CompTIA CompTIA Certifications SY0-501 Questions & Answers

• Question 261:

  During a security audit of a company's network, unsecure protocols were found to be in use. A network administrator wants to ensure browser-based access to company switches is using the most secure protocol. Which of the following protocols should be implemented?

  A. SSH2

  B. TLS1.2

  C. SSL1.3

  D. SNMPv3

  Correct Answer: A

  Product and Software: This article applies to all Aruba controllers and ArubaOS versions. The program Secure Shell (SSH) is a secure replacement for Telnet and the Berkeley r-utilities (rlogin, rsh, rcp, and rdist). SSH provides an encrypted channel for logging into another computer over a network, executing commands on a remote computer, and moving files from one computer to another. SSH provides strong host-to-host and user authentication as well as secure encrypted communications over an insecure internet.

  SSH2 is a more secure, efficient, and portable version of SSH that includes SFTP, which is functionally similar to FTP, but is SSH2 encrypted.

  SSH2 key authentication is a feature that Aruba Networks currently does not support and you need to use X509 certificates for authentication. SSH2 private keys can be converted to X509 cert format. Use the same private key to generate a certificate request and have the certificate signed by a valid CA. After the certificate is signed by the CA, it can be uploaded to the controller as 'Public Cert' and used for SSH authentication.

• Question 262:

  An organization's IRP prioritizes containment over eradication. An incident has been discovered where an attacker outside of the organization has installed cryptocurrency mining software on the organization's web servers. Given the organization's stated priorities, which of the following would be the NEXT step?

  A. Remove the affected servers from the network.

  B. Review firewall and IDS logs to identify possible source IPs.

  C. Identify and apply any missing operating system and software patches.

  D. Delete the malicious software and determine if the servers must be reimaged.

  Correct Answer: A

  Now, since the organization top priority is more of containment over eradication, an outbreak code that is hostile as a can be suppressed effectively by removing the web server completely from the overall network facilities or infrastructure. Also, if the affected servers are not removed, it might affect the integrity, confidentiality of sensitive materials or documents which will be exposed to the outside world by the attacker.

• Question 263:

  A company recently installed fingerprint scanners at all entrances to increase the facility's security. The scanners were installed on Monday morning, and by the end of the week it was determined that 1.5% of valid users were denied entry. Which of the following measurements do these users fall under?

  A. FRR

  B. FAR

  C. CER

  D. SLA

  Correct Answer: A

• Question 264:

  An attacker has obtained the user ID and password of a datacenter's backup operator and has gained access to a production system. Which of the following would be the attacker's NEXT action?

  A. Perform a passive reconnaissance of the network.

  B. Initiate a confidential data exfiltration process.

  C. Look for known vulnerabilities to escalate privileges.

  D. Create an alternate user ID to maintain persistent access.

  Correct Answer: B

• Question 265:

  Which of the following represents a multifactor authentication system?

  A. An iris scanner coupled with a palm print reader and fingerprint scanner with liveness detection.

  B. A secret passcode that prompts the user to enter a secret key if entered correctly.

  C. A digital certificate on a physical token that is unlocked with a secret passcode.

  D. A one-time password token combined with a proximity badge.

  Correct Answer: D

• Question 266:

  An organization's policy requires users to create passwords with an uppercase letter, lowercase letter, number, and symbol. This policy is enforced with technical controls, which also prevents users from using any of their previous 12

  passwords. The quantization does not use single sign-on, nor does it centralize storage of passwords.

  The incident response team recently discovered that passwords for one system were compromised. Passwords for a completely separate system have NOT been compromised, but unusual login activity has been detected for that separate

  system. Account login has been detected for users who are on vacation.

  Which of the following BEST describes what is happening?

  A. Some users are meeting password complexity requirements but not password length requirements.

  B. The password history enforcement is insufficient, and old passwords are still valid across many different systems.

  C. Some users are reusing passwords, and some of the compromised passwords are valid on multiple systems.

  D. The compromised password file has been brute-force hacked, and the complexity requirements are not adequate to mitigate this risk.

  Correct Answer: D

• Question 267:

  A healthcare company is revamping its IT strategy in light of recent regulations. The company is concerned about compliance and wants to use a pay-per-use model. Which of the following is the BEST solution?

  A. On-premises hosting

  B. Community cloud

  C. Hosted infrastructure

  D. Public SaaS

  Correct Answer: D

• Question 268:

  Which of the following is a security consideration for IoT devices?

  A. IoT devices have built-in accounts that users rarely access.

  B. IoT devices have less processing capabilities.

  C. IoT devices are physically segmented from each other.

  D. IoT devices have purpose-built applications.

  Correct Answer: A

• Question 269:

  The Chief Information Officer (CIO) has determined the company's new PKI will not use OCSP. The purpose of OCSP still needs to be addressed. Which of the following should be implemented?

  A. Build an online intermediate CA.

  B. Implement a key escrow.

  C. Implement stapling.

  D. Install a CRL.

  Correct Answer: D

• Question 270:

  An organization needs to integrate with a third-party cloud application. The organization has 15000 users and does not want to allow the cloud provider to query its LDAP authentication server directly. Which of the following is the BEST way for the organization to integrate with the cloud application?

  A. Upload a separate list of users and passwords with a batch import.

  B. Distribute hardware tokens to the users for authentication to the cloud.

  C. Implement SAML with the organization's server acting as the identity provider.

  D. Configure a RADIUS federation between the organization and the cloud provider.

  Correct Answer: D