It is impossible to pass CompTIA SY0-401 exam without any help in the short term. Come to Examcollection soon and find the most advanced, correct and guaranteed CompTIA SY0-401 practice questions. You will get a surprising result by our Updated CompTIA Security+ Certification practice guides.

2021 Mar SY0-401 exams

Q71. Which of the following types of wireless attacks would be used specifically to impersonate another WAP in order to gain unauthorized information from mobile users? 

A. IV attack 

B. Evil twin 

C. War driving 

D. Rogue access point 

Answer: B 

Explanation: 

An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits. 

Q72. Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need to use to verify the validity’s of Joe’s certificate? (Select TWO). 

A. The CA’s public key 

B. Joe’s private key 

C. Ann’s public key 

D. The CA’s private key 

E. Joe’s public key 

F. Ann’s private key 

Answer: A,E 

Explanation: 

Joe wants to send a message to Ann. It’s important that this message not be altered. Joe will use the private key to create a digital signature. The message is, in effect, signed with the private key. Joe then sends the message to Ann. Ann will use the public key attached to the message to validate the digital signature. If the values match, Ann knows the message is authentic and came from Joe. Ann will use a key provided by Joe—the public key—to decrypt the message. Most digital signature implementations also use a hash to verify that the message has not been altered, intentionally or accidently, in transit. Thus Ann would compare the signature area referred to as a message in the message with the calculated value digest (her private key in this case). If the values match, the message hasn’t been tampered with and the originator is verified as the person they claim to be. This process provides message integrity, nonrepudiation, and authentication. A certificate authority (CA) is an organization that is responsible for issuing, revoking, and distributing certificates. A certificate is nothing more than a mechanism that associates the public key with an individual. If Joe wants to send Ann an encrypted e-mail, there should be a mechanism to verify to Ann that the message received from Mike is really from Joe. If a third party (the CA) vouches for Joe and Ann trusts that third party, Ann can assume that the message is authentic because the third party says so. 

Q73. Users require access to a certain server depending on their job function. Which of the following would be the MOST appropriate strategy for securing the server? 

A. Common access card 

B. Role based access control 

C. Discretionary access control 

D. Mandatory access control 

Answer: B 

Explanation: 

Role-based Access Control is basically based on a user’s job description. When a user is assigned a specific role in an environment, that user’s access to objects is granted based on the required tasks of that role. 

Q74. Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites? 

A. Spam filter 

B. URL filter 

C. Content inspection 

D. Malware inspection 

Answer: B 

Explanation: 

Q75. On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages. 

Which of the following is the MOST likely cause for this issue? 

A. Too many incorrect authentication attempts have caused users to be temporarily disabled. 

B. The DNS server is overwhelmed with connections and is unable to respond to queries. 

C. The company IDS detected a wireless attack and disabled the wireless network. 

D. The Remote Authentication Dial-In User Service server certificate has expired. 

Answer: D 

Explanation: 

The question states that the network uses 802.1x with PEAP. The 802.1x authentication server is typically an EAP-compliant Remote Access Dial-In User Service (RADIUS). A RADIUS server will be configured with a digital certificate. When a digital certificate is created, an expiration period is configured by the Certificate Authority (CA). The expiration period is commonly one or two years. The question states that no configuration changes have been made so it’s likely that the certificate has expired. 

Up to date SY0-401 exam:

Q76. Which of the following can Joe, a security administrator, implement on his network to capture attack details that are occurring while also protecting his production network? 

A. Security logs 

B. Protocol analyzer 

C. Audit logs 

D. Honeypot 

Answer: D 

Explanation: 

A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study 

the attack to research current attack methodologies. 

According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main 

purposes: 

The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning 

where the system has weaknesses that need to be redesigned. 

The hacker can be caught and stopped while trying to obtain root access to the system. 

By studying the activities of hackers, designers can better create more secure systems that are 

potentially invulnerable to future hackers. 

There are two main types of honeypots: 

Production - A production honeypot is one used within an organization's environment to help 

mitigate risk. 

Research – A research honeypot add value to research in computer security by providing a platform to study the threat. 

Q77. An administrator is looking to implement a security device which will be able to not only detect network intrusions at the organization level, but help defend against them as well. Which of the following is being described here? 

A. NIDS 

B. NIPS 

C. HIPS 

D. HIDS 

Answer: B 

Explanation: 

Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it 

Q78. Two members of the finance department have access to sensitive information. The company is concerned they may work together to steal information. Which of the following controls could be implemented to discover if they are working together? 

A. Least privilege access 

B. Separation of duties 

C. Mandatory access control 

D. Mandatory vacations 

Answer: D 

Explanation: 

A mandatory vacation policy requires all users to take time away from work to refresh. Mandatory vacation give the employee a chance to refresh, but it also gives the company a chance to make sure that others can fill in any gaps in skills and satisfies the need to have replication or duplication at all levels. Mandatory vacations also provide an opportunity to discover fraud. In this case mandatory vacations can prevent the two members from colluding to steal the information that they have access to. 

Q79. After visiting a website, a user receives an email thanking them for a purchase which they did not request. Upon investigation the security administrator sees the following source code in a pop-up window: 

<HTML> 

<body onload="document.getElementByID(‘badForm’).submit()"> 

<form id="badForm" action="shoppingsite.company.com/purchase.php" method="post" > 

<input name="Perform Purchase" value="Perform Purchase"/> 

</form> 

</body> 

</HTML> 

Which of the following has MOST likely occurred? 

A. SQL injection 

B. Cookie stealing 

C. XSRF 

D. XSS 

Answer: C 

Explanation: 

XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application’s trust of a user who known or is supposed to have been authenticated. This is often accomplished without the user’s knowledge. 

Q80. Which of the following best practices makes a wireless network more difficult to find? 

A. Implement MAC filtering 

B. UseWPA2-PSK 

C. Disable SSID broadcast 

D. Power down unused WAPs 

Answer: C 

Explanation: 

Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it’s a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn’t for public use.