jdrad01-junk
Quiz by , created more than 1 year ago

Security+ SY0-401 Quiz on SY0-401 - Section A (Network Security), created by jdrad01-junk on 24/11/2014.

248
1
0
jdrad01-junk
Created by jdrad01-junk almost 10 years ago
Close

SY0-401 - Section A (Network Security)

Question 1 of 58

1

Which of the following means of wireless authentication is easily vulnerable to spoofing?

Select one of the following:

  • MAC Filtering

  • WPA - LEAP

  • WPA - PEAP

  • Enabled SSID

Explanation

Question 2 of 58

1

Which of the following implementation steps would be appropriate for a public wireless hot- spot?

Select one of the following:

  • Reduce power level

  • Disable SSID broadcast

  • Open system authentication

  • MAC filter

Explanation

Question 3 of 58

1

Which of the following controls would allow a company to reduce the exposure of sensitive systems from
unmanaged devices on internal networks?

Select one of the following:

  • 802.1x

  • Data encryption

  • Password strength

  • BGP

Explanation

Question 4 of 58

1

A network administrator has been tasked with securing the WLAN. Which of the following cryptographic
products would be used to provide the MOST secure environment for the WLAN?

Select one of the following:

  • WPA2 CCMP

  • WPA

  • WPA with MAC filtering

  • WPA2 TKIP

Explanation

Question 5 of 58

1

A security administrator is segregating all web-facing server traffic from the internal network and restricting it to
a single interface on a firewall. Which of the following BEST describes this new network?

Select one of the following:

  • VLAN

  • Subnet

  • VPN

  • DMZ

Explanation

Question 6 of 58

1

Which of the following network design elements allows for many internal devices to share one public IP
address?

Select one of the following:

  • DNAT

  • PAT

  • DNS

  • DMZ

Explanation

Question 7 of 58

1

A company determines a need for additional protection from rogue devices plugging into physical ports around
the building. Which of the following provides the highest degree of protection from unauthorized wired network
access?

Select one of the following:

  • Intrusion Prevention Systems

  • MAC filtering

  • Flood guards

  • 802.1x

Explanation

Question 8 of 58

1

Due to hardware limitation, a technician must implement a wireless encryption algorithm that uses the RC4
protocol. Which of the following is a wireless encryption solution that the technician should implement while
ensuring the STRONGEST level of security?

Select one of the following:

  • WPA2-AES

  • 802.11ac

  • WPA-TKIP

  • WEP

Explanation

Question 9 of 58

1

An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and
network security, the administrator desires to provide network access for this group only. Which of the following
would BEST address this desire?

Select one of the following:

  • Install a proxy server between the users' computers and the switch to filter inbound network traffic.

  • Block commonly used ports and forward them to higher and unused port numbers.

  • Configure the switch to allow only traffic from computers based upon their physical address.

  • Install host-based intrusion detection software to monitor incoming DHCP Discover requests.

Explanation

Question 10 of 58

1

A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD
users and 2 web servers without wireless access. Which of the following should the company configure to
protect the servers from the user devices? (Select TWO).

Select one or more of the following:

  • Deny incoming connections to the outside router interface.

  • Change the default HTTP port

  • Implement EAP-TLS to establish mutual authentication

  • Disable the physical switch ports

  • Create a server VLAN

  • Create an ACL to access the server

Explanation

Question 11 of 58

1

An organization does not have adequate resources to administer its large infrastructure. A security
administrator wishes to combine the security controls of some of the network devices in the organization. Which
of the following methods would BEST accomplish this goal?

Select one of the following:

  • Unified Threat Management

  • Virtual Private Network

  • Single sign on

  • Role-based management

Explanation

Question 12 of 58

1

Which of the following would allow the organization to divide a Class C IP address range into several ranges?

Select one of the following:

  • Which of the following would allow the organization to divide a Class C IP address range into several ranges?

  • Virtual LANs

  • NAT

  • Subnetting

Explanation

Question 13 of 58

1

A network administrator wants to block both DNS requests and zone transfers coming from outside IP
addresses. The company uses a firewall which implements an implicit allow and is currently configured with the
following ACL applied to its external interface.
PERMIT TCP ANY ANY 80
PERMIT TCP ANY ANY 443
Which of the following rules would accomplish this task? (Select TWO).

