CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 931:

  A bank is planning to implement a third factor to protect customer ATM transactions. Which of the following could the bank implement?

  A. SMS
  B. Fingerprint
  C. Chip and Pin
  D. OTP
  C. Chip and Pin

• Question 932:

  Which of the following can be used on a smartphone to BEST protect against sensitive data loss if the device is stolen? (Select TWO).

  A. Tethering
  B. Screen lock PIN
  C. Remote wipe
  D. Email password
  E. GPS tracking
  F. Device encryption
  C. Remote wipe
  F. Device encryption

  ---

  C: Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people.

  F: Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

• Question 933:

  Which of the following is the below pseudo-code an example of? IF VARIABLE (CONTAINS NUMBERS = TRUE) THEN EXIT

  A. Buffer overflow prevention
  B. Input validation
  C. CSRF prevention
  D. Cross-site scripting prevention
  B. Input validation

  ---

  Input validation is a defensive technique intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain.

• Question 934:

  Which of the following best practices makes a wireless network more difficult to find?

  A. Implement MAC filtering
  B. UseWPA2-PSK
  C. Disable SSID broadcast
  D. Power down unused WAPs
  C. Disable SSID broadcast

  ---

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn't for public use.

• Question 935:

  A group policy requires users in an organization to use strong passwords that must be changed every 15 days. Joe and Ann were hired 16 days ago. When Joe logs into the network, he is prompted to change his password; when Ann logs into the network, she is not prompted to change her password. Which of the following BEST explains why Ann is not required to change her password?

  A. Ann's user account has administrator privileges.
  B. Joe's user account was not added to the group policy.
  C. Ann's user account was not added to the group policy.
  D. Joe's user account was inadvertently disabled and must be re-created.
  C. Ann's user account was not added to the group policy.

  ---

  Group policy is used to manage Windows systems in a Windows network domain environment by means of a Group Policy Object (GPO). GPO's include a number of settings related to credentials, which includes password expiration. Because Anne was not prompted to change her password, it could only mean that her user account was not added to the group policy.

• Question 936:

  A database administrator receives a call on an outside telephone line from a person who states that they work for a well-known database vendor. The caller states there have been problems applying the newly released vulnerability patch for their database system, and asks what version is being used so that they can assist. Which of the following is the BEST action for the administrator to take?

  A. Thank the caller, report the contact to the manager, and contact the vendor support line to verify any reported patch issues.
  B. Obtain the vendor's email and phone number and call them back after identifying the number of systems affected by the patch.
  C. Give the caller the database version and patch level so that they can receive help applying the patch.
  D. Call the police to report the contact about the database systems, and then check system logs for attack attempts.
  A. Thank the caller, report the contact to the manager, and contact the vendor support line to verify any reported patch issues.

  ---

  Impersonation is where a person, computer, software application or service pretends to be someone or something it's not. Impersonation is commonly non-maliciously used in client/server applications. However, it can also be used as a security threat.

  In this question, the person making the call may be impersonating someone who works for a well-known database vendor. The actions described in this answer would mitigate the risk. By not divulging information about your database system and contacting the vendor directly, you can be sure that you are talking to the right people.

• Question 937:

  An online store wants to protect user credentials and credit card information so that customers can store their credit card information and use their card for multiple separate transactions.

  Which of the following database designs provides the BEST security for the online store?

  A. Use encryption for the credential fields and hash the credit card field
  B. Encrypt the username and hash the password
  C. Hash the credential fields and use encryption for the credit card field
  D. Hash both the credential fields and the credit card field
  C. Hash the credential fields and use encryption for the credit card field

  ---

  Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables. One main characteristic of hashing is that the algorithm must have few or no collisions ?in hashing two different inputs does not give the same output. Thus the credential fields should be hashed because anyone customer will have a unique credit card number/identity and since they will use their credit cards for many different transactions, the credit card field should be encrypted only, not hashed.

• Question 938:

  A security administrator has implemented a policy to prevent data loss. Which of the following is the BEST method of enforcement?

  A. Internet networks can be accessed via personally-owned computers.
  B. Data can only be stored on local workstations.
  C. Wi-Fi networks should use WEP encryption by default.
  D. Only USB devices supporting encryption are to be used.
  D. Only USB devices supporting encryption are to be used.

  ---

  The concern for preventing data loss is the concern for maintaining data confidentiality. This can be accomplished through encryption, access controls, and steganography. USB encryption is usually provided by the vendor of the USB device. It is not included on all USB devices.

• Question 939:

  Which of the following assets is MOST likely considered for DLP?

  A. Application server content
  B. USB mass storage devices
  C. Reverse proxy
  D. Print server
  B. USB mass storage devices

  ---

  Data loss prevention (DLP) systems monitor the contents of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access) and transmitting the data. A USB presents the most likely device to be used to steal data because of its physical size.

• Question 940:

  Which of the following offerings typically allows the customer to apply operating system patches?

  A. Software as a service
  B. Public Clouds
  C. Cloud Based Storage
  D. Infrastructure as a service
  D. Infrastructure as a service

  ---

  Cloud users install operating-system images and their application software on the cloud infrastructure to deploy their applications. In this model, the cloud user patches and maintains the operating systems and the application software.