate AP causing users to drop their connections and then reconnect to Joe's system with the same SSID. Which of the following BEST describes this of attack?

  A. Bluejacking
  B. WPS attack
  C. Evil twin
  D. War driving
  E. Replay attack
  C. Evil twin

• Question 919:

  A security analyst noticed a colleague typing the following command:

  `Telnet some-host 443'

  Which of the following was the colleague performing?

  A. A hacking attempt to the some-host web server with the purpose of achieving a distributed denial of service attack.
  B. A quick test to see if there is a service running on some-host TCP/443, which is being routed correctly and not blocked by a firewall.
  C. Trying to establish an insecure remote management session. The colleague should be using SSH or terminal services instead.
  D. A mistaken port being entered because telnet servers typically do not listen on port 443.
  B. A quick test to see if there is a service running on some-host TCP/443, which is being routed correctly and not blocked by a firewall.

  ---

  B: The Telnet program parameters are: telnet is the name or IP address of the remote server to connect to. is the port number of the service to use for the connection. TCP port 443 provides the HTTPS (used for secure web connections) service; it is the default SSL port. By running the Telnet some-host 443 command, the security analyst is checking that routing is done properly and not blocked by a firewall.

• Question 920:

  After working on his doctoral dissertation for two years, Joe, a user, is unable to open his dissertation file. The screen shows a warning that the dissertation file is corrupted because it is infected with a backdoor, and can only be recovered by upgrading the antivirus software from the free version to the commercial version. Which of the following types of malware is the laptop MOST likely infected with?

  A. Ransomware
  B. Trojan
  C. Backdoor
  D. Armored virus
  A. Ransomware

  ---

  Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed. Some forms of ransomware encrypt files on the system's hard drive), while some may simply lock the system and display messages intended to coax the user into paying. Ransomware typically propagates as a trojan like a conventional computer worm, entering a system through, for example, a downloaded file or a vulnerability in a network service. The program will then run a payload: such as one that will begin to encrypt personal files on the hard drive. More sophisticated ransomware may hybrid-encrypt the victim's plaintext with a random symmetric key and a fixed public key. The malware author is the only party that knows the needed private decryption key. Some ransomware payloads do not use encryption. In these cases, the payload is simply an application designed to restrict interaction with the system, typically by setting the Windows Shell to itself, or even modifying the master boot record and/or partition table (which prevents the operating system from booting at all until it is repaired)

  Ransomware payloads utilize elements of scareware to extort money from the system's user. The payload may, for example, display notices purportedly issued by companies or law enforcement agencies which falsely claim that the system had been used for illegal activities, or contains illegal content such as pornography and pirated software or media. Some ransomware payloads imitate Windows' product activation notices, falsely claiming that their computer's Windows installation is counterfeit or requires re-activation. These tactics coax the user into paying the malware's author to remove the ransomware, either by supplying a program which can decrypt the files, or by sending an unlock code that undoes the changes the payload has made.