CompTIA SY0-201

SY0-201 CompTIA Security +( 2008 Edition) Exam

Practice Test

Updated: Oct 1, 2009

Version 1.5
 CompTIA SY0-201: Practice Exam
QUESTION NO: 1

Who is responsible for establishing access permissions to network resources in the DAC access
control model?

A. The system administrator.

B. The owner of the resource.
C. The system administrator and the owner of the resource.
D. The user requiring access to the resource.

Answer: B

QUESTION NO: 2

Why do security researchers often use virtual machines?

m
A. To offer an environment where new network applications can be tested
.co
B. To offer a secure virtual environment to conduct online deployments
C. To offer a virtual collaboration environment to discuss security research
D. To offer an environment where malware can be executed with minimal risk to equipment and
sts
software

Answer: D
lTe

QUESTION NO: 3
tua

Which access control system allows the system administrator to establish access permissions to
network resources?
Ac

A. MAC
B. DAC
C. RBAC
D. None of the above.

Answer: A

QUESTION NO: 4

You work as a network administrator for your company. Taking personal safety into consideration,
what fire suppression substances types can effectively prevent damage to electronic equipment?

A. Halon

"Pass Any Exam. Any Time." - www.actualtests.com 2

 CompTIA SY0-201: Practice Exam
B. CO
C. Water
D. Foam

Answer: B

QUESTION NO: 5

Which of the following access control models uses roles to determine access permissions?

A. MAC
B. DAC
C. RBAC
D. None of the above.

m
Answer: C

.co
QUESTION NO: 6
sts
Given: John is a network administrator. He advises the server administrator of his company to
implement whitelisting, blacklisting, closing-open relays and strong authentication techniques.
lTe

Question: Which threat is being addressed?

A. Viruses
tua

B. Adware
C. Spam
D. Spyware
Ac

Answer: C

QUESTION NO: 7

Most current encryption schemes are based on

A. digital rights management

B. time stamps
C. randomizing
D. algorithms

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 3

 CompTIA SY0-201: Practice Exam

QUESTION NO: 8

Study the following items carefully, which one will permit a user to float a domain registration for a
maximum of five days?

A. Spoofing
B. DNS poisoning
C. Domain hijacking
D. Kiting

Answer: D

m
QUESTION NO: 9

Which of the following types of cryptography is typically used to provide an integrity check?

A. Public key
.co
B. Asymmetric
sts
C. Symmetric
D. Hash
lTe

Answer: D
tua

QUESTION NO: 10

The Public Key Infrastructure (PKI) is a set of hardware, software, people, policies, and
Ac

procedures needed to create, manage, store, distribute, and revoke digital certificates. The public
key infrastructure is based on which encryption schemes?

A. Symmetric
B. Quantum
C. Asymmetric
D. Elliptical curve

Answer: C

QUESTION NO: 11

How is access control permissions established in the RBAC access control model?

"Pass Any Exam. Any Time." - www.actualtests.com 4

 CompTIA SY0-201: Practice Exam
A. The system administrator.
B. The owner of the resource.
C. The role or responsibilities users have in the organization.
D. None of the above.

Answer: C

QUESTION NO: 12

Which threat is increased by the availability of portable external storage such as USB hard drives
to networks?

A. Increased loss business data

B. Introduction of material on to the network
C. Removal of sensitive and PII data

m
D. Introduction of rogue wireless access points

Answer: C
.co
sts

QUESTION NO: 13

What does the DAC access control model use to identify the users who have permissions to a
lTe

resource?

A. Predefined access privileges.

tua

B. The role or responsibilities users have in the organization

C. Access Control Lists
D. None of the above.
Ac

Answer: C

QUESTION NO: 14

What does the DAC access control model use to identify the users who have permissions to a
resource?

A. Predefined access privileges.

B. The role or responsibilities users have in the organization
C. Access Control Lists
D. None of the above.

"Pass Any Exam. Any Time." - www.actualtests.com 5

 CompTIA SY0-201: Practice Exam
Answer: C

QUESTION NO: 15

What does the DAC access control model use to identify the users who have permissions to a
resource?

A. Predefined access privileges.

B. The role or responsibilities users have in the organization
C. Access Control Lists
D. None of the above.

Answer: D

m
QUESTION NO: 16
.co
What does the DAC access control model use to identify the users who have permissions to a
resource?
sts
A. Predefined access privileges.
B. The role or responsibilities users have in the organization
C. Access Control Lists
lTe

D. None of the above.

Answer: C
tua

QUESTION NO: 17
Ac

Which of the following describes a type of algorithm that cannot be reversed in order to decode the
data?

A. Symmetric
B. One Way Function
C. Asymmetric
D. Pseudorandom Number Generator (PRNG)

Answer: B

QUESTION NO: 18

"Pass Any Exam. Any Time." - www.actualtests.com 6

 CompTIA SY0-201: Practice Exam
CRL is short for Certificate Revocation List. Which types of keys are included in a CRL?

A. Both public and private keys

B. Public keys
C. Steganographic keys
D. Private keys

Answer: A

QUESTION NO: 19

Secret Key encryption is also known as:

A. symmetrical
B. replay

m
C. one way function.
D. asymmetrical

Answer: A
.co
sts

QUESTION NO: 20
lTe

Virtualized applications, such as virtualized browsers, can protect the underlying operating system
from which of the following?
tua

A. Malware installation from suspects Internet sites

B. DDoS attacks against the underlying OS
C. Man-in-the-middle attacks
Ac

D. Phishing and spam attacks

Answer: A

QUESTION NO: 21

What does the MAC access control model use to identify the users who have permissions to a
resource?

A. Predefined access privileges.

B. The role or responsibilities users have in the organization
C. Access Control Lists
D. None of the above

"Pass Any Exam. Any Time." - www.actualtests.com 7

 CompTIA SY0-201: Practice Exam
Answer: A

QUESTION NO: 22

For the following items, which one is a collection of servers setup to attract hackers?

A. Honeypot
B. VLAN
C. Honeynet
D. DMZ

Answer: C

m
QUESTION NO: 23

Which of the following statements regarding the MAC access control models is TRUE?
.co
A. The Mandatory Access Control (MAC) model is a dynamic model.
B. In the Mandatory Access Control (MAC) the owner of a resource establishes access privileges
sts
to that resource.
C. In the Mandatory Access Control (MAC) users cannot share resources dynamically.
D. The Mandatory Access Control (MAC) model is not restrictive.
lTe

Answer: C
tua

QUESTION NO: 24
Ac

Which description is correct about an application or string of code that could not automatically
spread from one system to another but is designed to spread from file to file?

A. Botnet
B. Adware
C. Worm
D. Virus

Answer: D

QUESTION NO: 25

Which of the following are types of certificate-based authentication? (Select TWO)

"Pass Any Exam. Any Time." - www.actualtests.com 8

 CompTIA SY0-201: Practice Exam
A. Many-to-one mapping
B. One-to-one mapping
C. One-to-many mapping
D. Many-to-many mapping

Answer: A,B

QUESTION NO: 26

In computer security, an access control list (ACL) is a list of permissions attached to an object.
Which log will reveal activities about ACL?

A. Performance
B. Mobile device
C. Firewall

m
D. Transaction

Answer: C
.co
sts

QUESTION NO: 27

The ability to logon to multiple systems with the same credentials is typically known as:
lTe

A. decentralized management
B. single sign-on
tua

C. Role Based Access Control (RBAC)

D. centralized management
Ac

Answer: B

QUESTION NO: 28

For the following options, which is an area of the network infrastructure that allows a technician to
put public facing systems into it without compromising the entire infrastructure?

A. VLAN
B. VPN
C. NAT
D. DMZ

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 9

 CompTIA SY0-201: Practice Exam

QUESTION NO: 29

Which of the following would be MOST important to have to ensure that a company will be able to
recover in case of severe environmental trouble or destruction?

A. Disaster recovery plan

B. Alternate sites
C. Offsite storage
D. Fault tolerant systems

Answer: A

m
QUESTION NO: 30

Remote authentication allows you to authenticate Zendesk users using a locally hosted script.
.co
Which of the following is an example of remote authentication?

A. A user on a metropolitan area network (MAN) accesses a host by entering a username and
sts
password pair while not connected to the LAN.
B. A user on a campus area network (CAN) connects to a server in another building and enters a
username and password pair.
lTe

C. A user in one building logs on to the network by entering a username and password into a host
in the same building.
D. A user in one city logs onto a network by connecting to a domain server in another city.
tua

Answer: D
Ac

QUESTION NO: 31

Documentation describing a group expected minimum behavior is known as:Documentation

describing a group? expected minimum behavior is known as:

A. the need to know

B. acceptable usage
C. the separation of duties
D. a code of ethics

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 10

 CompTIA SY0-201: Practice Exam
QUESTION NO: 32

What maybe happen when hashing two different files creates the same result?

A. A mirror
B. A collision
C. A duplication
D. A pseudo-random event

Answer: B

QUESTION NO: 33

The DAC (Discretionary Access Control) model has an inherent flaw. Choose the option that
describes this flaw.

m
A. The DAC (Discretionary Access Control) model uses only the identity of the user or specific
.co
process to control access to a resource. This creates a security loophole for Trojan horse attacks.
B. The DAC (Discretionary Access Control) model uses certificates to control access to resources.
This creates an opportunity for attackers to use your certificates.
sts
C. The DAC (Discretionary Access Control) model does not use the identity of a user to control
access to resources. This allows anyone to use an account to access resources.
D. The DAC (Discretionary Access Control) model does not have any known security flaws.
lTe

Answer: A
tua

QUESTION NO: 34
Ac

The CEO of your company is worrying about staff browsing inappropriate material on the Internet
via HTTPS. Your company is advised to purchase a product which can decrypt the SSL session,
scan the content and then repackage the SSL session without staff knowing. Which type of attack
is similar to this product?

A. TCP/IP hijacking
B. Replay
C. Spoofing
D. Man-in-the-middle

Answer: D

QUESTION NO: 35

"Pass Any Exam. Any Time." - www.actualtests.com 11

 CompTIA SY0-201: Practice Exam
You work as the network administrator at Certkiller.com. The Certkiller.com network uses the
RBAC (Role Based Access Control) model. You must plan the security strategy for users to
access resources on the Certkiller.com network. The types of resources you must control access
to are mailboxes, and files and printers. Certkiller.com is divided into distinct departments and
functions named Finance, Sales, Research and Development, and Production respectively. Each
user has its own workstation, and accesses resources based on the department wherein he/she
works. You must determine which roles to create to support the RBAC (Role Based Access
Control) model.

Which of the following roles should you create?

A. Create mailbox, and file and printer roles.

B. Create Finance, Sales, Research and Development, and Production roles.
C. Create user and workstation roles.
D. Create allow access and deny access roles.

m
Answer: B
.co
QUESTION NO: 36
sts

Sending a patch through a testing and approval process is an example of which option?
lTe

A. Acceptable use policies

B. Change management
C. User education and awareness training
tua

D. Disaster planning

Answer: B
Ac

QUESTION NO: 37

Choose the access control model that allows access control determinations to be performed
based on the security labels associated with each user and each data item.

A. MACs (Mandatory Access Control) method

B. RBACs (Role Based Access Control) method
C. LBACs (List Based Access Control) method
D. DACs (Discretionary Access Control) method

Answer: A

"Pass Any Exam. Any Time." - www.actualtests.com 12

 CompTIA SY0-201: Practice Exam
QUESTION NO: 38

For the following items, which is a security limitation of virtualization technology?

A. A compromise of one instance will immediately compromise all instances.

B. It increases false positives on the NIDS.
C. Patch management becomes more time consuming.
D. If an attack occurs, it could potentially disrupt multiple servers.

Answer: D

QUESTION NO: 39

A company's new employees are asked to sign a document that describes the methods of and
purposes for accessing the company's IT systems. Which of the following BEST describes this

m
document?

A. Privacy Act of 1974

B. Authorized Access Policy
.co
C. Due diligence form
sts
D. Acceptable Use Policy

Answer: D
lTe

QUESTION NO: 40
tua

What technology is able to isolate a host OS from some types of security threats?

A. Kiting
Ac

B. Virtualization
C. Cloning
D. Intrusion detection

Answer: B

QUESTION NO: 41

Which of the following is the BEST place to obtain a hotfix or patch for an application or system?

A. An email from the vendor

B. A newsgroup or forum
C. The manufacturer's website

"Pass Any Exam. Any Time." - www.actualtests.com 13

 CompTIA SY0-201: Practice Exam
D. A CD-ROM

Answer: C

QUESTION NO: 42

Tom is a network administrator of his company. He guesses that PCs on the internal network may
be acting as zombies participating in external DDoS attacks. Which item will most effectively
confirm the administrators?? suspicions?

A. AV server logs
B. HIDS logs
C. Proxy logs
D. Firewall logs

m
Answer: D

.co
QUESTION NO: 43
sts
Choose the terminology or concept which best describes a (Mandatory Access Control) model.

A. Lattice
lTe

B. Bell La-Padula
C. BIBA
D. Clark and Wilson
tua

Answer: A
Ac

QUESTION NO: 44

Password cracking tools are available worldwide over the Internet. Which one of the following
items is a password cracking tool?

A. Wireshark
B. Nessus
C. John the Ripper
D. AirSnort

Answer: C

"Pass Any Exam. Any Time." - www.actualtests.com 14

 CompTIA SY0-201: Practice Exam
QUESTION NO: 45

Which authentication method does the following sequence: Logon request, encrypts value
response, server, challenge, compare encrypts results, authorize or fail referred to?

A. Certificates
B. Security Tokens
C. CHAP
D. Kerberos

Answer: C

QUESTION NO: 46

IDS is short for Intrusion Detection Systems. Which option is the MOST basic form of IDS?

m
A. Signature
B. Statistical
C. Anomaly
.co
D. Behavioral
sts

Answer: A
lTe

QUESTION NO: 47
tua

Which of the following statements is TRUE regarding the Security Token system?

A. If your token does not grant you access to certain information, that information will either not be
displayed or your access will be denied. The authentication system creates a token every time a
Ac

user or a session begins. At the completion of a session, the token is destroyed.

B. A certificate being handed from the server to the client once authentication has been
established. If you have a pass, you can wander throughout the network. BUT limited access is
allowed.
C. The authentication process uses a Key Distribution Center (KDC) to orchestrate the entire
process. The KDC authenticates the network. Principles can be users, programs, or systems. The
KDC provides a ticket to the network. Once this ticket is issued, it can be used to authenticate
against other principles. This occurs automatically when a request or service is performed by
another network.
D. The initiator sends a logon request from the client to the server. The server sends a challenge
back to the client. The challenge is encrypted and then sent back to the server. The server
compares the value from the client and if the information matches, the server grants authorization.
If the response fails, the session fails and the request phase starts over

"Pass Any Exam. Any Time." - www.actualtests.com 15

 CompTIA SY0-201: Practice Exam
Answer: A

QUESTION NO: 48

Which statement is true about the cryptographic algorithm employed by TLS to establish a session
key?

