CompTIA SY0-501 Online Practice Questions and Exam Preparation

CompTIA SY0-501 Online Questions & Answers

• Question 321:

  Which of the following BEST describes the concept of perfect forward secrecy?

  A. Using quantum random number generation to make decryption effectively impossible
  B. Preventing cryptographic reuse so a compromise of one operation does not affect other operations
  C. Implementing elliptic curve cryptographic algorithms with true random numbers
  D. The use of NDAs and policy controls to prevent disclosure of company secrets
  B. Preventing cryptographic reuse so a compromise of one operation does not affect other operations

• Question 322:

  An organization requires users to provide their fingerprints to access an application. To improve security, the application developers intend to implement multifactor authentication. Which of the following should be implemented?

  A. Use a camera for facial recognition
  B. Have users sign their name naturally
  C. Require a palm geometry scan
  D. Implement iris recognition
  B. Have users sign their name naturally

• Question 323:

  A security analyst accesses corporate web pages and inputs random data in the forms. The response received includes the type of database used and SQL commands that the database accepts. Which of the following should the security analyst use to prevent this vulnerability?

  A. Application fuzzing
  B. Error handling
  C. Input validation
  D. Pointer dereference
  C. Input validation

• Question 324:

  An organization is looking to build its second head office another city, which has a history flooding with an average of two flooding every 100 years. The estimated building cost is $1 million, an the estimated damage due to flooding is half of the building's cost.

  Given this information, which of the following is the SLE?

  A. $50,000
  B. $250,000
  C. $500,000
  D. $1,000,000
  C. $500,000

• Question 325:

  During a forensic investigation, which of the following must be addressed FIRST according to the order of volatility?

  A. Hard drive
  B. RAM
  C. Network attached storage
  D. USB flash drive
  B. RAM

• Question 326:

  Which of the following controls is implemented in lieu of the primary security controls?

  A. Compensating
  B. Corrective
  C. Detective
  D. Deterrent
  A. Compensating

• Question 327:

  A company is planning to build an internal website that allows for access to outside contracts and partners. A majority of the content will only be to internal employees with the option to share. Which of the following concepts is MOST appropriate?

  A. VPN
  B. Proxy
  C. DMZ D. Extranet
  D

• Question 328:

  During a data breach cleanup, it is discovered that not all of the sites involved have the necessary data wiping tools. The necessary tools are quickly distributed to the required technicians, but when should this problem BEST be revisited?

  A. Reporting
  B. Preparation
  C. Mitigation
  D. Lessons Learned
  D. Lessons Learned

• Question 329:

  A security analyst is performing a quantitative risk analysis. The risk analysis should show the potential monetary loss each time a threat or event occurs. Given this requirement, which of the following concepts would assist the analyst in determining this value? (Select two.)

  A. ALE
  B. AV
  C. ARO
  D. EF
  E. ROI
  B. AV
  D. EF

• Question 330:

  A security administrator has been conducting an account permissions review that has identified several users who belong to functional groups and groups responsible for auditing the functional groups' actions. Several recent outages have not been able to be traced to any user. Which of the following should the security administrator recommend to preserve future audit tag integrity?

  A. Enforcing stricter onboarding workflow policies.
  B. Applying least privilege to user group membership.
  C. Following standard naming conventions for audit group users.
  D. Restricting audit group membership to service accounts.
  D. Restricting audit group membership to service accounts.