Exam :   SY0-101

Title    :   Security+

  Ver     :    0 9 - 1 9 -07

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 1:

Who is responsible for establishing access permissions to network resources in the

DAC access control model?

A. The system administrator.

B. The owner of the resource.

C. The system administrator and the owner of the resource.

D. The user requiring access to the resource.

Answer: B

Explanation: 

The owner of the resource is responsible for  access privileges in the DAC (Discretionary

Access Control).

Incorrect Answers:

A: The system administrator is responsible for access privileges in the MAC (Mandatory

Access Control).

C: Only the owner of the resource is responsible for access privileges in the DAC

(Discretionary Access Control).

D: In no access control mechanism is the user that requires access  allowed to establish

access control permissions.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 11-12.

QUESTION 2:

Which access control system allows the owner of a resource to establish access

permissions to that resource?

A. MAC

B. DAC

C. RBAC

D. None of the above.

Answer: B

Explanation: 

The owner of the resource is responsible for  access privileges in the DAC (Discretionary

Access Control).

Incorrect Answers:

A: The system administrator is responsible for access privileges in the MAC (Mandatory

Access Control).

C: Access control using the RBAC model is based on the role or responsibilities users

SY0-101 

Actualtests.com - The Power of Knowing

have in the organization.

D: The owner of the resour ce is responsible for access privileges in the DAC

(Discretionary Access Control).

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 3:

Which access control system allows the system administrator to establish access

permissions to network resources?

A. MAC

B. DAC

C. RBAC

D. None of the above.

Answer: A

Explanation: 

The system administrator is responsible for access privileges in the MAC (Mandatory

Access Control).

Incorrect Answers:

B: The owner of the resour ce is responsible for access privileges in the DAC

(Discretionary Access Control).

C: Access control using the RBAC model is based on the role or responsibilities users

have in the organization.

D: The owner of the resour ce is responsible for access privileges in the DAC

(Discretionary Access Control).

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 4:

Who is responsible for establishing access permissions to network resources in the

MAC access control model?

A. The system administrator.

B. The owner of the resource.

C. The system administrator and the owner of the resource.

D. The user requiring access to the resource.

SY0-101 

Actualtests.com - The Power of Knowing

Answer: A

Explanation: 

The system administrator is responsible for access privileges in the MAC (Mandatory

Access Control).

Incorrect Answers:

B: The owner of the resour ce is responsible for access privileges in the DAC

(Discretionary Access Control).

C: Only the owner of the resource is responsible for access privileges in the DAC

(Discretionary Access Control).

D: In no access control mechanism is the user that requires access  allowed to establish

access control permissions.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 11-12.

QUESTION 5:

Which of the following access control models uses roles to determine access

permissions?

A. MAC

B. DAC

C. RBAC

D. None of the above.

Answer: C

Explanation: 

Access control using the RBAC model is based on the role or respons ibilities users have

in the organization. These usually reflect  the organization's structure and can be

implemented system wide.

Incorrect Answers:

A: Access control using the MAC model is based on predefined access privileges to a

resource.

B: Access control using the DAC model is based on the owner of th e resource allowing

other users access to that resource.

D: Access control using the RBAC model is based on the role or responsibilities users

have in the organization.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 6:

How is access control permissions established in the RBAC access control model?

A. The system administrator.

B. The owner of the resource.

C. The role or responsibilities users have in the organization.

D. None of the above.

Answer: C

Explanation: 

Access control using the RBAC model is based on the role or respons ibilities users have

in the organization. These usually reflect  the organization's structure and can be

implemented system wide.

Incorrect Answers:

A: Access control using the MAC model is based on predefined access privileges

established by the system administrator.

B: Access control using the DAC model is based on the owner of th e resource allowing

other users access to that resource.

D: Access control using the RBAC model is based on the role or responsibilities users

have in the organization.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 7:

Which access control model uses Access Control Lists to identify the users who have

permissions to a resource?

A. MAC

B. RBAC

C. DAC

D. None of the above.

Answer: C

Explanation: 

The DAC model allows the owner of a res ource to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

Incorrect Answers:

A: MAC model uses static relations. This is a predefined access privileges to a resource.

SY0-101 

Actualtests.com - The Power of Knowing

B: RBAC uses the role or responsibilities users have in the organiza tion rather than user

permissions.

D: The DAC model allows the owner of a re source to control access  privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 8:

Which access control model uses static relations to identify the users who have

permissions to a resource?

A. MAC

B. RBAC

C. DAC

D. None of the above.

Answer: A

Explanation: 

MAC model uses static relations. This is a predefined access privileges to a resource.

Incorrect Answers:

B: RBAC uses the role or responsibilities users have in the organiza tion rather than user

permissions.

C: The DAC model allows the owner of a resource to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

D: MAC model uses static relations. This is a predefined access privileges to a resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 9:

Which access control model uses predefined access privileges control access to a

resource?

A. MAC

B. RBAC

C. DAC

SY0-101 

Actualtests.com - The Power of Knowing

D. None of the above.

Answer: A

Explanation: 

MAC model uses static relations. This is a predefined access privileges to a resource.

Incorrect Answers:

B: RBAC uses the role or responsibilities users have in the organiza tion rather than user

permissions.

C: The DAC model allows the owner of a re source to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

D: MAC model uses static relations. This is a predefined access privileges to a resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 10: 

What does the DAC access control model use to identify the users who have

permissions to a resource?

A. Predefined access privileges.

B. The role or responsibilities user s have in the organization

C. Access Control Lists

D. None of the above.

Answer: C

Explanation: 

The DAC model allows the owner of a res ource to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

Incorrect Answers:

A: MAC model uses static relations. This is a predefined access privileges to a resource.

B: RBAC uses the role or responsibilities users have in the organiza tion rather than user

permissions.

D: The DAC model allows the owner of a re source to control access  privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 11: 

What does the MAC access control model use to identify the users who have

permissions to a resource?

A. Predefined access privileges.

B. The role or responsibilities user s have in the organization

C. Access Control Lists

D. None of the above.

Answer: A

Explanation: 

MAC model uses static relations. This is a predefined access privileges to a resource.

Incorrect Answers:

B: RBAC uses the role or responsibilities users have in the organiza tion rather than user

permissions.

C: The DAC model allows the owner of a re source to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

D: MAC model uses static relations. This is a predefined access privileges to a resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 12: 

What does the RBAC access control model use to identify the users who have

permissions to a resource?

A. Predefined access privileges.

B. The role or responsibilities user s have in the organization

C. Access Control Lists

D. None of the above.

Answer: B

Explanation: 

RBAC uses the role or responsibilities users have in the organization.

Incorrect Answers:

A: MAC model uses static relations. This is a predefined access privileges to a resource.

SY0-101 

Actualtests.com - The Power of Knowing

C: The DAC model allows the owner of a re source to control access privileges to that

resource. This model uses Access Control Lists (ACLs) to map a user's to access

permissions to a resource.

D: RBAC uses the role or responsibiliti es users have in the organization.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10, 668.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 13.

QUESTION 13: 

Which of the following statements regarding access control models is FALSE?

A. The MAC model uses predefined access privileges to a resource to determine a user's

access permissions to a resource.

B. The RBAC model uses the role or responsibilities users have in the organization to

determine a user's access permissions to a resource.

C. In the DAC model a user's access permissions to a resource is mapped to the user's

account.

D. The MAC model uses Access Control Lists  (ACLs) to map a user's access permissions

to a resource.

Answer: D

Explanation: 

The DAC model, not the MAC model, uses Access Control Lists (ACLs) to map a user's

to access permissions to a resource.

Incorrect Answers:

A, B, C: These are all true.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 11-12.

QUESTION 14: 

Which of the following statements regarding the MAC access control models is

TRUE?

A. The Mandatory Access Control (MAC) model is a dynamic model.

B. In the Mandatory Access Control (MAC)  the owner of a resource establishes access

privileges to that resource.

C. In the Mandatory Access Control (MAC) users cannot share resources dynamically.

D. The Mandatory Access Control (MAC) model is not restrictive.

Answer: C

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

Because the MAC model uses a predefined set of access privileges users cannot share

resources dynamically.

Incorrect Answers:

A: The MAC model is a static, not a dynamic, model.

B: In the MAC the system administrator, not the owner of a res ource, establishes access

privileges to files on the system.

D: Because the MAC model uses a predefined set of access privileges, it can be very

restrictive

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 11.

QUESTION 15: 

Choose the mechanism that is NOT a valid access control mechanism.

A. DAC (Discretionary Access Control) list.

B. SAC (Subjective Access Control) list.

C. MAC (Mandatory Access Control) list.

D. RBAC (Role Based Access Control) list.

Answer: B

Explanation: 

The three basic access control mechanisms are: MAC (Mandatory Access Control), DAC

(Discretionary Access Control) and RBAC (R ole Based Access Control). There is no

SAC (Subjective Access Control) list.

Incorrect Answers:

C: The three basic access control mechanisms are: MAC (Mandatory Access Control),

DAC (Discretionary Access Control) and  RBAC (Role Based Access Control). MAC is

based on predefined access privileges to a resource.

A: The three basic access control mechanisms are: MAC (Mandatory Access Control),

DAC (Discretionary Access Control) and  RBAC (Role Based Access Control). DAC is

based on the owner of the resource allowi ng other users access to that resource.

D: The three basic access control mechanisms are: MAC (Mandatory Access Control),

DAC (Discretionary Access Control) and  RBAC (Role Based Access Control). RBAC is

based on the role or responsibilitie s users have in the organization.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 13.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 16: 

The DAC (Discretionary Access Control)  model has an inherent flaw. Choose the

option that describes this flaw.

A. The DAC (Discretionary Access Control) model uses only the identity of the user or

specific process to control access to a res ource. This creates a security loophole for

Trojan horse attacks.

B. The DAC (Discretionary Access Control) m odel uses certificates to control access to

resources. This creates an opportunity  for attackers to use your certificates.

C. The DAC (Discretionary Access Control) m odel does not use the identity of a user to

control access to resources. This allows a nyone to use an account to access resources.

D. The DAC (Discretionary Access Control)  model does not have any known security

flaws.

Answer: A

Explanation: 

The DAC model is more flexible than the MAC model. It allows the owner of a resource

to control access privileges to that resour ce. Thus, access control is entirely at the

digression of the owner, as is the resource th at is shared. In other words, there are no

security checks to ensure that malicious  code is not made available for sharing.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, p. 720.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 393.

QUESTION 17: 

Choose the access control method which provides the most granular access to

protected objects?

A. Capabilities

B. Access control lists

C. Permission bits

D. Profiles

Answer: B

Explanation: 

Access control lists enable de vices in your network to ignore requests from specified

users or systems, or grant certain network capabilities to them. ACLs allow a stronger set

of access controls to be established in your network. The basic process of ACL control

allows the administrator to design and adapt th e network to deal with specific security

threats.

SY0-101 

Actualtests.com - The Power of Knowing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 13, 216, 219

QUESTION 18: 

You work as the network administrator at Certkiller .com. The Certkiller .com

network uses the RBAC (Role Ba sed Access Control) model.

You must plan the security strategy for users to access resources on the

Certkiller .com network. The types of resources you must control access to are

mailboxes, and files and printers. Certkiller .com is divided into distinct departments

and functions named Finance, Sales, Re search and Development, and Production

respectively. Each user has its own workstation, and accesses resources based on the

department wherein he/she works.

You must determine which roles to create to support the RBAC (Role Based Access

Control) model.

Which of the following roles should you create?

A. Create mailbox, and file and printer roles.

B. Create Finance, Sales, Research and Development, and Production roles.

C. Create user and workstation roles.

D. Create allow access and deny access roles.

Answer: B

Explanation: 

Access control using the RBAC model is based on the role or respons ibilities users have

in the organization. These roles usually reflect the organization's structure, such as its

division into different departme nts, each with its distinct role in the organization. Thus

the RBAC model could be based on  the different departments.

Incorrect Answers:

A: The RBAC model is based on user roles, not on resource roles such as file, printer,

and mailbox roles. These resource roles might  not reflect the diffe rent departments'

access requirements to them.

C: The RBAC model is based on user role s, not on a division between users and

machines. Grouping all users together does not differentiate between the different access

requirements of different users based on the role that those users fulfill in the

organization.

D: By implementing allow access and deny access roles, we would create only two

options: access to all resources or no access.  This does not differentiate between the

different access requirements of different users based on the role that those users fulfill in

the organization.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10.

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 13.

QUESTION 19: 

On the topic of the DAC (Discretionary Access Control) model, choose the

statement(s) which are TRUE.

A. All files that do not have a specified owner cannot be modified.

B. The system administrator is an owner of all objects.

C. The operating system is an owner of all objects.

D. All objects have an owner, and this owner has full control over that specific object.

Answer: D

Explanation: 

The DAC model allows the owner of a res ource to control access privileges to that

resource. Thus, access control is entirely at the digression of the owner who has full

control over the resource.

Incorrect Answers:

A: Each file does have an owner, which is th e user that created the file, or the user to

whom the creator of the file has transferred ownership.

B: The creator of the resource is the owner of that reso urce, not the administrator.

C: The creator of the resource is the owner of that reso urce, not the operating system.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 9-10.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 13.

QUESTION 20: 

Choose the access control model that allows  access control determinations to be

performed based on the security labels associated with each user and each data

item.

A. MACs (Mandatory Access Control) method

B. RBACs (Role Based Access Control) method

C. LBACs (List Based Access Control) method

D. DACs (Discretionary Access Control) method

Answer: A

Explanation: 

Mandatory Access Control is  a strict hierarchical model usually associated with

governments. All objects are given security  labels known as sensitivity labels and are

SY0-101 

Actualtests.com - The Power of Knowing

classified accordingly. Then all users are given specific security clearances as to what

they are allowed to access.

Incorrect Answers:

B: RBAC is based on group membership, which would reflect both the role users fulfill

in the organization and the st ructure of the organization.

C: LBAC is based on a list of users and the privileges they have been granted to an

object. This list is usually created by the administrator.

D: DAC is based on the ownership of a resource. The owner of the resource controls

access to that resource.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 8-10.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 13.

QUESTION 21: 

Choose the terminology or concept which best describes a (Mandatory Access

Control) model.

A. Lattice

B. Bell La-Padula

C. BIBA

D. Clark and Wilson

Answer: A

Explanation: 

The word lattice is used to describe the upper and lower bounds of a user's access

permission. In other words, a user's access di ffers at different le vels. It describes a

hierarchical model that is based on classifying data on sensitivity and categorizing it at

different levels. Users must have the correct  level of security clearances to access the

data. This is the system that MAC is based on.

Incorrect Answers:

B: TheBell La-Padula model prevents a user from accessing information that has a higher

security rating than that which the user is  authorized to access. It also prevents

information from being written to a lower level of security. Thus this model is based on

classification which is used in MAC. However, it is not the best answer.

C: TheBIBA model is similar to the Bell La-Padula model but is more concerned with

information integrity.

D: TheClark and Wilson model prevents the direct access of data. Data can only be

accessed through applications that have pr edefined capabilities. This prevents

unauthorized modification, errors, and fraud  from occurring. This does not describe

MAC.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 455, 267-269. 

QUESTION 22: 

Which of the following sequences is correct regarding the flow of the CHAP system?

A. Logon request, encrypts value response, server, challenge, compare encrypts results,

authorize or fail

B. Logon request, challenge, encrypts value response, server, compare encrypted results,

authorize or fail

C. Logon request, challenge, server, encrypts value response, compare encrypted results,

authorize or fail

D. Logon request, server, encrypts value response, challenge, compare encrypted results,

authorize or fail

Answer: B

Explanation: 

The initiator sends a logon request from the  client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14.

QUESTION 23: 

Which authentication method does the following sequence: Logon request, encrypts

value response, server, challenge, comp are encrypts results, authorize or fail

referred to?

A. Certificates

B. Security Tokens

C. CHAP

D. Kerberos

Answer: C

Explanation: 

The initiator sends a logon request from the  client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

SY0-101 

Actualtests.com - The Power of Knowing

over.

Incorrect answers:

A: A certificate being handed from the server to the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

B: If your token does not grant you access to certain information, that information will

either not be displayed or your access will be denied. The authentication system creates a

token every time a user or a  session begins. At the comple tion of a session, the token is

destroyed.

D: The authentication process uses a Key Di stribution Center (KDC) to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 24: 

Which of the following statements is TRUE regarding the CHAP authentication

system?

A. A certificate being handed from the server to the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

B. If your token does not grant you access to certain information, that information will

either not be displayed or your access will be denied. The authentication system creates a

token every time a user or a  session begins. At the comple tion of a session, the token is

destroyed

C. The authentication process uses a Key Di stribution Center (KDC) to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network.

D. The initiator sends a logon request from the client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over

Answer: D

Explanation: 

The initiator sends a logon request from the  client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

SY0-101 

Actualtests.com - The Power of Knowing

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over

Incorrect Answers:

A: This is known as the Certificate system.

B: This is known as the Security Token system.

C: This is known as the Kerberos system.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 25: 

Which of the following statements is TRUE regarding the Security Token system?