A. Blowfish
B. Diffie-Hellman
C. IKE
D. RSA

Answer: B

m
QUESTION NO: 49
.co
To aid in preventing the execution of malicious code in email clients, which of the following should
be done by the email administrator?
sts
A. Spam and anti-virus filters should be used
B. Regular updates should be performed
C. Preview screens should be disabled
lTe

D. Email client features should be disabled

Answer: A
tua

QUESTION NO: 50
Ac

Internet filter appliances/servers will most likely analyze which three items? (Select THREE).

A. Certificates
B. CRLs
C. Content
D. URLs

Answer: A,C,D

QUESTION NO: 51

Which of the following types of publicly accessible servers should have anonymous logins
disabled to prevent an attacker from transferring malicious data?

"Pass Any Exam. Any Time." - www.actualtests.com 16

 CompTIA SY0-201: Practice Exam
A. FTP
B. Email
C. Web
D. DNS

Answer: A

QUESTION NO: 52

Which practice can best code applications in a secure manner?

A. Input validation
B. Object oriented coding
G. Cross-site scripting
D. Rapid Application Development (RAD)

m
Answer: A
.co
QUESTION NO: 53
sts

In addition to bribery and forgery, which of the following are the MOST common techniques that
attackers use to socially engineer people? (Select TWO)
lTe

A. Phreaking
B. Dumpster diving
tua

C. Whois search
D. Flattery
E. Assuming a position of authority
Ac

Answer: D,E

QUESTION NO: 54

Which of the following will restrict access to files according to the identity of the user or group?

A. MAC
B. CRL
C. pki
D. DAC

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 17

 CompTIA SY0-201: Practice Exam

QUESTION NO: 55

Which of the following would be an easy way to determine whether a secure web page has a valid
certificate?

A. Right click on the lock at the bottom of the browser and check the certificate information
B. ContactThawte or Verisign and ask about the web page
C. Contact the web page's web master
D. Ensure that the web URL starts with 'https:\\'.

Answer: A

m
QUESTION NO: 56

Which description is correct concerning the process of comparing cryptographic hash functions of
.co
system executables, configuration files, and log files?

A. File integrity auditing

sts
B. Stateful packet filtering
C. Host based intrusion detection
D. Network based intrusion detection
lTe

Answer: A
tua

QUESTION NO: 57
Ac

A software or hardware device that allows only authorized network traffic in or out of a computer or
network is called a:

A. firewall
B. packet sniffer
C. honeypot
D. anti-virus program

Answer: A

QUESTION NO: 58

While hardening an operating system, which item is LEAST effective?

"Pass Any Exam. Any Time." - www.actualtests.com 18

 CompTIA SY0-201: Practice Exam
A. Configuration baselines
B. Limiting administrative privileges
C. Installing HIDS
D. Install a software firewall

Answer: C

QUESTION NO: 59

Which of the following types of attacks is BEST described as an attacker capturing part of a
communication and later sending that communication segment to the server while pretending to
be the client?

A. TCP/IP hijacking
B. Replay

m
C. Back door
D. Man in the middle .co
Answer: B
sts

QUESTION NO: 60
lTe

In computer networking, network address translation (NAT) is the process of modifying network
address information in datagram packet headers while in transit across a traffic routing device for
the purpose of remapping a given address space into another. Which description is true about a
tua

static NAT?

A. A static NAT uses a many to many mapping.

Ac

B. A static NAT uses a one to many mapping.

C. A static NAT uses a many to one mapping.
D. A static NAT uses a one to one mapping.

Answer: D

QUESTION NO: 61

Malicious code that enters a target system, lays dormant until a user opens the certain program
then deletes the contents of attached network drives and removable storage devices is known as
a:

A. worm

"Pass Any Exam. Any Time." - www.actualtests.com 19

 CompTIA SY0-201: Practice Exam
B. Trojan horse
C. logic bomb
D. honeypot

Answer: C

QUESTION NO: 62

Which action should be performed when discovering an unauthorized wireless access point
attached to a network?

A. Unplug the Ethernet cable from the wireless access point.

B. Change the SSID on the wireless access point
C. Run a ping against the wireless access point.
D. Enable MAC filtering on the wireless access point.

m
Answer: A
.co
QUESTION NO: 63
sts

Which of the following network authentication protocols uses symmetric key cryptography, stores a
shared key for each network resource and uses a Key Distribution Center (KDC)?
lTe

A. RADIUS
B. TACACS+
tua

C. Kerberos
d. pki
Ac

Answer: C

QUESTION NO: 64

In cryptography, MD5 (Message-Digest algorithm 5) is a widely used cryptographic hash function

with a 128-bit hash value. As an Internet standard (RFC 1321), MD5 has been employed in a wide
variety of security applications, and is also commonly used to check the integrity of files. A user
sees an MD5 hash number beside a file that they wish to download. Which description is true
about a hash?

A. A hash is a unique number that is generated after the file has been encrypted and used as the
SSL key during download.
B. A hash is a unique number that is generated based upon the TCP/IP transmission header and
should be verified before download.
"Pass Any Exam. Any Time." - www.actualtests.com 20
 CompTIA SY0-201: Practice Exam
C. A hash is a unique number that is generated based upon the files contents and used as the
SSL key during download.
D. A hash is a unique number that is generated based upon the files contents and should be
verified after download.

Answer: D

QUESTION NO: 65

The risks of social engineering can be decreased by implementing: (Select TWO)

A. security awareness training

B. risk assessment policies
C operating system patching instructions
D. vulnerability testing techniques

m
E. identity verification methods

Answer: A
.co
sts

QUESTION NO: 66

When a new network device is configured for first-time installation, which of the following is a
lTe

security threat?

A. Denial of Service (DoS)

tua

B. Attacker privilege escalation

C. Installation of a back door
D. Use of default passwords
Ac

Answer: D

QUESTION NO: 67

Which of the following access control models uses subject and object labels?

A. Mandatory Access Control (MAC)

B. Role Based Access Control (RBAC)
C. Rule Based Access Control (RBAC)
D. Discretionary Access Control (DAC)

Answer: A

"Pass Any Exam. Any Time." - www.actualtests.com 21

 CompTIA SY0-201: Practice Exam

QUESTION NO: 68

Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily
understood by unauthorized people. Which of the following is considered the weakest encryption?

A. 5HA
B. DES
C. RSA
D. AES

Answer: B

m
QUESTION NO: 69

Which of the following access decisions are based on a Mandatory Access Control (MAC)
environment?
.co
A. Access control lists
sts
B. Ownership
C. Group membership
D. Sensitivity labels
lTe

Answer: D
tua

QUESTION NO: 70
Ac

Which tool can best monitor changes to the approved system baseline?

A. Enterprise antivirus software

B. Enterprise performance monitoring software
C. Enterprise key management software
D. Enterprise resource planning software

Answer: B

QUESTION NO: 71

Audit log information can BEST be protected by: (Select TWO).

"Pass Any Exam. Any Time." - www.actualtests.com 22

 CompTIA SY0-201: Practice Exam
A. using a VPN
B. an IDS
C. access controls that restrict usage
D. an intrusion prevention system (IPS)
E. recording to write-once media.
F. a firewall that creates an enclave

Answer: C,E

QUESTION NO: 72

Which method will most effectively verify that a patch file downloaded from a third party has not
been modified since the time that the original manufacturer released the patch?

A. Compare the final MD5 hash with the original.

m
B. Compare the final LANMAN hash with the original.
C. Download the patch file through a SSL connection. .co
D. Download the patch file over an AES encrypted VPN connection.

Answer: A
sts
lTe

QUESTION NO: 73

Non-essential services are often appealing to attackers because non-essential services: (Select
TWO)
tua

A. consume less bandwidth

B. are not visible to an IDS
Ac

C. provide root level access

D. decrease the surface area for the attack
E. are not typically configured correctly or secured
F. sustain attacks that go unnoticed

Answer: E,F

QUESTION NO: 74

Which action should be performed to harden workstations and servers?

A. Report all security incidents.

B. Install only needed software.

"Pass Any Exam. Any Time." - www.actualtests.com 23

 CompTIA SY0-201: Practice Exam
C. Log on only as the administrator.
D. Check the logs regularly.

Answer: B

QUESTION NO: 75

A user downloads and installs a new screen saver and the program starts to rename and delete
random files. Which of the following would be the BEST description of this program?

A. Worm
B. Virus
C. Trojan horse
D. Logic bomb

m
Answer: C

.co
QUESTION NO: 76
sts
John works as a network administrator for his company. He uses a tool to check SMTP, DNS,
P0P3, and ICMP packets on the network. This is an example of which of the following?
lTe

A. A vulnerability scan
B. A protocol analyzer
C. A penetration test
tua

D. A port scanner

Answer: B
Ac

QUESTION NO: 77

Which of the following types of malicious software travels across computer networks without
requiring a user to distribute the software?

A. Virus
B. Worm
C. Trojan horse
D. Logic bomb

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 24

 CompTIA SY0-201: Practice Exam
QUESTION NO: 78

What will be implemented by a technician to mitigate the chances of a successful attack against
the wireless network?

A. Implement an authentication system and WEP.

B. Implement an identification system and WPA2.
C. Implement an authentication system and WPA.
D. Implement a biometric system and WEP.

Answer: C

QUESTION NO: 79

Which of the following should be done if an audit recording fails in an information system?

m
A. Log off the user
B. Overwrite the oldest audit records
C. Stop generating audit records
.co
D. Send an alert to the appropriate personnel
sts

Answer: D
lTe

QUESTION NO: 80
tua

In order to recover discarded company documents, which of the following might an attacker resort
to?

A. Shoulder surfing
Ac

B. Phishing
C. Dumpster diving
D. Insider theft

Answer: C

QUESTION NO: 81

Which of the following types of authentication BEST describes providing a username, password
and undergoing a thumb print scan to access a workstation?

A. Multifactor
B. Mutual

"Pass Any Exam. Any Time." - www.actualtests.com 25

 CompTIA SY0-201: Practice Exam
C. Biometric
D. Kerberos

Answer: A

QUESTION NO: 82

Which item specifies a set of consistent requirements for a workstation or server?

A. Patch management
B. Vulnerability assessment
C. Imaging software
D. Configuration baseline

Answer: D

m
QUESTION NO: 83
.co
Which of the following steps is MOST often overlooked during the auditing process?
sts

A. Reviewing event logs regularly

B. Enabling auditing on the system
lTe

C. Auditing every system event

D. Deciding what events to audit
tua

Answer: A
Ac

QUESTION NO: 84

Users would not like to enter credentials to each server or application to conduct their normal
work. Which type of strategy can solve this problem?

A. Biometrics
B. Smart card
C. Two-factor authentication
D. sso

Answer: D

QUESTION NO: 85

"Pass Any Exam. Any Time." - www.actualtests.com 26

 CompTIA SY0-201: Practice Exam
Kerberos uses which of the following ports by default?

A. 23
B. 88
C 139
D. 443

Answer: B

QUESTION NO: 86

What should be taken into consideration while executing proper logging procedures? (Select
TWO).

A. The information that is needed to reconstruct events

m
B. The password requirements for user accounts
C. The virtual memory allocated on the log server
D. The amount of disk space required
.co
Answer: A,D
sts

QUESTION NO: 87
lTe

Turnstiles, double entry doors and security guards are all prevention measures for which of the
following types of social engineering?
tua

A. Piggybacking
B. Looking over a co-workersshould'er to retrieve information
Ac

C. Looking through a co-worker's trash to retrieve information

D. Impersonation

Answer: A

QUESTION NO: 88

In computer programming, DLL injection is a technique used to run code within the address space
of another process by forcing it to load a dynamic-link library. Which activity is MOST closely
associated with DLL injection?

A. Penetration testing
B. SQL servers

"Pass Any Exam. Any Time." - www.actualtests.com 27

 CompTIA SY0-201: Practice Exam
C. Network mapping
D. Vulnerability assessment

Answer: A

QUESTION NO: 89

Spam is considered a problem even when deleted before being opened because spam:

A. verifies the validity of an email address

B. corrupts the mail file
C. wastes company bandwidth
D. installs Trojan horse viruses

Answer: C

m
QUESTION NO: 90
.co
Alex is a network administrator of his company. He is backing up all server data nightly to a local
sts
NAS device. Which additional action should Alex perform to block disaster in the case the primary
site is permanently lost?
lTe

A. Backup all data at a preset interval to removable disk and store the disk in a fireproof safe in the
buildings basement.
B. Backup all data at a preset interval to tape and store those tapes at a sister site in another city.
tua

C. Backup all data at a preset interval to tape and store those tapes at a sister site across the
street.
D. Backup all data at a preset interval to removable disk and store the disk in a safety deposit box
Ac

at the administrators home.

Answer: B

QUESTION NO: 91

Which of the following programming techniques should be used to prevent buffer overflow
attacks?

A. Input validation
B. Nested loops
C. Signed applets
D. Automatic updates

"Pass Any Exam. Any Time." - www.actualtests.com 28

 CompTIA SY0-201: Practice Exam
Answer: A

QUESTION NO: 92

Which description is correct about the standard load for all systems?

A. Configuration baseline
B. Group policy
C. Patch management
D. Security template

Answer: A

m
QUESTION NO: 93

Which of the following authentication systems make use of the KDC Key Distribution Center?

A. Certificates
.co
B. Security Tokens
sts
C. CHAP
D. Kerberos
lTe

Answer: D
tua

QUESTION NO: 94

A digital signature or digital signature scheme is a type of asymmetric cryptography. For

Ac

messages sent through an insecure channel, a properly implemented digital signature gives the
receiver reason to believe the message was sent by the claimed sender. While using a digital
signature, the message digest is encrypted with which of the following keys?

A. Senders public key

B. Receivers private key
C. Receivers public key
D. Senders private key

Answer: D

QUESTION NO: 95

"Pass Any Exam. Any Time." - www.actualtests.com 29

 CompTIA SY0-201: Practice Exam
Which of the following authentication methods increases the security of the authentication process
because it must be in your physical possession?

A. Smart Cards.
B. Kerberos
G. CHAP
D. Certificate

Answer: A

QUESTION NO: 96

Users need to access their email and several secure applications from any workstation on the
network. In addition, an authentication system implemented by the administrator requires the use
of a username, password, and a company issued smart card. This is an example of which of the

m
following?

A. Three factor authentication

.co
B. SSO
C. ACL
sts

D. Least privilege

Answer: B
lTe

QUESTION NO: 97
tua

Which of the following statements regarding authentication protocols is FALSE?

Ac

A. PAP is insecure because usernames and passwords are sent over the network in clear text.
B. CHAP is more secure than PAP because it encrypts usernames and passwords before they are
sent over the network.
C. RADIUS is a client/server-based system that provides authentication, authorization, and
accounting services for remote dial-up access.
D. MS-CHAP version 1 is capable of mutual authentication of both the client and the server.

