Test
SY0-401 - Section A (Network Security)
Preguntas del test (58)
1Which of the following means of wireless authentication is easily vulnerable to spoofing?
- AMAC Filtering
- BWPA - LEAP
- CWPA - PEAP
- DEnabled SSID
2Which of the following implementation steps would be appropriate for a public wireless hot- spot?
- AReduce power level
- BDisable SSID broadcast
- COpen system authentication
- DMAC filter
3Which of the following controls would allow a company to reduce the exposure of sensitive systems from
unmanaged devices on internal networks?- A802.1x
- BData encryption
- CPassword strength
- DBGP
4A network administrator has been tasked with securing the WLAN. Which of the following cryptographic
products would be used to provide the MOST secure environment for the WLAN?- AWPA2 CCMP
- BWPA
- CWPA with MAC filtering
- DWPA2 TKIP
5A security administrator is segregating all web-facing server traffic from the internal network and restricting it to
a single interface on a firewall. Which of the following BEST describes this new network?- AVLAN
- BSubnet
- CVPN
- DDMZ
6Which of the following network design elements allows for many internal devices to share one public IP
address?- ADNAT
- BPAT
- CDNS
- DDMZ
7A company determines a need for additional protection from rogue devices plugging into physical ports around
the building. Which of the following provides the highest degree of protection from unauthorized wired network
access?- AIntrusion Prevention Systems
- BMAC filtering
- CFlood guards
- D802.1x
8Due to hardware limitation, a technician must implement a wireless encryption algorithm that uses the RC4
protocol. Which of the following is a wireless encryption solution that the technician should implement while
ensuring the STRONGEST level of security?- AWPA2-AES
- B802.11ac
- CWPA-TKIP
- DWEP
9An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and
network security, the administrator desires to provide network access for this group only. Which of the following
would BEST address this desire?- AInstall a proxy server between the users' computers and the switch to filter inbound network traffic.
- BBlock commonly used ports and forward them to higher and unused port numbers.
- CConfigure the switch to allow only traffic from computers based upon their physical address.
- DInstall host-based intrusion detection software to monitor incoming DHCP Discover requests.
10A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD
users and 2 web servers without wireless access. Which of the following should the company configure to
protect the servers from the user devices? (Select TWO).- ADeny incoming connections to the outside router interface.
- BChange the default HTTP port
- CImplement EAP-TLS to establish mutual authentication
- DDisable the physical switch ports
- ECreate a server VLAN
- FCreate an ACL to access the server
11An organization does not have adequate resources to administer its large infrastructure. A security
administrator wishes to combine the security controls of some of the network devices in the organization. Which
of the following methods would BEST accomplish this goal?- AUnified Threat Management
- BVirtual Private Network
- CSingle sign on
- DRole-based management
12Which of the following would allow the organization to divide a Class C IP address range into several ranges?
- AWhich of the following would allow the organization to divide a Class C IP address range into several ranges?
- BVirtual LANs
- CNAT
- DSubnetting
13A network administrator wants to block both DNS requests and zone transfers coming from outside IP
addresses. The company uses a firewall which implements an implicit allow and is currently configured with the
following ACL applied to its external interface.
PERMIT TCP ANY ANY 80
PERMIT TCP ANY ANY 443
Which of the following rules would accomplish this task? (Select TWO).- AChange the firewall default settings so that it implements an implicit deny
- BApply the current ACL to all interfaces of the firewall
- CRemove the current ACL
- DAdd the following ACL at the top of the current ACL DENY TCP ANY ANY 53
- EAdd the following ACL at the bottom of the current ACL DENY ICMP ANY ANY 53
- FAdd the following ACL at the bottom of the current ACL DENY IP ANY ANY 53
14A security administrator wishes to increase the security of the wireless network. Which of the following BEST
addresses this concern?- AChange the encryption from TKIP-based to CCMP-based.
- BSet all nearby access points to operate on the same channel.
- CConfigure the access point to use WEP instead of WPA2.
- DEnable all access points to broadcast their SSIDs.
15Sally, a sales manager, successfully connected her company-issued smartphone to the wireless network in her
office without supplying a username/password combination. Upon disconnecting from the wireless network, she
attempted to connect her personal tablet computer to the same wireless network and could not connect.
Which of the following is MOST likely the reason?- AThe company wireless is using a MAC filter.
- BThe company wireless has SSID broadcast disabled.
- CThe company wireless is using WEP.
- DThe company wireless is using WPA2.
16A network technician is on the phone with the system administration team. Power to the server room was lost
and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are
powered off. Assuming each server only provides one service, which of the following should be powered on
FIRST to establish DNS services?- ABind server
- BApache server
- CExchange server
- DRADIUS server
17A security technician at a small business is worried about the Layer 2 switches in the network suffering from a
DoS style attack caused by staff incorrectly cabling network connections between switches.