A. If your token does not grant you access to certain information, that information will

either not be displayed or your access will be denied. The authentication system creates a

token every time a user or a  session begins. At the comple tion of a session, the token is

destroyed.

B. A certificate being handed from the server to the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

C. The authentication process uses a Key Di stribution Center (KDC) to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network.

D. The initiator sends a logon request from the client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over

Answer: A

Explanation: 

The Security Token system functions in this manor. If your token does not grant you

access to certain information, that information  will either not be displayed or your access

will be denied. The authentication system creates a token every time a user or a session

begins. At the completion of a session, the token is destroyed.

Incorrect Answers:

B: This is known as the Certificate system.

C: This is known as the Kerberos system.

D: This is known as the CHAP system.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 26: 

Which of the following statements is TRUE regarding the Certificate system?

A. If your token does not grant you access to certain information, that information will

either not be displayed or your access will be denied. The authentication system creates a

token every time a user or a  session begins. At the comple tion of a session, the token is

destroyed.

B. The authentication process uses a Key Di stribution Center (KDC) to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network.

C. The initiator sends a logon request from the client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over

D. A certificate being handed from the server to the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

Answer: D

Explanation: 

A certificate being handed from the server to  the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

Incorrect answers:

A: This is known as the Security Token system.

B: This is known as the Kerberos system.

C: This is known as the CHAP system.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 27: 

Which of the following statements is  TRUE regarding the Kerberos system?

A. If your token does not grant you access to certain information, that information will

either not be displayed or your access will be denied. The authentication system creates a

token every time a user or a  session begins. At the comple tion of a session, the token is

SY0-101 

Actualtests.com - The Power of Knowing

destroyed.

B. The authentication process uses a Key Di stribution Center (KDC) to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network.

C. The initiator sends a logon request from the client to the server. The server sends a

challenge back to the client. The challenge is encrypted and then sent back to the server.

The server compares the value from the client and if the information matches, the server

grants authorization. If the re sponse fails, the session fails  and the request phase starts

over

D. A certificate being handed from the server to the client once authentication has been

established. If you have a pass, you can wander throughout the network. BUT limited

access is allowed.

Answer: B

Explanation: 

The authentication process uses a Key Distribution Center (KDC)  to orchestrate the

entire process. The KDC authenticates the network. Principles can be users, programs, or

systems. The KDC provides a ticket to the network. Once this ticket is issued, it can be

used to authenticate against other principles. This occurs automatically when a request or

service is performed by another network

Incorrect answers:

A: This is known as the Security Token system.

C: This is known as the CHAP system.

D: This is known as the Certificate system.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 28: 

Which of the following authentication systems make use of the KDC Key

Distribution Center?

A. Certificates

B. Security Tokens

C. CHAP.

D. Kerberos.

Answer: D

Explanation: 

The Kerberos authentication process uses a Ke y Distribution Center  (KDC) to orchestrate

the entire process.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A, B, C: All make use of challenges.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-16.

QUESTION 29: 

Which of the following methods of authentication makes use of hand scanners,

fingerprints, retinal scanners or  DNA structure to identify the user?

A. Smart Cards

B. Multi-Factor

C. Kerberos

D. Biometrics

Answer: D

Explanation: 

Biometric devices use physical characteristics to identify the user. Multi-Factor could

also be a factor but will requi re another authentication method  in order for it to accept the

user's login.

Incorrect answers:

A: A smart card is a type of badge or card that can allow access to multiple resources

including buildings, parking lots, and computers.

B: When two or more of these access methods  are included as a part  of the authentication

process, you are implementing a multi-factor system.

C: Kerberos is an authentication scheme that  uses tickets (unique keys) embedded within

messages.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-18.

QUESTION 30: 

Which of the following authentication methods increases the security of the

authentication process because it must be in your physical possession?

A. Smart Cards.

B. Kerberos.

C. CHAP.

D. Certificate.

Answer: A

Explanation: 

SY0-101 

Actualtests.com - The Power of Knowing

The reader is connected to the workstation a nd validates against the security system but

this system holds a risk if the card is not taken care of. A whole system can become

useless if your smart card is lost or stolen.

Incorrect answers:

B: Kerberos makes use of a computer based Key Distribution Center.

C, D: Makes use of challenges.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-18.

QUESTION 31: 

What is the first thing a computer system requires from a user for correct

authentication?

A. Username and Password.

B. Smart card.

C. Certificate.

D. Security Token.

Answer: A

Explanation: 

CHAP performs the handshake process when first establishing a connectin; and then at

random intervals during the transaction session.

Incorrect answers:

B: Smart Cards make use of a pin number.

C: Certificates are required for verification only.

D: Security Tokens are only used once and are only created once a user logs in.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-18.

QUESTION 32: 

Which of the following methods of authentication makes use of a card that is similar

to a credit card?

A. CHAP

B. Certification

C. Biometrics

D. Smart Cards

Answer: D

Explanation: 

SY0-101 

Actualtests.com - The Power of Knowing

A smart card is a type of badge or card that can allow access to multiple resources

including buildings, parking lots, and computers.

Incorrect answers:

A: Makes use of challenges.

B: Makes use of challenges.

C: Makes use of physical characteristics such as fingerprints and DNA.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp 14-19.

QUESTION 33: 

Which of the following authentication methods scans unique physical attributes of a

user to identify the user?

A. Smart Cards

B. Multi-Factor

C. Kerberos

D. Biometrics

Answer: D

Explanation: 

Biometric devices use physical characteristics to identify the user. Multi-Factor could

also be a factor but will requi re another authentication method  in order for it to accept the

user's login.

Incorrect answers:

A: A smart card is a type of badge or card that can allow access to multiple resources

including buildings, parking lots, and computers.

B: When two or more of these access methods  are included as a part  of the authentication

process, you are implementing a multi-factor system.

C: Kerberos is an authentication scheme that  uses tickets (unique keys) embedded within

messages.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 14-18.

QUESTION 34: 

Which of the following is the MOST secure form of authentication?

A. Kerberos

B. Biometrics

C. Smart Cards

D. Username/password

SY0-101 

Actualtests.com - The Power of Knowing

Answer: B

Explanation: 

Biometrics is the use of authenticating a user by scanning on of their unique

physiological body parts. Just like in the movies, a user places their hand on a finger print

scanner or they put their eyes against a retinal scanner. If the image matches what's on

the database, it authenticates the user. Since  a persons fingerprint, blood vessel print, or

retinal image is unique the only way the system can authenticate is if the proper user is

there. The only way an unauthorized user  to get access is to physically kidnap the

authorized user and force them through the system. For this reason, biometrics are the

strongest (and the costliest) for of authentication.

Incorrect answers:

A: Kerberos are not as reliable as biometrics.

C: Smart Card authentication is one of the more secure forms of au thentication but is not

as secure as biometrics.

D: Usernames and passwords can be intercepted and are the least secure.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 18-19, 265

QUESTION 35: 

Which of the following is the LEAST secure form of authentication?

A. Kerberos

B. Biometrics

C. Smart Cards

D. Username/password

Answer: D

Explanation: 

Usernames and passwords can be intercepted and are the least secure.

Incorrect answers:

A: Kerberos are not as reliable as biometrics.

B: Biometrics is the use of authenticating a user by scanning on of their unique

physiological body parts. For this reason, biometrics are the strongest  (and the costliest)

for of authentication.

C: Smart Card authentication is one of the more secure forms of au thentication but is not

as secure as biometrics.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 18-19, 265

QUESTION 36: 

SY0-101 

Actualtests.com - The Power of Knowing

One of the below is considered as the MOST  secure way of authentication, which is

it?

A. Biometric

B. Password

C. Token

D. Ticket Granting

Answer: A

Explanation: 

Biometric authentication systems take advantage of an individual's unique physical

characteristics in order to authenticate that  person's identity. Various forms of biometric

authentication include face, voice, eye, hand, si gnature, and fingerprint, each have their

own advantages and disadvantages. When combined with the use of a PIN it can provide

two factors authentication.

QUESTION 37: 

One of the below is an extremely critical attribute of a biometri cs system, which is

it?

A. Acceptability

B. Accuracy

C. Throughput

D. Reliability

Answer: B

QUESTION 38: 

Which of the following uses unencrypted username and passwords?

A. PAP

B. CHAP

C. RADIUS

D. MS-CHAP

Answer: A

Password Authentication Protocol (PAP) uses username and password combinations but

transmits the username and password in clear text.

Incorrect Answers:

B: Challenge Handshake Authentication Protocol (CHAP) does not use username and

password combinations but uses a Shared Secr et which is stored locally in clear text.

However, the Shared Secret is not transmitted over the network.

C: Remote Authentication Dial-In User Service (RADIUS) is an authentication and

SY0-101 

Actualtests.com - The Power of Knowing

accounting service that uses username and password combinations but transmits the

username and password in encrypted form.

D: Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) does not use

username and password combinations but uses a  Shared Secret which is stored locally in

encrypted form.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 338-340.

QUESTION 39: 

Which of the following uses encrypted username and passwords?

A. PAP

B. CHAP

C. RADIUS

D. MS-CHAP

Answer: C

Remote Authentication Dial-In User Service (RADIUS) is an authentication and

accounting service that uses username and password combinations but transmits the

username and password in encrypted form.

Incorrect Answers:

A: Password Authentication Protocol (PAP)  uses username and password combinations

but transmits the username and password in clear text.

B: Challenge Handshake Authentication Protocol (CHAP) does not use username and

password combinations but uses a Shared Secr et which is stored locally in clear text.

However, the Shared Secret is not transmitted over the network.

D:

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) does not use

username and password combinations but uses a  Shared Secret which is stored locally in

encrypted form.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 338-340.

QUESTION 40: 

Which of the following statements regarding authentication protocols is FALSE?

A. PAP is insecure because usernames and passwords are sent over the network in clear

text.

B. CHAP is more secure than PAP because it encrypts usernames and passwords before

they are sent over the network.

C. RADIUS is a client/server-based system that provides authen tication, authorization,

and accounting services for remote dial-up access.

SY0-101 

Actualtests.com - The Power of Knowing

D. MS-CHAP version 1 is capable of mutual  authentication of both the client and the

server.

Answer: D

MS-CHAP version 2 is capable of mutual au thentication but MS-CHAP version 1 is not

capable of mutual authentication.

Incorrect Answers:

A: Password Authentication Protocol (PAP)  uses username and password combinations

but transmits the username and password in clear text.

B: Challenge Handshake Authentication Protocol (CHAP) does not send username and

password combinations but uses a Shared Secr et which is stored locally in clear text.

D: Remote Authentication Dial-In User Service (RADIUS) is an authentication and

accounting service for dial-up access.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 338-340.

QUESTION 41: 

Choose the password generator that uses a challenge-response method for

authentication.

A. Asynchronous password generator

B. Synchronous password generator

C. Cryptographic keys

D. Smart cards

Answer: B

Explanation: 

An synchronous password generator, has an  authentication server that generates a

challenge (a large number or string) which is encrypted with the private key of the token

device and has that token device's public key so it can verify authenticity of the request

(which is independent from the time factor).  That challenge can also include a hash of

transmitted data, so not only can the authenticati on be assured; but also the data integrity.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 1

QUESTION 42: 

Which password management system best provides for a system with a large

number of users?

A. Self service password reset management systems

B. Locally saved passwords management systems

SY0-101 

Actualtests.com - The Power of Knowing

C. multiple access methods management systems

D. synchronized passwords management systems

Answer: A

Explanation: 

A self service password reset is a system where if an individual user forgets their

password, they can reset it on th eir own (usually by answering a secret question on a web

prompt, then receiving a new temporary password on a pre-specified email address)

without having to call the help desk. For a system with many users, this will significantly

reduce the help desk call volume.

Incorrect answers:

B: Locally saved password management systems are not designed for large networks and

large amounts of users.

C: A multi-factor system is when two or more access methods are included as part of the

authentication process. This would be impractical with a large number of users.

D: Synchronized password would pose a serious threat for any amount of users.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 2

QUESTION 43: 

Which of the following is a solution that you can implement to protect against an

intercepted password?

A. Implement a VPN (Virtual Private Network).

B. Implement PPTP (Point-to-Point Tunneling Protocol).

C. Implement a one time password.

D. Implement complex password requirements.

Answer: C

Explanation: 

A one time password is simply a password that  has to be changed every time you log on;

effectively making any intercepted password good for only the brief interval of time

before the legitimate user happens to login themselves. So by chance, if someone were to

intercept a password it would probably alre ady be expired, or be on the verge of

expiration within a matter of hours.

Incorrect Answers:

A: VPN tunnels through the Internet to establish a link  between two remote private

networks. However, these connections are not considered secure unless a tunneling

protocol, such as PPTP, and an encryption protocol, such as IPSec is used.

B: PPTP is a tunneling protocol. It does not provide encryption which could mitigate

against interception.

D: Complex password requirements make th e password more difficult to crack using

SY0-101 

Actualtests.com - The Power of Knowing

brute force and dictionary attacks. However, it does not protect the password from being

intercepted.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 22-26, 105-108.

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp.112-114

QUESTION 44: 

Which definition best defines what a challenge-response session is?

A. A challenge-response session is a work station or system that produces a random

challenge string that the user provides, wh en prompted, in conjunction with the proper

PIN (Personal Identification Number).

B. A challenge-response session is a workstation or system that produces a random login

ID that the user provides, when prompted, in conjunction with the proper PIN (Personal

Identification Number).

C. A challenge-response session is a special hardware device used to produce random

text in a cryptography system.

D. A challenge-response session is the authentication mechanism in the workstation or

system that does not determine whethe r the owner should be authenticated.

Answer: A

Explanation: 

A common authentication technique whereby an individual is prompted (the challenge)

to provide some private information (the res ponse). Most security systems that rely on

smart cards are based on challenge-response. A user is given a code (the challenge)

which he or she enters into the smart card. The smart card then displays a new code (the

response) that the user can present to log in.

Incorrect Answers:

B: Challenge-response sessions do not generate random login IDs but random challenges.

C: Challenge-response sessions do not rely on  special hardware devices to generate the

challenge or the response. The computer system does this.

D: The purpose of authentication is to determine if the owner should be authenticated.

References:

Michael Cross, Norris L. Johnson, Jr. and Tony Piltzecker, Security+ Study Guide and

DVD Training System, Rockland, MA, Syngress, 2002, pp. 20-21.

http://www.webopedia.com/TERM/C/challenge_response.html

QUESTION 45: 

A very important capability or element  must be deployed before the Kerberos

authentication system functions properly. What is it?

SY0-101 

Actualtests.com - The Power of Knowing

A. You must deploy dynamic IP (Internet Pr otocol) routing protocols for routers and

servers.

B. You must deploy separate ne twork segments for the realms.

C. You must deploy Token authentication devices.

D. You must deploy time synchronization services for clients and servers.

Answer: D

Explanation: 

Time synchronization is crucial because Kerberos uses server and workstation time as

part of the authentication process. Kerber os authentication uses  a Key Distribution

Center (KDC) to orchestrate the process. Th e KDC authenticates the principle (which can

be a user, a program, or a system) and provides it  with a ticket. Once this ticket is issued,

it can be used to authenticate against other principles. This occurs automatically when a

request or service is performed by another principle. Kerberos is quickly becoming a

common standard in network environments. Its only significant weakne ss is that the KDC

can be a single point of failure. If the KDC goes down, the authentication process will

stop.

Incorrect answers:

A: This is irrelevant.

B: Time synchronization is more important in Kerberos.

C: Tokens devices are not as essential to Kerberos as time synchronization is.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.17

QUESTION 46: 

For which reason are clocks used in Kerberos authentication?

A. Clocks are used to ensure proper connections.

B. Clocks are used to ensure that tickets expire correctly.

C. Clocks are used to generate the  seed value for the encryptions keys.

D. Clocks are used to both benchmark a nd specify the optimal encryption algorithm.

Answer: B

Explanation: 

The actual verification of a client's identity is done by validating an authenticator. The

authenticator contains the client's identity and a timestamp.

To insure that the authenticator is up-to-date and is not an old one that has been captured

by an attacker, the timestamp in the authentica tor is checked against the current time. If

the timestamp is not close enough to the curren t time (typically within five minutes) then

the authenticator is rejected as invalid. Thus, Kerberos requires your system clocks to be

loosely synchronized (the defau lt is 5 minutes, but it can be adjusted in Version 5 to be

whatever you want).

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A: Proper connections are not dependant on time synchronization.

C: Generating seed value for encryption keys are not time related.

D: You do not need time synchronization  for benchmark and set optimal encryption

algorithms.

References:

http://www.faqs.org/faqs/kerberos-faq/general/section-22.html

QUESTION 47: 

Choose the important consideration tobear in mind on the Kerberos authentication

system.

A. Kerberos authentication is at risk to man in the middle attacks.

B. Kerberos authentication tickets can be  spoofed by hackers using replay attacks.

C. Kerberos authentication requires a centralized managed database of all user account

and resource passwords.

D. Kerberos authentication uses clear text passwords.

Answer: C

Explanation: 

If the key distribution centre  is down, all of other systems dependent on those keys won't

be able to function.