Answer: D

QUESTION NO: 98

Many unauthorized staff has been entering the data center by piggybacking authorized staff. The
CIO has mandated to stop this behavior. Which technology should be installed at the data center
to prevent piggybacking?
"Pass Any Exam. Any Time." - www.actualtests.com 30
 CompTIA SY0-201: Practice Exam
A. Mantrap
B. Token access
C. Security badges
D. Hardware locks

Answer: A

QUESTION NO: 99

Which password management system best provides for a system with a large number of users?

A. Self service password reset management systems

B. Locally saved passwords management systems
C. multiple access methods management systems
D. synchronized passwords management systems

m
Answer: A
.co
QUESTION NO: 100
sts

Why will a Faraday cage be used?

lTe

A. To find rogue access points

B. To allow wireless usage
C. To mitigate data emanation
tua

D. To minimize weak encryption

Answer: C
Ac

QUESTION NO: 101

Which definition best defines what a challenge-response session is?

A. A challenge-response session is a workstation or system that produces a random challenge

string that the user provides, when prompted, in conjunction with the proper PIN (Personal
Identification Number).
B. A challenge-response session is a workstation or system that produces a random login ID that
the user provides, when prompted, in conjunction with the proper PIN (Personal Identification
Number).
C. A challenge-response session is a special hardware device used to produce random text in a
cryptography system.

"Pass Any Exam. Any Time." - www.actualtests.com 31

 CompTIA SY0-201: Practice Exam
D. A challenge-response session is the authentication mechanism in the workstation or system
that does not determine whether the owner should be authenticated.

Answer: A

QUESTION NO: 102

The hashing algorithm is created from a hash value, making it nearly impossible to derive the
original input number. Which item can implement the strongest hashing algorithm?

A. NTLMv2
B. LANMAN
C. NTLM
D. VLAN

m
Answer: A

.co
QUESTION NO: 103
sts
For which reason are clocks used in Kerberos authentication?

A. Clocks are used to ensure proper connections.

lTe

B. Clocks are used to ensure that tickets expire correctly.

C. Clocks are used to generate the seed value for the encryptions keys.
D. Clocks are used to both benchmark and specify the optimal encryption algorithm.
tua

Answer: B
Ac

QUESTION NO: 104

Network utilization is the ratio of current network traffic to the maximum traffic that the port can
handle. Which of the following can most effectively determine whether network utilization is
abnormal?

A. Application log
B. Performance baseline
C. Systems monitor
D. Security log

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 32

 CompTIA SY0-201: Practice Exam
QUESTION NO: 105

To reduce vulnerabilities on a web server, an administrator should adopt which of the following
preventative measures?

A. Use packet sniffing software on all inbound communications

B. Apply the most recent manufacturer updates and patches to the server.
C. Enable auditing on the web server and periodically review the audit logs
D. Block all Domain Name Service (DNS) requests coming into the server.

Answer: B

QUESTION NO: 106

A travel reservation organization conducts the majority of its transactions via a public facing

m
website. Any downtime to this website will lead to serious financial damage for this organization.
One web server is connected to several distributed database servers. Which statement is correct
about this scenario?
.co
A. RAID
sts
B. Warm site
C. Proxy server
D. Single point of failure
lTe

Answer: D
tua

QUESTION NO: 107

Ac

Which of the following is a common type of attack on web servers?

A. Birthday
B. Buffer overflow
C. Spam
D. Brute force

Answer: B

QUESTION NO: 108

An Intrusion detection system (IDS) is software and/or hardware designed to detect unwanted
attempts at accessing, manipulating, and/or disabling of computer systems, mainly through a
network, such as the Internet. When an IDS is configured to match a specific traffic pattern, then

"Pass Any Exam. Any Time." - www.actualtests.com 33

 CompTIA SY0-201: Practice Exam
which of the following is this referring to?

A. Signature-based
B. Behavior-based
C. Anomaly-based
D. Heuristic-based

Answer: A

QUESTION NO: 109

The employees at a company are using instant messaging on company networked computers.
The MOST important security issue to address when using instant messaging is that instant
messaging:

m
A. communications are a drain on bandwidth
B. communications are open and unprotected
C. has no common protocol
.co
D. uses weak encryption
sts
Answer: B
lTe

QUESTION NO: 110

Removable storage has been around almost as long as the computer itself. Which of the following
tua

is the GREATEST security risk regarding removable storage?

A. Availability of data
Ac

B. Integrity of data
C. Not enough space available
D. Confidentiality of data

Answer: D

QUESTION NO: 111

A VPN typically provides a remote access link from one host to another over:

A. an intranet
B. a modem
C. a network interface card

"Pass Any Exam. Any Time." - www.actualtests.com 34

 CompTIA SY0-201: Practice Exam
D. the Internet

Answer: D

QUESTION NO: 112

In which authentication model a ticket granting server is an important concept?

A. CHAP
B. pap
C. Kerberos
D. RADIUS

Answer: C

m
QUESTION NO: 113
.co
Which of the following would be needed to ensure that a user who has received an email cannot
claim that the email was not received?
sts

A. Anti-aliasing
B. Data integrity
lTe

C. Asymmetric cryptography
D. Non-repudiation
tua

Answer: D
Ac

QUESTION NO: 114

Coaxial cable is a cable consisting of an inner conductor, surrounded by a tubular insulating layer
typically made from a flexible material with a high dielectric constant, all of which is then
surrounded by another conductive layer (typically of fine woven wire for flexibility, or of a thin
metallic foil), and then finally covered again with a thin insulating layer on the outside. Which is the
primary security risk with coaxial cable?

A. Crosstalk between the wire pairs

B. Data emanation from the core
C. Refraction of the signal
D. Diffusion of the core light source

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 35

 CompTIA SY0-201: Practice Exam

QUESTION NO: 115

Which of the following portions of a company's network is between the Internet and an internal
network?

A. IDS
B. Demilitarized zone (DMZ)
C. Filter router
D. Bastion host

Answer: B

m
QUESTION NO: 116

A technician is conducting a forensics analysis on a computer system. Which step should be taken
FIRST?
.co
A. Search for Trojans.
sts
B. Look for hidden files.
C. Get a binary copy of the system.
D. Analyze temporary files.
lTe

Answer: C
tua

QUESTION NO: 117

Ac

Which of the following is MOST often used to allow a client or partner access to a network?

A. Extranet
B. Intranet
C. VLAN
D. Demilitarized zone (DMZ)

Answer: A

QUESTION NO: 118

In a secure environment, which authentication mechanism will perform better?

"Pass Any Exam. Any Time." - www.actualtests.com 36

 CompTIA SY0-201: Practice Exam
A. RADIUS because it encrypts client-server passwords.
B. TACACS because it encrypts client-server negotiation dialogs.
C. TACACS because it is a remote access authentication service.
D. RADIUS because it is a remote access authentication service.

Answer: B

QUESTION NO: 119

Which of the following types of firewalls provides inspection at layer 7 of the OSI model?

A. Application-proxy
B. Network address translation (NAT)
C. Packet filters
D. Stateful inspection

m
Answer: A
.co
QUESTION NO: 120
sts

Which goals can be achieved by use of security templates? (Select TWO).

lTe

A. To ensure that PKI will work properly within thecompanys trust model
B. To ensure that performance is standardized across all servers
C. To ensure that servers are in compliance with the corporate security policy
tua

D. To ensure that all servers start from a common security configuration

Answer: C,D
Ac

QUESTION NO: 121

A newly hired security specialist is asked to evaluate a company's network security. The security
specialist discovers that users have installed personal software; the network OS has default
settings and no patches have been installed and passwords are not required to be changed
regularly. Which of the following would be the FIRST step to take?

A. Install software patches.

B. Disable non-essential services.
C. Enforce the security policy.
D. Password management

"Pass Any Exam. Any Time." - www.actualtests.com 37

 CompTIA SY0-201: Practice Exam
Answer: C

QUESTION NO: 122

Which of the following can be used to implement a procedure to control inbound and outbound
traffic on a network segment?

A. Proxy
B. NIDS
C. ACL
D. HIDS

Answer: C

m
QUESTION NO: 123
.co
Giving each user or group of users only the access they need to do their job is an example of
which of the following security principals?
sts
A. Least privilege
B. Defense in depth
C. Separation of duties
lTe

D. Access control

Answer: A
tua

QUESTION NO: 124

Ac

Which one of the following is not Bluetooth threat?

A. blue jacking.
B. bluesnarfing.
C. discovery mode.
D. asmurf attack.

Answer: D

QUESTION NO: 125

A company implements an SMTP server on their firewall. This implementation would violate which
of the following security principles?

"Pass Any Exam. Any Time." - www.actualtests.com 38

 CompTIA SY0-201: Practice Exam
A. Keep the solution simple
B. Use a device as intended
C. Create an in-depth defense
D. Address internal threats

Answer: B

QUESTION NO: 126

In computing, the Basic Input/Output System (BIOS , also known as the System BIOS, is a de
facto standard defining a firmware interface for IBM PC Compatible computers. A user is
concerned with the security of their laptops BIOS. The user would not like anyone to be able to
access control functions except themselves. Which of the following could make the BIOS more
secure?

m
A. Password
B. Flash the BIOS
C. Encrypt the hard drive
.co
D. Create an access-list
sts

Answer: A
lTe

QUESTION NO: 127

A company is upgrading the network and needs to reduce the ability of users on the same floor
tua

and network segment to see each other's traffic. Which of the following network devices should be
used?
Ac

A. Router
B. Hub
C. Switch
D. Firewall

Answer: C

QUESTION NO: 128

In computing, a Uniform Resource Locator (URL) is a type of Uniform Resource Identifier (URI)
that specifies where an identified resource is available and the mechanism for retrieving it. When a
user attempts to go to a website, he notices the URL has changed, which attack will MOST likely
cause the problem?

"Pass Any Exam. Any Time." - www.actualtests.com 39

 CompTIA SY0-201: Practice Exam
A. ARP poisoning
B. DLL injection
C. DNS poisoning
D. DDoS attack

Answer: C

QUESTION NO: 129

A system administrator reports that an unauthorized user has accessed the network. Which of the
following would be the FIRST action to take?

A. Notify management.
B. Determine the business impact.
C. Contact law enforcement officials.

m
D. Contain the problem.

Answer: D
.co
sts

QUESTION NO: 130

After analyzing vulnerability and applying a security patch, which non-intrusive action should be
lTe

taken to verify that the vulnerability was truly removed?

A. Update the antivirus definition file.

tua

B. Apply a security patch from the vendor.

C. Repeat the vulnerability scan.
D. Perform a penetration test.
Ac

Answer: C

QUESTION NO: 131

A companys security' specialist is securing a web server that is reachable from the Internet. The
web server is located in the core internal corporate network. The network cannot be redesigned
and the server cannot be moved. Which of the following should the security specialist implement
to secure the web server? (Select TWO).

A. Router with an IDS module

B. Network-based IDS
C. Router with firewall rule set

"Pass Any Exam. Any Time." - www.actualtests.com 40

 CompTIA SY0-201: Practice Exam
D. Host-based IDS
E. Network-basedfirewal
F. Host-based firewall

Answer: D,F

QUESTION NO: 132

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an

attempt to make a computer resource unavailable to its intended users. Which method can be
used to perform denial of service (DoS) attacks?

A. Adware
B. Botnet
C. Spyware

m
D. Privilege escalation

Answer: B
.co
sts

QUESTION NO: 133

The CHAP (Challenge Handshake Authentication Protocol) sends a logon request from the client
lTe

to the server, and the server sends a challenge back to the client At which stage does the CHAP
protocol perform the handshake process? Choose the best complete answer.
tua

A. At the stage when the connection is established and at whichever time after the connection has
been established.
B. At the stage when the connection is established and when the connection is disconnected.
Ac

C. At the stage when the connection is established.

D. At the stage when the connection is disconnected.

Answer: A

QUESTION NO: 134

A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect
malicious activity such as denial of service attacks, port scans or even attempts to crack into
computers by monitoring network traffic. Which NIDS configuration is solely based on specific
network traffic?

A. Anomaly-based

"Pass Any Exam. Any Time." - www.actualtests.com 41

 CompTIA SY0-201: Practice Exam
B. Host-based
C. Behavior-based
D. Signature-based

Answer: D

QUESTION NO: 135

Which of the following are nonessential protocols and services?

A. Network News Transfer Protocol (NNTP)

B. TFTP (Trivial File Transfer Protocol).
C. Domain Name Service (DNS)
D. Internet Control Message Protocol (ICMP)

m
Answer: B

.co
QUESTION NO: 136
sts
You work as a network technician for your company. The company policy for availability needs full
backups on Sunday and incremental backups each week night at 10 p.m. The file server crashes
on Wednesday afternoon; how many types are required to restore the data on the file server for
lTe

Thursday morning?

A. One
tua

B. Two
C. Three
D. Four
Ac

Answer: C

QUESTION NO: 137

Which of the following protocols are not recommended due to them supplying passwords and
information over the network?

A. Network News Transfer Protocol (NNTP)

B. SNMP (Simple Network Management Protocol).
C. Domain Name Service (DNS)
D. Internet Control Message Protocol (ICMP)

"Pass Any Exam. Any Time." - www.actualtests.com 42

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 138

Which is the correct order in which crucial equipment should draw power?

A. Backup generator, UPS battery, UPS line conditioner

B. Uninterruptible Power Supply (UPS) battery, UPS line conditioner, backup generator
C. Backup generator, UPS line conditioner, UPS battery
D. UPS line conditioner, UPS battery, and backup generator

Answer: D

m
QUESTION NO: 139

Most key fob based identification systems use which of the following types of authentication
mechanisms? (Select TWO).
.co
A. Kerberos
sts
B. Biometrics
C. Username/password
D. Certificates
lTe

E. Token

Answer: C,E
tua

QUESTION NO: 140

Ac

Which item will MOST likely permit an attacker to make a switch function like a hub?

A. MAC flooding
B. DNS spoofing
C. ARP poisoning
D. DNS poisoning

Answer: A

QUESTION NO: 141

Which of the following describes a server or application that is accepting more input than the
server or application is expecting?

"Pass Any Exam. Any Time." - www.actualtests.com 43

 CompTIA SY0-201: Practice Exam
A. Denial of service (DoS)
B. Syntax error
C. Buffer overflow
D. Brute force

Answer: C

QUESTION NO: 142

The IP Authentication Header (AH) is used to provide connectionless integrity and data origin
authentication for IP datagrams (hereafter referred to as just "authentication"), and to provide
protection against replays. Which of the following is correct about authentication headers (AH)?

A. The authentication information is a keyed hash based on all of the bytes in the packet.
B. The authentication information may be the same on different packets if the integrity remains in

m
place.
.co
C. The authentication information hash will increase by one if the bytes remain the same on
transfer.
D. The authentication information hash will remain the same if the bytes change on transfer.
sts

Answer: A
lTe

QUESTION NO: 143

Which of the following refers to the ability to be reasonably certain that data is not modified or
tua

tampered with?

