Sy0-401 I

Front 1

The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems. Which of the following phases of incident response is MOST appropriate as a FIRST response?

A. Recovery

B. Follow-up

C. Validation

D. Identification

E. Eradication

F. Containment

Back 1

D. Identification

Front 2

Which of the following protocols operates at the HIGHEST level of the OSI model?

A. ICMP

B. IPSec

C. SCP

D. TCP

Back 2

C. SCP

Front 3

Which of the following can be implemented in hardware or software to protect a web server from cross-site scripting attacks?

A. Intrusion Detection System

B. Flood Guard Protection

C. Web Application Firewall

D. URL Content Filter

Back 3

C. Web Application Firewall

Front 4

Jane, a security administrator, needs to implement a secure wireless authentication method that uses a remote RADIUS server for authentication.

Which of the following is an authentication method Jane should use?

A. WPA2-PSK

B. WEP-PSK

C. CCMP

D. LEAP

Back 4

D. LEAP

Front 5

Which of the following is being tested when a company's payroll server is powered off for eight hours?

A. Succession plan

B. Business impact document

C. Continuity of operations plan

D. Risk assessment plan

Back 5

C. Continuity of operations plan

Front 6

A network engineer is designing a secure tunneled VPN. Which of the following protocols would be the MOST secure?

A. IPSec

B. SFTP

C. BGP

D. PPTP

Back 6

A. IPSec

Front 7

Which of the following implementation steps would be appropriate for a public wireless hot-spot?

A. Reduce power level

B. Disable SSID broadcast

C. Open system authentication

D. MAC filter

Back 7

C. Open system authentication

Front 8

Which of the following is a step in deploying a WPA2-Enterprise wireless network?

A. Install a token on the authentication server

B. Install a DHCP server on the authentication server

C. Install an encryption key on the authentication server

D. Install a digital certificate on the authentication server

Back 8

D. Install a digital certificate on the authentication server

Front 9

Deploying a wildcard certificate is one strategy to:

A. Secure the certificate's private key.

B. Increase the certificate's encryption key length.

C. Extend the renewal date of the certificate.

D. Reduce the certificate management burden.

Back 9

D. Reduce the certificate management burden.

Front 10

Which of the following ciphers would be BEST used to encrypt streaming video?

A. RSA

B. RC4

C. SHA1

D. 3DES

Back 10

B. RC4

Front 11

A bank has a fleet of aging payment terminals used by merchants for transactional processing.

The terminals currently support single DES but require an upgrade in order to be compliant with security standards. Which of the following is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of transactional data?

A. AES

B. 3DES

C. RC4

D. WPA2

Back 11

B. 3DES

Front 12

Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?

A. WAF

B. NIDS

C. Routers

D. Switches

Back 12

A. WAF

Front 13

After a number of highly publicized and embarrassing customer data leaks as a result of social engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will reduce the risk of another data leak. Which of the following would be MOST effective in reducing data leaks in this situation?

A. Information Security Awareness
B. Social Media and BYOD
C. Data Handling and Disposal
D. Acceptable Use of IT Systems

Back 13

A. Information Security Awareness

Front 14

Which of the following is used to verify data integrity?

A. SHA
B. 3DES
C. AES
D. RSA

Back 14

A. SHA

Front 15

By default, which of the following uses TCP port 22? (Select THREE).

A. FTPS
B. STELNET
C. TLS
D. SCP
E. SSL
F. HTTPS
G. SSH
H. SFTP

Back 15

D. SCP, G. SSH, and H. SFTP

Front 16

Access mechanisms to data on encrypted USB hard drives must be implemented correctly
otherwise:

A. user accounts may be inadvertently locked out.
B. data on the USB drive could be corrupted.
C. data on the hard drive will be vulnerable to log analysis.
D. the security controls on the USB drive can be bypassed.

Back 16

D. the security controls on the USB drive can be bypassed.

Front 17

A security administrator is segregating all web-facing server traffic from the internal network and restricting it to a single interface on a firewall. Which of the following BEST describes this new network?

A. VLAN
B. Subnet
C. VPN
D. DMZ

Back 17

D. DMZ

Front 18

Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

A. Kerberos
B. TACACS+
C. RADIUS
D. LDAP

Back 18

D. LDAP

Front 19

Which of the following has a storage root key?

A. HSM
B. EFS
C. TPM
D. TKIP

Back 19

C. TPM

Front 20

The concept of rendering data passing between two points over an IP based network impervious
to all but the most sophisticated advanced persistent threats is BEST categorized as which of the
following?

A. Stream ciphers

B. Transport encryption
C. Key escrow
D. Block ciphers

Back 20

B. Transport encryption

Front 21

On Monday, all company employees report being unable to connect to the corporate wireless
network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were
made to the wireless network and its supporting infrastructure, and that there are no outages.

Which of the following is the MOST likely cause for this issue?

A. Too many incorrect authentication attempts have caused users to be temporarily disabled.
B. The DNS server is overwhelmed with connections and is unable to respond to queries.
C. The company IDS detected a wireless attack and disabled the wireless network.
D. The Remote Authentication Dial-In User Service server certificate has expired.

Back 21

D. The Remote Authentication Dial-In User Service server certificate has expired.

Front 22

A recent audit has discovered that at the time of password expiration clients are able to recycle the
previous credentials for authentication. Which of the following controls should be used together to
prevent this from occurring? (Select TWO).

A. Password age
B. Password hashing
C. Password complexity
D. Password history
E. Password length

Back 22

A. Password age, D. Password history

Front 23

A system administrator is configuring UNIX accounts to authenticate against an external server. The configuration file asks for the following information DC=ServerName and DC=COM. Which of the following authentication services is being used?

A. RADIUS
B. SAML
C. TACACS+
D. LDAP

Back 23

D. LDAP

Front 24

In Kerberos, the Ticket Granting Ticket (TGT) is used for which of the following?

A. Identification
B. Authorization
C. Authentication
D. Multifactor authentication

Back 24

C. Authentication

Front 25

Which of the following network design elements allows for many internal devices to share one
public IP address?

A. DNAT
B. PAT
C. DNS
D. DMZ

Back 25

B. PAT

Front 26

Which of the following components of an all-in-one security appliance would MOST likely be
configured in order to restrict access to peer-to-peer file sharing websites?

A. Spam filter
B. URL filter
C. Content inspection
D. Malware inspection

Back 26

B. URL filter

Front 27

When considering a vendor-specific vulnerability in critical industrial control systems which of the
following techniques supports availability?

A. Deploying identical application firewalls at the border
B. Incorporating diversity into redundant design
C. Enforcing application white lists on the support workstations
D. Ensuring the systems’ anti-virus definitions are up-to-date

Back 27

B. Incorporating diversity into redundant design

Front 28

During the information gathering stage of a deploying role-based access control model, which of
the following information is MOST likely required?

A. Conditional rules under which certain systems may be accessed
B. Matrix of job titles with required access privileges
C. Clearance levels of all company personnel
D. Normal hours of business operation

Back 28

B. Matrix of job titles with required access privileges

Front 29

A security technician is attempting to improve the overall security posture of an internal mail
server. Which of the following actions would BEST accomplish this goal?

A. Monitoring event logs daily
B. Disabling unnecessary services
C. Deploying a content filter on the network
D. Deploy an IDS on the network

Back 29

B. Disabling unnecessary services

Front 30

During the analysis of a PCAP file, a security analyst noticed several communications with a
remote server on port 53. Which of the following protocol types is observed in this traffic?

A. FTP
B. DNS
C. Email
D. NetBIOS

Back 30

B. DNS