Which of the following will BEST mitigate the risk if implemented on the switches?- ASpanning tree
- BFlood guards
- CAccess control lists
- DSyn flood
18An administrator wants to establish a WiFi network using a high gain directional antenna with a narrow radiation
pattern to connect two buildings separated by a very long distance. Which of the following antennas would be
BEST for this situation?- ADipole
- BYagi
- CSector
- DOmni
19A security analyst is reviewing firewall logs while investigating a compromised web server. The following ports
appear in the log:
22, 25, 445, 1433, 3128, 3389, 6667
Which of the following protocols was used to access the server remotely?- ALDAP
- BHTTP
- CRDP
- DHTTPS
20An organization does not want the wireless network name to be easily discovered. Which of the following
software features should be configured on the access points?- ASSID broadcast
- BMAC filter
- CWPA2
- DAntenna placement
21A network engineer is setting up a network for a company. There is a BYOD policy for the employees so that
they can connect their laptops and mobile devices.
Which of the following technologies should be employed to separate the administrative network from the
network in which all of the employees' devices are connected?- AVPN
- BVLAN
- CWPA2
- DMAC filtering
22When performing the daily review of the system vulnerability scans of the network Bob, the administrator,
noticed several security related vulnerabilities with an assigned vulnerability identification number. Bob
researches the assigned vulnerability identification number from the vendor website. Bob proceeds with
applying the recommended solution for identified vulnerability.
Which of the following is the type of vulnerability described?- ANetwork based
- BIDS
- CSignature based
- DHost based
23While configuring a new access layer switch, the administrator, Bob, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?
- ALog Analysis
- BVLAN Management
- CNetwork separation
- D802.1x
24Results from a vulnerability analysis indicate that all enabled virtual terminals on a router can be accessed
using the same password. The company's network device security policy mandates that at least one virtual
terminal have a different password than the other virtual terminals. Which of the following sets of commands
would meet this requirement?- Aline vty 0 6 P@s5W0Rd password line vty 7 Qwer++!Y password
- Bline console 0 password password line vty 0 4 password P@s5W0Rd
- Cline vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd
- Dline vty 0 3 password Qwer++!Y line console 0 password P@s5W0Rd
25After entering the following information into a SOHO wireless router, a mobile device's user reports being
unable to connect to the network:
PERMIT 0A: D1: FA. B1: 03: 37
DENY 01: 33: 7F: AB: 10: AB
Which of the following is preventing the device from connecting?- AWPA2-PSK requires a supplicant on the mobile device.
- BHardware address filtering is blocking the device.
- CTCP/IP Port filtering has been implemented on the SOHO router.
- DIP address filtering has disabled the device from connecting.
26Which of the following MOST interferes with network-based detection techniques?
- AMime-encoding
- BSSL
- CFTP
- DAnonymous email accounts
27Thomas, a network administrator, is capturing packets on the network and notices that a large amount of the
traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from
the other traffic?- AConnect the WAP to a different switch.
- BCreate a voice VLAN.
- CCreate a DMZ.
- DSet the switch ports to 802.1q mode.
28Which of the following is BEST used as a secure replacement for TELNET?
- AHTTPS
- BHMAC
- CGPG
- DSSH
29Which of the following is a difference between TFTP and FTP?
- ATFTP is slower than FTP.
- BTFTP is more secure than FTP.
- CTFTP utilizes TCP and FTP uses UDP.
- DTFTP utilizes UDP and FTP uses TCP.
30Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that
these were false indicators. Which of the following security devices needs to be configured to disable future
false alarms?- ASignature based IPS
- BSignature based IDS
- CApplication based IPS
- DAnomaly based IDS
31Alice, a security administrator, has observed repeated attempts to break into a server. Which of the following is
designed to stop an intrusion on a specific server?- AHIPS
- BNIDS
- CHIDS
- DNIPS
32Which of the following allows Thomas, a security technician, to provide the MOST secure wireless
implementation?- AImplement WPA
- BDisable SSID
- CAdjust antenna placement
- DImplement WEP
33Thomas, the compliance manager, wants to meet regulations. Thomas would like certain ports blocked only on
all computers that do credit card transactions. Which of the following should Thomas implement to BEST
achieve this goal?- AA host-based intrusion prevention system
- BA host-based firewall
- CAntivirus update system
- DA network-based intrusion detection system
34Thomas, the system administrator, wishes to monitor and limit users' access to external websites.
Which of the following would BEST address this?- ABlock all traffic on port 80.
- BImplement NIDS.
- CUse server load balancers.
- DInstall a proxy server.
