CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 941:

  During the analysis of a PCAP file, a security analyst noticed several communications with a remote server on port 53. Which of the following protocol types is observed in this traffic?

  A. FTP
  B. DNS
  C. Email
  D. NetBIOS
  B. DNS

  ---

  DNS (Domain Name System) uses port 53.

• Question 942:

  A security administrator wishes to implement a method of generating encryption keys from user passwords to enhance account security. Which of the following would accomplish this task?

  A. NTLMv2
  B. Blowfish
  C. Diffie-Hellman
  D. PBKDF2
  C. Diffie-Hellman

• Question 943:

  Datacenter access is controlled with proximity badges that record all entries and exits from the datacenter. The access records are used to identify which staff members accessed the data center in the event of equipment theft. Which of the following MUST be prevented in order for this policy to be effective?

  A. Password reuse
  B. Phishing
  C. Social engineering
  D. Tailgating
  D. Tailgating

  ---

  Tailgating is the term used for someone being so close to you when you enter a building that they are able to come in right behind you without needing to use a key, a card, or any other security device. This should be prevented in this case.

• Question 944:

  Which of the following is characterized by an attack against a mobile device?

  A. Evil twin
  B. Header manipulation
  C. Blue jacking
  D. Rogue AP
  C. Blue jacking

  ---

  A bluejacking attack is where unsolicited messages are sent to mobile devices using Bluetooth.

  Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or

  bluechat) to another Bluetooth-enabled device via the OBEX protocol.

  Bluetooth has a very limited range, usually around 10 metres (32.8 ft) on mobile phones, but laptops can reach up to 100 metres (328 ft) with powerful (Class 1) transmitters. Bluejacking is usually harmless, but because bluejacked people

  generally don't know what has happened, they may think that their phone is malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it's possible to send images or sounds as well. Bluejacking has been

  used in guerrilla marketing campaigns to promote advergames.

• Question 945:

  Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

  A. Kerberos
  B. TACACS+
  C. RADIUS
  D. LDAP
  D. LDAP

  ---

  The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

  A common usage of LDAP is to provide a "single sign on" where one password for a user is shared between many services, such as applying a company login code to web pages (so that staff log in only once to company computers, and then are automatically logged into the company intranet). LDAP is based on a simpler subset of the standards contained within the X.500 standard. Because of this relationship, LDAP is sometimes called X.500-lite. A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS. Global Catalog is available by default on ports 3268, and 3269 for LDAPS. The client then sends an operation request to the server, and the server sends responses in return. The client may request the following operations: StartTLS -- use the LDAPv3 Transport Layer Security (TLS) extension for a secure connection

• Question 946:

  Which of the following is an example of a false negative?

  A. The IDS does not identify a buffer overflow.
  B. Anti-virus identifies a benign application as malware.
  C. Anti-virus protection interferes with the normal operation of an application.
  D. A user account is locked out after the user mistypes the password too many times.
  A. The IDS does not identify a buffer overflow.

  ---

  With a false negative, you are not alerted to a situation when you should be alerted.

• Question 947:

  Ann an employee is visiting Joe, an employee in the Human Resources Department. While talking to Joe, Ann notices a spreadsheet open on Joe's computer that lists the salaries of all employees in her department. Which of the following forms of social engineering would BEST describe this situation?

  A. Impersonation
  B. Dumpster diving
  C. Tailgating
  D. Shoulder surfing
  D. Shoulder surfing

  ---

  Ann was able to see the Spreadsheet on Joe's computer. This direct observation is known as shoulder surfing.

  Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand.

• Question 948:

  A new web server has been provisioned at a third party hosting provider for processing credit card transactions. The security administrator runs the netstat command on the server and notices that ports 80, 443, and 3389 are in a `listening' state. No other ports are open. Which of the following services should be disabled to ensure secure communications?

  A. HTTPS
  B. HTTP
  C. RDP
  D. TELNET
  B. HTTP

  ---

  HTTP uses port 80. HTTP does not provide encrypted communications. Port 443 is used by HTTPS which provides secure encrypted communications. Port 3389 is used by RDP (Remote Desktop Protocol) which does provide encrypted communications.

• Question 949:

  A Windows- based computer is infected with malware and is running too slowly to boot and run a malware scanner. Which of the following is the BEST way to run the malware scanner?

  A. Kill all system processes
  B. Enable the firewall
  C. Boot from CD/USB
  D. Disable the network connection
  C. Boot from CD/USB

• Question 950:

  A security administrator must implement a network authentication solution which will ensure encryption of user credentials when users enter their username and password to authenticate to the network.

  Which of the following should the administrator implement?

  A. WPA2 over EAP-TTLS
  B. WPA-PSK
  C. WPA2 with WPS
  D. WEP over EAP-PEAP
  D. WEP over EAP-PEAP

  ---

  D: Wired Equivalent Privacy (WEP) is designed to provide security equivalent to that of a wired network. WEP has vulnerabilities and isn't considered highly secure. Extensible Authentication Protocol (EAP) provides a framework for authentication that is often used with wireless networks. Among the five EAP types adopted by the WPA/ WPA2 standard are EAP-TLS, EAP-PSK, EAP-MD5, as well as LEAP and PEAP. PEAP is similar in design to EAP-TTLS, requiring only a server-side PKI certificate to create a secure TLS tunnel to protect user authentication, and uses server-side public key certificates to authenticate the server. It then creates an encrypted TLS tunnel between the client and the authentication server. In most configurations, the keys for this encryption are transported using the server's public key. The ensuing exchange of authentication information inside the tunnel to authenticate the client is then encrypted and user credentials are safe from eavesdropping.