Your success in CompTIA comptia security+ sy0 401 pdf is our sole target and we develop all our comptia security+ get certified get ahead sy0 401 study guide braindumps in a way that facilitates the attainment of this target. Not only is our sy0 401 study guide pdf study material the best you can find, it is also the most detailed and the most updated. sy0 401 vce Practice Exams for CompTIA Security+ sy0 401 vce are written to the highest standards of technical accuracy.

Q301. Sara, a security analyst, is trying to prove to management what costs they could incur if their customer database was breached. This database contains 250 records with PII. Studies show that the cost per record for a breach is $300. The likelihood that their database would be breached in the next year is only 5%. Which of the following is the ALE that Sara should report to management for a security breach? 

A. $1,500 

B. $3,750 

C. $15,000 

D. $75,000 

Answer: B 

Explanation: 

SLE × ARO = ALE, where SLE is equal to asset value (AV) times exposure factor (EF); and ARO 

is the annualized rate of occurrence. 

SLE = 250 x $300; ARO = 5% 

$75000 x 0.05 = $3750 


Q302. A company has implemented PPTP as a VPN solution. Which of the following ports would need to be opened on the firewall in order for this VPN to function properly? (Select TWO). 

A. UDP 1723 

B. TCP 500 

C. TCP 1723 

D. UDP 47 

E. TCP 47 

Answer: C,D 

Explanation: 

A PPTP tunnel is instantiated by communication to the peer on TCP port 1723. This TCP connection is then used to initiate and manage a second GRE tunnel to the same peer. The PPTP GRE packet format is non-standard, including an additional acknowledgement field replacing the typical routing field in the GRE header. However, as in a normal GRE connection, those modified GRE packets are directly encapsulated into IP packets, and seen as IP protocol number 47. 


Q303. A systems engineer has been presented with storage performance and redundancy requirements for a new system to be built for the company. The storage solution must be designed to support the highest performance and must also be able to support more than one drive failure. Which of the following should the engineer choose to meet these requirements? 

A. A mirrored striped array with parity 

B. A mirrored mirror array 

C. A striped array 

D. A striped array with parity 

Answer: B 

Explanation: 


Q304. A technician is investigating intermittent switch degradation. The issue only seems to occur when the building’s roof air conditioning system runs. Which of the following would reduce the connectivity issues? 

A. Adding a heat deflector 

B. Redundant HVAC systems 

C. Shielding 

D. Add a wireless network 

Answer: C 

Explanation: 

EMI can cause circuit overload, spikes, or even electrical component failure. In the question it is mentioned that switch degradation occurs when the building’s roof air-conditioning system is also running. All electromechanical systems emanate EMI. Thus you could alleviate the problem using EMI shielding. 


Q305. The security administrator is implementing a malware storage system to archive all malware seen by the company into a central database. The malware must be categorized and stored based on similarities in the code. Which of the following should the security administrator use to identify similar malware? 

A. TwoFish 

B. SHA-512 

C. Fuzzy hashes 

D. HMAC 

Answer: C 

Explanation: 

Hashing is used to ensure that a message has not been altered. It can be useful for positively identifying malware when a suspected file has the same hash value as a known piece of malware. However, modifying a single bit of a malicious file will alter its hash value. To counter this, a continuous stream of hash values is generated for rolling block of code. This can be used to determine the similarity between a suspected file and known pieces of malware. 


Q306. A retail store uses a wireless network for its employees to access inventory from anywhere in the store. Due to concerns regarding the aging wireless network, the store manager has brought in a consultant to harden the network. During the site survey, the consultant discovers that the network was using WEP encryption. Which of the following would be the BEST course of action for the consultant to recommend? 

A. Replace the unidirectional antenna at the front of the store with an omni-directional antenna. 

B. Change the encryption used so that the encryption protocol is CCMP-based. 

C. Disable the network's SSID and configure the router to only access store devices based on MAC addresses. 

D. Increase the access point's encryption from WEP to WPA TKIP. 

Answer: B 

Explanation: 


Q307. In PKI, a key pair consists of: (Select TWO). 

A. A key ring 

B. A public key 

C. A private key 

D. Key escrow 

E. A passphrase 

Answer: B,C 

Explanation: 

In a PKI the sender encrypts the data using the receiver's public key. The receiver decrypts the data using his own private key. The key pair consists of these two keys. 


Q308. A security analyst performs the following activities: monitors security logs, installs surveillance cameras and analyzes trend reports. Which of the following job responsibilities is the analyst performing? (Select TWO). 

A. Detect security incidents 

B. Reduce attack surface of systems 

C. Implement monitoring controls 

D. Hardening network devices 

E. Prevent unauthorized access 

Answer: A,C 

Explanation: 

By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is implementing monitoring controls. With the monitoring controls in place, by monitoring the security logs, reviewing the footage from the security cameras and analyzing trend reports, the security analyst is able to detect security incidents. 


Q309. A security administrator must implement a firewall rule to allow remote employees to VPN onto the company network. The VPN concentrator implements SSL VPN over the standard HTTPS port. Which of the following is the MOST secure ACL to implement at the company's gateway firewall? 

A. PERMIT TCP FROM ANY 443 TO 199.70.5.25 443 

B. PERMIT TCP FROM ANY ANY TO 199.70.5.23 ANY 

C. PERMIT TCP FROM 199.70.5.23 ANY TO ANY ANY 

D. PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443 

Answer: D 

Explanation: 


Q310. Which of the following is the BEST method for ensuring all files and folders are encrypted on all corporate laptops where the file structures are unknown? 

A. Folder encryption 

B. File encryption 

C. Whole disk encryption 

D. Steganography 

Answer: C 

Explanation: 

Full-disk encryption encrypts the data on the hard drive of the device or on a removable drive. This feature ensures that the data on the device or removable drive cannot be accessed in a useable form should it be stolen. Furthermore, full-disk encryption is not dependant on knowledge of the file structure.