A. Authentication
Ac

B. Integrity
C. Non-repudiation
D. Confidentiality

Answer: B

QUESTION NO: 144

Which description is correct about the form used while transferring evidence?

A. Evidence log
B. Booking slip
C. Chain of custody

"Pass Any Exam. Any Time." - www.actualtests.com 44

 CompTIA SY0-201: Practice Exam
D. Affidavit

Answer: C

QUESTION NO: 145

Disguising oneself as a reputable hardware manufacturer's field technician who is picking up a

server for repair would be described as:

A. a phishing attack
B. a Trojan horse
C. a man-in-the-middle attack
D. social engineering

Answer: D

m
QUESTION NO: 146
.co
A graphical user interface (GUI) is a type of user interface which allows people to interact with
sts
electronic devices such as computers; hand-held devices such as MP3 Players, Portable Media
Players or Gaming devices; household appliances and office equipment. Which of the following
will allow a technician to restrict a user accessing to the GUI?
lTe

A. Use of logical tokens

B. Group policy implementation
tua

C. Password policy enforcement

D. Access control lists
Ac

Answer: B

QUESTION NO: 147

A security specialist has downloaded a free security software tool from a trusted industry site. The
source has published the MD5 hash values for the executable program. The specialist performs a
successful virus scan on the download but the MD5 hash is different. Which of the following steps
should the specialist take?

A. Avoid executing the file and contact the source website administrator
B. Ignore the MD5 hash values because the values can change during IP fragmentation.
C. Re-run the anti-virus program to ensure that it contains no virus execute
D. Install the executable program because there was probably a mistake with the MD5 value.

"Pass Any Exam. Any Time." - www.actualtests.com 45

 CompTIA SY0-201: Practice Exam
Answer: A

QUESTION NO: 148

Which authentication method will prevent a replay attack from occurring?

A. RADIUS
B. L2TP
C. Kerberos
D. CHAP

Answer: C

m
QUESTION NO: 149

Which of the following identifies the layer of the OSI model where SSL provides encryption?

A. Application
.co
B. Network
sts
C. Session
D. Transport
lTe

Answer: C
tua

QUESTION NO: 150

Which of the following can be used by a technician to detect staff members that are connecting to
Ac

an unauthorized website?

A. Protocol analyzer
B. Host routing table
C HIDS
D. Bluesnarfing

Answer: A

QUESTION NO: 151

Which of the following would be the BEST reason to disable unnecessary services on a server?

"Pass Any Exam. Any Time." - www.actualtests.com 46

 CompTIA SY0-201: Practice Exam
A. Not starting a service will save system memory and reduce startup time.
B. If a service doesn't support the function of the server the service won't be missed.
C. Attack surface and opportunity for compromise are reduced
D. Services can be re-enabled if needed at a later time

Answer: C

QUESTION NO: 152

For the following items, which is an example of an attack that executes once a year on a certain
date?

A. Rootkit
B. Virus
C. Logic bomb

m
D. Worm

Answer: C
.co
sts

QUESTION NO: 153

Access controls based on security labels associated with each data item and each user are known
lTe

as:

A. Mandatory Access Control (MAC)

tua

B. Role Based Access Control (RBAC)

C. List Based Access Control (LBAC)
D. Discretionary Access Control (DAC)
Ac

Answer: A

QUESTION NO: 154

Which tool can help the technician to find all open ports on the network?

A. Router ACL
B. Performance monitor
C. Protocol analyzer
D. Network scanner

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 47

 CompTIA SY0-201: Practice Exam

QUESTION NO: 155

A user is assigned access rights explicitly. This is a feature of which of the following access control
models?

A. Discretionary Access Control (DAC)

B. Mandatory Access Control (MAC)
C. Rule Based Access Control (RBAC)
D. Role Based Access Control (RBAC)

Answer: A

m
QUESTION NO: 156

Which algorithms can best encrypt large amounts of data?

A. Asymmetric key algorithms

.co
B. Symmetric key algorithms
sts
C. ECC algorithms
D. Hashing algorithms
lTe

Answer: B
tua

QUESTION NO: 157

Which of the following describes an attacker encouraging a person to perform an action in order to
Ac

be successful?

A. Man-in-the-middle
B. Social engineering
C. Back door
D. Password guessing

Answer: B

QUESTION NO: 158

During which phase of identification and authentication does proofing occur?

"Pass Any Exam. Any Time." - www.actualtests.com 48

 CompTIA SY0-201: Practice Exam
A. Authentication
B. Testing
C. Verification
D. Identification

Answer: D

QUESTION NO: 159

A user has received an email from a mortgage company asking for personal information including
bank account numbers. This would BEST be described as:

A. spam
B. phishing
C. packet sniffing

m
D. a hoax

Answer: B
.co
sts

QUESTION NO: 160

Which item can reduce the attack surface of an operating system?

lTe

A. Installing HIDS
B. Patch management
tua

C. Installing antivirus
D. Disabling unused services
Ac

Answer: D

QUESTION NO: 161

Which of the following connectivity is required for a web server that is hosting an SSL based web
site?

A. Port 443 inbound

B. Port 443 outbound
C. Port 80 inbound
D. Port 80 outbound

Answer: A

"Pass Any Exam. Any Time." - www.actualtests.com 49

 CompTIA SY0-201: Practice Exam

QUESTION NO: 162

For the following items, which is a protocol analyzer?

A. Cain _Abel
B. WireShark
C. Nessus
D. John the Ripper

Answer: B

QUESTION NO: 163

m
Malicious port scanning is a method of attack to determine which of the following?

A. Computer name
B. The fingerprint of the operating system
.co
C. The physical cabling topology of a network
sts
D. User IDs and passwords

Answer: B
lTe

QUESTION NO: 164

tua

Which description is correct about a way to prevent buffer overflows?

A. Apply all security patches to workstations.

Ac

B. Monitor P2P program usage through content filters.

C. Apply security templates enterprise wide.
D. Apply group policy management techniques.

Answer: A

QUESTION NO: 165

Which of the following is used to determine equipment status and modify the configuration or
settings of network devices?

A. SNMP

"Pass Any Exam. Any Time." - www.actualtests.com 50

 CompTIA SY0-201: Practice Exam
B. DHCP
C SMTP
D. CHAP

Answer: A

QUESTION NO: 166

Which item will effectively allow for fast, highly secure encryption of a USB flash drive?

A. 3DES
B. SHA-1
C. MD5
D. AES256

m
Answer: D

.co
QUESTION NO: 167
sts
Which of the following describes the process by which a single user name and password can be
entered to access multiple computer applications?
lTe

A. Single sign-on
B. Encryption protocol
C. Access control lists
tua

D. Constrained user interfaces

Answer: A
Ac

QUESTION NO: 168

Network traffic is data in a network. Which tool can be used to review network traffic for clear text
passwords?

A. Port scanner
B. Protocol analyzer
C. Firewall
D. Password cracker

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 51

 CompTIA SY0-201: Practice Exam
QUESTION NO: 169

To preserve evidence for later use in court, which of the following needs to be documented?

A. Audit trail of systems usage

B. Disaster recovery plan
C. Chain of certificates
D. Chain of custody

Answer: D

QUESTION NO: 170

What are best practices while installing and securing a new system for a home user? (Select
THREE).

m
A. Use a strong firewall.
B. Install remote control software.
C. Apply all system patches.
.co
D. Apply all service packs.
sts

Answer: A,C,D
lTe

QUESTION NO: 171

tua

Which of the following is a major reason that social engineering attacks succeed?

A. Strong passwords are not required

B. Lack of security awareness
Ac

C. Multiple logins are allowed

D. Audit logs are not monitored frequently

Answer: B

QUESTION NO: 172

Which security action should be finished before access is given to the network?

A. Identification and authorization

B. Identification and authentication
C. Authentication and authorization
D. Authentication and password

"Pass Any Exam. Any Time." - www.actualtests.com 52

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 173

Which of the following types of backups requires that files and software that have been changed
since the last full backup be copied to storage media?

A. Incremental
B. Differential
C. Full
D. Delta

Answer: B

m
QUESTION NO: 174
.co
Which port must be open to allow a user to login remotely onto a workstation?

A. 53
sts
B. 636
C. 3389
D. 8080
lTe

Answer: C
tua

QUESTION NO: 175

Ac

The authentication process where the user can access several resources without the need for
multiple credentials is known as:

A. Discretionary Access Control (DAC).

B. need to know
C. decentralized management
D. single sign-on

Answer: D

QUESTION NO: 176

Which item best describes an instance where a biometric system identifies legitimate users as
being unauthorized?

"Pass Any Exam. Any Time." - www.actualtests.com 53

 CompTIA SY0-201: Practice Exam
A. False acceptance
B. False positive
C. False rejection
D. False negative

Answer: C

QUESTION NO: 177

The purpose of the SSID in a wireless network is to:

A. define the encryption protocols used.

B. secure the WAP
C. identify the network
D. protect the client

m
Answer: C
.co
QUESTION NO: 178
sts

Which of the following is the best description about the method of controlling how and when users
can connect in from home?
lTe

A. Remote access policy

B. Remote authentication
tua

C. Terminal access control

D. Virtual Private Networking (VPN)
Ac

Answer: A

QUESTION NO: 179

Which of the following would be the MOST common method for attackers to spoof email?

A. Web proxy
B. Man in the middle attacks
C. Trojan horse programs
D. Open relays

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 54

 CompTIA SY0-201: Practice Exam
QUESTION NO: 180

The implicit deny will block anything you didn't specifically allow but you may have allowed stuff
that you don't need. A technician is reviewing the system logs for a firewall and is told that there is
an implicit deny within the ACL Which is an example of an implicit deny?

A. An implicit deny statement denies all traffic from one network to another.
B. Each item is denied by default because of the implicit deny.
C. Items which are not specifically given access are denied by default.
D. An ACL is a way to secure traffic from one network to another.

Answer: C

QUESTION NO: 181

m
Which of the following is often misused by spyware to collect and report a user's activities?

A. Persistent cookie
B. Web bug
.co
C. Tracking cookie
sts
D. Session cookie

Answer: C
lTe

QUESTION NO: 182

tua

Which of the following is not identified within the penetration testing scope of work?

A. a complete list of all network vulnerabilities.

Ac

B. handling of information collected by the penetration testing team.

C. IP addresses of machines from which penetration testing will be executed.
D. a list of acceptable testing techniques and tools to be utilized.

Answer: A

QUESTION NO: 183

Choose the figure which represents the number of ports in the TCP/IP (Transmission Control
Protocol/Internet Protocol) which are vulnerable to being scanned, attacked, and exploited.

A. 32 ports
B. 1,024 ports

"Pass Any Exam. Any Time." - www.actualtests.com 55

 CompTIA SY0-201: Practice Exam
C. 65,535 ports
D. 16,777,216 ports

Answer: C

QUESTION NO: 184

Tom is a network technician of his company. Now, he is making a decision between implementing
a HIDS on the database server and implementing a NIDS. Why NIDS may be better to implement?
(Select TWO).

A. Many HIDS only offer a low level of detection granularity.

B. Many HIDS are not able to detect network attacks.
C. Many HIDS have a negative impact on system performance.
D. Many HIDS are not good at detecting attacks on database servers.

m
Answer: B,C
.co
QUESTION NO: 185
sts

Which of the following would be considered a detrimental effect of a virus hoax? (Select TWO).
lTe

A. The email server capacity is consumed by message traffic.

B. Technical support resources are consumed by increased user calls.
C. Users are tricked into changing the system configuration.
tua

D. Users are at risk for identity theft.

Answer: B,C
Ac

QUESTION NO: 186

Which types of keys will be used if a server and workstation communicate via SSL? (Select TWO).

A. Public key
B. Recovery key
G. Session key
D. Keylogger

Answer: A

"Pass Any Exam. Any Time." - www.actualtests.com 56

 CompTIA SY0-201: Practice Exam
QUESTION NO: 187

To keep an 802.llx network from being automatically discovered, a user should:

A. turn off the SSID broadcast

B. leave the SSID default.
C. change the SSID name.
D. activate the SSID password

Answer: A

QUESTION NO: 188

Which security policy will be most likely used while attempting to mitigate the risks involved with
allowing a user to access company email via their cell phone?

m
A. The cell phone should require a password after a set period of inactivity.
.co
B. The cell phone should have data connection abilities disabled.
C. The cell phone should only be used for company related emails.
D. The cell phone data should be encrypted according to NIST standards.
sts

Answer: A
lTe

QUESTION NO: 189

tua

Which of the following BEST describes the baseline process of securing devices on a network
infrastructure?

A. Enumerating
Ac

B. Hardening
C. Active prevention
D. Passive detection

Answer: B

QUESTION NO: 190

In computing, virtualization is a broad term that refers to the abstraction of computer resources.
Which is a security reason to implement virtualization throughout the network infrastructure?

A. To implement additional network services at a lower cost

B. To analyze the various network traffic with protocol analyzers

"Pass Any Exam. Any Time." - www.actualtests.com 57

 CompTIA SY0-201: Practice Exam
C. To isolate the various network services and roles
D. To centralize the patch management of network servers

Answer: C

QUESTION NO: 191

Which of the following types of removable media is write-once and appropriate for archiving
security logs?

A. Tape
B. CD-R
C. Hard disk
D. USB drive

m
Answer: B

.co
QUESTION NO: 192
sts
After installing new software on a machine, what needs to be updated to the baseline?

A. Honeypot
lTe

B. Signature-based NIPS
C. Signature-based NIDS
D. Behavior-based HIDS
tua

Answer: D
Ac

QUESTION NO: 193

Which of the following could cause communication errors with an IPSec VPN tunnel because of
changes made to the IP header?

A. SOCKS
B. NAT
C. DNS
D. Private addressing

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 58

 CompTIA SY0-201: Practice Exam
QUESTION NO: 194

A PC is rejecting push updates from the server; all other PCs on the network are accepting the
updates successfully. What should be examined first?

A. Password expiration
B. Local firewall
C. Anti-spyware
D. Pop-up blocker

Answer: B

QUESTION NO: 195

A company wants to connect the network to a manufacturer's network to be able to order parts.

m
Which of the following types of networks should the company implement to provide the connection
while limiting the services allowed over the connection?

A. Scatternet
.co
B. Extranet
sts
C. VPN
D. Intranet
lTe

Answer: B
tua

QUESTION NO: 196

Malware, a portmanteau from the words malicious and software, is software designed to infiltrate
Ac

or damage a computer system without the owner's informed consent. A network technician
suspects that a piece of malware is consuming too many CPU cycles and slowing down a system.
Which item can help determine the amount of CPU cycles being consumed?

A. Install malware scanning software.

B. Run performance monitor to evaluate the CPU usage.
C. Use a protocol analyzer to find the cause of the traffic.
D. Install HIDS to determine the CPU usage.