Select one or more of the following:

  • Change the firewall default settings so that it implements an implicit deny

  • Apply the current ACL to all interfaces of the firewall

  • Remove the current ACL

  • Add the following ACL at the top of the current ACL DENY TCP ANY ANY 53

  • Add the following ACL at the bottom of the current ACL DENY ICMP ANY ANY 53

  • Add the following ACL at the bottom of the current ACL DENY IP ANY ANY 53

Explanation

Question 14 of 58

1

A security administrator wishes to increase the security of the wireless network. Which of the following BEST
addresses this concern?

Select one of the following:

  • Change the encryption from TKIP-based to CCMP-based.

  • Set all nearby access points to operate on the same channel.

  • Configure the access point to use WEP instead of WPA2.

  • Enable all access points to broadcast their SSIDs.

Explanation

Question 15 of 58

1

Sally, a sales manager, successfully connected her company-issued smartphone to the wireless network in her
office without supplying a username/password combination. Upon disconnecting from the wireless network, she
attempted to connect her personal tablet computer to the same wireless network and could not connect.
Which of the following is MOST likely the reason?

Select one of the following:

  • The company wireless is using a MAC filter.

  • The company wireless has SSID broadcast disabled.

  • The company wireless is using WEP.

  • The company wireless is using WPA2.

Explanation

Question 16 of 58

1

A network technician is on the phone with the system administration team. Power to the server room was lost
and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are
powered off. Assuming each server only provides one service, which of the following should be powered on
FIRST to establish DNS services?

Select one of the following:

  • Bind server

  • Apache server

  • Exchange server

  • RADIUS server

Explanation

Question 17 of 58

1

A security technician at a small business is worried about the Layer 2 switches in the network suffering from a
DoS style attack caused by staff incorrectly cabling network connections between switches.
Which of the following will BEST mitigate the risk if implemented on the switches?

Select one of the following:

  • Spanning tree

  • Flood guards

  • Access control lists

  • Syn flood

Explanation

Question 18 of 58

1

An administrator wants to establish a WiFi network using a high gain directional antenna with a narrow radiation
pattern to connect two buildings separated by a very long distance. Which of the following antennas would be
BEST for this situation?

Select one of the following:

  • Dipole

  • Yagi

  • Sector

  • Omni

Explanation

Question 19 of 58

1

A security analyst is reviewing firewall logs while investigating a compromised web server. The following ports
appear in the log:
22, 25, 445, 1433, 3128, 3389, 6667
Which of the following protocols was used to access the server remotely?

Select one of the following:

  • LDAP

  • HTTP

  • RDP

  • HTTPS

Explanation

Question 20 of 58

1

An organization does not want the wireless network name to be easily discovered. Which of the following
software features should be configured on the access points?

Select one of the following:

  • SSID broadcast

  • MAC filter

  • WPA2

  • Antenna placement

Explanation

Question 21 of 58

1

A network engineer is setting up a network for a company. There is a BYOD policy for the employees so that
they can connect their laptops and mobile devices.
Which of the following technologies should be employed to separate the administrative network from the
network in which all of the employees' devices are connected?

Select one of the following:

  • VPN

  • VLAN

  • WPA2

  • MAC filtering

Explanation

Question 22 of 58

1

When performing the daily review of the system vulnerability scans of the network Bob, the administrator,
noticed several security related vulnerabilities with an assigned vulnerability identification number. Bob
researches the assigned vulnerability identification number from the vendor website. Bob proceeds with
applying the recommended solution for identified vulnerability.
Which of the following is the type of vulnerability described?

Select one of the following:

  • Network based

  • IDS

  • Signature based

  • Host based

Explanation

Question 23 of 58

1

While configuring a new access layer switch, the administrator, Bob, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?

Select one of the following:

  • Log Analysis

  • VLAN Management

  • Network separation

  • 802.1x

Explanation

Question 24 of 58

1

Results from a vulnerability analysis indicate that all enabled virtual terminals on a router can be accessed
using the same password. The company's network device security policy mandates that at least one virtual
terminal have a different password than the other virtual terminals. Which of the following sets of commands
would meet this requirement?

Select one of the following:

  • line vty 0 6 P@s5W0Rd password line vty 7 Qwer++!Y password

  • line console 0 password password line vty 0 4 password P@s5W0Rd

  • line vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd

  • line vty 0 3 password Qwer++!Y line console 0 password P@s5W0Rd

Explanation

Question 25 of 58

1

After entering the following information into a SOHO wireless router, a mobile device's user reports being
unable to connect to the network:
PERMIT 0A: D1: FA. B1: 03: 37
DENY 01: 33: 7F: AB: 10: AB
Which of the following is preventing the device from connecting?