Incorrect answers:

A: This will not prevent Kerberos from functioning.

B: This will not prevent Kerberos from functioning.

D: Encryption is part of Kerberos. No passwords are sent in clear text.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.17

QUESTION 48: 

You work as the security administrator at Certkiller .com. You must implement an

authentication protocol that uses only encrypted passwords during the

authentication process.

Choose the authentication protocol that accomplishes this.

A. PPTP (Point-to-Point Tunneling Protocol)

B. SMTP (Simple Mail Transfer Protocol)

C. Kerberos

D. CHAP (Challenge Handshake Authentication Protocol)

Answer: D

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

CHAP is commonly used to encrypt passwords. It provides for on-demand authentication

within an ongoing data transmission, that  is repeated at random intervals during a

session. The challenge response uses a hashing function derived from the Message Digest

5 (MD5) algorithm.

Incorrect answers:

A: PPTP is a tunneling protocol. It does not provide encryption.

B: SMTP is a protocol for sending e-mail between SMTP servers.

C: Kerberos is an authentication scheme that  uses tickets (unique keys) embedded within

messages.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.112

QUESTION 49: 

The CHAP (Challenge Handshake Authentication Protocol) sends a logon request

from the client to the server, and the serv er sends a challenge back to the client.

At which stage does the CHAP protocol perform the handshake process? Choose

the best complete answer.

A. At the stage when the connection is established and at whichever time after the

connection has been established.

B. At the stage when the connection is established and when the connection is

disconnected.

C. At the stage when the connection is established.

D. At the stage when the connection is disconnected.

Answer: A

Explanation: 

CHAP performs the handshake process when fi rst establishing a connection; and then at

random intervals during the transaction session.

Incorrect answers:

B: CHAP also challenges for a handshake during the connection.

C: CHAP also challenges for a hands hake after the initial connection.

D: CHAP also challenges for  a handshake during connections.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.15

QUESTION 50: 

Choose the method of authentication  which is the most COSTLY method.

A. Passwords

SY0-101 

Actualtests.com - The Power of Knowing

B. Tokens

C. Biometrics

D. Shared secrets

Answer: C

Explanation: 

Biometrics

These technologies are becoming more reliable, and they will become widely used over

the next few years. Many companies use sm art cards as their primary method of access

control. Implementations have been limited in many applications because of the high cost

associated with these technologies.

Incorrect answers:

A, B, D: Passwords, tokens and shared secrets are in use in most companies since they

are not as costly as biometrics.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 18-19, 265 

QUESTION 51: 

Which of the following are nonessential protocols and services?

A. Network News Transfer Protocol (NNTP)

B. TFTP (Trivial File Transfer Protocol).

C. Domain Name Service (DNS)

D. Internet Control Message Protocol (ICMP)

Answer: B

Explanation: 

TFTP is a nonessential protocol.

Incorrect answers:

A, C, D: These are usually essential protocols.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp.20-21.

QUESTION 52: 

Which of the following are nonessential protocols and services?

A. Mail

B. Web

C. NetBios services

D. Network News Transfer Protocol (NNTP)

SY0-101 

Actualtests.com - The Power of Knowing

Answer: C

Explanation: 

NetBios is a nonessential protocol.

Incorrect answers:

A, B, D: These are usually essential protocols.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp.20-21.

QUESTION 53: 

Which of the following protocols are not recommended due to them supplying

passwords and information over the network?

A. Network News Transfer Protocol (NNTP)

B. SNMP (Simple Network Management Protocol).

C. Domain Name Service (DNS)

D. Internet Control Message Protocol (ICMP)

Answer: B

Explanation: 

SNMP (Simple Network Management Protocol) is a nonessential protocol.

Incorrect answers:

A, C, D: These are usually essential protocols and are more secure.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp.20-21.

QUESTION 54: 

Which of the following protocols are not recommended due to them supplying

passwords and information over the network?

A. Network News Transfer Protocol (NNTP)

B. Internet Control Message Protocol (ICMP)

C. NetBios services

D. Network News Transfer Protocol (NNTP)

Answer: C

Explanation: 

NetBios services are a nonessential protocol.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A, B, D: These are usually essential protocols and are more safe and secure.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp.20-21.

QUESTION 55: 

From the recommendations below, which is  considered the best method for securing

a web browser?

A. Do not upgrade web browsers because new  versions have a tendency to contain more

security flaws.

B. Disable all unused features of the web browser.

C. Only use a VPN (Virtual Private Network) connection to connect to the Internet.

D. Deploy a filtering policy for unknown and illegal websites that you do not want users

to access.

Answer: B

Explanation: 

Features that make web surfing more exciting like: ActiveX, Java, JavaScript, CGI

scripts, and cookies all pose security concerns. Disabling them (which is as easy as

setting your browser security  level to High) is the be st method of securing a web

browser, since its simple, secure , and within every users reach.

Incorrect answers:

A: As newer versions one expects them to be better than the predece ssors. However, this

is not the best method to secure a web browser.

C: VPN tunnels through the Internet to establish a link  between two remote private

networks. However, these connections are not considered secure unless a tunneling

protocol, such as PPTP, and an encryption protocol, such as IPSec is used.

D: This does not represent the best  method for securing a web browser.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp.112-114

QUESTION 56: 

Choose the figure which represents the number of ports in the TCP/IP

(Transmission Control Protocol/Internet Protocol) which are vulnerable to being

scanned, attacked, and exploited.

A. 32 ports

B. 1,024 ports

C. 65,535 ports

D. 16,777,216 ports

SY0-101 

Actualtests.com - The Power of Knowing

Answer: C

Explanation: 

Internet Control Message Protocol (ICMP)  abuse and port scans represent known attack

signatures. The Ping utility uses ICMP and is often used as a probing utility prior to an

attack or may be the attack  itself. If a host is being bomb arded with ICMP echo requests

or other ICMP traffic, this behavior should set off the IDS. Port scans are a more devious

form of attack/reconnaissance used to discove r information about a system. Port scanning

is not an attack but is often a precursor to such activity. Port scans can be sequential,

starting with port 1 and scanning to po rt 65535, or random. A knowledge-based IDS

should recognize either type of scan and send an alert.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 7

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex Publishing, 2004, p. 67

QUESTION 57: 

A DNS (Domain Name Service) server uses a specific port number. Choose this port

number from the options.

A. Port 32

B. Port 1,024

C. Port 65,535

D. Port 16,777,216

Answer: B

Explanation: 

Port 53 is used for Domain Name System (DNS) Name Queries

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press, Redmond, 2003, Appendix B

http://www.iana.org/assignments/port-numbers 

QUESTION 58: 

Which of the following access attacks would involve listening in on someone's

network?

A. Eavesdropping

B. Snooping

C. Interception

D. None of the above

SY0-101 

Actualtests.com - The Power of Knowing

Answer: A

Explanation: 

Eavesdropping is the process  of listening in or overhearing parts of a conversation.

Eavesdropping also includes attackers listening in on your network traffic.

Incorrect answers:

B: Snooping occurs when someone looks through your files in the hopes of finding

something interesting.

C: a passive interception would involve someone who routinel y monitors network traffic.

Active interception might include putting a computer system between the sender and

receiver to capture information as it is sent. From the perspective of interception, this

process is a covert process.

D: There are only three types of access attacks  and therefore must be one of the three.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 59: 

Which of the following access attacks would involve looking through your files in

the hopes of finding something interesting?

A. Interception

B. Snooping

C. Eavesdropping

D. None of the above

Answer: B

Explanation: 

Snooping occurs when someone looks thr ough your files in the hopes of finding

something interesting.

Incorrect answers:

A : a passive interception would involve someone  who routinely monito rs network traffic.

Active interception might include putting a computer system between the sender and

receiver to capture information as it is sent. From the perspective of interception, this

process is a covert process

C: Eavesdropping is the process of listening  in or overhearing part s of a conversation.

Eavesdropping also includes attackers listening in on your network traffic.

D: There are only three types of access attacks  and therefore must be one of the three.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 60: 

SY0-101 

Actualtests.com - The Power of Knowing

Which of the following access attacks would involve putting a computer system

between the sender and receiver to capture information?

A. Snooping

B. Eavesdropping

C. Interception

D. None of the above

Answer: C

Explanation: 

A passive interception would involve someone  who routinely monitors network traffic.

Active interception might include putting a computer system between the sender and

receiver to capture information as it is sent. From the perspective of interception, this

process is a covert process

Incorrect answers:

A: Snooping occurs when someone looks through your files in the hopes of finding

something interesting.

B: Eavesdropping is the process of listening  in or overhearing part s of a conversation.

Eavesdropping also includes attackers listening in on your network traffic.

D: There are only three types of access attacks  and therefore must be one of the three.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 61: 

Which of the following definitions would be correct regarding Eavesdropping?

A. Placing a computer system between the sender and receiver to capture information.

B. Someone looking through your files.

C. Listening or overhearing parts of a conversation

D. Involve someone who routinely monitors network traffic.

Answer: C

Explanation: 

Eavesdropping is the process  of listening in or overhearing parts of a conversation.

Eavesdropping also includes attackers listening in on your network traffic.

Incorrect answers:

A: This access attack is known as Active Inception.

B: This access attack is known as Snooping

D: This access attack is known as Passive Inception.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 62: 

Which of the following definitions would be correct regarding Snooping?

A. Involve someone who routinely monitors network traffic

B. Someone looking through your files.

C. Placing a computer system between the sender and receiver to capture information

D. Listening or overhearing parts of a conversation.

Answer: B

Explanation: 

Snooping occurs when someone looks thr ough your files in the hopes of finding

something interesting

Incorrect answers:

A: This access attack is known as Passive Inception

C: This access attack is known as Eavesdropping

D: This access attack is known as Active Inception

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 63: 

Which of the following definitions would be correct regarding Active Inception?

A. Someone looking through your files

B. Involve someone who routinely monitors network traffic

C. Listening or overhearing parts of a conversation

D. Placing a computer system between the sender and receiver to capture information.

Answer: D

Explanation: 

Active interception might include putting a computer system between the sender and

receiver to capture information as it is sent. From the perspective of interception, this

process is a covert process.

Incorrect answers:

A: This access attack is known as Snooping

B: This access attack is known as Passive Inception

C: This access attack is known as Eavesdropping

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 64: 

Which of the following definitions would be correct regarding Passive Inception?

A. Placing a computer system between the sender and receiver to capture information

B. Listening or overhearing parts of a conversation

C. Involve someone who routinely monitors network traffic

D. Someone looking through your files.

Answer: C

Explanation: 

From the perspective of interception, this process is a covert process. A passive

interception would involve someone who  routinely monitors network traffic.

Incorrect answers:

A: This access attack is known as Active Inception

B: This access attack is known as Eavesdropping

D: This access attack is known as Snooping

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 65: 

One of the below options are correct regarding the DoS (Denial of Service) attack?

A. Prevention access to resources by users authorized to use those resources.

B. Use of multiple computers to attack a single organization.

C. Placing a computer system between the sender and receiver to capture information

D. Listening or overhearing parts of a conversation.

Answer: A

Explanation: 

Denial of service (DoS) attacks prevents access to resources by users authorized to use

those resources. An attacker may attempt  to bring down an e-commerce website to

prevent or deny usage by legitimate customers. DoS attacks are very common on the

Internet.

Incorrect answers:

B: This attack is known as the DDoS (Distributed Denial of Service)

C: This access attack is known as Active Inception

D: This access attack is known as Eavesdropping.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 66: 

One of the below options are correct regarding the DDoS (Distributed Denial of

Service) attack?

A. Listening or overhearing parts of a conversation

B. Placing a computer system between the sender and receiver to capture information

C. Use of multiple computers to attack a single organization

D. Prevention access to resources by users authorized to use those resources

Answer: C

Explanation: 

A relatively new type of DoS attack called a Distributed Denial of Service Attack

(DDoS) uses multiple computers to attack a  single organization. These attacks exploit the

inherent weaknesses of dedicated  networks such as DSL and cable.

Incorrect answers:

A: This access attack is known as Eavesdropping

B: This access attack is known as Active Inception

D: This attack is known as the DoS (Denial of Service)

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 67: 

Which of the following attacks would involve bringing down an e-commerce website

to prevent or deny usage by legitimate customers?

A. DoS

B. Inception

C. DDoS

D. Eavesdropping

Answer: A

Explanation: 

Denial of service (DoS) attacks prevents access to resources by users authorized to use

those resources. An attacker may attempt  to bring down an e-commerce website to

prevent or deny usage by legitimate customers. DoS attacks are very common on the

Internet.

Incorrect answers:

B: A passive interception would involve someone who routinely monitors network

traffic. Active interception might include put ting a computer system between the sender

and receiver to capture information as it is sent. From the perspective  of interception, this

process is a covert process.

SY0-101 

Actualtests.com - The Power of Knowing

C: A relatively new type of DoS attack cal led a Distributed Denial  of Service Attack

(DDoS) uses multiple computers to attack a  single organization. These attacks exploit the

inherent weaknesses of dedicated  networks such as DSL and cable

D: Eavesdropping is the process of listening  in or overhearing part s of a conversation.

Eavesdropping also includes attacker s listening in on your network traffic

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 68: 

Which of the following attacks would involve multiple computers attacking a single

organization?

A. Inception

B. Eavesdropping

C. DoS

D. DDoS

Answer: D

Explanation: 

A relatively new type of DoS attack called a Distributed Denial of Service Attack

(DDoS) uses multiple computers to attack a  single organization. These attacks exploit the

inherent weaknesses of dedicated  networks such as DSL and cable.

Incorrect answers:

A : A passive interception would involve someone who routinely monito rs network traffic.

Active interception might include putting a computer system between the sender and

receiver to capture information as it is sent. From the perspective of interception, this

process is a covert process.

B: Eavesdropping is the process of listening  in or overhearing part s of a conversation.

Eavesdropping also includes attackers listening in on your network traffic.

C: Denial of service (DoS) attacks prevents access to resources by users authorized to

use those resources. An attacker may attemp t to bring down an e-commerce website to

prevent or deny usage by legitimate customers. DoS attacks are very common on the

Internet.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 51-52.

QUESTION 69: 

Why do programmers make use of back doors?

A. For maintenance purposes

B. For observation purposes

SY0-101 

Actualtests.com - The Power of Knowing

C. For complicated operating systems

D. For all of the above mentioned

Answer: D

Explanation: 

During the development of a complicated operating system or application, programmers

add back doors or maintenance hooks. Th ese back doors allow them to examine

operations inside the code while the code is running.

Incorrect answers:

A, B, C: These are vital points to think about for using back doors but are not true

reasons to embark in the use of back doors. Not just any system can make use of back

doors.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 53

QUESTION 70: 

Which of the following common attacks would involve writing a fake logon

program?

A. Back Door Attacks

B. Spoofing

C. Man In The Middle

D. Replay Attack

Answer: B

Explanation: 

A spoofing attack is simply an attempt by someone or something to masquerade as

someone else. This type of attack is usually  considered an access attack. A very common

spoofing attack that was popular for many y ears involved a programmer writing a fake

logon program. This program would prompt  the user for a user ID and password.

Incorrect answers:

A: During the development of a complicated operating system or application,

programmers add back doors or maintenance hooks. These back doors allow them to

examine operations inside the code while  the code is running. The back doors are

stripped out of the code wh en it is moved to production.

C: This type of attack is also an access attack, but it can be  used as the starting point for a

modification attack. The method used in these attacks places a piece  of software between

a server and the user. The software intercepts and then sends the information to the

server. The server responds back to the so ftware, thinking it is the legitimate client.

D: These attacks occur when information is captured over a network. Replay attacks are

used for access or modification attacks. In a  distributed environment, logon and password

information is sent between the client and the authentication system. The attacker can

SY0-101 

Actualtests.com - The Power of Knowing

capture this information and replay it again later.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 54-57.

QUESTION 71: 

Which of the following common attacks would allow them to examine operations

inside the code while the code is running?

A. Replay Attack

B. Man In The Middle

C. Spoofing

D. Back Door Attacks

Answer: D

Explanation: 

During the development of a complicated operating system or application, programmers

add back doors or maintenance hooks. Th ese back doors allow them to examine

operations inside the code while the code is running. The back doors are stripped out of

the code when it is moved to production

Incorrect answers:

A: These attacks occur when information is captured over a network. Replay attacks are

used for access or modification attacks. In a  distributed environment, logon and password

information is sent between the client and the authentication system. The attacker can

capture this information and replay it again later

B: This type of attack is also an access attack, but it can be  used as the starting point for a

modification attack. The method used in these attacks places a piece  of software between

a server and the user. The software intercepts and then sends the information to the

server. The server responds back to the so ftware, thinking it is the legitimate client.

C: A spoofing attack is simply an attempt  by someone or something to masquerade as

someone else. This type of attack is usually  considered an access attack. A very common

spoofing attack that was popular for many y ears involved a programmer writing a fake

logon program. This program would prompt  the user for a user ID and password.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 54-57.

QUESTION 72: 

Which of the following common attacks would attack places a piece of software

between a server and the user?

