we provide Precise CompTIA comptia sy0 401 exam question which are the best for clearing comptia security+ sy0 401 test, and to get certified by CompTIA CompTIA Security+ Certification. The comptia security+ study guide sy0 401 Questions & Answers covers all the knowledge points of the real comptia security+ sy0 401 exam. Crack your CompTIA comptia security+ study guide sy0 401 Exam with latest dumps, guaranteed!

Q271. Which of the following BEST represents the goal of a vulnerability assessment? 

A. To test how a system reacts to known threats 

B. To reduce the likelihood of exploitation 

C. To determine the system’s security posture 

D. To analyze risk mitigation strategies 

Answer: C 

Explanation: 

A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. 

A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. 


Q272. Which of the following provides additional encryption strength by repeating the encryption process with additional keys? 

A. AES 

B. 3DES 

C. TwoFish 

D. Blowfish 

Answer: B 

Explanation: 

Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it’s more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys). 


Q273. Ann works at a small company and she is concerned that there is no oversight in the finance department; specifically, that Joe writes, signs and distributes paycheques, as well as other expenditures. Which of the following controls can she implement to address this concern? 

A. Mandatory vacations 

B. Time of day restrictions 

C. Least privilege 

D. Separation of duties 

Answer: D 

Explanation: 

Separation of duties divides administrator or privileged tasks into separate groupings, which in turn, is individually assigned to unique administrators. This helps in fraud prevention, error reduction, as well as conflict of interest prevention. For example, those who configure security should not be the same people who test security. In this case, Joe should not be allowed to write and sign paycheques. 


Q274. A user ID and password together provide which of the following? 

A. Authorization 

B. Auditing 

C. Authentication 

D. Identification 

Answer: C 

Explanation: 

Authentication generally requires one or more of the following: 

Something you know: a password, code, PIN, combination, or secret phrase. 

Something you have: a smart card, token device, or key. 

Something you are: a fingerprint, a retina scan, or voice recognition; often referred to as 

biometrics, discussed later in this chapter. 

Somewhere you are: a physical or logical location. 

Something you do: typing rhythm, a secret handshake, or a private knock. 


Q275. Which of the following are Data Loss Prevention (DLP) strategies that address data in transit issues? (Select TWO). 

A. Scanning printing of documents. 

B. Scanning of outbound IM (Instance Messaging). 

C. Scanning copying of documents to USB. 

D. Scanning of SharePoint document library. 

E. Scanning of shared drives. 

F. Scanning of HTTP user traffic. 

Answer: B,F 

Explanation: 

DLP systems monitor the contents of systems (workstations, servers, networks) to make sure key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access) and transmitting the data. Outbound IM and HTTP user traffic refers to data over a network which falls within the DLP strategy. 


Q276. NO: 36 

Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote sites through a VPN connection. How could Sara BEST accommodate the vendor? 

A. Allow incoming IPSec traffic into the vendor’s IP address. 

B. Set up a VPN account for the vendor, allowing access to the remote site. 

C. Turn off the firewall while the vendor is in the office, allowing access to the remote site. 

D. Write a firewall rule to allow the vendor to have access to the remote site. 

Answer: D 

Explanation: 

Firewall rules are used to define what traffic is able pass between the firewall and the internal network. Firewall rules block the connection, allow the connection, or allow the connection only if it is secured. Firewall rules can be applied to inbound traffic or outbound traffic and any type of network. 


Q277. Which of the following solutions provides the most flexibility when testing new security controls prior to implementation? 

A. Trusted OS 

B. Host software baselining 

C. OS hardening 

D. Virtualization 

Answer: D 

Explanation: 


Q278. Users need to exchange a shared secret to begin communicating securely. Which of the following is another name for this symmetric key? 

A. Session Key 

B. Public Key 

C. Private Key 

D. Digital Signature 

Answer: C 

Explanation: 

Explanation: Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. A symmetric key, sometimes referred to as a secret key or private key, is a key that isn’t disclosed to people who aren’t authorized to use the encryption system. 


Q279. Which of the following can hide confidential or malicious data in the whitespace of other files (e.g. JPEGs)? 

A. Hashing 

B. Transport encryption 

C. Digital signatures 

D. Steganography 

Answer: D 

Explanation: 

Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message. 


Q280. Which of the following is a difference between TFTP and FTP? 

A. TFTP is slower than FTP. 

B. TFTP is more secure than FTP. 

C. TFTP utilizes TCP and FTP uses UDP. 

D. TFTP utilizes UDP and FTP uses TCP. 

Answer: D 

Explanation: 

FTP employs TCP ports 20 and 21 to establish and maintain client-to-server communications, whereas TFTP makes use of UDP port 69.