Select one of the following:

  • WPA2-PSK requires a supplicant on the mobile device.

  • Hardware address filtering is blocking the device.

  • TCP/IP Port filtering has been implemented on the SOHO router.

  • IP address filtering has disabled the device from connecting.

Explanation

Question 26 of 58

1

Which of the following MOST interferes with network-based detection techniques?

Select one of the following:

  • Mime-encoding

  • SSL

  • FTP

  • Anonymous email accounts

Explanation

Question 27 of 58

1

Thomas, a network administrator, is capturing packets on the network and notices that a large amount of the
traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from
the other traffic?

Select one of the following:

  • Connect the WAP to a different switch.

  • Create a voice VLAN.

  • Create a DMZ.

  • Set the switch ports to 802.1q mode.

Explanation

Question 28 of 58

1

Which of the following is BEST used as a secure replacement for TELNET?

Select one of the following:

  • HTTPS

  • HMAC

  • GPG

  • SSH

Explanation

Question 29 of 58

1

Which of the following is a difference between TFTP and FTP?

Select one of the following:

  • TFTP is slower than FTP.

  • TFTP is more secure than FTP.

  • TFTP utilizes TCP and FTP uses UDP.

  • TFTP utilizes UDP and FTP uses TCP.

Explanation

Question 30 of 58

1

Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that
these were false indicators. Which of the following security devices needs to be configured to disable future
false alarms?

Select one of the following:

  • Signature based IPS

  • Signature based IDS

  • Application based IPS

  • Anomaly based IDS

Explanation

Question 31 of 58

1

Alice, a security administrator, has observed repeated attempts to break into a server. Which of the following is
designed to stop an intrusion on a specific server?

Select one of the following:

  • HIPS

  • NIDS

  • HIDS

  • NIPS

Explanation

Question 32 of 58

1

Which of the following allows Thomas, a security technician, to provide the MOST secure wireless
implementation?

Select one of the following:

  • Implement WPA

  • Disable SSID

  • Adjust antenna placement

  • Implement WEP

Explanation

Question 33 of 58

1

Thomas, the compliance manager, wants to meet regulations. Thomas would like certain ports blocked only on
all computers that do credit card transactions. Which of the following should Thomas implement to BEST
achieve this goal?

Select one of the following:

  • A host-based intrusion prevention system

  • A host-based firewall

  • Antivirus update system

  • A network-based intrusion detection system

Explanation

Question 34 of 58

1

Thomas, the system administrator, wishes to monitor and limit users' access to external websites.
Which of the following would BEST address this?

Select one of the following:

  • Block all traffic on port 80.

  • Implement NIDS.

  • Use server load balancers.

  • Install a proxy server.

Explanation

Question 35 of 58

1

Sara, the security administrator, must configure the corporate firewall to allow all public IP addresses on the
internal interface of the firewall to be translated to one public IP address on the external interface of the same
firewall. Which of the following should Sara configure?

Select one of the following:

  • PAT

  • NAP

  • DNAT

  • NAC

Explanation

Question 36 of 58

1

Thomas needs to open ports on the firewall to allow for secure transmission of files. Which of the following
ports should be opened on the firewall?

Select one of the following:

  • TCP 23

  • UDP 69

  • TCP 22

  • TCP 21

Explanation

Question 37 of 58

1

Which statement is TRUE about the operation of a packet sniffer?

Select one of the following:

  • It can only have one interface on a management network.

  • They are required for firewall operation and stateful inspection.

  • The Ethernet card must be placed in promiscuous mode.

  • It must be placed on a single virtual LAN interface.

Explanation

Question 38 of 58

1

Which of the following firewall rules only denies DNS zone transfers?

Select one of the following:

  • deny udp any any port 53

  • deny ip any any

  • deny tcp any any port 53

  • deny all dns packets

Explanation

Question 39 of 58

1

Which of the following technologies can store multi-tenant data with different security requirements?

Select one of the following:

  • Data loss prevention

  • Trusted platform module

  • Hard drive encryption

  • Cloud computing

Explanation

Question 40 of 58

1

Which of the following devices would MOST likely have a DMZ interface?

Select one of the following:

  • Firewall

  • Switch

  • Load balancer

  • Proxy

Explanation

Question 41 of 58

1

Which default port number is secure?

Select one of the following:

  • 21

  • 22

  • 23

  • 25

Explanation

Question 42 of 58

1

Which should you do so that your wireless signal does not reach all the way out to the parking lot?