A. Spoofing

B. Back Door Attacks

SY0-101 

Actualtests.com - The Power of Knowing

C. Man In The Middle

D. Replay Attack

Answer: C

Explanation: 

A spoofing attack is simply an attempt by someone or something to masquerade as

someone else. This type of attack is usually  considered an access attack. A very common

spoofing attack that was popular for many y ears involved a programmer writing a fake

logon program. This program would prompt  the user for a user ID and password

Incorrect answers:

A: This type of attack is also an access attack, but it can be  used as the starting point for a

modification attack. The method used in these attacks places a piece  of software between

a server and the user. The software intercepts and then sends the information to the

server. The server responds back to the so ftware, thinking it is the legitimate client

B: During the development of a complicated operating system or application,

programmers add back doors or maintenance hooks. These back doors allow them to

examine operations inside the code while  the code is running. The back doors are

stripped out of the code wh en it is moved to production

C: These attacks occur when information is captured over a network. Replay attacks are

used for access or modification attacks. In a  distributed environment, logon and password

information is sent between the client and the authentication system. The attacker can

capture this information and replay it again later.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 54-57.

QUESTION 73: 

Which of the following common attacks would the attacker capture the user's login

information and replay it again later?

A. Back Door Attacks

B. Replay Attack

C. Spoofing

D. Man In The Middle

Answer: C

Explanation: 

These attacks occur when information is captured over a network. Replay attacks are

used for access or modification attacks. In a  distributed environment, logon and password

information is sent between the client and the authentication system. The attacker can

capture this information and replay it again later

Incorrect answers:

A: During the development of a complicated operating system or application,

SY0-101 

Actualtests.com - The Power of Knowing

programmers add back doors or maintenance hooks. These back doors allow them to

examine operations inside the code while  the code is running. The back doors are

stripped out of the code wh en it is moved to production

B: This type of attack is also an access attack, but it can be  used as the starting point for a

modification attack. The method used in these attacks places a piece  of software between

a server and the user. The software intercepts and then sends the information to the

server. The server responds back to the so ftware, thinking it is the legitimate client

C: A spoofing attack is simply an attempt  by someone or something to masquerade as

someone else. This type of attack is usually  considered an access attack. A very common

spoofing attack that was popular for many y ears involved a programmer writing a fake

logon program. This program would prompt  the user for a user ID and password

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 54-57.

QUESTION 74: 

Which of the following protocols suites are responsible for IP addressing?

A. ARP

B. IP

C. IGMP

D. ICMP

Answer: B

Explanation: 

IP (Internet Protocol) is a r outable protocol, and it is responsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP.

Incorrect answers:

A : ARP (Address Resolution Protocol) is re sponsible for resolving IP addresses to

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Access  Control (MAC) address.

C: IGMP (Internet Group Management Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts.

D: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 62-63.

QUESTION 75: 

Which of the following protocol suite are responsible for resolving IP addressing?

SY0-101 

Actualtests.com - The Power of Knowing

A. IGMP

B. IP

C. ARP

D. ICMP

Answer: C

Explanation: 

ARP (Address Resolution Protocol) is responsible for resolving IP addresses to Network

Interface layer addresses, including hardware addresses. ARP can resolve an IP address

to a Media Access Control (MAC) address

Incorrect answers:

A: IGMP (Internet Group Mana gement Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts.

B: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP.

D: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 62-63.

QUESTION 76: 

Which of the following protocols suites are primarily responsible for managing IP

multicast groups?

A. ARP

B. IP

C. ICMP

D. IGMP

Answer: D

Explanation: 

IGMP (Internet Group Management Protocol)  is responsible primarily for managing IP

multicast groups. IP multicasts can send messages or packets to a specified group of hosts

Incorrect answers:

A: ARP (Address Resolution Protocol) is responsible for resolving IP addresses to

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Acce ss Control (MAC) address

B: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

SY0-101 

Actualtests.com - The Power of Knowing

verify it for accuracy. Accuracy chec king is the responsibility of TCP

C: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 62-63.

QUESTION 77: 

Which of the following protocol suites provides maintenance and reporting

functions?

A. ICMP

B. IGMP

C. ARP

D. IP

Answer: A

Explanation: 

ICMP (Internet Control Management Prot ocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Incorrect answers:

B: IGMP (Internet Group Management Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts

C: ARP (Address Resolution Protocol) is responsible for resolving IP addresses to

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Acce ss Control (MAC) address

D: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 62-63.

QUESTION 78: 

Which of the following definitions suits the protocols suite IP?

A. Responsible for IP addressing

B. Responsible for resolving IP addressing

C. Responsible for managing IP multicast groups

D. Provides maintenance and reporting functions

Answer: A

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

IP (Internet Protocol) is a r outable protocol, and it is responsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP

Incorrect answers:

B: ARP (Address Resolution Protocol) is responsible for resolving IP addresses to

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Acce ss Control (MAC) address

C: IGMP (Internet Group Management Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts

D: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 62-63

QUESTION 79: 

Which of the following definitions suits the protocols suite ARP?

A. Responsible for IP addressing

B. Responsible for resolving IP addressing

C. Responsible for managing IP multicast groups

D. Provides maintenance and reporting functions

Answer: B

Explanation: 

ARP (Address Resolution Protocol) is responsible for resolving IP addresses to Network

Interface layer addresses, including hardware addresses. ARP can resolve an IP address

to a Media Access Control (MAC) address

Incorrect answers:

A: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP

C: IGMP (Internet Group Management Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts

D: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 62-63

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 80: 

Which of the following definitions suits the protocols suite IGMP?

A. Responsible for IP addressing

B. Responsible for resolving IP addressing

C. Responsible for managing IP multicast groups

D. Provides maintenance and reporting functions

Answer: C

Explanation: 

IGMP (Internet Group Management Protocol)  is responsible primarily for managing IP

multicast groups. IP multicasts can send messages or packets to a specified group of hosts

Incorrect answers:

A: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

also fragments and reassembles message packets. IP only routes information; it does not

verify it for accuracy. Accuracy chec king is the responsibility of TCP

B: ARP (Address Resolution Protocol) is responsible for resolving IP addresses to

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Acce ss Control (MAC) address

D: ICMP (Internet Control Management Protocol) provides maintenance and reporting

functions. ICMP is the protocol used by the PING program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 62-63

QUESTION 81: 

Which of the following definitions suits the protocols suite ICMP?

A. Responsible for IP addressing

B. Responsible for resolving IP addressing

C. Responsible for managing IP multicast groups

D. Provides maintenance and reporting functions

Answer: D

Explanation: 

ICMP (Internet Control Management Prot ocol) provides maintenance and reporting

functions. ICMP is the protoc ol used by the PING program

Incorrect answers:

A: IP (Internet Protocol) is a routable protocol, and it is re sponsible for IP addressing. IP

verify it for accuracy. Accuracy

checking is the responsibility of TCP

B: ARP (Address Resolution Protocol) is responsible for resolving IP addresses to

SY0-101 

Actualtests.com - The Power of Knowing

Network Interface layer addresses, including hardware addresses. ARP can resolve an IP

address to a Media Acce ss Control (MAC) address

C: IGMP (Internet Group Management Protocol) is responsible primarily for managing

IP multicast groups. IP multicasts can send mess ages or packets to a specified group of

hosts.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 62-63

QUESTION 82: 

Which of the following options is the correct sequence for the TCP Three-Way

Handshake?

A. Host A, SYN, SYN/ACK, ACK, Host B

B. Host A, ACK, SYN/ACK, Host B, SYN

C. Host A, SYN/ACK, ACK, SYN, Host B

D. Host A, ACK, SYN/ACK, SYN, Host B

Answer: A

Explanation: 

A host called a client originates this connection. The client sends a TCP segment, or

message, to the server. This client segment includes an Initial Sequence Number (ISN)

for the connection and a window size. The server responds with a TCP segment that

contains its Initial Sequence Number, and  a window size indicating its buffer or window

size. The client then sends back an acknowledgement of the server's sequence number.

Incorrect answers:

B, C, D: They are all incorrect sequences and would never work and therefore do not

take part in the Three-Way Handshake.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 66.

QUESTION 83: 

Which of the following attacks are being referred to if the attack involves the

attacker gaining access to a host in the  network and logically disconnecting it?

A. TCP/IP Hijacking

B. UDP Attack

C. ICMP Attacks

D. Smurf Attacks

Answer: A

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

TCP/IP hijacking, also called  active sniffing, involves the a ttacker gaining access to a

host in the network and logically disconnecti ng it from the network. The attacker then

inserts another machine with the same IP address.

This happens quickly and gives the attacker access to the session and to all of the

information on the original system. The serv er will not know this has occurred and will

respond as if the client is trusted.

Incorrect answers:

B: UDP attack attacks either a maintenance protocol or a UDP service in order to

overload services and initiate a DoS situation. UDP attacks can also exploit UDP

protocols. UDP packets are not connec tion-oriented and do not require the

synchronization process described in the previous section. UDP packets, however, are

susceptible to interception, and UDP can be attacked

C : ICMP attacks occur by triggering a respons e from the ICMP protocol when it responds

to a seemingly legitimate maintenance  request. ICMP supports maintenance and

reporting in a TCP/IP network. ICMP is part of the IP level of the protocol suite. Several

programs, including PING, use the ICMP protocol. Until fairly recently, ICMP was

regarded as a benign protocol that was incapable of very much damage.

D: Smurf attacks are becoming common and can create pure havoc in a network. A smurf

attack uses IP spoofing and broadcasting to  send a PING to a group of hosts in a network.

When a host is pinged, it sends back ICMP message traffic information indicating status

to the originator. If a broadcast is sent to a network, all of the hosts  will answer back to

the ping. The result of this  is an overload of the network and the target system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 72-73.

QUESTION 84: 

Which of the following protocols is used to transmit e-mail between the two e-mail

servers?

A. Post Office Protocol, version 3 (POP3)

B. Simple Mail Transfer Protocol (SMTP)

C. Internet Control Message Protocol (ICMP)

D. Internet Message Access Protocol, version 4 (IMAP4)

Answer: B

SMTP (Simple Mail Transfer Protocol) is used for sending e-mail messages.

Incorrect Answers:

A, D: POP3 and IMAP4 transmit e-mail between the e-mail client and the e-mail server.

C: ICMP (Internet Control Message Protocol) is used for network management and

control. It provides error te sting and reporting for TCP/IP.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 78-79, 116, 207.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 85: 

Which of the following protocols is used to transmit e-mail between an e-mail client

and an e-mail server?

A. Hypertext Transfer Protocol (HTTP)

B. Post Office Protocol, version 3 (POP3)

C. Simple Mail Transfer Protocol (SMTP)

D. Internet Control Message Protocol (ICMP)

Answer: B

POP3 and IMAP4 transmit e-mail between the e-mail client and the e-mail server.

Incorrect Answers:

A: HTTP is the protocol that is used by a web browser to  communicate with web severs.

It is not used for transmitting e-mail betw een the e-mail client and the e-mail server.

C: SMTP (Simple Mail Transfer Protocol) is used for transmitting  e-mail messages from

one e-mail server to another, not between  the e-mail server and the e-mail client.

D: ICMP (Internet Control Message Protocol) is used for network management and

control. It provides error te sting and reporting for TCP/IP.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 78-79, 116, 207.

QUESTION 86: 

Which of the following provides error reporting in TCP/IP?

A. NNTP

B. ICMP

C. IGMP

D. SNMP

Answer: B

ICMP (Internet Control Message Protocol) is used for network management and control.

It provides error testing  and reporting for TCP/IP.

Incorrect Answers:

A: NNTP (Network News Transfer Protocol) is used to access Usenet  news servers. It

does not provide error reporting.

C: IGMP (Internet Group Management Protocol) is used to manage  IP multicast sessions.

It does not provide error reporting.

D: SNMP (Simple Network Management Protocol) is a communications protocol that

collects information about network devices, su ch as hubs, routers, and bridges. It does

not provide error reporting.

References:

SY0-101 

Actualtests.com - The Power of Knowing

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 112-118.

QUESTION 87: 

Which of the following is used to manage IP multicast sessions?

A. NNTP

B. ICMP

C. IGMP

D. SNMP

Answer: C

IGMP (Internet Group Management Protocol) is  used to manage IP multicast sessions. It

does not provide error reporting.

Incorrect Answers:

A: NNTP (Network News Transfer Protocol) is used to access Usenet  news servers. It

does not manage IP multicast sessions.

B: ICMP (Internet Control Message Protocol) is used for network management and

control. It provides error testing and repor ting for TCP/IP. It does not manage IP

multicast sessions

D: SNMP (Simple Network Management Protocol) is a communications protocol that

collects information about network devices, su ch as hubs, routers, and bridges. It does

not manage IP multicast sessions.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 112-118.

QUESTION 88: 

Which of the following protocols is used to transmit data between a web browser

and a web server?

A. SSH

B. HTTP

C. SFTP

D. IMAP4

Answer: B

HTTP is the protocol that is used by a web browser to communicate with web severs.

Incorrect Answers:

A: The SSH protocol is used to estab lish a secure Telnet session over TCP/IP.

C: SFTP transmit data securely between tan FTP client and an FTP server.

D: IMAP4 transmit e-mail between the e-mail client and the e-mail server. It does not

transmit data between a web browser and a web server.

References:

SY0-101 

Actualtests.com - The Power of Knowing

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 297.

QUESTION 89: 

Which of the following is a secure alternative to Telnet?

A. SSH

B. HTTP

C. SFTP

D. IMAP4

Answer: A

Telnet is a terminal emulation protocol that provides a remote logon to another host over

the network. The SSH protocol is used to es tablish a secure Telnet  session over TCP/IP.

It can thus be sued instead of Telnet.

Incorrect Answers:

B: HTTP is the protocol that is used by a web browser to  communicate with web severs.

This is not a function of Telnet.

C: SFTP transmit data securely between tan FTP client and an FTP server. This is not a

function of Telnet.

D: IMAP4 transmit e-mail between the e-mail client and the e-mail server. This is not a

function of Telnet.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 297.

QUESTION 90: 

Which of the following provides remote logon over the Internet?

A. Telnet

B. SSH

C. PPP

D. IMAP4

Answer: C

The PPP protocol is used to establish a connection over point-to-point links such as

dial-up and dedicated leased lines that are used to connect to the Internet.

Incorrect Answers:

A, B: Telnet is a terminal emulation protocol  that provides a remote logon to another host

over the network, not over the Internet. The SSH  protocol is used to establish a secure

Telnet session over TCP/IP. It can th us be sued instead of Telnet.

D: IMAP4 transmit e-mail between the e-mail client and the e-mail server. This is not a

function of Telnet.

References:

SY0-101 

Actualtests.com - The Power of Knowing

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 297.

QUESTION 91: 

Which of the following CANNOT be  used for remote connections?

A. Telnet

B. SSH

C. PPP

D. IMAP4

Answer: D

IMAP4 transmit e-mail between the e-mail clie nt and the e-mail server. This does not

allow remote connections.

Incorrect Answers:

A, B: Telnet is a terminal emulation protocol  that provides a remote logon to another host

over the network, not over the Internet. The SSH  protocol is used to establish a secure

Telnet session over TCP/IP. It can th us be sued instead of Telnet.

C: The PPP protocol is used to establish a remote connection ove r point-to-point links

such as dial-up and dedicated leased lines  that are used to connect to the Internet.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 117, 297.

QUESTION 92: 

Which of the following attacks are being referred to if packets are not

connection-oriented and do not requ ire the synchronization process?

A. TCP/IP Hijacking

B. UDP Attack

C. ICMP Attacks

D. Smurf Attacks

Answer: B

Explanation: 

UDP attack attacks either a maintenance protocol or a UDP service in order to overload

services and initiate a DoS situation. UDP attacks can also exploit UDP protocols. UDP

packets are not connection-oriented and do not require the synchronization process

described in the previous section. UDP packets, however, are susceptible to interception,

and UDP can be attacked

Incorrect answers:

A: TCP/IP hijacking, also called active sniffing, involves the attacker gaining access to a

host in the network and logically disconnecti ng it from the network. The attacker then

SY0-101 

Actualtests.com - The Power of Knowing

inserts another machine with the same IP address. This happens  quickly and gives the

attacker access to the session and to all of  the information on the original system. The

server will not know this has occurred and will respond as if the client is trusted.

C: ICMP attacks occur by triggering a response from the ICMP protocol when it

responds to a seemingly legitimate maintena nce request. ICMP supports maintenance and

reporting in a TCP/IP network. ICMP is part of the IP level of the protocol suite. Several

programs, including PING, use the ICMP protocol. Until fairly recently, ICMP was

regarded as a benign protocol that was incapable of very much damage.

D: Smurf attacks are becoming common and can create pure havoc in a network. A smurf

attack uses IP spoofing and broadcasting to  send a PING to a group of hosts in a network.

When a host is pinged, it sends back ICMP message traffic information indicating status

to the originator. If a broadcast is sent to a network, all of the hosts  will answer back to

the ping. The result of this  is an overload of the network and the target system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 72-73.