Answer: B

QUESTION NO: 197

"Pass Any Exam. Any Time." - www.actualtests.com 59

 CompTIA SY0-201: Practice Exam
Which of the following ports are typically used by email clients? (Select TWO)

A. 3389
B. 194
C. 143
D. 110
E. 49
F. 23

Answer: C,D

QUESTION NO: 198

In order to allow for more oversight of past transactions, a company decides to exchange positions
of the purchasing agent and the accounts receivable agent. Which is an example of this?

m
A. Separation of duties
B. Least privilege
.co
C. Implicit deny
D. Job rotation
sts

Answer: D
lTe

QUESTION NO: 199

tua

Fiber optic cable is considered safer than CAT5 because fiber optic cable: (Select TWO).

A. is not susceptible to interference.

Ac

B. is hard to tap in to.

C. is made of glass rather than copper.
D. can be run for a longer distance
E. is more difficult to install

Answer: A,B

QUESTION NO: 200

How to make sure that when an employee leaves the company permanently, the company will
have access to their private keys?

A. Store the keys in escrow.

"Pass Any Exam. Any Time." - www.actualtests.com 60

 CompTIA SY0-201: Practice Exam
B. Store them in a CRL.
C. Obtain the employees hardware token.
D. Immediately delete the account.

Answer: A

QUESTION NO: 201

A DNS (Domain Name Service) server uses a specific port number. Choose this port number from
the options.

A. Port 32
B. Port 1,024
C. Port 65,535
D. Port 16,777,216

m
Answer: B
.co
QUESTION NO: 202
sts

An outside auditor has been contracted to determine whether weak passwords are being used on
the network. In order to achieve this goal, the auditor is running a password cracker against the
lTe

master password file. Which of the following is an example of this?

A. Vulnerability assessment
tua

B. Malware scan
C. Baselining
D. Fingerprinting
Ac

Answer: A

QUESTION NO: 203

Which of the following access attacks would involve looking through your files in the hopes of
finding something interesting?

A. Interception
B. Snooping
C. Eavesdropping
D. None of the above

"Pass Any Exam. Any Time." - www.actualtests.com 61

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 204

Identify the service provided by message authentication code (MAC) hash;

A. data recovery.
B. fault tolerance.
C. key recovery.
D. integrity

Answer: D

m
QUESTION NO: 205

A company wants to implement a VLAN. Senior management believes that a VLAN will be secure
.co
because authentication is accomplished by MAC addressing and that dynamic trunking protocol
(DTP) will facilitate network efficiency. Which of the following issues should be discussed with
senior management before VLAN implementation?
sts

A. MAC addresses can be spoofed and DTP allows rogue network devices to configure ports
B. MAC addresses can be spoofed and DTP allows only authenticated users.
lTe

C. MAC addresses are a secure authentication mechanism and DTP allows rogue network
devices to configure ports.
D. MAC addresses are a secure authentication mechanism and DTP allows only authenticated
tua

users.

Answer: A
Ac

QUESTION NO: 206

John works as a network administrator for his company. On the monthly firewall log, he discovers
that many internal PCs are sending packets on a routine basis to a single external PC. Which
statement correctly describes what is happening?

A. The remote PC has a zombie slave application running and the local PCs have a zombie
master application running.
B. The remote PC has a zombie master application running and the local PCs have a zombie
slave application running.
C. The remote PC has a spam slave application running and the local PCs have a spam master
application running.

"Pass Any Exam. Any Time." - www.actualtests.com 62

 CompTIA SY0-201: Practice Exam
D. The remote PC has a spam master application running and the local PCs have a spam slave
application running.

Answer: B

QUESTION NO: 207

Pretty Good Privacy (PGP) uses a PKI Trust Model where no certificate authority (CA) is
subordinate to another. The model with no single trusted root is known as:

A. peer-to-peer
B. downlevel
C. hierarchical
D. hybrid

m
Answer: A

.co
QUESTION NO: 208
sts
Which key can be used by a user to log into their network with a smart card?

A. Public key
lTe

B. Cipher key
C. Shared key
D. Private key
tua

Answer: D
Ac

QUESTION NO: 209

Which of the following would be an effective way to ensure that a compromised PKI key can not
access a system?

A. Reconfigure the key

B. Revoke the key
C. Delete the key
D. Renew the key

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 63

 CompTIA SY0-201: Practice Exam
QUESTION NO: 210

Which description is true about the process of securely removing information from media (e.g.
hard drive) for future use?

A. Deleting
B. Reformatting
C. Sanitization
D. Destruction

Answer: C

QUESTION NO: 211

Which of the following provides the MOST secure form of encryption?

m
A. 3DES
B. Diffie-Hellman
C. DES
.co
D. AES
sts

Answer: D
lTe

QUESTION NO: 212

tua

Users on a network report that they are receiving unsolicited emails from the same email address.
Which action should be performed to prevent this from occurring?

A. Install an ACL on the firewall to block traffic from the sender and filter the IP address.
Ac

B. Configure a rule in each users router and restart the router.

C. Install an anti-spam filter on the domain mail servers and filter the email address.
D. Configure rules on the users host and restart the host.

Answer: C

QUESTION NO: 213

Which of the following describes the validation of a message's origin?

A. Integrity
B. Confidentiality
C. Non-repudiation

"Pass Any Exam. Any Time." - www.actualtests.com 64

 CompTIA SY0-201: Practice Exam
D. Asymmetric encryption

Answer: C

QUESTION NO: 214

Users are using thumb drives to connect to USB ports on company workstations. A technician is
concerned that sensitive files can be copied to the USB drives. Which mitigation technique would
address this concern? (Select TWO).

A. Disable the USB root hub within the OS.

B. Apply the concept of least privilege to USB devices.
C. Disable USB within the workstations BIOS.
D. Run spyware detection against all workstations.

m
Answer: A,C

.co
QUESTION NO: 215
sts
Using software on an individual computer to generate a key pair is an example of which of the
following approaches to PKI architecture?
lTe

A. Decentralized
B. Centralized
C. Hub and spoke
tua

D. Distributed key

Answer: A
Ac

QUESTION NO: 216

Which description is true about how to accomplish steganography in graphic files?

A. Replacing the most significant bit of each byte

B. Replacing the most significant byte of each bit
C. Replacing the least significant byte of each bit
D. Replacing the least significant bit of each byte

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 65

 CompTIA SY0-201: Practice Exam
QUESTION NO: 217

Which of the following types of encryption would be BEST to use for a large amount of data?

A. Asymmetric
B. Symmetric
C. ROT13
D. Hash

Answer: B

QUESTION NO: 218

Which one of the following options is a vulnerability assessment tool?

m
A. AirSnort
B. John the Ripper
C. Cain _Abel
D. Nessus
.co
sts
Answer: D
lTe

QUESTION NO: 219

Malicious software that travels across computer networks without user assistance is an example of
tua

a:

A. worm
B. virus
Ac

C. logic bomb
D. Trojan hors

Answer: A

QUESTION NO: 220

You work as a network administrator for your company. Your company has just detected a
malware incident. Which will be your first response?

A. Removal
B. Containment
C. Recovery

"Pass Any Exam. Any Time." - www.actualtests.com 66

 CompTIA SY0-201: Practice Exam
D. Monitor

Answer: B

QUESTION NO: 221

When setting password rules, which of the following would lower the level of security of a network?

A. Passwords must be greater than six characters and contain at least one non-alpha.
B. All passwords are set to expire at regular intervals and users are required to choose new
passwords that have not been used before.
C. Complex passwords that users can not remotely change are randomly generated by the
administrator and given to users
D. After a set number of failed attempts the server will lock out any user account forcing the user
to call the administrator to re-enable the account.

m
Answer: C
.co
QUESTION NO: 222
sts

You are a network technician of your company. You have just detected an intrusion on your
company??s network from the Internet. What should be checked FIRST?
lTe

A. The firewall logs

B. The performance logs
tua

C. The DNS logs

D. The access logs
Ac

Answer: A

QUESTION NO: 223

A person pretends to be a telecommunications repair technician, enters a building stating that

there is a networking trouble work order and requests that a security guard unlock the wiring closet
The person connects a packet sniffer to the network switch in the wiring closet and hides the
sniffer behind the switch against a wall. This is an example of:

A. a vulnerability scan
B. social engineering
C. a man in the middle attack
D. a penetration test

"Pass Any Exam. Any Time." - www.actualtests.com 67

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 224

Which method could identify when unauthorized access has occurred?

A. Implement session termination mechanism.

B. Implement previous logon notification.
C. Implement session lock mechanism.
D. Implement two-factor authentication.

Answer: B

m
QUESTION NO: 225

Which of the following definitions would be correct regarding Eavesdropping?

.co
A. Placing a computer system between the sender and receiver to capture information.
B. Someone looking through your files.
sts
C. Listening or overhearing parts of a conversation
D. Involve someone who routinely monitors network traffic.
lTe

Answer: C
tua

QUESTION NO: 226

Which practice is the best to secure log files?

Ac

A. Copy or save the logs to a remote log server.

B. Change security settings to avoid corruption.
C. Log all failed and successful login attempts.
D. Deny administrators all access to log files to prevent write failures.

Answer: A

QUESTION NO: 227

Which of the following definitions would be correct regarding Active Inception?

A. Someone looking through your files

"Pass Any Exam. Any Time." - www.actualtests.com 68

 CompTIA SY0-201: Practice Exam
B. Involve someone who routinely monitors network traffic
C. Listening or overhearing parts of a conversation
D. Placing a computer system between the sender and receiver to capture information.

Answer: D

QUESTION NO: 228

How to test the integrity of a company's backup data?

A. By reviewing the written procedures

B. By conducting another backup
C. By restoring part of the backup
D. By using software to recover deleted files

m
Answer: C

.co
QUESTION NO: 229
sts
Nmap has been run against a server and more open ports than expected have been discovered.
Which of the following would be the FIRST step to take?
lTe

A. All ports should be closed and observed to see whether a process tries to reopen the port.
B. Nmap should be run again and observed to see whether different results are obtained.
C. All ports should be left open and traffic monitored for malicious activity
tua

D. The process using the ports should be examined.

Answer: D
Ac

QUESTION NO: 230

Which statement best describes a static NAT?

A. A static NAT uses a many to many mapping.

B. A static NAT uses a one to many mapping.
C. A static NAT uses a many to one mapping.
D. A static NAT uses a one to one mapping.

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 69

 CompTIA SY0-201: Practice Exam
QUESTION NO: 231

Which of the following would be MOST desirable when attacking encrypted data?

A. Sniffed traffic
B. Block cipher
C. Weak key
D. Algorithm used

Answer: C

QUESTION NO: 232

Which scanner can find a rootkit?

m
A. Email scanner
B. Malware scanner
C. Anti-spam scanner
D. Adware scanner
.co
sts
Answer: B
lTe

QUESTION NO: 233

Social engineering attacks would be MOST effective in which of the following environments?
tua

(Select TWO).

A. A locked, windowless building

B. A military facility with computer equipment containing biometrics.
Ac

C. A public building that has shared office space.

D. A company with a dedicated information technology (IT) security staff.
E. A company with a help desk whose personnel have minimal training.

Answer: C,E

QUESTION NO: 234

What is steganography primarily used for?

A. Data integrity
B. Message digest
C. Hide information

"Pass Any Exam. Any Time." - www.actualtests.com 70

 CompTIA SY0-201: Practice Exam
D. Encrypt information

Answer: C

QUESTION NO: 235

Which of the following is the MOST effective way for an administrator to determine what security
holes reside on a network?

A. Perform a vulnerability assessment

B. Run a port scan
C. Run a sniffer
D. Install and monitor an IDS

Answer: A

m
QUESTION NO: 236
.co
For the following sites, which one has the means (e.g. equipment, software, and communications)
sts
to facilitate a full recovery within minutes?

A. Cold site
lTe

B. Hot site
C. Warm site
D. Reciprocal site
tua

Answer: B
Ac

QUESTION NO: 237

A company has instituted a VPN to allow remote users to connect to the office. As time progresses
multiple security associations are created with each association being more secure. Which of the
following should be implemented to automate the selection of the BEST security association for
each user?

A. AES
B. 3DES
C. SHA
D. IKE

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 71

 CompTIA SY0-201: Practice Exam

QUESTION NO: 238

Which item is not a logical access control method?

A. biometrics
B. group policy.
C. ACL
D. software token.

Answer: A

QUESTION NO: 239

m
The concept that a web script is run in its own environment and cannot interfere with any other
process is known as a:

A. honey pot
.co
B. VLAN
sts
C. quarantine
D. sandbox
lTe

Answer: D
tua

QUESTION NO: 240

Which description is true about the external security testing?

Ac

A. Conducted from outside the perimeter switch but inside the border router
B. Conducted from outside the perimeter switch but inside the firewall
C. Conducted from outside the organizations security perimeter
D. Conducted from outside the building that hosts the organizations servers

Answer: C

QUESTION NO: 241

A small manufacturing company wants to deploy secure wireless on their network. Which of the
following wireless security protocols could be used? (Select TWO).

"Pass Any Exam. Any Time." - www.actualtests.com 72

 CompTIA SY0-201: Practice Exam
A. WEP
B. IPX
C. WPA
D. WAN

Answer: A,C

QUESTION NO: 242

What should be established immediately upon evidence seizure?

A. Forensic analysis
B. Start the incident respond plan
C. Chain of custody
D. Damage and loss control

m
Answer: C
.co
QUESTION NO: 243
sts

Which of the following uses private key / public key technology to secure web sites?
lTe

A. SSL
B. TCP
C. Media Access Control (MAC)
tua

D. Access Control List (ACL)

Answer: A
Ac

QUESTION NO: 244

Which one of the following options will permit an attacker to hide the presence of malicious code
through altering the systems process and registry entries?

A. Trojan
B. Logic bomb
C. Worm
D. Rootkit

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 73

 CompTIA SY0-201: Practice Exam
QUESTION NO: 245

Which of the following is the MOST significant flaw in Pretty Good Privacy (PGP) authentication?

A. Private keys can be compromised.

B. A user must trust the public key that is received
C. It is subject to a man-in-the-middle attack
D. Weak encryption can be easily broken

Answer: B

QUESTION NO: 246

Patch management must be combined with full-featured systems management to be effective.

Determining which patches are needed, applying the patches and which of the following are three

m
generally accepted activities of patch management?

.co
A. Backing up the patch file executables to a network share
B. Updating the firewall configuration to include the patches
C. Auditing for the successful application of the patches
sts
D. Running a NIDS report to list the remaining vulnerabilities

Answer: C
lTe

QUESTION NO: 247

tua

The MOST common exploits of Internet-exposed network services are due to:

A. illicit servers
Ac

B. Trojan horse programs

C. active content (e.g. Java Applets)
D. buffer overflows

Answer: D

QUESTION NO: 248

Which option is correct about a hash algorithms ability to avoid the same output from two guessed
inputs?

