CompTIA SY0-501 Online Practice Questions and Exam Preparation

CompTIA SY0-501 Online Questions & Answers

• Question 531:

  The data backup window has expanded into the morning hours and has begun to affect production users. The main bottleneck in the process is the time it takes to replicate the backups to separate severs at the offsite data center. Which of the following uses of deduplication could be implemented to reduce the backup window?

  A. Implement deduplication at the network level between the two locations
  B. Implement deduplication on the storage array to reduce the amount of drive space needed
  C. Implement deduplication on the server storage to reduce the data backed up
  D. Implement deduplication on both the local and remote servers
  B. Implement deduplication on the storage array to reduce the amount of drive space needed

• Question 532:

  A network administrator has been asked to install an IDS to improve the security posture of an organization. Which of the following control types Is an IDS?

  A. Corrective
  B. Physical
  C. Detective
  D. Administrative
  C. Detective

• Question 533:

  The president of a company that specializes in military contracts receives a request for an interview. During the interview, the reporter seems more interested in discussing the president's family life and personal history than the details of a recent company success. Which of the following security concerns is this MOST likely an example of?

  A. Insider threat
  B. Social engineering
  C. Passive reconnaissance
  D. Phishing
  B. Social engineering

• Question 534:

  DRAG DROP

  A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.

  Select and Place:

  

  

  ---

  When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone.

  Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and

  printouts.

  Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and

  expenses associated with the investigation.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, p. 453

• Question 535:

  Which of the following vulnerability types would the type of hacker known as a script kiddie be MOST dangerous against?

  A. Passwords written on the bottom of a keyboard
  B. Unpatched exploitable Internet-facing services
  C. Unencrypted backup tapes
  D. Misplaced hardware token
  B. Unpatched exploitable Internet-facing services

• Question 536:

  A security administrator is trying to eradicate a worm, which is spreading throughout the organization, using an old remote vulnerability in the SMB protocol. The worm uses Nmap to identify target hosts within the company. The administrator wants to implement a solution that will eradicate the current worm and any future attacks that may be using zero-day vulnerabilities. Which of the following would BEST meet the requirements when implemented?

  A. Host-based firewall
  B. Enterprise patch management system
  C. Network-based intrusion prevention system
  D. Application blacklisting
  E. File integrity checking
  C. Network-based intrusion prevention system

• Question 537:

  The security administrator has installed a new firewall which implements an implicit DENY policy by default. Click on the firewall and configure it to allow ONLY the following communication.

  1.

  The Accounting workstation can ONLY access the web server on the public network over the default HTTPS port. The accounting workstation should not access other networks.

  2.

  The HR workstation should be restricted to communicate with the Financial server ONLY, over the default SCP port

  3.

  The Admin workstation should ONLY be able to access the servers on the secure network over the default TFTP port.

  Instructions: The firewall will process the rules in a top-down manner in order as a first match The port number must be typed in and only one port number can be entered per rule Type ANY for all ports. The original firewall configuration can

  be reset at any time by pressing the reset button. Once you have met the simulation requirements, click save and then Done to submit.

  

  Hot Area:

  

  

  ---

  Section: Network Security Implicit deny is the default security stance that says if you aren't specifically granted access or privileges for a resource, you're denied access by default. Rule #1 allows the Accounting workstation to ONLY access the web server on the public network over the default HTTPS port, which is TCP port 443. Rule #2 allows the HR workstation to ONLY communicate with the Financial server over the default SCP port, which is TCP Port 22 Rule #3 and Rule #4 allow the Admin workstation to ONLY access the Financial and Purchasing servers located on the secure network over the default TFTP port, which is Port 69. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 26, 44 http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 538:

  Which of the following network vulnerability scan indicators BEST validates a successful, active scan?

  A. The scan job is scheduled to run during off-peak hours.
  B. The scan output lists SQL injection attack vectors.
  C. The scan data identifies the use of privileged-user credentials.
  D. The scan results identify the hostname and IP address.
  D. The scan results identify the hostname and IP address.

• Question 539:

  An attacker compromises a public CA and issues unauthorized X.509 certificates for Company.com. In the future, Company.com wants to mitigate the impact of similar incidents. Which of the following would assist Company.com with its goal?

  A. Certificate pinning
  B. Certificate stapling
  C. Certificate chaining
  D. Certificate with extended validation
  A. Certificate pinning

• Question 540:

  A security administrator is creating a risk assessment with regard to how to harden internal communications in transit between servers. Which of the following should the administrator recommend in the report?

  A. Configure IPSec in transport mode.
  B. Configure server-based PKI certificates.
  C. Configure the GRE tunnel.
  D. Configure a site-to-site tunnel.
  B. Configure server-based PKI certificates.