QUESTION 93: 

Which of the following attacks are being referred to if it was regarded as a benign

protocol that was incapable of very much damage?

A. TCP/IP Hijacking

B. UDP Attack

C. ICMP Attacks

D. Smurf Attacks

Answer: C

Explanation: 

ICMP attacks occur by triggering a response fr om the ICMP protocol when it responds to

a seemingly legitimate maintenance request . ICMP supports maintenance and reporting

in a TCP/IP network. ICMP is part of the IP  level of the protocol suite. Several programs,

including PING, use the ICMP protocol. Until fairly recently, ICMP was regarded as a

benign protocol that was incapable of very much damage.

Incorrect answers:

A: TCP/IP hijacking, also called active sniffing, involves the attacker gaining access to a

host in the network and logically disconnecti ng it from the network. The attacker then

inserts another machine with the same IP address. This happens  quickly and gives the

attacker access to the session and to all of  the information on the original system. The

server will not know this has occurred and will respond as if the client is trusted.

B: UDP attack attacks either a maintenance protocol or a UDP service in order to

overload services and initiate a DoS situation. UDP attacks can also exploit UDP

protocols. UDP packets are not connec tion-oriented and do not require the

synchronization process described in the previous section. UDP packets, however, are

susceptible to interception, and UDP can be attacked

SY0-101 

Actualtests.com - The Power of Knowing

D: Smurf attacks are becoming common and can create pure havoc in a network. A smurf

attack uses IP spoofing and broadcasting to  send a PING to a group of hosts in a network.

When a host is pinged, it sends back ICMP message traffic information indicating status

to the originator. If a broadcast is sent to a network, all of the hosts  will answer back to

the ping. The result of this  is an overload of the network and the target system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 72-73.

QUESTION 94: 

Which of the following attacks uses IP spoofing and broadcasting to send a PING to

a group of hosts in a network?

A. TCP/IP Hijacking

B. UDP Attack

C. ICMP Attacks

D. Smurf Attacks

Answer: D

Explanation: 

Smurf attacks are becoming common and can create pure havoc in a network. A smurf

attack uses IP spoofing and broadcasting to  send a PING to a group of hosts in a network.

When a host is pinged, it sends back ICMP message traffic information indicating status

to the originator. If a broadcast is sent to a network, all of the hosts  will answer back to

the ping. The result of this  is an overload of the network and the target system

Incorrect answers:

A: TCP/IP hijacking, also called active sniffing, involves the attacker gaining access to a

host in the network and logically disconnecti ng it from the network. The attacker then

inserts another machine with the same IP address. This happens  quickly and gives the

attacker access to the session and to all of  the information on the original system. The

server will not know this has occurred and will respond as if the client is trusted.

B: UDP attack attacks either a maintenance protocol or a UDP service in order to

overload services and initiate a DoS situation. UDP attacks can also exploit UDP

protocols. UDP packets are not connec tion-oriented and do not require the

synchronization process described in the previous section. UDP packets, however, are

susceptible to interception, and UDP can be attacked

C: ICMP attacks occur by triggering a response from the ICMP protocol when it

responds to a seemingly legitimate maintena nce request. ICMP supports maintenance and

reporting in a TCP/IP network. ICMP is part of the IP level of the protocol suite. Several

programs, including PING, use the ICMP protocol. Until fairly recently, ICMP was

regarded as a benign protocol that was incapable of very much damage.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 72-73.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 95: 

One of the below is a description for a password cracker, which one is it?

A. A program that can locate and read a password file.

B. A program that provides software registration passwords or keys.

C. A program that performs comparative analysis.

D. A program that obtains privileged access to the system.

Answer: C

Explanation: 

In a dictionary crack, L0phtCrack  encrypts (i.e., hashes) all the passwords in a dictionary

file you specify and compares every result with the passwor d hash. If L0phtCrack finds

any matches, it knows the password is the dictionary word. L0phtCrack comes with a

default dictionary file, words-english. You can download additional files from the

Internet or create a custom file. In the Tools Options dialog box, you can choose to run

the dictionary attack against the L ANMAN password hash, the NT LAN Manager

(NTLM) password hash, or both (which is the default).

In a hybrid crack, L0phtCrack extends the di ctionary crack by appending numbers or

symbols to each word in the dictionary file.  For example, in addition to trying "Galileo,"

L0phtCrack also tries "Galileo24," "13Galile o," "?Galileo," "Galileo!," and so on. The

default number of characters L0phtCrack tries is two, and you can change this number in

the Tools Options dialog box.

In a brute-force crack, L0phtCrack tries ever y possible combination  of characters in a

character set. L0phtCrack offers four char acter sets, ranging from alpha only to all

alphanumeric plus all symbol characters.  You can choose a character set from the

Character Set drop-down box in the Tools Options dialog box or type a custom character

set in the Character Set drop- down box. L0phtCrack saves custom sets in files with an .lc

extension. You can also specify  a character set in the password file, as the example in

Figure 2 shows.

QUESTION 96: 

One of the below attacks focus on the cracking of passwords, which one is it?

A. SMURF

B. Spamming

C. Teardrop

D. Dictionary

Answer: D

Explanation: 

Dictionaries may be used in a cracking  program to determine passwords. A short

SY0-101 

Actualtests.com - The Power of Knowing

dictionary attack involves  trying a list of hundreds or thousands of words that are

frequently chosen as passwords against se veral systems. Although most systems resist

such attacks, some do not. In one case, one system in five yielded to a particular

dictionary attack.

QUESTION 97: 

Which of the below options would you consider as a program that constantly

observes data traveling over a network?

A. Smurfer

B. Sniffer

C. Fragmenter

D. Spoofer

Answer: B

Explanation: 

A sniffer is a program and/or device that monitor data traveling ove r a network. Sniffers

can be used both for legitimate network management functions and for stealing

information off a network. Unauthorized sn iffers can be extremely dangerous to a

network's security because they ar e virtually impossible to detect

QUESTION 98: 

Choose the concept that represents the scenario where a st ring of data sent to a

buffer is larger than the bu ffer is capable of handling.

A. Brute Force attack

B. Buffer overflows

C. Man in the middle attack

D. Blue Screen of Death attack

E. SYN flood attack

F. Spoofing attack

Answer: B

Explanation: 

Buffer overflows occur when an  application receives more da ta than it is programmed to

accept. This situation can cause an applicati on to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

Incorrect answers:

A: A brute force attack is an attempt to guess passwords until a successful guess occurs.

C: A man-in-the-middle attack is an attack that occurs when someone/thing that is trusted

intercepts packets and retransmits them to another party.

SY0-101 

Actualtests.com - The Power of Knowing

D : WinNuke or Blue Screen of Death is a Windows-based attack that affects only

computers running Windows NT 3.51 or 4.  It is caused by the way the Windows NT

TCP/IP stack handles bad data in the TCP header.

Instead of returning an error code or rejecting the bad data, it sends NT to the Blue

Screen of Death (BSOD). Figuratively speaking, the attack "nukes" the computer.

E: A SYN flood attack forces a victim system to use up one of its finite number of

connections for each connection the initiator opens. Because these requests arrive so

quickly, the victim system has no time to  free dangling, incomplete connections before

all its resources are consumed.

F: A spoofing attack is simply an attempt by someone or something masquerading as

someone else. This type of attack is usually considered an access attack.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 135

QUESTION 99: 

From the listing of attacks, choose the attack which exploits session initiation

between a Transport Control Program (TCP) client and server within a network?

A. Buffer Overflow attack

B. SYN attack

C. Smurf attack

D. Birthday attack

Answer: B

Explanation: 

SYN flood is a DoS attack in which the hack er sends a barrage of SYN packets. The

receiving station tries to re spond to each SYN request for a connection, thereby tying up

all the resources. All incoming connections are rejected until all current connections can

be established. Change this if you want but in the SYN flood the hacker sends a SYN

packet to the receiving station with a spoofed return address of some broadcast address

on their network. The receiving station sends out this SYN packets (pings the broadcast

address) which causes multiple servers or  stations to respond to the ping, thus

overloading the originator of the ping (the receiving station). Therefore, the hacker may

send only 1 SYN packet, whereas the network of  the attacked station is actually what

does the barrage of return packets  and overloads the receiving station.

Incorrect answers:

A: Buffer overflow attacks, as the name implies, attempt to put more data (usually long

input strings) into the buffer than it can hold.

C: A smurf attack is an attack caused by pinging a broadcast to a num ber of sites with a

false "from" address. When the hosts all respond to the ping, they flood the false "from"

site with echoes.

D: A birthday attack is a probability method of finding similar keys in MD5.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 530

QUESTION 100:

From the listing of attacks, which us es either improperly formatted MTUs

(Maximum Transmission Unit) or the ICMP (Internet Control Message Protocol) to

crash the targeted network computer?

A. A man in the middle attack

B. A smurf attack

C. A Ping of Death attack

D. TCP SYN (Transmission Control Protocol / Synchronized) attack

Answer: C

Explanation: The Ping of Death attack i nvolved sending IP packets of a size greater

than 65,535 bytes to the target computer. IP  packets of this si ze are illegal, but

applications can be built that are capable of creating them. Carefully programmed

operating systems could detect and safely ha ndle illegal IP packets, but some failed

to do this.

Remember that MTU packets that are bigger than the maximum size the underlying layer

can handle are fragmented into smaller packets, which are then reassembled by the

receiver. For ethernet style de vices, the MTU is typically 1500.

Incorrect Answers

A: A man in the middle attack allows a third party to intercept and replace components of

the data stream.

B: The "smurf" attack, named after its exploit program, is one of the most recent in the

category of network-level attacks against hosts. A perpetrator sends a large amount of

ICMP echo (ping) traffic at IP broadcast ad dresses, all of it having a spoofed source

address of a victim.

D: In a TCP SYN attack a sender transmits a volume of connections that cannot be

completed. This causes the connection queues to fill up, thereby denying service to

legitimate TCP users.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 52

QUESTION 101:

From the listing of attacks, which analy zes how the operating system (OS) responds

to specific network traffic, in an atte mpt to determine the operating system running

in your networking environment?

A. Operating system scanning.

B. Reverse engineering.

SY0-101 

Actualtests.com - The Power of Knowing

C. Fingerprinting

D. Host hijacking.

Answer: C

Explanation: 

Fingerprinting is the act of in specting returned information fr om a server (ie. One method

is ICMP Message quoting where  the ICMP quotes back part of the original message with

every ICMP error message. Each operating system will quote definite amount of message

to the ICMP error messages. The peculiarity in the error messages  received from various

types of operating systems helps us in identifying the remote host's OS.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 67

QUESTION 102:

Which of the following correctly specifies what malicious port scanning attempts to

determine?

A. Attempts to determine the computer name

B. Attempts to fingerprint the operating system

C. Attempts to determine the phys ical cabling topology of a network

D. Attempts to determine user IDs and passwords

Answer: B

Explanation: 

Malicious port scanning is an attempt to find an unused port that the system won't

acknowledge. Several programs now can use por t scanning for advanced host detection

and operating system fingerpr inting. With knowledge of the operating system, the hacker

can look up known vulnerabilities and exploits for that particular system.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 3

QUESTION 103:

One fingerprinting technique works by exploiting this piece of information:

Operating systems differ when it comes to the amount of information that is quoted

when ICMP (Internet Control Message Protocol) errors occur.

Choose the fingerprinting technique that exploits this piece of information.

A. TCP (Transmission Control Protocol) options.

B. ICMP (Internet Control Message Protocol) error message quenching.

C. Fragmentation handling.

SY0-101 

Actualtests.com - The Power of Knowing

D. ICMP (Internet Control Message Protocol) message quoting.

Answer: D

ICMP Message quoting: The ICMP quotes back  part of the original message with every

ICMP error message. Each operating system w ill quote definite amount of message to the

ICMP error messages. The pecu liarity in the error messages received from various types

of operating systems helps us in identifying the remote host's OS.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 70

QUESTION 104:

From the listing of attack types, which  exploits poor programming techniques or

lack of code review?

A. CGI (Common Gateway Interface) scripts

B. Birthday attacks

C. Buffer overflow attacks

D. Dictionary attacks

Answer: C

Explanation: 

Buffer overflows occur when an  application receives more da ta than it is programmed to

accept. This situation can cause an applicati on to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system. This exploitation is usually a resu lt of a programming erro r in the development

of the software.

Incorrect answers:

A: CGI scripts were used to capture data from a user using simple forms. Vulnerabilities

in CGI are its inherent ability to do what it is told. If a CGI script is written to wreak

havoc (or carries extra code added to it by a  miscreant) and it is executed, your systems

will suffer.

B: A birthday attack is a probability method of finding similar keys in MD5.

D: A dictionary attack cycles through known words in a dictionary f ile, testing the user's

password to see whether a match is made.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 135

QUESTION 105:

From the listing of attacks, choose the attack which misuses the TCP (Transmission

Control Protocol) three-way handshake proc ess, in an attempt to overload network

servers, so that authorized users ar e denied access to network resources?

SY0-101 

Actualtests.com - The Power of Knowing

A. Man in the middle attack

B. Smurf attack

C. Teardrop attack

D. SYN (Synchronize) attack

Answer: D

Explanation: 

SYN flood is a DoS attack in which the hack er sends a barrage of SYN packets. The

receiving station tries to re spond to each SYN request for a connection, thereby tying up

all the resources. All incoming connections are rejected until all current connections can

be established.

Incorrect answers:

A: A man-in-the-middle attack is an attack that occurs when someone/thing that is trusted

intercepts packets and retransmits them to another party.

B: A smurf attack is an attack caused by pinging a broadcast to a num ber of sites with a

false "from" address. When the hosts all respond to the ping, they flood the false "from"

site with echoes.

C: A teardrop attack is a DoS attack that uses large packets and odd offset values to

confuse the receiver and  help facilitate a crash.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 530

QUESTION 106:

From the list below, choose the exploit that can be considered a DoS attack because

more traffic than what the node can handle is flooded to that node.

A. Ping of death

B. Buffer overflow

C. Logic bomb

D. Smurf attack

Answer: B

Explanation: 

Buffer overflows occur when an  application receives more da ta than it is programmed to

accept. This situation can cause an applicati on to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

Incorrect answers:

A: The ping of death crashes a system by  sending Internet Contro l Message Protocol

(ICMP) packets that are larger than the system can handle.

C: A logic bomb is a special kind of virus or Trojan horse that is  set to go off following a

SY0-101 

Actualtests.com - The Power of Knowing

preset time interval, or following a pre-se t combination of keyboard strokes. Some

unethical advertisers use logic bombs to deliver the right pop-up  advertisement following

a keystroke, and some disgruntled employees set up logic bombs to go off to sabotage

their company's computers if they  feel termination is imminent.

D: A smurf attack uses IP s poofing and broadcasting to send a ping to a group of hosts in

a network.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 135

QUESTION 107:

From the list below, choose the security breach that typically results in authorized

users being unable to access the system. This security breach usually does not result

in theft of data or any ot her form of security loss.

A. CRL

B. DoS

C. ACL

D. MD2

Answer: B

Explanation: 

DOS attacks prevent access to resources by users authorized to use those resources. An

attacker may attempt to bring down an e-commerce website to prevent or deny usage by

legitimate customers.

Incorrect answers:

A: A Certificate Revocation List (CRL) is a list of digital certificate revocations that must

be regularly downloaded to stay current.

C: An Access Control List (ACL) is a list of rights that an object has to resources in the

network.

D: A Message Digest Algorithm (MDA) is an algorithm that creates a hash value. The

hash value is also used to help maintain in tegrity. There are severa l versions of MD; the

most common are MD5, MD4, and MD2.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 53

QUESTION 108:

Which type of network attack are Loki, NetCaZ, Masters Paradise and NetBus

examples of?

A. Brute force attack

B. Spoofing attack

SY0-101 

Actualtests.com - The Power of Knowing

C. Back door attack

D. Man in the middle attack

Answer: C

Explanation: 

Since backdoor's are publicly marketed/distr ibuted software applications, they are

characterized by having a trade name.

Incorrect answers:

A: A brute force attack is an attempt to guess passwords until a successful guess occurs.

B: A spoofing attack is simply an attempt by someone or something masquerading as

someone else. This type of attack is usually considered an access attack.

D: A man-in-the-middle attack is an attack that occurs when someone/thing that is trusted

intercepts packets and retransmits them to another party.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.54

QUESTION 109:

TCP/IP (Transmission Control Protocol /Internet Protocol) session hijacking

exploits a specific, inherent characteristic of the TCP/IP protocol. Which is it?

A. TCP/IP does not have an authentication mechanism, and allows a clear text password

of 16 bytes.

B. TCP/IP allows packets to be tunneled to an alternate network.

C. TCP/IP does not have an authentication mechanism, and allows connectionless

packets from whichever person.

D. TCP/IP allows a packet to be spoofed a nd added into a data stream, and in so doing

allows commands to be executed on the remote host.

Answer: D

Explanation: 

TCP/IP's connection orientated nature, and l ack of natural security makes it easy to

hijack a session by spoofing.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.69

QUESTION 110:

For which network attack can you implement these types of ingress/egress traffic

filtering to reduce the likeli hood of the attack occurring?

