CompTIA CompTIA Certifications SY0-501 Questions & Answers

• Question 81:

  A highly complex password policy has made it nearly impossible to crack account passwords. Which of the following might a hacker still be able to perform?

  A. Pass-the-hash attack

  B. ARP poisoning attack

  C. Birthday attack

  D. Brute force attack

  Correct Answer: A

• Question 82:

  An organization wants to implement a solution that allows for automated logical controls for network defense. An engineer plans to select an appropriate network security component, which automates response actions based on security threats to the network. Which of the following would be MOST appropriate based on the engineer's requirements?

  A. NIPS

  B. HIDS

  C. Web proxy

  D. Elastic load balancer

  E. NAC

  Correct Answer: A

• Question 83:

  A company recently experienced data exfiltration via the corporate network. In response to the breach, a security analyst recommends deploying an out-of-band IDS solution. The analyst says the solution can be implemented without purchasing any additional network hardware. Which of the following solutions will be used to deploy the IDS?

  A. Network tap

  B. Network proxy

  C. Honeypot

  D. Port mirroring

  Correct Answer: A

  Port Mirroring, also known as SPAN (Switched Port Analyzer), is a method of monitoring network traffic. With port mirroring enabled, the switch sends a copy of all network packets seen on one port (or an entire VLAN) to another port, where the packet can be analyzed.

• Question 84:

  An instructor is teaching a hands-on wireless security class and needs to configure a test access point to show students an attack on a weak protocol. Which of the following configurations should the instructor implement?

  A. WPA2

  B. WPA

  C. EAP

  D. WEP

  Correct Answer: D

• Question 85:

  A security analyst is hardening a large-scale wireless network. The primary requirements are the following: Must use authentication through EAP-TLS certificates Must use an AAA server Must use the most secure encryption protocol Given these requirements, which of the following should the analyst implement and recommend? (Select TWO.)

  A. 802.1X

  B. 802.3

  C. LDAP

  D. TKIP

  E. CCMP

  F. WPA2-PSK

  Correct Answer: AF

• Question 86:

  A security analyst receives a notification from the IDS after working hours, indicating a spike in network traffic. Which of the following BEST describes this type of IDS?

  A. Anomaly-based

  B. Stateful

  C. Host-based

  D. Signature-based

  Correct Answer: A

• Question 87:

  A Chief Information Security Officer (CISO) has tasked a security analyst with assessing the security posture of an organization and which internal factors would contribute to a security compromise. The analyst performs a walk-through of the organization and discovers there are multiple instances of unlabeled optical media on office desks. Employees in the vicinity either do not claim ownership or disavow any knowledge concerning who owns the media.

  Which of the following is the MOST immediate action to be taken?

  A. Confiscate the media and dispose of it in a secure manner as per company policy.

  B. Confiscate the media, insert it into a compter, find out what is on the disc, and then label it and return it to where it was found.

  C. Confiscate the media and wait for the owner to clain it. If it is not claimed within one month, shred it.

  D. Confiscate the media, insert it into a computer, make a copy of the disc, and then return the original to where it was found.

  Correct Answer: A

• Question 88:

  A number of employees report that parts of an ERP application are not working. The systems administrator reviews the following information from one of the employee workstations:

  Execute permission denied: financemodule.dll

  Execute permission denied: generalledger.dll

  Which of the following should the administrator implement to BEST resolve this issue while minimizing risk and attack exposure?

  A. Update the application blacklist

  B. Verify the DLL's file integrity

  C. Whitelist the affected libraries

  D. Place the affected employees in the local administrator's group

  Correct Answer: C

• Question 89:

  A security administrator has configured a RADIUS and a TACACS+ server on the company's network. Network devices will be required to connect to the TACACS+ server for authentication and send accounting information to the RADIUS server. Given the following information: RADIUS IP: 192.168.20.45 TACACS+ IP: 10.23.65.7 Which of the following should be configured on the network clients? (Select two.)

  A. Accounting port: TCP 389

  B. Accounting port: UDP 1812

  C. Accounting port: UDP 1813

  D. Authentication port: TCP 49

  E. Authentication port: TCP 88

  F. Authentication port: UDP 636

  Correct Answer: CD

• Question 90:

  Several workstations on a network are found to be on OS versions that are vulnerable to a specific attack. Which of the following is considered to be a corrective action to combat this vulnerability?

  A. Install an antivirus definition patch

  B. Educate the workstation users

  C. Leverage server isolation

  D. Install a vendor-supplied patch

  E. Install an intrusion detection system

  Correct Answer: D