★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW SY0-401 Exam Dumps (PDF & VCE):
Available on: https://www.certleader.com/SY0-401-dumps.html


It is impossible to pass CompTIA SY0-401 exam without any help in the short term. Come to Ucertify soon and find the most advanced, correct and guaranteed CompTIA SY0-401 practice questions. You will get a surprising result by our Leading CompTIA Security+ Certification practice guides.

2021 Mar SY0-401 exam guide

Q261. A hospital IT department wanted to secure its doctor’s tablets. The IT department wants operating system level security and the ability to secure the data from alteration. Which of the following methods would MOST likely work? 

A. Cloud storage 

B. Removal Media 

C. TPM 

D. Wiping 

Answer: C 

Explanation: 

Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system’s motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. 


Q262. Which of the following protocols is vulnerable to man-in-the-middle attacks by NOT using end to end TLS encryption? 

A. HTTPS 

B. WEP 

C. WPA 

D. WPA 2 

Answer: B 

Explanation: 

WEP offers no end-to-end TLS encryption. 

The WEP process consists of a series of steps as follows: 

The wireless client sends an authentication request. 

The Access Point (AP) sends an authentication response containing clear-text (uh-oh!) challenge 

text. 

The client takes the challenge text received and encrypts it using a static WEP key. 

The client sends the encrypted authentication packet to the AP. 

The AP encrypts the challenge text using its own static WEP key and compares the result to the 

authentication packet sent by the client. If the results match, the AP begins the association 

process for the wireless client. 

The big issue with WEP is the fact that it is very susceptible to a Man in the Middle attack. The 

attacker captures the clear-text challenge and then the authentication packet reply. The attacker 

then reverses the RC4 encryption in order to derive the static WEP key. Yikes! 

As you might guess, the designers attempted to strengthen WEP using the approach of key 

lengths. The native Windows client supported a 104-bit key as opposed to the initial 40-bit key. 

The fundamental weaknesses in the WEP process still remained however. 


Q263. A company hosts its public websites internally. The administrator would like to make some changes to the architecture. 

The three goals are: 

(1)

 reduce the number of public IP addresses in use by the web servers 

 (2)

 drive all the web traffic through a central point of control 

 (3)

 mitigate automated attacks that are based on IP address scanning 

Which of the following would meet all three goals? 

A. Firewall 

B. Load balancer 

C. URL filter 

D. Reverse proxy 

Answer: D 

Explanation: 


Q264. Which of the following is the difference between identification and authentication of a user? 

A. Identification tells who the user is and authentication tells whether the user is allowed to logon to a system. 

B. Identification tells who the user is and authentication proves it. 

C. Identification proves who the user is and authentication is used to keep the users data secure. 

D. Identification proves who the user is and authentication tells the user what they are allowed to do. 

Answer: B 

Explanation: 

Identification is described as the claiming of an identity, and authentication is described as the act of verifying or proving the claimed identity. 


Q265. A recent vulnerability scan found that Telnet is enabled on all network devices. Which of the following protocols should be used instead of Telnet? 

A. SCP 

B. SSH 

C. SFTP 

D. SSL 

Answer: B 

Explanation: 

SSH transmits both authentication traffic and data in a secured encrypted form, whereas Telnet transmits both authentication credentials and data in clear text. 


Improved SY0-401 exam prep:

Q266. Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? 

Host 192.168.1.123 

[00:

 00: 01]Successful Login: 015 192.168.1.123 : local 

 [00:

 00: 03]Unsuccessful Login: 022 214.34.56.006 : RDP 192.168.1.124 

 [00:

 00: 04]UnSuccessful Login: 010 214.34.56.006 : RDP 192.168.1.124 

 [00:

 00: 07]UnSuccessful Login: 007 214.34.56.006 : RDP 192.168.1.124 

 [00:

 00: 08]UnSuccessful Login: 003 214.34.56.006 : RDP 192.168.1.124 

A. 

Reporting 

B. 

IDS 

C. 

Monitor system logs 

D. 

Hardening 

Answer: D 

Explanation: 

We can see a number of unsuccessful login attempts using a Remote Desktop Connection (using the RDP protocol) from a computer with the IP address 192.168.1.124. Someone successfully logged in locally. This is probably an authorized login (for example, Joe logging in). Hardening is the process of securing a system. We can harden (secure) the system by either disallowing remote desktop connections altogether or by restricting which IPs are allowed to initiate remote desktop connections. 


Q267. Which of the following can be utilized in order to provide temporary IT support during a disaster, where the organization sets aside funds for contingencies, but does not necessarily have a dedicated site to restore those services? 

A. Hot site 

B. Warm site 

C. Cold site 

D. Mobile site 

Answer: D 

Explanation: 

Not having a dedicated site means that the mobile site can fill the role of either being a hot, warm or cold site as a disaster recovery measure. 


Q268. An administrator needs to secure a wireless network and restrict access based on the hardware address of the device. Which of the following solutions should be implemented? 

A. Use a stateful firewall 

B. Enable MAC filtering 

C. Upgrade to WPA2 encryption 

D. Force the WAP to use channel 1 

Answer: B 

Explanation: 


Q269. A security analyst informs the Chief Executive Officer (CEO) that a security breach has just occurred. This results in the Risk Manager and Chief Information Officer (CIO) being caught unaware when the CEO asks for further information. Which of the following strategies should be implemented to ensure the Risk Manager and CIO are not caught unaware in the future? 

A. Procedure and policy management 

B. Chain of custody management 

C. Change management 

D. Incident management 

Answer: D 

Explanation: 

incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). The events that could occur include security breaches. 


Q270. Which of the following mitigation strategies is established to reduce risk when performing updates to business critical systems? 

A. Incident management 

B. Server clustering 

C. Change management 

D. Forensic analysis 

Answer: C 

Explanation: 

Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company’s assets. In this case ‘performing updates to business critical systems.