A. Collision strength
B. Collision resistance

"Pass Any Exam. Any Time." - www.actualtests.com 74

 CompTIA SY0-201: Practice Exam
C. Collision strength
D. Collision metric

Answer: B

QUESTION NO: 249

Which of the following would be an example of a hardware device where keys can be stored?
(Select TWO).

A. PCI card
B. Smart card
C. PCMCIA card
D. Network interface card (NIC)

m
Answer: B,C

.co
QUESTION NO: 250
sts
Encryption is the conversion of data into a form, called a ciphertext that cannot be easily
understood by unauthorized people. Which encryption is the strongest by use of mathematical
evaluation techniques?
lTe

A. 3DES
B. ROT13
tua

C. AES
D. DES
Ac

Answer: C

QUESTION NO: 251

The Diffie-Hellman encryption algorithm relies on which of the following?

A. Tunneling
B. Digital signatures
C. Key exchange
D. Passwords

Answer: C

"Pass Any Exam. Any Time." - www.actualtests.com 75

 CompTIA SY0-201: Practice Exam
QUESTION NO: 252

Which technology is able to isolate a host OS from some types of security threats?

A. Kiting
B. Virtualization
C. Cloning
D. Intrusion detection

Answer: B

QUESTION NO: 253

Non-repudiation is enforced by which of the following?

m
A. Secret keys
B. Digital signatures
C. pki
D. Cipher block chaining
.co
sts
Answer: B
lTe

QUESTION NO: 254

Your company has already implemented two-factor authentication and wants to install a third
tua

authentication factor. If the existing authentication system uses strong passwords and PKI tokens,
which item would provide a third factor?

A. Six digit PINs

Ac

B. Pass phrases
C. Fingerprint scanner
D. Elliptic curve

Answer: C

QUESTION NO: 255

Which of the following would be the MOST effective backup site for disaster recovery?

A. Cold site
B. Warm site
C. Hot site

"Pass Any Exam. Any Time." - www.actualtests.com 76

 CompTIA SY0-201: Practice Exam
D. Reciprocal agreement

Answer: C

QUESTION NO: 256

Which one of the following options will create a security buffer zone between two rooms?

A. Mantrap
B. Anti-pass back
C DMZ
D. Turnstile

Answer: A

m
QUESTION NO: 257
.co
Which of the following describes backing up files and software that have changed since the last
full or incremental backup?
sts

A. Full backup
B. Differential backup
lTe

C. Incremental backup
D. Delta backup
tua

Answer: C
Ac

QUESTION NO: 258

Which is the primary objective to implement performance monitoring applications on network

systems from a security standpoint?

A. To detect host intrusions from external networks

B. To detect network intrusions from external attackers
C. To detect integrity degradations to network attached storage
D. To detect availability degradations caused by attackers

Answer: D

QUESTION NO: 259

"Pass Any Exam. Any Time." - www.actualtests.com 77

 CompTIA SY0-201: Practice Exam
Human resource department personnel should be trained about security policy:

A. guidelines and enforcement.

B. maintenance.
C. monitoring and administration
D. implementation

Answer: A

QUESTION NO: 260

Which of the following can affect heaps and stacks?

A. SQL injection
B. Cross-site scripting

m
C. Buffer overflows
D. Rootkits

Answer: C
.co
sts

QUESTION NO: 261

lTe

An enclosure that prevents radio frequency signals from emanating out of a controlled
environment is BEST described as which of the following?
tua

A. Faraday cage
B. Mantrap
C. Grounded wiring frame
Ac

D. TEMPEST

Answer: A

QUESTION NO: 262

Which of the following is not a step in the incident response?

A. recovery.
B. repudiation
C. containment
D. eradication

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 78

 CompTIA SY0-201: Practice Exam

QUESTION NO: 263

In a classified environment, a clearance into a Top Secret compartment only allows access to
certain information within that compartment. This is known as

A. dual control.
B. need to know.
C. separation of duties
D. acceptable use.

Answer: B

m
QUESTION NO: 264

On the basis of certain ports, which of the following will allow wireless access to network
resources?
.co
A. 802.11a
sts
B. 802.11n
C. 802.lx
D. 802.11g
lTe

Answer: C
tua

QUESTION NO: 265

Ac

An organization has a hierarchical-based concept of privilege management with administrators

having full access, human resources personnel having slightly less access and managers having
access to their own department files only. This is BEST described as:

A. Discretionary Access Control (DAC).

B. Rule Based Access Control (RBAC).
C. Mandatory Access Control (MAC)
D. Role Based Access Control (RBAC)

Answer: D

QUESTION NO: 266

"Pass Any Exam. Any Time." - www.actualtests.com 79

 CompTIA SY0-201: Practice Exam
Identify the item that can determine which flags are set in a TCP/IP handshake?

A. Networkmapper
B. FIN/RST
C. Protocol analyzer
D. SYN/ACK

Answer: C

QUESTION NO: 267

A representative from the human resources department informs a security specialist that an
employee has been terminated. Which of the following would be the BEST action to take?

A. Disable the employee's user accounts and keep the data for a specified period of time.

m
B. Disable the employee's user accounts and delete all data.
C. Contact the employee's supervisor regarding disposition of user accounts
.co
D. Change the employee's user password and keep the data for a specified period.

Answer: A
sts

QUESTION NO: 268

lTe

Which one of the following processes is best to remove PII data from a disk drive before reuse?
tua

A. Reformatting
B. Sanitization
C Degaussing
Ac

D. Destruction

Answer: B

QUESTION NO: 269

One of the below options are correct regarding the DDoS (Distributed Denial of Service) attack?

A. Listening or overhearing parts of a conversation

B. Placing a computer system between the sender and receiver to capture information
C. Use of multiple computers to attack a single organization
D. Prevention access to resources by users authorized to use those resources

Answer: C

"Pass Any Exam. Any Time." - www.actualtests.com 80

 CompTIA SY0-201: Practice Exam

QUESTION NO: 270

Why malware that uses virtualization techniques is difficult to detect?

A. The malware may be implementing a proxy server for command and control.
B. A portion of the malware may have been removed by the IDS.
C. The malware may be using a Trojan to infect the system.
D. The malware may be running at a more privileged level than the antivirus software.

Answer: D

QUESTION NO: 271

m
An SMTP server is the source of email spam in an organization. Which of the following is MOST
likely the cause?

A. The administrator account was not secured.

.co
B. X.400 connectors have not been password protected.
sts
C. Remote access to the email application's install directory has not been removed.
D. Anonymous relays have not been disabled.
lTe

Answer: D
tua

QUESTION NO: 272

A graphical user interface (GUI) is a type of user interface which allows people to interact with
Ac

electronic devices such as computers; hand-held devices such as MP3 Players, Portable Media
Players or Gaming devices; household appliances and office equipment. Which of the following
will permit a technician to restrict a users?? access to the GUI?

A. Use of logical tokens

B. Group policy implementation
C. Password policy enforcement
D. Access control lists

Answer: B

QUESTION NO: 273

"Pass Any Exam. Any Time." - www.actualtests.com 81

 CompTIA SY0-201: Practice Exam
The first step in creating a security baseline would be:

A. identifying the use case.

B. installing software patches.
C. vulnerability testing
D. creating a security policy

Answer: D

QUESTION NO: 274

Which key is generally applied FIRST to a message digest to provide non-repudiation by use of
asymmetric cryptography?

A. Private key of the receiver

m
B. Private key of the sender
C. Public key of the sender
D. Public key of the receiver
.co
Answer: B
sts

QUESTION NO: 275

lTe

Default passwords in hardware and software should be changed:

tua

A. if a threat becomes known.

B. once each month
C. when the hardware or software is turned on.
Ac

D. when the vendor requires it

Answer: C

QUESTION NO: 276

An organization needs to monitor all network traffic as it traverses their network. Which item
should be used by the technician?

A. Honeypot
B. Protocol analyzer
C. HIDS
D. Content filter

"Pass Any Exam. Any Time." - www.actualtests.com 82

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 277

Which of the following types of programs autonomously replicates itself across networks?

A. Trojan horse
B. Worm
C. Virus
D. Spyware

Answer: B

m
QUESTION NO: 278

An accountant has logged onto the company's outside banking website. An administrator uses a
.co
TCP/IP monitoring tool to discover that the accountant was actually using a spoofed banking
website. What most likely cause this attack? (Select TWO).
sts
A. Altered hosts file
B. Bluesnarfing
C. Networkmapper
lTe

D. DNS poisoning

Answer: A,D
tua

QUESTION NO: 279

Ac

Which of the following is employed to allow distrusted hosts to connect to services inside a
network without allowing the hosts direct access to the internal networks?

A. VLAN
B. Extranet
C. Demilitarized zone (DMZ)
D. Intranet

Answer: C

QUESTION NO: 280

"Pass Any Exam. Any Time." - www.actualtests.com 83

 CompTIA SY0-201: Practice Exam
You work as a network administrator for your company. Your company requires you to improve the
physical security of a data center located inside the office building. The data center already
maintains a physical access log and has a video surveillance system. Which additional control can
be performed?

A. ACL
B. Defense-in-depth
C. Logical token
D. Mantrap

Answer: D

QUESTION NO: 281

Which of the following BEST describes an attempt to transfer DNS zone data?

m
A. Evasion
B. Fraggle
.co
C. Teardrop
D. Reconnaissance
sts

Answer: D
lTe

QUESTION NO: 282

tua

Which method is the LEAST intrusive to check the environment for known software flaws?

A. Port scanner
Ac

B. Vulnerability scanner
C. Penetration test
D. Protocol analyzer

Answer: B

QUESTION NO: 283

A honeypot is used to:

A. provide an unauthorized user with a place to safely work.

B. give an unauthorized user time to complete an attack.
C. trap attackers in a false network.

"Pass Any Exam. Any Time." - www.actualtests.com 84

 CompTIA SY0-201: Practice Exam
D. allow administrators a chance to observe an attack.

Answer: D

QUESTION NO: 284

Which item can easily create an unencrypted tunnel between two devices?

A. PPTP
B. AES
C. L2TP
D. HTTPS

Answer: C

m
QUESTION NO: 285
.co
Which of the following are components of host hardening? (Select TWO).
sts
A. Removing a user's access to the user's data.
B. Adding users to the administrator group.
C. Disabling unnecessary services.
lTe

D. Configuring the Start menu and Desktop

E. Applying patches
tua

Answer: C,E
Ac

QUESTION NO: 286

In order to encrypt credit card data, which will be the most secure algorithm with the least CPU
utilization?

A. 3DES
B. AES
C. SHA-1
D. MD5

Answer: B

QUESTION NO: 287

"Pass Any Exam. Any Time." - www.actualtests.com 85

 CompTIA SY0-201: Practice Exam
Pretty good privacy (PGP) uses a PKI Trust Model where no certificate authority (CA) is
subordinate to another. The model with no single trusted root is known as:

A. peer-to-peer.
B. downlevel.
C. hierarchical
D. hybrid

Answer: A

QUESTION NO: 288

Which solution can be used by a user to implement very tight security controls for technicians that
seek to enter the users' datacenter?

m
A. Combination locks and key locks
B. Smartcard and proximity readers
C. Magnetic lock and pin
.co
D. Biometric reader and smartcard
sts
Answer: D
lTe

QUESTION NO: 289

Which of the following is a protocol analyzer?

tua

A. John the Ripper

B. WireShark
Ac

C. Cain _Abel
D. Nessus

Answer: B

QUESTION NO: 290

In a secure environment, which authentication mechanism performs better?

A. RADIUS because it is a remote access authentication service.

B. TACACS because it encrypts client-server negotiation dialogs.
C. RADIUS because it encrypts client-server passwords.
D. TACACS because it is a remote access authentication service.

"Pass Any Exam. Any Time." - www.actualtests.com 86

 CompTIA SY0-201: Practice Exam
Answer: B

QUESTION NO: 291

Which of the following common attacks would the attacker capture the user's login information and
replay it again later?

A. Back Door Attacks

B. Replay Attack
C. Spoofing
D. Man In The Middle

Answer: C

m
QUESTION NO: 292
.co
After auditing file, which log will show unauthorized usage attempts?

A. Application
sts
B. Performance
C. Security
D. System
lTe

Answer: C
tua

QUESTION NO: 293

Ac

Which of the following encryption algorithms relies on the inability to factor large prime numbers?

A. Elliptic Curve
B. AES256
C. RSA
D. SHA-1

Answer: C

QUESTION NO: 294

While monitoring application activity and modification, which system should be used?

"Pass Any Exam. Any Time." - www.actualtests.com 87

 CompTIA SY0-201: Practice Exam
A. NIDS
B. RADIUS
C. HIDS
D. OVAL

Answer: C

QUESTION NO: 295

The difference between identification and authentication is that:

A. authentication verifies a set of credentials while identification verifies the identity of the network.
B. authentication verifies a user ID belongs to a specific user while identification verifies the
identity of a user group.
C. authentication verifies a set of credentials while identification verifies the identity of a user

m
requesting credentials.
.co
D. authentication verifies the identity of a user requesting credentials while identification verifies a
set of credentials.

Answer: C
sts
lTe

QUESTION NO: 296

The main objective of risk management in an organization is to reduce risk to a level:

tua

A. where the ALE is lower than the SLE.

B. where the ARO equals the SLE.
C. the organization will mitigate.
Ac

D. the organization will accept.

Answer: D

QUESTION NO: 297

Following a disaster, which of the following functions should be returned FIRST from the backup
facility to the primary facility?

A. Web services
B. Systems functions
C. Executive functions
D. Least critical functions

"Pass Any Exam. Any Time." - www.actualtests.com 88

 CompTIA SY0-201: Practice Exam
Answer: D

QUESTION NO: 298

PKI to encrypt sensitive emails sent to an assistant. In addition to encrypting the body of the email,
the executive wants to encrypt the signature so that the assistant can verify that the email actually
came from the executive.

Which asymmetric key should be used by the executive to encrypt the signature?

A. Shared
B. Private
C. Hash
D. Public

m
Answer: B
.co
QUESTION NO: 299
sts

Which of the following is a reason to use a vulnerability scanner?

A. To identify open ports on a system

lTe

B. To assist with protocol analyzing

C. To identify remote access policies
D. To assist with PKI implementation
tua

Answer: A
Ac

QUESTION NO: 300

Your company's website permits customers to search for a product and display the current price
and quantity available of each product from the production database. Which of the following will
invalidate an SQL injection attack launched from the lookup field at the web server level?

A. NIPS
B. Security template
C. Buffer overflow protection
D. Input validation

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 89

 CompTIA SY0-201: Practice Exam
QUESTION NO: 301

The FIRST step in creating a security baseline would be:

A. identifying the use case

B. installing software patches
C. vulnerability testing.
D. creating a security policy

Answer: D

QUESTION NO: 302

Look at the following intrusion detection systems carefully, which one uses well defined models of
how an attack occurs?

m
A. Anomaly
B. Protocol
C. Signature
.co
D. Behavior
sts

Answer: C
lTe

QUESTION NO: 303

tua

A computer system containing personal identification information is being implemented by a

company's sales department. The sales department has requested that the system become
operational before a security review can be completed. Which of the following can be used to
Ac

explain the reasons a security review must be completed?