1. A packet arriving at the  network must have a des tination address from the

internal network.

SY0-101 

Actualtests.com - The Power of Knowing

2. A packet arriving at the ne twork must not have a source  address of the internal

network.

3. A packet arriving at the ne twork or being sent from the network must not have a

source address or destination address of a private address and must not have an

address that is specified in  RFC19lS reserved space.

4. A packet being sent from the network must have a source address from the

internal network.

5. A packet being sent from the network mu st not have a destination address of the

internal network.

A. SYN (Synchronize) flooding

B. Spoofing attacks

C. DoS (Denial of Service) attacks

D. Dictionary attacks

Answer: B

Explanation: 

By having strict addressing filters, an adminstrator prevents a spoofed address from

gaining access.

Incorrect answers:

A: A SYN flood forces a victim system to us e up one of its finite number of connections

for each connection the initiator opens.

C: Dos attacks can also be a result of SYN flooding.

D: A dictionary attack cycles through known words in a dictionary f ile, testing the user's

password to see whether a match is made.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 1

QUESTION 111:

From the list of attacks, which has to do with the misdirection of domain name

resolution and Internet traffic?

A. DoS (Denial of Service) attacks

B. Spoofing attacks

C. Brute force attacks

D. Reverse DNS (Domain Name Service)

Answer: B

Explanation: 

A spoofing attack is simply an attempt by someone or something masquerading as

someone else.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: Denial of service(DoS) attacks prevent ac cess to resources by users authorized to use

those resources.

C: A brute force attack is an attempt to guess passwords until a successful guess occurs.

This type of attack usually occurs over  a long period. It can be accomplished by applying

every possible combination of characters that could be the key.

D: Reverse DNS involves using an IP address to find a domai n name, rather than using a

domain name to find an IP address (normal  DNS). PTR records are used for the reverse

lookup, and often this is used to  authenticate inco ming connections.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 56

QUESTION 112:

An attacker that launches an IP (Internet Protocol) spoofing attack against your

network attempts to manipulate a specific  field within an IP (Internet Protocol)

packet. Which is it?

A. Version field.

B. Source address field.

C. Source port field.

D. Destination address field.

Answer: B

Explanation: 

In IP Spoofing a hacker tries to gain  access to a network by pretending his or her

machine has the same network address as the internal network.

Incorrect answers:

The source port field is the port that is addressed on the destination.

The destination address field is the port to where data is being sent.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 515

QUESTION 113:

You work as the security administrator at Certkiller .com. While monitoring

network traffic, you find that your domain name server is resolving the domain

name to the incorrect IP (Internet Protocol) address. You discover that Internet

traffic is being misdirected.

You immediately suspect that  an intruder has launched a malicious attack against

the network. Which type of network attack is in progress?

A. DoS (Denial of Service) attack

B. Spoofing attack

SY0-101 

Actualtests.com - The Power of Knowing

C. Brute force attack

D. Reverse DNS (Domain Name Service)

Answer: B

Explanation: 

Spoofing is when you forge the source address of  traffic, so it appears to come from

somewhere else, preferably somewhere safe  and trustworthy. Web spoofing is a process

where someone creates a convincing copy of a legitimate website or a portion of the

world wide web, so that when someone enters a site that they think is safe, they end up

communicating directly with the hacker. To  avoid this you should rely on certificates,

IPSEC, and set up a filter to block internet traffic with an internal network address.

Incorrect answers:

A: Denial of service(DoS) attacks prevent ac cess to resources by users authorized to use

those resources.

C: A brute force attack is an attempt to guess passwords until a successful guess occurs.

This type of attack usually occurs over  a long period. It can be accomplished by applying

every possible combination of characters that could be the key.

D: Reverse DNS involves using an IP address to find a domai n name, rather than using a

domain name to find an IP address (normal  DNS). PTR records are used for the reverse

lookup, and often this is used to  authenticate inco ming connections.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 54

QUESTION 114:

You work as the security administrator at Certkiller .com. While monitoring

network traffic, you find that an intruder has managed to access resources residing

on your internal network.

You immediately attempt to find out wher e the attack is originating from. You

discover that the source IP (Internet Protocol) addresses are originating from

trusted networks

Which type of network attack is in progress?

A. Social engineering

B. TCP/IP (Transmission Control Protocol/Internet Protocol) hijacking

C. Smurfing

D. Spoofing attack

Answer: D

Explanation: 

Spoofing is the process of trying to deceive,  or to spoof, someone into believing that a

source address is coming from somewhere else.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: Social engineering deals with the hu man aspect of gaining access and passwords.

B: TCP/IP hijacking requir es an existing session.

C: Smurfing is a legitimate kind of DoS attack that does involve spoofing, however it

doesn't match the above description.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 85-86.

QUESTION 115:

One type of network attack sends two different messages that use the same hash

function to generate the same message  digest. Which network attack does this?

A. Man in the middle attack.

B. Ciphertext only attack.

C. Birthday attack.

D. Brute force attack.

Answer: C

Explanation: 

A birthday attack is based on the principle that amongst 23 people, the probability of 2 of

them having the same birthday is greater th e 50%. By that rational if an attacker

examines the hashes of an entire organiza tions passwords, they'll come up with some

common denominators.

Incorrect answers:

A: A man-in-the-middle attack is an attack that occurs when someone/thing that is trusted

intercepts packets and retransmits them to another party.

B & D: Ciphertext can be used in brute fo rce attacks as well. If the cryptographic

formula is known, the attack can concentrate on breaking the cipher used more efficiently

than pure guessing.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 312

QUESTION 116:

You can defend against a specific network attack by increasing the complexity and

keyspace of a password. Which  network attack is this?

A. Dictionary attack

B. Brute force attack

C. Inference

D. Frontal

Answer: B

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

A brute force attack is when a computer program try's EVERY single keystroke

combination until it cracks the password. If you had a bike lock or a brief case with three

combinations of numbers (0-9), there were 999 possible choices, so  if you started at 000

and worked your way up you could attempt every number in about 20 minutes and

eventually crack the lock. A computer keyboard has millions of possibilities, but since

computers can enter thousands and even millions of keys a second, a brute force attack

can be successful in a matter of hours.  Each keyspace exponentially increases the

possible answer choices, so passwords that are extremely shor t can be cracked within an

hour but passwords beyond eight characters requi re time and computer resources that are

usually beyond a brute force hackers patience and financial motives.

A dictionary attack is an attack that uses words from a database (dictionary) to test

against passwords until a match is found. This is not a complexity issue.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 86

QUESTION 117:

You can defend against dictionary password cracks by enforcing a minimum length

for passwords. What is the minimum recommended password length?

A. 6 characters in length.

B. 8 characters in length.

C. 10 characters in length.

D. 12 characters in length.

Answer: B

Explanation: 

A dictionary attack is a preliminary brute force attempt at guessing a password.

Dictionary attacks work on the principle that most people choose a simple word or phrase

passwords can be hacked in a matter of  hours. Since passwords become exponentially

passwords can be hacked in a matter of  hours. Since passwords become exponentially

more difficult to crack with each character, passwords greater then 8 characters consume

excessive time and resources to crack.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 3

QUESTION 118:

You can defend against man in the middle attacks by implementing which of the

following?

SY0-101 

Actualtests.com - The Power of Knowing

A. A virtual LAN (Local Area Network)

B. A GRE (Generic Route Encapsulation) tunnel IP-IP (Internet Protocol-within-Internet

Protocol Encapsulation Protocol)

C. A PKI (Public Key Infrastructure)

D. An enforcement of badge system

Answer: C

Explanation: 

PKI is a two-key system. Messages are en crypted with a public key. Messages are

decrypted with a private key. If you want to  send an encrypted  message to someone, you

would request their public key. You would encrypt the message using their public key

and send it to them. They would then use  their private key to decrypt the message.

Incorrect answers:

A

: This is a LAN that allows users on different switch ports to part icipate in their own

network separate from, but sti ll connected to, the other stati ons on the same or connected

switch. Who is to say that the perpetrator is  not one of the users in  the private separate

network?

B: PPTP encapsulates virtual network packets into PPP, which are, in turn, encapsulated

into generic routing encapsul ation (GRE) packets and transm itted in the form of IP

datagrams between the parties.  Meaning that after the tunnel is created data gets to be

transferred, however, this does not pr event man in the middle attacks.

D: A smart card is a type of badge or card that gives you access to resources including

buildings, parking lots, and computers. It contains information about your identity and

access privileges. Each area or computer has a card scanner or a  reader in which you

insert your card. But this will not prevent man in the middle attacks.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 331

QUESTION 119:

You can defend against man in the middle attacks by implementing which of the

following?

A. A firewall solution

B. Strong encryption

C. Strong authentication

D. Strong, hard-to-decipher passwords

Answer: B

Explanation: 

Encryption makes the intercepted data unreadable to the interceptor.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: A firewall will not prevent a man in the middle attack.

C: Authentication only happens during logon and the attack could occur when already

logged on. In some instances au thentication is not present.

D: Passwords are usually only used when  logging on. This is not a good enough defense.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 86

QUESTION 120:

You work as the security administrator  at Certkiller .com. You have received

instruction from the CIO to assess the  company's vulnerability with regard to

well-known network attacks.

All users of the Certkiller .com network have been issued with a token and 4-digit

personal identification number (PIN), which  they use to access their computers. The

token works by performing off-line checking for the correct PIN.

Which type of network attack is Certkiller .com at risk to?

A. Birthday

B. Brute force

C. Man-in-the-middle

D. Smurf

Answer: B

Explanation: Brute force attacks are performed with t ools that cycle through many

possible character, number, and symbol combinations to guess a password. Since

the token allows offline checking of PIN,  the cracker can keep trying PINs until it is

cracked.

Incorrect answers:

A: This type of attack is also an access attack, but it can be  used as the starting point for a

modification attack.

C: A man-in-the-middle attack is commonly  used to gather information in transit

between two hosts.

D: A smurf attack uses IP s poofing and broadcasting to send a ping to a group of hosts in

a network.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Chapter 

QUESTION 121:

Which of the following definitions can be correctly fitted to the Polymorphic Virus?

A. Change form in order to avoid detection. These types of viruses attack your system,

display a message on your computer , and delete files on your system.

B. It attaches itself to another file, such  as a word processing document. It may also

SY0-101 

Actualtests.com - The Power of Knowing

arrive as part of an e-mail for a free game, software, or other file. When activated and

performs its task, it infects all of the word  processing or template files. Consequently,

every new file will carry the virus.

C. This virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the virus redirects commands around its elf in order to avoid detection.

D. It attacks or bypasses the antivirus softwa re installed on a computer. You can consider

it as an anti-antivirus. It can directly attack your antivir us software and potentially

destroy the virus definition file of your antivirus software . Destroying this information

without your knowledge would leave you  with a false sense of security

Answer: A

Explanation: 

Polymorphic viruses change form in order to  avoid detection. These types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

Incorrect answers:

B: This virus is known as the Trojan Horse Virus

C: This virus is known as the Stealth Virus

D: This virus is known as the Retrovirus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 122:

Which of the following definitions can be correctly fitted to the Trojan Horse Virus?

A. Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

B. It attaches itself to another file, such  as a word processing document. It may also

arrive as part of an e-mail for a free game, software, or other file. When activated and

performs its task, it infects all of the word  processing or template files. Consequently,

every new file will carry the virus.

C. This virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the virus redirects commands around its elf in order to avoid detection.

D. It attacks or bypasses the antivirus softwa re installed on a computer. You can consider

it as an anti-antivirus. It can directly attack your antivir us software and potentially

destroy the virus definition file of your antivirus software . Destroying this information

SY0-101 

Actualtests.com - The Power of Knowing

without your knowledge would leave you  with a false sense of security

Answer: B

Explanation: 

A Trojan horse attaches itself to another file, such as a word processing document. Trojan

horses may also arrive as part of an e-mail for a free game, software, or other file. When

the Trojan horse activates and performs its task, it infects all of the word processing or

template files.

Incorrect answers:

A: This virus is known as the Polymorphic Virus

C: This virus is known as the Stealth Virus

D: This virus is known as the Retrovirus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 123:

Which of the following definitions can be correctly fitted to the Stealth Virus?

A. Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation

B. It attaches itself to another file, such  as a word processing document. It may also

arrive as part of an e-mail for a free game, software, or other file. When activated and

performs its task, it infects all of the word  processing or template files. Consequently,

every new file will carry the virus

C. This virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the virus redirects commands around its elf in order to avoid detection

D. It attacks or bypasses the antivirus softwa re installed on a computer. You can consider

it as an anti-antivirus. It can directly attack your antivir us software and potentially

destroy the virus definition file of your antivirus software . Destroying this information

without your knowledge would leave you  with a false sense of security

Answer: C

Explanation: 

A stealth virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the stealth virus redirects commands around itself  in order to avoid detection. An infected

file may report a file size different from what is actually  present in order to avoid

detection

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: This virus is known as the Polymorphic Virus

B: This virus is known as the Trojan Horse Virus

D: This virus is known as the Retrovirus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 124:

Which of the following definitions can be correctly fitted to the Retrovirus?

A. Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation

B. It attaches itself to another file, such  as a word processing document. It may also

arrive as part of an e-mail for a free game, software, or other file. When activated and

performs its task, it infects all of the word  processing or template files. Consequently,

every new file will carry the virus

C. This virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the virus redirects commands around its elf in order to avoid detection

D. It attacks or bypasses the antivirus softwa re installed on a computer. You can consider

it as an anti-antivirus. It can directly attack your antivir us software and potentially

destroy the virus definition file of your antivirus software . Destroying this information

without your knowledge would leave you  with a false sense of security

Answer: D

Explanation: 

A retrovirus attacks or bypasses the antivirus software inst alled on a computer. You can

consider a retrovirus as an anti-antivirus. Re troviruses can directly  attack your antivirus

software and potentially dest roy the virus definition file of your antivirus software.

Destroying this information without your knowledge would leave you with a false sense

of security. The virus may also directly attack an antivirus program  to create bypasses for

the virus.

Incorrect answers:

A: This virus is known as the Polymorphic Virus

B: This virus is known as the Trojan Horse Virus

C: This virus is known as the Stealth Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 125:

SY0-101 

Actualtests.com - The Power of Knowing

Which of the following definitions can be correctly fitted to the Multipartite Virus?

A. This virus attacks your system in multiple ways. This virus may attempt to infect your

boot sector, infect all of your  executable files, and destroy yo ur applications files. The

hope here is that you will not be able to correct all of the problems and will allow the

infestation to continue

B. This virus is designed to make itself difficult to detect or analyze. These viruses will

cover themselves with "prote ctive code" that stops debuggers or disassemblers from

examining critical elements of the virus. Th e virus may be written in such a way that

some aspects of the programming act as a decoy  to distract analysis while the actual code

hides in other areas in the program

C. This virus attaches itself to legitimate programs and then creates a program with a

different file extension. This file may reside  in the temporary dire ctory of your system.

When the user types the name of the legitimate program, the companion virus executes

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

D. This virus modifies and alters other progr ams and databases. The  virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Answer: A

Explanation: 

A Multipartite virus attacks your system in multiple ways. A multipartite virus may

attempt to infect your boot sector, infect all of your executable files, and destroy your

applications files. The hope here is that you will not be able  to correct all of the problems

and will allow the infestation to continue.

Incorrect answers:

B: This virus is known as the Armored Virus

C: This virus is known as the Companion Virus

D: This virus is known as the Phage Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 126:

Which of the following definitions can be correctly fitted to the Armored Virus?

A. This virus attacks your system in multiple ways. This virus may attempt to infect your

boot sector, infect all of your  executable files, and destroy yo ur applications files. The

hope here is that you will not be able to correct all of the problems and will allow the

infestation to continue

SY0-101 

Actualtests.com - The Power of Knowing

B. This virus is designed to make itself difficult to detect or analyze. These viruses will

cover themselves with "prote ctive code" that stops debuggers or disassemblers from

examining critical elements of the virus. Th e virus may be written in such a way that

some aspects of the programming act as a decoy  to distract analysis while the actual code

hides in other areas in the program

C. This virus attaches itself to legitimate programs and then creates a program with a

different file extension. This file may reside  in the temporary dire ctory of your system.

When the user types the name of the legitimate program, the companion virus executes

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

D. This virus modifies and alters other progr ams and databases. The  virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Answer: B

Explanation: 

An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program

Incorrect answers:

A: This virus is known as the Multipartite Virus

C: This virus is known as the Companion Virus

D: This virus is known as the Phage Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 127:

Which of the following definitions can be correctly fitted to the Companion Virus?

A. This virus attacks your system in multiple ways. This virus may attempt to infect your

boot sector, infect all of your  executable files, and destroy yo ur applications files. The

hope here is that you will not be able to correct all of the problems and will allow the

infestation to continue

B. This virus is designed to make itself difficult to detect or analyze. These viruses will

cover themselves with "prote ctive code" that stops debuggers or disassemblers from

examining critical elements of the virus. Th e virus may be written in such a way that

some aspects of the programming act as a decoy  to distract analysis while the actual code

hides in other areas in the program

SY0-101 

Actualtests.com - The Power of Knowing

C. This virus attaches itself to legitimate programs and then creates a program with a

different file extension. This file may reside  in the temporary dire ctory of your system.

