Exam Code: SY0-401 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: CompTIA Security+ Certification
Certification Provider: CompTIA
Free Today! Guaranteed Training- Pass SY0-401 Exam.

2021 Dec SY0-401 free exam questions

Q461. After Ann, a user, logs into her banking websites she has access to her financial institution mortgage, credit card, and brokerage websites as well. Which of the following is being described? 

A. Trusted OS 

B. Mandatory access control 

C. Separation of duties 

D. Single sign-on 

Answer: D 

Explanation: 

Single sign-on means that once a user (or other subject) is authenticated into a realm, re-authentication is not required for access to resources on any realm entity. The question states that when Ann logs into her banking websites she has access to her financial institution mortgage, credit card, and brokerage websites as well. This describes an SSO scenario. 


Q462. A security administrator plans on replacing a critical business application in five years. Recently, there was a security flaw discovered in the application that will cause the IT department to manually re-enable user accounts each month at a cost of $2,000. Patching the application today would cost $140,000 and take two months to implement. Which of the following should the security administrator do in regards to the application? 

A. Avoid the risk to the user base allowing them to re-enable their own accounts 

B. Mitigate the risk by patching the application to increase security and saving money 

C. Transfer the risk replacing the application now instead of in five years 

D. Accept the risk and continue to enable the accounts each month saving money 

Answer: D 

Explanation: 

This is a risk acceptance measure that has to be implemented since the cost of patching would be too high compared to the cost to keep the system going as is. Risk acceptance is often the choice you must make when the cost of implementing any of the other four choices (i.e. risk deterrence, mitigation, transference or avoidance) exceeds the value of the harm that would occur if the risk came to fruition. 


Q463. Which of the following is the below pseudo-code an example of? 

IF VARIABLE (CONTAINS NUMBERS = TRUE) THEN EXIT 

A. Buffer overflow prevention 

B. Input validation 

C. CSRF prevention 

D. Cross-site scripting prevention 

Answer: B 

Explanation: 

Input validation is a defensive technique intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain. 


Q464. Which of the following would Jane, an administrator, use to detect an unknown security vulnerability? 

A. Patch management 

B. Application fuzzing 

C. ID badge 

D. Application configuration baseline 

Answer: B 

Explanation: 

Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. 


Q465. Which of the following firewall rules only denies DNS zone transfers? 

A. deny udp any any port 53 

B. deny ip any any 

C. deny tcp any any port 53 

D. deny all dns packets 

Answer: C 

Explanation: 

DNS operates over TCP and UDP port 53. TCP port 53 is used for zone transfers. 


Down to date SY0-401 exam answers:

Q466. A security technician needs to open ports on a firewall to allow for domain name resolution. 

Which of the following ports should be opened? (Select TWO). 

A. TCP 21 

B. TCP 23 

C. TCP 53 

D. UDP 23 

E. UDP 53 

Answer: C,E 

Explanation: 

DNS uses TCP and UDP port 53. TCP port 53 is used for zone transfers, whereas UDP port 53 is used for queries. 


Q467. Which of the following ports would be blocked if Pete, a security administrator, wants to deny access to websites? 

A. 21 

B. 25 

C. 80 

D. 3389 

Answer: C 

Explanation: 

Port 80 is used by HTTP, which is the foundation of data communication for the World Wide Web. 


Q468. A technician wants to securely collect network device configurations and statistics through a scheduled and automated process. Which of the following should be implemented if configuration integrity is most important and a credential compromise should not allow interactive logons? 

A. SNMPv3 

B. TFTP 

C. SSH 

D. TLS 

Answer: A 

Explanation: 


Q469. In order to maintain oversight of a third party service provider, the company is going to implement a Governance, Risk, and Compliance (GRC) system. This system is promising to provide overall security posture coverage. Which of the following is the MOST important activity that should be considered? 

A. Continuous security monitoring 

B. Baseline configuration and host hardening 

C. Service Level Agreement (SLA) monitoring 

D. Security alerting and trending 

Answer: A 

Explanation: 

The company is investing in a Governance, Risk, and Compliance (GRC) system to provide overall security posture coverage. This is great for testing the security posture. However, to be effective and ensure the company always has a good security posture, you need to monitor the security continuously. 

Once a baseline security configuration is documented, it is critical to monitor it to see that this baseline is maintained or exceeded. A popular phrase among personal trainers is “that which gets measured gets improved.” Well, in network security, “that which gets monitored gets secure.” Continuous monitoring means exactly that: ongoing monitoring. This may involve regular measurements of network traffic levels, routine evaluations for regulatory compliance, and checks of network security device configurations. 


Q470. Who should be contacted FIRST in the event of a security breach? 

A. Forensics analysis team 

B. Internal auditors 

C. Incident response team 

D. Software vendors 

Answer: C 

Explanation: 

A security breach is an incident and requires a response. The incident response team would be better equipped to deal with any incident insofar as all their procedures are concerned. Their procedures in addressing incidents are: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control.