Select one of the following:

  • Disable SSID broadcasting

  • Turn off MAC filtering

  • Lower the power level

  • Implement WEP encryption

Explanation

Question 43 of 58

1

Admin Bob took a new WAP out of the box, plugged it in, and walked away. An attacker was able to access the
WAP using an administrator account. Which would have prevented the attack?

Select one of the following:

  • Configure MAC filtering

  • Disable SSID broadcasting

  • Change the default password

  • Configure 802.1x authentication

Explanation

Question 44 of 58

1

You enter the wireless network information into your computer correctly and connect to the network. You
remain connected, but you can't access any resources on the network. Which is the most likely reason?

Select one of the following:

  • Mac filtering is turned on

  • The SSID is disabled

  • The encryption is too strong

  • The WAP power level is too low

Explanation

Question 45 of 58

1

Which would allow home users to access internal company resources?

Select one of the following:

  • NAT

  • VLANs

  • NAC

  • VPN

Explanation

Question 46 of 58

1

You have two routers connected together, which then connect to two switches, which are also connected
together via fiber. How would you prevent unauthorized devices from connecting to the network?

Select one of the following:

  • Configure only one of the routers to run DHCP

  • Implement port security on the switches

  • Enable VTP on both switches and set to the same domain

  • Configure each port on the switches to use the same VLAN other than the default one

Explanation

Question 47 of 58

1

Which two would you need to use together to allow telecommuting while keeping it secure?

Select one or more of the following:

  • DMZ

  • VLANs

  • NAC

  • Spam filter

  • VPN concentrator

Explanation

Question 48 of 58

1

Your wireless network is dropping packets and degrading service only during certain times of day. What should
be your first troubleshooting step?

Select one of the following:

  • Increase the power level

  • Change to a higher gain antenna

  • Perform a site survey

  • Configure stronger encryption

Explanation

Question 49 of 58

1

You look at your router Access Control List and you see that it allows web, email, and SSH traffic. For some
reason though, some users are unable to access network printing services. Which could be blocking this?

Select one of the following:

  • Port security

  • Flood guards

  • Implicit deny

  • Loop protection

Explanation

Question 50 of 58

1

Your company allows business partners to connect to several of your application servers located at the main
office. What can the main office implement to protect the rest of the company from those business partners?

Select one of the following:

  • VPN

  • NAC

  • IDS

  • DMZ

Explanation

Question 51 of 58

1

Which protocol provides secure access to log on to a remote server's console to do some maintenance?

Select one of the following:

  • SFTP

  • SCP

  • HTTPS

  • SSH

Explanation

Question 52 of 58

1

Which provides a more secure connection than WPA TKIP?

Select one of the following:

  • MAC filtering

  • WEP

  • WPA2 CCMP

  • Disable SSID broadcast and increase power levels

Explanation

Question 53 of 58

1

Which solution would scan web traffic for malware and block it if malware is found, and could also block certain
websites that are inappropriate?

Select one of the following:

  • IDS

  • Firewall

  • UTM

  • ACL

Explanation

Question 54 of 58

1

How do you prevent unauthorized devices from connecting to the network via your network drops?

Select one of the following:

  • Mandatory Access Control

  • WPA2

  • Port Security

  • Network Intrusion Pevention

Explanation

Question 55 of 58

1

Which subnet mask would put these 4 PC's on different broadcast domains?
PC1 = 10.10.10.4
PC2 = 10.10.10.10
PC3 = 10.10.10.17
PC4 = 10.10.10.26

Select one of the following:

  • /24

  • /27

  • /28

  • /29

  • /30

Explanation

Question 56 of 58

1

Choose the port numbers in the proper order to match the order of these protocols: FTP, TFTP, Telnet, HTTP.

Select one of the following:

  • 80, 21, 23, 69

  • 21, 69, 23, 80

  • 69, 23, 21, 80

  • 23, 21, 80, 69

Explanation

Question 57 of 58

1

Choose the port numbers in the proper order to match the order of these protocols: HTTPS, SMTP, SNMP,
SCP.

Select one of the following:

  • 161, 22, 25, 443

  • 443, 161, 22, 25

  • 443, 25, 161, 22

  • 161, 443, 161, 22

Explanation

Question 58 of 58

1

Which of the following should be considered to mitigate data theft when using CAT5 wiring?

Select one of the following:

  • CCTV

  • Environmental monitoring

  • Multimode fiber

  • EMI shielding

Explanation

Previous
Next