A. Vulnerability assessment
B. Risk assessment
C. Corporate security policy
D. Need to know policy

Answer: C

QUESTION NO: 304

You work as a network technician. You have been asked to reconstruct the infrastructure of an
organization. You should make sure that the virtuaiization technology is implemented securely.
What should be taken into consideration while implementing virtuaiization technology?

"Pass Any Exam. Any Time." - www.actualtests.com 90

 CompTIA SY0-201: Practice Exam
A. The technician should perform penetration testing on all the virtual servers to monitor
performance.
B. The technician should verify that the virtual servers and the host have the latest service packs
and patches applied.
C. The technician should verify that the virtual servers are dual homed so that traffic is securely
separated.
D. The technician should subnet the network so each virtual server is on a different network
segment.

Answer: B

QUESTION NO: 305

Which of the following attacks are being referred to if the attack involves the attacker gaining

m
access to a host in the network and logically disconnecting it?

A. TCP/IP Hijacking
B. UDP Attack
.co
C. ICMP Attacks
sts
D. Smurf Attacks

Answer: A
lTe

QUESTION NO: 306

tua

Which protocol can be used to ensure secure transmissions on port 443?

A. HTTPS
Ac

B. SHTTP
C. Telnet
D. SFTP

Answer: A

QUESTION NO: 307

Which of the following protocols is used to transmit data between a web browser and a web
server?

A. SSH
B. HTTP

"Pass Any Exam. Any Time." - www.actualtests.com 91

 CompTIA SY0-201: Practice Exam
C. SFTP
D. IMAP4

Answer: B

QUESTION NO: 308

Which method can be used to correct a single security issue on a workstation?

A. A patch
B. Configuration baseline
C. A service pack
D. Patch management

Answer: A

m
QUESTION NO: 309
.co
Which of the following logs shows when the workstation was last shutdown?
sts

A. DHCP
B. Security
lTe

C. Access
D. System
tua

Answer: D
Ac

QUESTION NO: 310

Which one of the following options overwrites the return address within a program to execute
malicious code?

A. Buffer overflow
B. Rootkit
C. Logic bomb
D. Privilege escalation

Answer: A

QUESTION NO: 311

"Pass Any Exam. Any Time." - www.actualtests.com 92

 CompTIA SY0-201: Practice Exam
Which of the following attacks are being referred to if packets are not connection-oriented and do
not require the synchronization process?

A. TCP/IP Hijacking
B. UDP Attack
C. ICMP Attacks
D. Smurf Attacks

Answer: B

QUESTION NO: 312

Which security application can not proactively detect workstation anomalies?

A. HIPS

m
B. NIDS
C. antivirus software
D. personal software firewall.
.co
Answer: B
sts

QUESTION NO: 313

lTe

One of the below is a description for a password cracker, which one is it?
tua

A. A program that can locate and read a password file.

B. A program that provides software registration passwords or keys.
C. A program that performs comparative analysis.
Ac

D. A program that obtains privileged access to the system.

Answer: C

QUESTION NO: 314

Risk assessment is a common first step in a risk management process. Risk assessment is the
determination of quantitative or qualitative value of risk related to a concrete situation and a
recognized threat (also called hazard). As a best practice, risk assessments should be based upon
which of the following?

A. An absolute measurement of threats

B. A qualitative measurement of risk and impact

"Pass Any Exam. Any Time." - www.actualtests.com 93

 CompTIA SY0-201: Practice Exam
C. A quantitative measurement of risk, impact and asset value
D. A survey of annual loss, potential threats and asset value

Answer: C

QUESTION NO: 315

Which of the below options would you consider as a program that constantly observes data
traveling over a network?

A. Smurfer
B. Sniffer
C. Fragmenter
D. Spoofer

m
Answer: B

.co
QUESTION NO: 316
sts
Which of the following will require setting a baseline? (Select TWO).

A. Anomaly-based monitoring
lTe

B. Signature-based monitoring
C. NIPS
D. Behavior-based monitoring
tua

Answer: A,D
Ac

QUESTION NO: 317

From the listing of attacks, choose the attack which exploits session initiation between a Transport
Control Program (TCP) client and server within a network?

A. Buffer Overflow attack

B. SYN attack
C. Smurf attack
D. Birthday attack

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 94

 CompTIA SY0-201: Practice Exam
QUESTION NO: 318

Which statement correctly describes the difference between a secure cipher and a secure hash?

A. A hash can be reversed, a cipher cannot.

B. A hash produces a variable output for any input size, a cipher does not
C. A cipher can be reversed, a hash cannot.
D. A cipher produces the same size output for any input size, a hash does not.

Answer: C

QUESTION NO: 319

Which of the following assessment tools would be MOST appropriate for determining if a
password was being sent across the network in clear text?

m
A. Protocol analyzer
B. Port scanner
C. Password cracker
.co
D. Vulnerability scanner
sts

Answer: A
lTe

QUESTION NO: 320

tua

A peer-to-peer computer network uses diverse connectivity between participants in a network and
the cumulative bandwidth of network participants rather than conventional centralized resources
where a relatively low number of servers provide the core value to a service or application. Which
Ac

of the following is a security risk while using peer-to-peer software?

A. Licensing
B. Cookies
C. Data leakage
D. Multiple streams

Answer: C

QUESTION NO: 321

From the listing of attacks, which analyzes how the operating system (OS) responds to specific
network traffic, in an attempt to determine the operating system running in your networking
environment?

"Pass Any Exam. Any Time." - www.actualtests.com 95

 CompTIA SY0-201: Practice Exam
A. Operating system scanning.
B. Reverse engineering.
C. Fingerprinting
D. Host hijacking.

Answer: C

QUESTION NO: 322

For the following items, which one is a collection of servers setup to attract hackers?

A. VLAN
B. DMZ
C. Honeynet
D. Honeypot

m
Answer: C
.co
QUESTION NO: 323
sts

From the listing of attacks, choose the attack which misuses the TCP (Transmission Control
Protocol) three-way handshake process, in an attempt to overload network servers, so that
lTe

authorized users are denied access to network resources?

A. Man in the middle attack

tua

B. Smurf attack
C. Teardrop attack
D. SYN (Synchronize) attack
Ac

Answer: D

QUESTION NO: 324

Both the server and the client authenticate before exchanging datA. This is an example of which of
the following?

A. SSO
B. biometrics
C. mutual authentication.
D. multifactor authentication

"Pass Any Exam. Any Time." - www.actualtests.com 96

 CompTIA SY0-201: Practice Exam
Answer: C

QUESTION NO: 325

A technician is helping an organization to correct problems with staff members unknowingly

downloading malicious code from Internet websites. Which of the following should the technician
do to resolve the problem?

A. Use Java virtual machines to reduce impact

B. Disable unauthorized ActiveX controls
C. Implement a policy to minimize the problem
D. Install a NIDS

Answer: B

m
QUESTION NO: 326 .co
A protocol analyzer will most likely detect which security related anomalies?
sts
A. Many malformed or fragmented packets
B. Passive sniffing of local network traffic
C. Decryption of encrypted network traffic
lTe

D. Disabled network interface on a server

Answer: A
tua

QUESTION NO: 327

Ac

One type of network attack sends two different messages that use the same hash function to
generate the same message digest. Which network attack does this?

A. Man in the middle attack.

B. Ciphertext only attack.
C. Birthday attack.
D. Brute force attack.

Answer: C

QUESTION NO: 328

"Pass Any Exam. Any Time." - www.actualtests.com 97

 CompTIA SY0-201: Practice Exam
In computing, a stateful firewall (any firewall that performs stateful packet inspection (SPI) or
stateful inspection) is a firewall that keeps track of the state of network connections (such as TCP
streams, UDP communication) traveling across it. You have been studying stateful packet
inspection and want to perform this security technique on the network. Which device will you use
to BEST utilize stateful packet inspection?

A. Switch
B. Hub
C. ids
D. Firewall

Answer: D

QUESTION NO: 329

m
To which of the following viruses does the characteristic when the virus will attempt to avoid
.co
detection by masking itself from applications. It may attach itself to the boot sector of the hard
drive, form part of?

A. Polymorphic Virus
sts

B. Trojan Horse Virus

C. Stealth Virus
lTe

D. Retrovirus

Answer: C
tua

QUESTION NO: 330

Ac

The NIC should be placed in which mode to monitor all network traffic while placing a NIDS onto
the network?

A. Promiscuous
B. Half-duplex
C. Full-duplex
d. Auto

Answer: A

QUESTION NO: 331

Which of the following is an installable package that includes several patches from the same
vendor for various applications?
"Pass Any Exam. Any Time." - www.actualtests.com 98
 CompTIA SY0-201: Practice Exam
A. Hotfix
B. Patch template
C. Service pack
D. Patch rollup

Answer: C

QUESTION NO: 332

Which item can be commonly programmed into an application for ease of administration?

A. Back door
B. Trojan
C. Worm
D. Zombie

m
Answer: A
.co
QUESTION NO: 333
sts

To which of the following viruses does the characteristic when the virus may attempt to infect your
boot sector, infect all of your executable files, and destroy your applications files form part of?
lTe

A. Multipartite Virus
B. Armored Virus
tua

C. Companion Virus
D. Phage Virus
Ac

Answer: A

QUESTION NO: 334

Which of the following is MOST effective in preventing adware?

A. Firewall
B. HIDS
C. Antivirus
D. Pop-up blocker

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 99

 CompTIA SY0-201: Practice Exam
QUESTION NO: 335

Choose the most effective method of preventing computer viruses from spreading throughout the
network.

A. You should require root/administrator access to run programs and applications.

B. You should enable scanning of all e-mail attachments.
C. You should prevent the execution of .vbs files.
D. You should install a host based IDS (Intrusion Detection System)

Answer: B

QUESTION NO: 336

Choose the correct order in which crucial equipment should draw power.

m
A. Backup generator, UPS battery, UPS line conditioner
.co
B. Uninterruptible Power Supply (UPS) battery, UPS line conditioner, backup generator
C. Backup generator, UPS line conditioner, UPS battery
D. UPS line conditioner, UPS battery, and backup generator
sts

Answer: D
lTe

QUESTION NO: 337

tua

Choose the statement that best details the difference between a worm and a Trojan horse?

A. Worms are distributed through e-mail messages while Trojan horses do not.
B. Worms self replicate while Trojan horses do not.
Ac

C. Worms are a form of malicious code while Trojan horses are not
D. There is no difference between a worm and a Trojan horse.

Answer: B

QUESTION NO: 338

Recently, your company has implemented a work from home program. Employees should connect
securely from home to the corporate network. Which encryption technology can be used to
achieve this goal?

A. L2TP
B. IPSec

"Pass Any Exam. Any Time." - www.actualtests.com 100

 CompTIA SY0-201: Practice Exam
C. pppoE
D. pptp

Answer: B

QUESTION NO: 339

Choose the statement which best defines the characteristics of a computer virus.

A. A computer virus is a find mechanism, initiation mechanism and can propagate.

B. A computer virus is a learning mechanism, contamination mechanism and can exploit.
C. A computer virus is a search mechanism, connection mechanism and can integrate.
D. A computer virus is a replication mechanism, activation mechanism and has an objective.

Answer: D

m
QUESTION NO: 340
.co
After the maximum number attempts have failed, which of the following could set an account to
sts
lockout for 30 minutes?

A. Account lockout threshold

lTe

B. Account lockout duration

C. Password complexity requirements
D. Key distribution center
tua

Answer: B
Ac

QUESTION NO: 341

Choose the attack or malicious code that cannot be prevented or deterred solely through using
technical measures.

A. Dictionary attacks.
B. Man in the middle attacks.
C. DoS (Denial of Service) attacks.
D. Social engineering.

Answer: D

"Pass Any Exam. Any Time." - www.actualtests.com 101

 CompTIA SY0-201: Practice Exam
QUESTION NO: 342

A Faraday cage or Faraday shield is an enclosure formed by conducting material, or by a mesh of

such material. Such an enclosure blocks out external static electrical fields. Faraday cages are
named after physicist Michael Faraday, who built one in 1836. Which of the following would a
Faraday cage prevent usage of?

A. Cell phone
B. Uninterruptible Power Supply (UPS)
C. Storage drive
D. USB key

Answer: A

QUESTION NO: 343

m
An Auditing system is necessary to prevent attacks on what part of the system?

A. The files.
.co
B. The operating system.
sts
C. The systems memory
D. None of the above
lTe

Answer: A
tua

QUESTION NO: 344

Which encryption algorithm depends on the inability to factor large prime numbers?
Ac

A. SHA-1
B. AES256
C. RSA
D. Elliptic Curve

Answer: C

QUESTION NO: 345

Choose the network mapping tool (scanner) which uses ICMP (Internet Control Message
Protocol).

A. A port scanner.

"Pass Any Exam. Any Time." - www.actualtests.com 102

 CompTIA SY0-201: Practice Exam
B. A map scanner.
C. A ping scanner.
D. A share scanner.

Answer: C

QUESTION NO: 346

Look at the following items, which one usually applies specifically to a web browser?

A. Anti-spyware
B. Pop-up blocker
C. Personal software firewall
D. Antivirus

m
Answer: B

.co
QUESTION NO: 347
sts
One type of port scan can determine which ports are in a listening state on the network, and can
then perform a two way handshake. Which type of port scan can perform this set of actions?
lTe

A. A TCP (transmission Control Protocol) SYN (Synchronize) scan

B. A TCP (transmission Control Protocol) connect scan
C. A TCP (transmission Control Protocol) fin scan
tua

D. A TCP (transmission Control Protocol) null scan

Answer: A
Ac

QUESTION NO: 348

Which one of the following options will allow for a network to remain operational after a Tl failure?

A. Redundant servers
B. Redundant ISP
C. RAID 5 drive array
D. Uninterruptible Power Supply (UPS)

Answer: B

"Pass Any Exam. Any Time." - www.actualtests.com 103

 CompTIA SY0-201: Practice Exam
QUESTION NO: 349

Which of the following has largely replaced SLIP?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)
C. vpn
D. RADIUS (Remote Authentication Dial-In User Service)

Answer: B

QUESTION NO: 350

In cryptography, a pre-shared key or PSK is a shared secret which was previously shared
between the two parties using some secure channel before it needs to be used. Pre-shared keys

m
can be applied to which of the following?

A. TPM
B. pgp
.co
C. Digital signature
sts
D. CA

Answer: B
lTe

QUESTION NO: 351

tua

Which of the following definitions fit correctly to RADIUS?