When the user types the name of the legitimate program, the companion virus executes

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

D. This virus modifies and alters other progr ams and databases. The  virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Answer: C

Explanation: 

A companion virus attaches itself to legitimate programs and then creates a program with

a different file extension. This file may reside in the temporary di rectory of your system.

When the user types the name of the legitimate program, the companion virus executes

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

Incorrect answers:

A: This virus is known as the Multipartite Virus

B: This virus is known as the Armored Virus

D: This virus is known as the Phage Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 128:

Which of the following definitions can be correctly fitted to the Phage Virus?

A. This virus attacks your system in multiple ways. This virus may attempt to infect your

boot sector, infect all of your  executable files, and destroy yo ur applications files. The

hope here is that you will not be able to correct all of the problems and will allow the

infestation to continue

B. This virus is designed to make itself difficult to detect or analyze. These viruses will

cover themselves with "prote ctive code" that stops debuggers or disassemblers from

examining critical elements of the virus. Th e virus may be written in such a way that

some aspects of the programming act as a decoy  to distract analysis while the actual code

hides in other areas in the program

C. This virus attaches itself to legitimate programs and then creates a program with a

different file extension. This file may reside  in the temporary dire ctory of your system.

When the user types the name of the legitimate program, the companion virus executes

SY0-101 

Actualtests.com - The Power of Knowing

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

D. This virus modifies and alters other progr ams and databases. The  virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Answer: D

Explanation: 

A Phage virus modifies and alters other programs and databases. The virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Incorrect answers:

A: This virus is known as the Multipartite Virus

B: This virus is known as the Armored Virus

C: This virus is known as the Companion Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 129:

Which of the following definitions can be correctly fitted to the Macro Virus?

A. These programs in the document are ca lled macros. A macro can tell your word

processor to spellcheck your document automatic ally when it opens viruses can infect all

of the documents on your system and spread to other systems using mail or other

methods. Macro viruses are the fastest growing exploitation today

B. This virus is designed to make itself difficult to detect or analyze. These viruses will

cover themselves with "prote ctive code" that stops debuggers or disassemblers from

examining critical elements of the virus. Th e virus may be written in such a way that

some aspects of the programming act as a decoy  to distract analysis while the actual code

hides in other areas in the program

C. This virus attaches itself to legitimate programs and then creates a program with a

different file extension. This file may reside  in the temporary dire ctory of your system.

When the user types the name of the legitimate program, the companion virus executes

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

D. This virus modifies and alters other progr ams and databases. The  virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

SY0-101 

Actualtests.com - The Power of Knowing

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Answer: A

Explanation: 

A macro virus exploits the enhancements made too many application programs.

Programs such as Word or Excel allow pr ogrammers to expand the capability of the

application. Word for example, supports a mini-BASIC programming language that

allows files to be manipulated automatically. These programs in the document are called

macros. A macro can tell your word processor to spellcheck your document

automatically when it opens. Macro viruses can infect all of the documents on your

system and spread to other systems using  mail or other methods. Macro viruses are the

fastest growing exploitation today.

Incorrect answers:

B: This virus is known as the Armored Virus

C: This virus is known as the Companion Virus

D: This virus is known as the Phage Virus

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81

QUESTION 130:

To which of the following viruses does the characteristic when  the virus attacks your

system, display a message on your computer, and delete files on your system form

part of?

A. Polymorphic Virus

B. Trojan Horse Virus

C. Stealth Virus

D. Retrovirus

Answer: A

Explanation: 

Polymorphic viruses change form in order to  avoid detection. These types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

Incorrect answers:

B: A Trojan horse attaches its elf to another file, such as a word processing document.

Trojan horses may also arrive as  part of an e-mail for a free game, software, or other file.

When the Trojan horse activates and performs its task, it infects all of the word

processing or template files.

SY0-101 

Actualtests.com - The Power of Knowing

C: A stealth virus will attemp t to avoid detection by masking  itself from applications. It

may attach itself to the boot sector of the hard drive. When a system utility or program

runs, the stealth virus redirects commands ar ound itself in order to  avoid detection. An

infected file may report a file size different from what is actually pr esent in order to avoid

detection

D

: A retrovirus attacks or bypa sses the antivirus software in stalled on a computer. You can

consider a retrovirus as an anti-antivirus. Re troviruses can directly  attack your antivirus

software and potentially dest roy the virus definition file of your antivirus software.

Destroying this information without your knowledge would leave you with a false sense

of security. The virus may also directly att ack an antivirus program  to create bypasses for

the virus.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 131:

To which of the following viruses does the characteristic when the virus activates

and performs its

task, it infects all of the word proces sing or template files form part of?

A. Polymorphic Virus

B. Trojan Horse Virus

C. Stealth Virus

D. Retrovirus

Answer: B

Explanation: 

A Trojan horse attaches itself to another file, such as a word processing document. Trojan

horses may also arrive as part of an e-mail for a free game, software, or other file. When

the Trojan horse activates and performs its task, it infects all of the word processing or

template files.

Incorrect answers:

A: Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

C: A stealth virus will attemp t to avoid detection by masking  itself from applications. It

may attach itself to the boot sector of the hard drive. When a system utility or program

runs, the stealth virus redirects commands ar ound itself in order to  avoid detection. An

infected file may report a file size different from what is actually pr esent in order to avoid

detection

D: A retrovirus attacks or bypasses the antivirus software installe d on a computer. You

SY0-101 

Actualtests.com - The Power of Knowing

can consider a retrovirus as an anti-antivirus. Retroviruse s can directly attack your

antivirus software and potentially destroy th e virus definition file of your antivirus

software. Destroying this information without your knowledge would leave you with a

false sense of security. The virus may also dire ctly attack an antivirus program to create

bypasses for the virus.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 132:

To which of the following viruses does the characteristic when the virus will attempt

to avoid detection by masking itself from applications. It may attach itself to the

boot sector of the hard drive, form part of?

A. Polymorphic Virus

B. Trojan Horse Virus

C. Stealth Virus

D. Retrovirus

Answer: C

Explanation: 

A stealth virus will attempt to avoid detection by masking itself from applications. It may

attach itself to the boot sector of the hard  drive. When a system utility or program runs,

the stealth virus redirects commands around itself  in order to avoid detection. An infected

file may report a file size different from what is actually  present in order to avoid

detection.

Incorrect answers:

A: Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

B: A Trojan horse attaches its elf to another file, such as a word processing document.

Trojan horses may also arrive as  part of an e-mail for a free game, software, or other file.

When the Trojan horse activates and performs its task, it infects all of the word

processing or template files

D: A retrovirus attacks or bypasses the antivirus software installe d on a computer. You

can consider a retrovirus as an anti-antivirus. Retroviruse s can directly attack your

antivirus software and potentially destroy th e virus definition file of your antivirus

software. Destroying this information without your knowledge would leave you with a

false sense of security. The virus may also dire ctly attack an antivirus program to create

bypasses for the virus.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 133:

To which of the following viruses does the characteristic when the virus bypasses the

antivirus software installed on a computer, form part of?

A. Polymorphic Virus

B. Trojan Horse Virus

C. Stealth Virus

D. Retrovirus

Answer: D

Explanation: 

A retrovirus attacks or bypasses the antivirus software inst alled on a computer. You can

consider a retrovirus as an anti-antivirus. Re troviruses can directly  attack your antivirus

software and potentially dest roy the virus definition file of your antivirus software.

Destroying this information without your knowledge would leave you with a false sense

of security. The virus may also directly attack an antivirus program  to create bypasses for

the virus.

Incorrect answers:

A: Polymorphic viruses change form in orde r to avoid detection. Th ese types of viruses

attack your system, display a message on your  computer, and delete files on your system.

The virus will attempt to hide from your antivirus software. Freque ntly, the virus will

encrypt parts of itself to avoid detection. Wh en the virus does this,  it is referred to as

mutation.

B: A Trojan horse attaches its elf to another file, such as a word processing document.

Trojan horses may also arrive as  part of an e-mail for a free game, software, or other file.

When the Trojan horse activates and performs its task, it infects all of the word

processing or template files

C: A stealth virus will attemp t to avoid detection by masking  itself from applications. It

may attach itself to the boot sector of the hard drive. When a system utility or program

runs, the stealth virus redirects commands ar ound itself in order to  avoid detection. An

infected file may report a file size different from what is actually pr esent in order to avoid

detection.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 134:

To which of the following viruses does  the characteristic when the virus may

attempt to infect your boot sector, infect all of your executable files, and destroy

your applications files form part of?

SY0-101 

Actualtests.com - The Power of Knowing

A. Multipartite Virus

B. Armored Virus

C. Companion Virus

D. Phage Virus

Answer: A

Explanation: 

A Multipartite virus attacks your system in multiple ways. A multipartite virus may

attempt to infect your boot sector, infect all of your executable files, and destroy your

applications files. The hope here is that you will not be able  to correct all of the problems

and will allow the infestation to continue.

Incorrect answers:

B: An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program

C: A companion virus attaches itself to legitimate programs and then creates a program

with a different file extension. This file may reside in the tempor ary directory of your

system. When the user types the name of the legitimate program, the companion virus

executes instead of the real program. This e ffectively hides the virus from the user. Many

of the viruses that are used  to attack Windows systems make  changes to program pointers

in the Registry so that it points to the infected program. The infected program may

perform its dirty deed and then start the real program

D: A Phage virus modifies and alters other programs and databases. The virus infects all

of these files. The only way to remove this virus is to reinstall  the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 135:

To which of the following viruses does the characteristic when the virus is designed

to make itself difficult to detect or analyze. These viruses will cover themselves with

"protective code" that stops debuggers or  disassemblers from examining critical

elements of the virus form part of?

A. Multipartite Virus

B. Armored Virus

C. Companion Virus

D. Phage Virus

SY0-101 

Actualtests.com - The Power of Knowing

Answer: B

Explanation: 

An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program.

Incorrect answers:

A : A Multipartite virus attacks your system in multiple ways. A multipartite virus may

attempt to infect your boot sector, infect all of your executable files, and destroy your

applications files. The hope here is that you will not be able  to correct all of the problems

and will allow the infestation to continue

C: A companion virus attaches itself to legitimate programs and then creates a program

with a different file extension. This file may reside in the tempor ary directory of your

system. When the user types the name of the legitimate program, the companion virus

executes instead of the real program. This e ffectively hides the virus from the user. Many

of the viruses that are used  to attack Windows systems make  changes to program pointers

in the Registry so that it points to the infected program. The infected program may

perform its dirty deed and then start the real program

D: A Phage virus modifies and alters other programs and databases. The virus infects all

of these files. The only way to remove this virus is to reinstall  the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 136:

To which of the following viruses does the characteristic when the virus attaches

itself to legitimate programs and then creates a program with a different file

extension. This file may reside in the tem porary directory of your system form part

of?

A. Multipartite Virus

B. Armored Virus

C. Companion Virus

D. Phage Virus

Answer: C

Explanation: 

A companion virus attaches itself to legitimate programs and then creates a program with

a different file extension. This file may reside in the temporary di rectory of your system.

When the user types the name of the legitimate program, the companion virus executes

SY0-101 

Actualtests.com - The Power of Knowing

instead of the real program. This effectively hides the virus from the user. Many of the

viruses that are used to attack Windows syst ems make changes to program pointers in the

Registry so that it points to the infected  program. The infected program may perform its

dirty deed and then start the real program.

Incorrect answers:

A: A Multipartite virus attacks your system in multiple ways. A multipartite virus may

attempt to infect your boot sector, infect all of your executable files, and destroy your

applications files. The hope here is that you will not be able  to correct all of the problems

and will allow the infestation to continue

B: An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program

D: A Phage virus modifies and alters other programs and databases. The virus infects all

of these files. The only way to remove this virus is to reinstall  the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 137:

To which of the following viruses does th e characteristic when the virus modifies

and alters other programs and databases. Th e virus infects all of these files. The

only way to remove this virus is to rein stall the programs that are infected, form

part of?

A. Multipartite Virus

B. Armored Virus

C. Companion Virus

D. Phage Virus

Answer: D

Explanation: 

A Phage virus modifies and alters other programs and databases. The virus infects all of

these files. The only way to remove this virus is to reinstall the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

Incorrect answers:

A: A Multipartite virus attacks your system in multiple ways. A multipartite virus may

attempt to infect your boot sector, infect all of your executable files, and destroy your

applications files. The hope here is that you will not be able  to correct all of the problems

and will allow the infestation to continue

SY0-101 

Actualtests.com - The Power of Knowing

B: An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program

C: A companion virus attaches itself to legitimate programs and then creates a program

with a different file extension. This file may reside in the tempor ary directory of your

system. When the user types the name of the legitimate program, the companion virus

executes instead of the real program. This e ffectively hides the virus from the user. Many

of the viruses that are used  to attack Windows systems make  changes to program pointers

in the Registry so that it points to the infected program. The infected program may

perform its dirty deed and then start the real program

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 80-81.

QUESTION 138:

Choose the most effective method of prev enting computer viruses from spreading

throughout the network.

A:You should require root/administrator access to run programs and applications.

B:You should enable scanning of all e-mail attachments.

C:You should prevent the execution of .vbs files.

D:You should install a host based IDS (Intrusion Detection System)

Answer: B

Explanation: 

Viruses get into your computer in one of three ways. They may enter your computer on a

contaminated floppy or CD-ROM, through e-mail, or as a part of another program.

Incorrect answers:

A: This will pose a more serious risk.

C: Preventing the execution of .vbs f iles will not prevent virus infection.

D: Host based IDS installation is not as effective as scanning e-mail attachments.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 76

QUESTION 139:

You work as the security administrator at  Certkiller .com. You want to educate your

users on how they should respond to an e- mail message that contains a warning

about a virus that could have accidentally been sent in the page. You want to inform

users on the actions they should perform wh en the message suggests that the user

delete a specific file when it appears on the user's computer.

What should you do next?

SY0-101 

Actualtests.com - The Power of Knowing

A. Users must check for the f ile and delete it immediately.

B. Users must check for the file, delete it immediately, and then copy the e-mail message

to all distribution lists.

C. Users must immediately report the conten ts of the e-mail message to the security

administrator.

D. Users must simply ignore the message because it is a virus hoax. Users need perform

no actions.

Answer: C

Explanation: 

In such a scenario the most rational answer is to tell your  network administrator. Most

network administrators don't have much to do most of the day, so they live for an

opportunity like this.

Incorrect Answers:

A: Deleting the file wouldn't be good, becau se deleting a file doesn't necessarily

eliminate a problem, as it could put it to your email trash folder, or  to your recycle bin.

This will give you a false sense of security, and work against the process of containment.

B: Copying the email to all distribution lists, is another mistake, because if indeed the

email does contain a virus, you'll only spread it.

D: Ignoring the problem isn't a good probl em, although virus hoaxes are common, all it

takes is one real virus to cause a mini-disaster.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 79

QUESTION 140:

You work as the security administrator at Certkiller .com. You must document the

procedure for handling computer virus infections.

Choose the action which you should specify  to perform when receiving an e-mail

message warning of the existence of a virus on the system if a specific executable file

exists?

A. First investigate the e-mail message as a possible hoax with a trusted anti-virus

vendor.

B. First search for and delete the virus file.

C. First broadcast a message to the all users  to alert them of the presence of a virus.

D. First locate and download a patch to repair the file.

Answer: A

Explanation: 

If a virus threat is for real, the major an ti-virus players like Symantec, McAfee, or

Sophos will know about it before you, and they will have details on their sites.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

B: Searching for and deleting a file is not only a waste of time with today's OS's complex

directory systems, but its also ineffective.  One can miss a file, the file could be hidden,

the wrong file can be deleted, and worst of all:  when you delete a file it doesn't really get

completely deleted, instead it gets sent to a 'recycle bin.'

C: Broadcasting an alert and creating panic isn't the right thing  to do, because it will

waste bandwidth, and perhaps terrorizing the users is the original intent of the attack.

D: The act of locating and downloading a patch isn't just time consuming, but there's a

chance that the patch itself could be the virus, or the process of resetting the computer

could activate the virus.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 79

QUESTION 141:

Choose the statement that best details the difference between a worm and a Trojan

horse?

A. Worms are distributed through e-mail messages while Trojan horses do not.

B. Worms self replicate  while Trojan horses do not.

C. Worms are a form of malicious  code while Trojan horses are not.

D. There is no difference between a worm and a Trojan horse.

Answer: B

Explanation: 

A worm is different from a virus. Worms  reproduce themselves, are self-contained and

do not need a host applicati on to be transported. The Trojan horse program may be

installed as part of an installation process. They do not re produce or self replicate.

Incorrect answers:

A: The main difference between a worm and a  Trojan horse is not the way they are being

spread, but rather the self replicating aspect of worms.

C: Both can be malicious.