35Sara, the security administrator, must configure the corporate firewall to allow all public IP addresses on the
internal interface of the firewall to be translated to one public IP address on the external interface of the same
firewall. Which of the following should Sara configure?- APAT
- BNAP
- CDNAT
- DNAC
36Thomas needs to open ports on the firewall to allow for secure transmission of files. Which of the following
ports should be opened on the firewall?- ATCP 23
- BUDP 69
- CTCP 22
- DTCP 21
37Which statement is TRUE about the operation of a packet sniffer?
- AIt can only have one interface on a management network.
- BThey are required for firewall operation and stateful inspection.
- CThe Ethernet card must be placed in promiscuous mode.
- DIt must be placed on a single virtual LAN interface.
38Which of the following firewall rules only denies DNS zone transfers?
- Adeny udp any any port 53
- Bdeny ip any any
- Cdeny tcp any any port 53
- Ddeny all dns packets
39Which of the following technologies can store multi-tenant data with different security requirements?
- AData loss prevention
- BTrusted platform module
- CHard drive encryption
- DCloud computing
40Which of the following devices would MOST likely have a DMZ interface?
- AFirewall
- BSwitch
- CLoad balancer
- DProxy
41Which default port number is secure?
- A21
- B22
- C23
- D25
42Which should you do so that your wireless signal does not reach all the way out to the parking lot?
- ADisable SSID broadcasting
- BTurn off MAC filtering
- CLower the power level
- DImplement WEP encryption
43Admin Bob took a new WAP out of the box, plugged it in, and walked away. An attacker was able to access the
WAP using an administrator account. Which would have prevented the attack?- AConfigure MAC filtering
- BDisable SSID broadcasting
- CChange the default password
- DConfigure 802.1x authentication
44You enter the wireless network information into your computer correctly and connect to the network. You
remain connected, but you can't access any resources on the network. Which is the most likely reason?- AMac filtering is turned on
- BThe SSID is disabled
- CThe encryption is too strong
- DThe WAP power level is too low
45Which would allow home users to access internal company resources?
- ANAT
- BVLANs
- CNAC
- DVPN
46You have two routers connected together, which then connect to two switches, which are also connected
together via fiber. How would you prevent unauthorized devices from connecting to the network?- AConfigure only one of the routers to run DHCP
- BImplement port security on the switches
- CEnable VTP on both switches and set to the same domain
- DConfigure each port on the switches to use the same VLAN other than the default one
47Which two would you need to use together to allow telecommuting while keeping it secure?
- ADMZ
- BVLANs
- CNAC
- DSpam filter
- EVPN concentrator
48Your wireless network is dropping packets and degrading service only during certain times of day. What should
be your first troubleshooting step?- AIncrease the power level
- BChange to a higher gain antenna
- CPerform a site survey
- DConfigure stronger encryption
49You look at your router Access Control List and you see that it allows web, email, and SSH traffic. For some
reason though, some users are unable to access network printing services. Which could be blocking this?- APort security
- BFlood guards
- CImplicit deny
- DLoop protection
50Your company allows business partners to connect to several of your application servers located at the main
office. What can the main office implement to protect the rest of the company from those business partners?- AVPN
- BNAC
- CIDS
- DDMZ
51Which protocol provides secure access to log on to a remote server's console to do some maintenance?
- ASFTP
- BSCP
- CHTTPS
- DSSH
52Which provides a more secure connection than WPA TKIP?
- AMAC filtering
- BWEP
- CWPA2 CCMP
- DDisable SSID broadcast and increase power levels
53Which solution would scan web traffic for malware and block it if malware is found, and could also block certain
websites that are inappropriate?- AIDS
- BFirewall
- CUTM
- DACL
54How do you prevent unauthorized devices from connecting to the network via your network drops?
- AMandatory Access Control
- BWPA2
- CPort Security
- DNetwork Intrusion Pevention
55Which subnet mask would put these 4 PC's on different broadcast domains?
PC1 = 10.10.10.4
PC2 = 10.10.10.10
PC3 = 10.10.10.17
PC4 = 10.10.10.26- A/24
- B/27
- C/28
- D/29
- E/30
56Choose the port numbers in the proper order to match the order of these protocols: FTP, TFTP, Telnet, HTTP.
- A80, 21, 23, 69
- B21, 69, 23, 80
- C69, 23, 21, 80
- D23, 21, 80, 69
57Choose the port numbers in the proper order to match the order of these protocols: HTTPS, SMTP, SNMP,
SCP.- A161, 22, 25, 443
- B443, 161, 22, 25
- C443, 25, 161, 22
- D161, 443, 161, 22
58Which of the following should be considered to mitigate data theft when using CAT5 wiring?
- ACCTV
- BEnvironmental monitoring
- CMultimode fiber
- DEMI shielding
Información
- Descripción
- Security+ SY0-401 Test sobre SY0-401 - Section A (Network Security), creado por jdrad01-junk el 24/11/2014.
- Autor
- jdrad01-junk
- Idioma
- English
- Visitas
- 276
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test