A. Is an older protocol that was used in early remote access environments

Ac

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk, IPX,
andDECnet
C. are used to make connections between private networks across a public network, such as the
Internet
D. is a mechanism that allows authentication of dial-in and other network connections

Answer: D

QUESTION NO: 352

Which description is correct about a tool used by organizations to verify whether or not a staff
member has been involved in malicious activity?

"Pass Any Exam. Any Time." - www.actualtests.com 104

 CompTIA SY0-201: Practice Exam
A. Mandatory vacations
B. Time of day restrictions
C. Implicit deny
D. Implicit allow

Answer: A

QUESTION NO: 353

Which of the following definitions fit correctly to TACACS?

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk, IPX,
andDECnet
C. are used to make connections between private networks across a public network, such as the

m
Internet
.co
D. It allows credentials to be accepted from multiple methods, including Kerberos.

Answer: D
sts

QUESTION NO: 354

lTe

Which access control method gives the owner control over providing permissions?

A. Mandatory Access Control (MAC)

tua

B. Role-Based Access Control (RBAC)

C. Rule-Based Access control (RBAC)
D. Discretionary Access Control (DAC)
Ac

Answer: D

QUESTION NO: 355

Which of the following needs to be backed up on a domain controller to be able to recover Active
Directory?

A. System files
B. User date
C. System state
D. Operating system

"Pass Any Exam. Any Time." - www.actualtests.com 105

 CompTIA SY0-201: Practice Exam
Answer: C

QUESTION NO: 356

Which item best describes an instance where a biometric system identifies legitimate users as
being unauthorized?

A. False acceptance
B. False positive
C. False rejection
D. False negative

Answer: C

m
QUESTION NO: 357
.co
Which of the following definitions fit correctly to PPTP?

A. It supports encapsulation in a single point-to-point environment

sts
B. It was created by Cisco as a method of creating tunnels primarily for dial-up connections
C. It is primarily a point-to-point protocol
D. It is a tunneling protocol originally designed for UNIX systems.
lTe

Answer: A
tua

QUESTION NO: 358

Ac

Which one of the following options is an attack launched from multiple zombie machines in attempt
to bring down a service?

A. TCP/IP hijacking
B. DoS
C. DDoS
D. Man-in-the-middle

Answer: C

QUESTION NO: 359

From the list of protocols, which two are VPN (Virtual Private Network) tunneling protocols?
Choose two protocols.

"Pass Any Exam. Any Time." - www.actualtests.com 106

 CompTIA SY0-201: Practice Exam
A. PPP (Point-to-Point Protocol),
B. SLIP (Serial Line Internet Protocol).
C. L2TP (Layer Two Tunneling Protocol).
D. SMTP (Simple Mail Transfer Protocol).
E. PPTP (Point-to-Point Tunneling Protocol).

Answer: C,E

QUESTION NO: 360

Which of the following is correct about an instance where a biometric system identifies
unauthorized users and allows them access?

A. false positive.
B. false rejection.

m
C. false acceptance.
D. false negative. .co
Answer: C
sts

QUESTION NO: 361

lTe

You work as the security administrator at Certkiller.com. You must configure the firewall to support
TACACS. Which port(s) should you open on the firewall?
tua

A. Port 21
B. Port 161
C. Port 53
Ac

D. Port 49

Answer: D

QUESTION NO: 362

Which security measures should be recommended while implementing system logging

procedures? (Select TWO).

A. Collect system temporary files.

B. Apply retention policies on the log files.
C. Perform CRC checks.
D. Perform hashing of the log files.

"Pass Any Exam. Any Time." - www.actualtests.com 107

 CompTIA SY0-201: Practice Exam
Answer: D

QUESTION NO: 363

Which of the following network attacks cannot occur in an e-mail attack?

A. Dictionary attack
B. Trojan Horse
C. Phage Virus
D. Polymorphic Virus

Answer: A

m
QUESTION NO: 364

Which media is LEAST susceptible to a tap being placed on the line?

A. Fiber
.co
B. Coaxial
sts
C. utp
D. STP
lTe

Answer: A
tua

QUESTION NO: 365

Which of the following attacks are being referred to if someone is accessing your e-mail server
Ac

and sending inflammatory information to others?

A. Trojan Horse.
B. Phage Virus.
C. Repudiation Attack.
D. Polymorphic Virus.

Answer: C

QUESTION NO: 366

Tom is a network administrator of his company. He suspects that files are being copied to a
remote location during off hours. The file server does not have logging enabled. Which logs will be
the BEST place to look for information?

"Pass Any Exam. Any Time." - www.actualtests.com 108

 CompTIA SY0-201: Practice Exam
A. Antivirus logs
B. Firewall logs
C. DNS logs
D. Intrusion detection logs

Answer: B

QUESTION NO: 367

A technician is auditing the security posture of an organization. The audit shows that many of the
users have the ability to access the company's accounting information. Which of the following
should the technician recommend to address this problem?

A. Changing file level audit settings

B. Implementing a host based intrusion detection system

m
C. Changing the user rights and security groups
.co
D. Implementing a host based intrusion prevention system

Answer: C
sts

QUESTION NO: 368

lTe

Job rotation is a cross-training technique where organizations minimize collusion amongst staff.

A. True
tua

B. False

Answer: A
Ac

QUESTION NO: 369

A security specialist is reviewing firewall logs and sees the information below. Which of the
following BEST describes the attack that is occurring?

"Pass Any Exam. Any Time." - www.actualtests.com 109

 CompTIA SY0-201: Practice Exam

A. ARP poisoning
B. DNS spoofing
C. Port scan
D. PING sweep

m
Answer: C

QUESTION NO: 370

.co
sts
Which description is true about penetration testing?

A. Simulating an actual attack on a network

lTe

B. Establishing a security baseline

C. Hacking into a network for malicious reasons
D. Detecting active intrusions
tua

Answer: A
Ac

QUESTION NO: 371

Which of the following would be MOST useful in determining which internal user was the source of
an attack that compromised another computer in its network?

A. The firewall's logs

B. The attacking computer's audit logs
C. The target computer's audit logs.
D. The domain controller's logs.

Answer: C

"Pass Any Exam. Any Time." - www.actualtests.com 110

 CompTIA SY0-201: Practice Exam
QUESTION NO: 372

Which encryption algorithms can be used to encrypt and decrypt data?

A. NTLM
B. MD5
C. SHA-l
D. RC5

Answer: D

QUESTION NO: 373

By which means do most network bound viruses spread?

m
A. E-mail
B. Floppy
C. CD-Rom
D. Mass storage devices
.co
sts
Answer: A
lTe

QUESTION NO: 374

The Lightweight Directory Access Protocol or LDAP is an application protocol for querying and
tua

modifying directory services running over TCP/IP. A user needs to implement secure LDAP on the
network. Which port number will secure LDAP use by default?

A. 53
Ac

B. 389
C. 443
D. 636

Answer: D

QUESTION NO: 375

Which of the following definitions should BEST suit the functions of an e-mail server?

A. Detect the viruses in the messages received from various sources and send warnings to the
recipient to warn him/her of the risky mail.
B. Notify you that a message carries a virus.

"Pass Any Exam. Any Time." - www.actualtests.com 111

 CompTIA SY0-201: Practice Exam
C. Forms a platform on which messages are sent.
D. Makes use of a port used specifically for messages to be sent through.

Answer: A

QUESTION NO: 376

On a company's LAN, port 3535 is typically blocked for outbound traffic. An end-user has recently
purchased a legitimate business program that needs to make outbound calls through this port
Which step should be taken by a technician to allow this? (Select TWO).

A. Change the users subnet mask.

B. Open the port on the company's firewall.
C. Open the port on the VLAN.
D. Open the port on the users personal software firewall.

m
Answer: B,D
.co
QUESTION NO: 377
sts

Choose the primary disadvantage of using a third party mail relay.

lTe

A. Spammers can utilize the third party mail relay.

B. A third party mail relay limits access to specific users.
C. A third party mail relay restricts the types of e-mail that maybe sent.
tua

D. A third party mail relay restricts spammers from gaining access.

Answer: A
Ac

QUESTION NO: 378

Which method is the easiest to disable a 10Base2 network?

A. Remove a vampire tap.

B. Introduce crosstalk.
C. Remove a terminator.
D. Install a zombie.

Answer: C

"Pass Any Exam. Any Time." - www.actualtests.com 112

 CompTIA SY0-201: Practice Exam
QUESTION NO: 379

Choose the option that details one of the primary benefits of using S/MIME /Secure Multipurpose
Internet Mail Extension)?

A. S/MIME allows users to send both encrypted and digitally signed e-mail messages.
B. S/MIME allows users to send anonymous e-mail messages.
C. S/MIME allows users to send e-mail messages with a return receipt.
D. S/MIME expedites the delivery of e-mail messages.

Answer: A

QUESTION NO: 380

Host intrusion detection systems (HIDS) and network intrusion detection systems (NIDS) are

m
methods of security management for computers and networks. A HIDS is installed to monitor
which of following?

A. Temporary Internet files

.co
B. CPU performance
sts
C. System files
D. NIC performance
lTe

Answer: C
tua

QUESTION NO: 381

On the topic of comparing viruses and hoaxes, which statement is TRUE? Choose the best TRUE
Ac

statement.

A. Hoaxes can create as much damage as a real virus.

B. Hoaxes are harmless pranks and should be ignored.
C. Hoaxes can help educate users about a virus.
D. Hoaxes carry a malicious payload and can be destructive.

Answer: A

QUESTION NO: 382

The purpose of a DNS server is to enable people and applications to lookup records in DNS
tables. Why implement security logging on a DNS server?

"Pass Any Exam. Any Time." - www.actualtests.com 113

 CompTIA SY0-201: Practice Exam
A. To monitor unauthorized zone transfers
B. To control unauthorized DNSDoS
C. To measure the DNS server performance
D. To perform penetration testing on the DNS server

Answer: A

QUESTION NO: 383

Choose the scheme or system used by PGP (Pretty Good Privacy) to encrypt data.

A. Asymmetric scheme
B. Symmetric scheme
C. Symmetric key distribution system
D. Asymmetric key distribution system

m
Answer: A
.co
QUESTION NO: 384
sts

Which security threat will affect PCs and can have its software updated remotely by a command
and control center?
lTe

A. Zombie
B. Adware
tua

C. Worm
D. Virus
Ac

Answer: A

QUESTION NO: 385

Which of the following web vulnerabilities is being referred to when it receives more data than it is
programmed to accept?

A. Buffer Overflows.
B. Cookies.
C. cgi.
D. SMTP Relay

Answer: A

"Pass Any Exam. Any Time." - www.actualtests.com 114

 CompTIA SY0-201: Practice Exam

QUESTION NO: 386

Which of the following will permit an administrator to find weak passwords on the network?

A. A password generator
B. A networkmapper
C. A hash function
D. A rainbow table

Answer: D

QUESTION NO: 387

m
Which of the following is a security reason to implement virtualization throughout the network
infrastructure?
.co
A. To analyze the various network traffic with protocol analyzers
B. To centralize the patch management of network servers
sts
C. To isolate the various network services and roles
D. To implement additional network services at a lower cost
lTe

Answer: C
tua

QUESTION NO: 388

Which security measure should be used while implementing access control?

Ac

A. Password complexity requirements

B. Disabling SSID broadcast
C. Time of day restrictions
D. Changing default passwords

Answer: A

QUESTION NO: 389

Which of the following web vulnerabilities is being referred to when it has a feature designed into
many e-mail servers that allows them to forward e-mail to other e-mail servers?

"Pass Any Exam. Any Time." - www.actualtests.com 115

 CompTIA SY0-201: Practice Exam
A. Buffer Overflows.
B. Cookies.
C. cgi
D. SMTP Relay

Answer: D

QUESTION NO: 390

Study the following items carefully, which one will permit a user to float a domain registration for a
maximum of five days?

A. Spoofing
B. DNS poisoning
C. Domain hijacking

m
D. Kiting

Answer: D
.co
sts

QUESTION NO: 391

Which of the following definitions BEST suit Java Applet?

lTe

A. It is a programming language that allows access to system resources of the system running the
script
tua

B. The client browser must have the ability to run Java applets in a virtual machine on the client
C. It can also include a digital signature to verify authenticity
D. It allows customized controls, icons, and other features to increase the usability of web enabled
Ac

systems

Answer: B

QUESTION NO: 392

A programmer plans to change the server variable in the coding of an authentication function for a
proprietary sales application. Which process should be followed before implementing the new
routine on the production application server?

A. Change management
B. Secure disposal
C. Password complexity

"Pass Any Exam. Any Time." - www.actualtests.com 116

 CompTIA SY0-201: Practice Exam
D. Chain of custody

Answer: A

QUESTION NO: 393

Which of the following definitions BEST suit Buffer Overflow?

A. It receives more data than it is programmed to accept.

B. It is used to provide a persistent, customized web experience for each visit.
C. It's an older form of scripting that was used extensively in early web systems
D. It has a feature designed into many e-mail servers that allows them to forward e-mail to other e-
mail servers

Answer: A

m
QUESTION NO: 394
.co
An administrator wants to make sure that no equipment is damaged when encountering a fire or
sts
false alarm in the server room. Which type of fire suppression system should be used?

A. Carbon Dioxide
lTe

B. Deluge sprinkler
C. Hydrogen Peroxide
D. Wet pipe sprinkler
tua

Answer: A
Ac

QUESTION NO: 395

An end-to-end traffic performance guarantee made by a service provider to a customer is a:

A. DRP.
B. BCP.
C. SLA.
D. VPN

Answer: C

QUESTION NO: 396

"Pass Any Exam. Any Time." - www.actualtests.com 117

 CompTIA SY0-201: Practice Exam
The staff must be cross-trained in different functional areas in order to detect fraud. Which of the
following is an example of this?

A. Implicit deny
B. Least privilege
C. Separation of duties
D. Job rotation

Answer: D

QUESTION NO: 397

Which of the following would allow an administrator to find weak passwords on the network?

A. A networkmapper

m
B. A hash function
C. A password generator
D. A rainbow table
.co
Answer: D
sts

QUESTION NO: 398

lTe

When power must be delivered to critical systems, which of the following is a countermeasure?
tua

A. Backup generator
B. Warm site
C. Redundant power supplies
Ac

D. Uninterruptible power supplies (UPSs)

Answer: A

QUESTION NO: 399

Which of the following statements are true regarding File Sharing?

A. FTP is a protocol, a client, and a server.

B. Security was based on the honor system.
C. As discussed earlier, SSH is a program that allows connections to be secured by encrypting the
session between the client and the server.
D. When files are stored on a workstation, the connection is referred to as a peer-to-peer
connection.

"Pass Any Exam. Any Time." - www.actualtests.com 118

 CompTIA SY0-201: Practice Exam
Answer: D

QUESTION NO: 400

Who is finally in charge of the amount of residual risk?

A. The senior management

B. The DRP coordinator
C. The security technician
D. The organizations security officer

Answer: A

m
.co
sts
lTe
tua
Ac

"Pass Any Exam. Any Time." - www.actualtests.com 119