Want to know Actualtests sy0 401 study guide pdf Exam practice test features? Want to lear more about CompTIA CompTIA Security+ Certification certification experience? Study Breathing CompTIA comptia security+ get certified get ahead sy0 401 study guide answers to Up to the immediate present comptia security+ study guide sy0 401 questions at Actualtests. Gat a success with an absolute guarantee to pass CompTIA sy0 401 dump (CompTIA Security+ Certification) test on your first attempt.

Q81. A malicious program modified entries in the LMHOSTS file of an infected system. Which of the following protocols would have been affected by this? 

A. ICMP 

B. BGP 

C. NetBIOS 

D. DNS 

Answer: C 

Explanation: 

The LMHOSTS file provides a NetBIOS name resolution method that can be used for small networks that do not use a WINS server. NetBIOS has been adapted to run on top of TCP/IP, and is still extensively used for name resolution and registration in Windows-based environments. 


Q82. A security administrator wishes to increase the security of the wireless network. Which of the following BEST addresses this concern? 

A. Change the encryption from TKIP-based to CCMP-based. 

B. Set all nearby access points to operate on the same channel. 

C. Configure the access point to use WEP instead of WPA2. 

D. Enable all access points to broadcast their SSIDs. 

Answer: A 

Explanation: 

CCMP makes use of 128-bit AES encryption with a 48-bit initialization vector. This initialization vector makes cracking a bit more difficult. 


Q83. Which of the following BEST describes a demilitarized zone? 

A. A buffer zone between protected and unprotected networks. 

B. A network where all servers exist and are monitored. 

C. A sterile, isolated network segment with access lists. 

D. A private network that is protected by a firewall and a VLAN. 

Answer: A 

Explanation: 

A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall. 


Q84. Jane, an IT security technician, needs to create a way to secure company mobile devices. Which of the following BEST meets this need? 

A. Implement voice encryption, pop-up blockers, and host-based firewalls. 

B. Implement firewalls, network access control, and strong passwords. 

C. Implement screen locks, device encryption, and remote wipe capabilities. 

D. Implement application patch management, antivirus, and locking cabinets. 

Answer: C 

Explanation: Screen-lock is a security feature that requires the user to enter a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it will be difficult for anyone else to access your data or applications. Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. 


Q85. Which of the following MOST interferes with network-based detection techniques? 

A. Mime-encoding 

B. SSL 

C. FTP 

D. Anonymous email accounts 

Answer: B 

Explanation: 

Secure Sockets Layer (SSL) is used to establish secure TCP communication between two machines by encrypting the communication. Encrypted communications cannot easily be inspected for anomalies by network-based intrusion detection systems (NIDS). 


Q86. A security administrator is reviewing the company’s continuity plan. The plan specifies an RTO of six hours and RPO of two days. Which of the following is the plan describing? 

A. Systems should be restored within six hours and no later than two days after the incident. 

B. Systems should be restored within two days and should remain operational for at least six hours. 

C. Systems should be restored within six hours with a minimum of two days worth of data. 

D. Systems should be restored within two days with a minimum of six hours worth of data. 

Answer: C 

Explanation: 

The recovery time objective (RTO) is the maximum amount of time that a process or service is allowed to be down and the consequences still to be considered acceptable. Beyond this time, the break in business continuity is considered to affect the business negatively. The RTO is agreed on during the business impact analysis (BIA) creation. 

The recovery point objective (RPO) is similar to RTO, but it defines the point at which the system needs to be restored. This could be where the system was two days before it crashed (whip out the old backup tapes) or five minutes before it crashed (requiring complete redundancy). As a general rule, the closer the RPO matches the item of the crash, the more expensive it is to obtain. 


Q87. Which of the following should Matt, a security administrator, include when encrypting smartphones? (Select TWO). 

A. Steganography images 

B. Internal memory 

C. Master boot records 

D. Removable memory cards 

E. Public keys 

Answer: B,D 

Explanation: 

All useable data on the device should be encrypted. This data can be located on the hard drive, or removable drives, such as USB devices and memory cards, and on internal memory. 


Q88. The security manager received a report that an employee was involved in illegal activity and has saved data to a workstation’s hard drive. During the investigation, local law enforcement’s criminal division confiscates the hard drive as evidence. Which of the following forensic procedures is involved? 

A. Chain of custody 

B. System image 

C. Take hashes 

D. Order of volatility 

Answer: A 

Explanation: 

Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. 


Q89. Which of the following security account management techniques should a security analyst implement to prevent staff, who has switched company roles, from exceeding privileges? 

A. Internal account audits 

B. Account disablement 

C. Time of day restriction 

D. Password complexity 

Answer: A 

Explanation: 

Internal account auditing will allow you to switch the appropriate users to the proper accounts required after the switching of roles occurred and thus check that the principle of least privilege is followed. 


Q90. The string: 

‘ or 1=1-- -

Represents which of the following? 

A. Bluejacking 

B. Rogue access point 

C. SQL Injection 

D. Client-side attacks 

Answer: C 

Explanation: 

The code in the question is an example of a SQL Injection attack. The code ‘1=1’ will always provide a value of true. This can be included in statement designed to return all rows in a SQL table. 

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.