D: There are differences of which the worms ability to replicate itself is the

distinguishing factor.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp 83, 85

QUESTION 142:

Choose the malicious code which can distribute itself without using having to attach

to a host file.

A. A virus.

SY0-101 

Actualtests.com - The Power of Knowing

B. A Trojan horse.

C. A logic bomb.

D. A worm.

Answer: D

Explanation: 

Worms are dangerous because they can enter a system by exploiting a 'hole' in an

operating system. They don't' need a host file, and they don't need  any user intervention

to replicate by themselves. Some infamous  worms were: Morris, Badtrans, Nimda, and

Code Red.

Incorrect answers:

A: A virus is a piece of software designed to  infect a computer system. A virus may also

damage the data on your hard disk, destroy your operating system, a nd possibly spread to

other systems.

B: Trojan horses are programs that enter a system or network unde r the guise of another

program. A Trojan horse may be included as an attachment or as part of an installation

program.

C: Designed to take advantage of holes in  security, worms are similar in function and

behavior to viruses, Trojan horses, and logic bombs-with the exception that they are

self-replicating.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 80

QUESTION 143:

One type of malicious code can record system keystrokes in a text file and then

e-mail it to the source. This code can delete system logs when a backup is

performed, and at five day intervals.

Which type of malicious code  can perform these actions?

A. A virus.

B. A back door.

C. A logic bomb.

D. A worm.

Answer: C

Explanation: 

A logic bomb is a special kind of virus or Tr ojan horse that is set to go off following a

preset time interval, or following a pre-se t combination of keyboard strokes. Some

unethical advertisers use logic bombs to deliver the right pop-up  advertisement following

a keystroke, and some disgruntled employees set up logic bombs to go off to sabotage

their company's computers if they  feel termination is imminent.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: A virus is a piece of software designed to  infect a computer system. A virus may also

damage the data on your hard disk, destroy your operating system, a nd possibly spread to

other systems.

B: A back door is not an attack in its own right; it allows a user to enter a  system from a

different interface or with different credentials.

D: Designed to take advantage of holes in  security, worms are similar in function and

behavior to viruses, Trojan horses, and logic bombs-with the exception that they are

self-replicating.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 80

QUESTION 144:

You work as the security administrator at Certkiller .com. A system administrator

named Rory Allen has recently resigned from the company.

You delete the user ID of Rory and immediately notice that the system has started

deleting files.

Which type of malicious code  is present on the network?

A. A logic bomb

B. A virus

C. A Trojan horse

D. A worm

Answer: A

Explanation: 

A Logic bomb is a virus or Trojan horse that  is built to go off when a particular event

occurs or a certain amount of time passes, in this case when the system administrator user

ID was deleted.

Incorrect answers:

B: A virus is a piece of software designed to infect a computer system. A virus may also

damage the data on your hard disk, destroy your operating system, a nd possibly spread to

other systems.

C: Trojan horses are programs that enter a system or network unde r the guise of another

program. A Trojan horse may be included as an attachment or as part of an installation

program.

D: Designed to take advantage of holes in  security, worms are similar in function and

behavior to viruses, Trojan horses, and logic bombs-with the exception that they are

self-replicating.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 80

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 145:

Choose the statement which best defines the characteristics of a computer virus.

A. A computer virus is a find mechanism, initiation mechanism and can propagate.

B. A computer virus is a learning mechanism, contamination mechanism and can exploit.

C. A computer virus is a search mechanism, connection mechanism and can integrate.

D. A computer virus is a replication mechanism, activation mechanism and has an

objective.

Answer: D

Explanation: 

Replication mechanism: To replicate a virus  needs to attach itself to the right code,

where it can replicate and spread past security systems into other systems.

Activation mechanism: Most viruses require the user to actually do something. During

the 80's and early 90's most viruses were  activated when you booted from a floppy disk,

or inserted a new floppy disk in to an infected drive. Nowa days most computer virus's

come as email forwards, and they require the user to execute.

Objective: many viruses have no objective at all, but some have the objective to delete

data, hog up memory, or  crash the system.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 1 

QUESTION 146:

Which of the following options best describe how a social  engineering attack occurs?

A. You are attacked and robbed of the necessary information

B. You are e-mailed by your "manager" and he is out of town and forgot his password

and you send him the necessary information

C. A family member told your "best friend" the password

D. A colleague spies on you in a quest to get your password and acqui res it by reading as

you type.

Answer: B

Explanation: 

Another very common approach is initiated by a phone call or an e-mail from your

software vendor, telling you that they have a cr itical fix that must be installed on your

computer system. If this patch is not installed right away, your system will crash and you

will lose all of your data. For some reas on, you have changed your maintenance account

password and they can't log on. Your systems  operator gives the password to the person.

Bingo! You have been hit again.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A, C, D: These do not fall under a typical social engineering attack.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 87

QUESTION 147:

What type of attacker would normally be interested in acquiri ng the login password

information?

A. A technician

B. A network professional

C. A con artist

D. A secretary

Answer: C

Explanation: 

Only a con artist would want this information to attack the system and insert a virus.

Incorrect answers:

A, B, D: A these people wouldn't need that information from a specific user, and wouldn't

attack by means of social engineering.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 87

QUESTION 148:

Which of the following attacks would involve acquiring information by means of

e-mail or phone call?

A. Phage Virus

B. Armored Virus

C. Trojan horse.

D. Social engineering.

Answer: D

Explanation: 

Another very common approach is initiated by a phone call or an e-mail from your

software vendor, telling you that they have a cr itical fix that must be installed on your

computer system. If this patch is not installed right away, your system will crash and you

will lose all of your data. For some reas on, you have changed your maintenance account

password and they can't log on. Your systems  operator gives the password to the person.

Bingo! You have been hit again.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: A Phage virus modifies and alters other programs and databases. The virus infects all

of these files. The only way to remove this virus is to reinstall  the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system

B: An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program

C: A Trojan horse attaches its elf to another file, such as a word processing document.

Trojan horses may also arrive as  part of an e-mail for a free game, software, or other file.

When the Trojan horse activates and performs its task, it infects all of the word

processing or template files

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 57, 87

QUESTION 149:

What would be the best method to steer clear of all social engineering attacks?

A. Don't tell anyone your password

B. Get qualified staff

C. Use a more complex method of authentication

D. All of the above

Answer: D

Explanation: 

All of the above are great measures to effectively stay away from social engineering

attacks.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p.83

QUESTION 150:

Which of the following attacks are low-tech?

A. Trojan Horse

B. Social engineering

C. Phage Virus

D. Armored Virus

Answer: B

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

Social Engineering is a low-tech attack  due to it requiring minimal software and

computer skills.

Incorrect answers:

A: A Trojan horse attaches itself to another file, such as a word processing document.

Trojan horses may also arrive as  part of an e-mail for a free game, software, or other file.

When the Trojan horse activates and performs its task, it infects all of the word

processing or template files.

C: A Phage virus modifies and alters other programs and databases. The virus infects all

of these files. The only way to remove this virus is to reinstall  the programs that are

infected. If you miss even a single incident of this virus on the victim system, the process

will start again and infect the system.

D: An armored virus is designed to make itself difficult to detect or analyze. Armored

viruses will cover themselves with "pro tective code" that stops debuggers or

disassemblers from examining critical elements of the virus. The virus may be written in

such a way that some aspects of the programming  act as a decoy to di stract analysis while

the actual code hides in  other areas in the program.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p.83

QUESTION 151:

Which attack is not dependant on computer skills and software?

A. Trojan Horse

B. Social engineering

C. Phage Virus

D. Armored Virus

Answer: B

Explanation: 

Social Engineering is normally carried  through by con men and not really hacking

professionals.

Incorrect answers:

A, C, D: These viruses are  all carried through by  means of high-tech software programs

and trained computer hacking specialists.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p.57-83

QUESTION 152:

Which of the following options would be FALSE regarding the reason why social

engineering attacks are so successful?

SY0-101 

Actualtests.com - The Power of Knowing

A. The lack of qualified staff

B. The minimal chance of the attack occurring

C. The fact that passwords  are given away too easily

D. The attacker being part of the company

Answer: D

Explanation: 

The attacker wouldn't be part of the comp any due to all employees owning their own

passwords and if the attack er was to attack the company it wouldn't be a social

engineering attack.

Incorrect answers:

A, B, C: These options form a large part of carrying through a social engineering attack.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p.83

QUESTION 153:

Which of the following options would be TRUE regarding the reason why social

engineering attacks are so successful?

A. A highly qualified staff

B. The minimal chance of the attack occurring

C. The fact that passwords are not given away easily

D. The attacker being part of the company

Answer: B

Explanation: 

There is such a slim chance that the social engi neering attack that very often it is the last

known risk to the company and is therefor e ignored until it happens to the company.

Incorrect answers:

A, B, C: These options do not form part of carrying through a social engineering attack

and would make the attack more difficult to carry through.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p.83

QUESTION 154:

You are a respected worker at Certkiller .com and your boss  realizes that you

attacked the system but you deny and pers ist in proving your innocence. You then

realize you had a visit from an old colleague  that was fired some time back. This

person acquired all the necessary information to perform the attack. What type of

SY0-101 

Actualtests.com - The Power of Knowing

attack is this person performing?

A. Trojan Horse

B. Social engineering

C. Phage Virus

D. Armored Virus

Answer: B

Explanation: 

This person is a con man and he/she is absorbing as much information as possible to

access the company as an employee.

Incorrect answers:

A, C, D: These viruses are  all carried through by  means of high-tech software programs

and trained computer hacking specialists they therefore requires no contact with one of

the companies employees.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 87

Todd Bill, The Security+ Training Guide, QUE  Publishing, Indianapolis, 2003, Chapter

3

QUESTION 155:

Why would Social Engineering be regarded as a low-tech attack method?

A. Due to it not requiring intricate software

B. Due to it requiring a Highly trained software professional

C. Due to it requiring authentication only

D. Due to it requiring only verbal contact with someone from the firm

Answer: D

Explanation: 

Social Engineering requires nothing but human intelligence  in order to carry through an

attack. A skilled con man could acquire this information easily just by talking.

Incorrect answers:

A, B, C: Social engineering requires no such things.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 83

QUESTION 156:

Which of the following attacks could be the most successful when the security

technology is properly imple mented and configured?

SY0-101 

Actualtests.com - The Power of Knowing

A. Logical attacks

B. Physical attacks

C. Social Engineering attacks

D. Trojan Horse attacks

Answer: C

Explanation: 

Social Engineering attacks - In computer securi ty systems, this type of attack is usually

the most successful, especially when the  security technology is properly implemented

and configured. Usually, these attacks rely on  the faults in human beings. An example of

a social engineering attack has a hacker impersonating a network service technician. The

serviceman approaches a low-level employee and requests their password for network

servicing purposes. With smartcards, this type  of attack is a bit more difficult. Most

people would not trust an impersonator wish ing to have their smartcard and PIN for

service purposes.

QUESTION 157:

Choose the more common method used by intruders to gain unauthorized access to

a networking system.

A. A brute force attack.

B. Logging of keystrokes.

C. Trojan horse.

D. Social engineering.

Answer: D

Explanation: 

Social engineering is a process where an attacker attempts to acquire information about

your network and system by talking to people  in the organization. A social engineering

attack may occur over the phone, by e-mail, or by a visit.

The answer is not written in the book, but th e easiest way to gain information would be

social engineering.

Incorrect answers:

A: A brute force attack is an attempt to guess passwords until a successful guess occurs.

This type of attack usually occurs over a long period.

B: Logging of keystrokes involves being at the workstation itself.

C: Trojan horses are programs that enter a system or network unde r the guise of another

program. A Trojan horse may be included as an attachment or as part of an installation

program. This involves too much effort  compared to social engineering.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 57, 87

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 158:

You work as the security administrator  at Certkiller .com. You must implement

measures to protect Certkiller .com against a social engineering attack.

Which option best describes the measures you should implement?

A. Enforce the security policy, user e ducation, and limit available information.

B. Enforce the security policy, user edu cation, and implementing a firewall solution.

C. Enforce the security policy, implementing a firewall solution, and incident response.

D. Enforce the security policy, incident response, and system logging.

Answer: A

Explanation: 

A seems to be the best answer. The other answers involving objects and social

engineering are verbal attacks.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p.83

QUESTION 159:

Choose the attack or malicious code that entails the theft of network passwords

without the intruder using software tools.

A. Trojan programs.

B. Social engineering attacks.

C. Sniffing.

D. Hacking.

Answer: B

Explanation: 

Social engineering is any means of using  people to seek out information. These people

practice espionage to: break in without detection,  disguise themselves  in, trick others into

giving them access, or trick others into giving them information.

Incorrect answers:

A: A Trojan is a software "code" used to infiltrate a network, like the installation of

zombie software used for remote control attacks.

C: Sniffing is an application that captures all traffic traveling past  a network interface

attached to some network.

D: Hacking is both hardware and software based.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Chapter

2

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 160:

Choose the attack or malicious code that cannot be prevented or deterred solely

through using technical measures.

A. Dictionary attacks.

B. Man in the middle attacks.

C. DoS (Denial of Service) attacks.

D. Social engineering.

Answer: D

Explanation: 

Because of human rights laws, it is unlawful to use technology to directly control

people's emotions and behaviors. For this reason social engineer ing attacks cannot be

deterred through technical means.

Incorrect answers:

A: To prevent this type of attack you need to put technical measures in place that forces

users to make use of difficult passwords.

B: In this attack, a third system is placed between two hosts (electronically) already

communicating or currently in the process of setting up a communication channel.

Positive mutual authentication between the e nd points of a given session is probably the

best way to prevent these attacks. Certificates can be used  for mutual authentication.

C: The Denial of service attack can be deterred through technical means because they

make a target machine unavailable as the result of a buffer overrun and a crash. These

DoS attacks are not application specific and can be prevented by a firewall.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Chapter

3

QUESTION 161:

You work as the security administrator at Certkiller .com. You are busy auditing the

Certkiller .com wireless network.

You find an unauthorized Access Point under the desk of a user named Amy Walsh.

Amy works in the Finance department. You confront Amy about this. Amy denies

any knowledge of the unauthorized Access  Point. Amy informs you though that a

new friend has recently visited her, a nd on numerous occasions, at the company

premises.

Choose the type of attack that was launched against Certkiller .com.

A. A SYN flood attcks.

B. A (DDos) Distributed Denial of Service attack.

C. A man in the Middle attack.

D. A TCP flood attack.

SY0-101 

Actualtests.com - The Power of Knowing

E. IP Spoofing.

F. Social Engineering

G. A replay attack

H. Phone tag

I. A halloween attack

Answer: F

Explanation: 

Social engineering is a process where an attacker attempts to acquire information about

your network and system by talking to people  in the organization. A social engineering

attack may occur over the phone,  be e-mail, or by a visit.

Incorrect answers:

A: A SYN flood, forces a victim system to use up one of its finite number of connections

for each connection the initiator opens.

B: Distributed denial of service attacks are multicell attacks.

C: A man-in-the-middle attack is commonly  used to gather information in transit

between two hosts.

D: In this attack, the source system sends a flood of SYN requests and never sends the

final ACK, creating a half-open TCP session.

E: In IP Spoofing a hacker can impersonate  a valid service by sourcing traffic using the

service's IP address or name.

G: A replay attack is similar in part to a man-in-the-middle attack. In this instance, an

attacker intercepts traffic between two end points and retransmits or replays it later.

H: Phone tag is not the same as social engineering.

I: You are not a victim of a Halloween attack in this case.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 87

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Chapter3

QUESTION 162:

Why do many web servers provide message auditing, as do logon, system, and

applications?

A. To view what a particular party is doing

B. To view who is logged on

C. To check for unusual events

D. To check the volume of information on the system

Answer: C

Explanation: 

This is done to ensure that the system is running ok and isn't being attacked.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A, B, D: These options do not form part of this process.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 88.

QUESTION 163:

An Auditing system is necessary to prevent attacks on what part of the system?

A. The files.

B. The operating system.

C. The systems memory

D. None of the above

Answer: A

Explanation: 

Files can be deleted, scrambled, modified, a nd administrators can be prevented from

knowing what is happening in the site

Incorrect answers:

B, C, D: These options do not form part of this process.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 88

QUESTION 164:

Which of the following statements regarding system auditing is TRUE?

A. System audit files must be re viewed regularly for unusual events.

B. System audit files are not suscepti ble to access or modification attacks.

C. System audit files don't hold much information.

D. System audit files do not contain critical systems information that attackers can use to

gather more detailed data about your network.

Answer: A

Explanation: 

System audit files are no good if they are  not periodically reviewed for unusual events.

Incorrect answers:

B: System audit files can be deleted, scrambled, modified, and administrators can be

prevented from knowing what is happening in the site.

C: The amount and volume of information these files contain can be overwhelming

D: These files may also be susceptible to access or modification attacks. These files often

contain critical systems information including resource sharin g, security status, etc. The

attacker may be able to use this informati on to gather more detailed data about your

SY0-101 

Actualtests.com - The Power of Knowing

network.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 88

QUESTION 165:

Which of the following statements regarding system auditing is TRUE?

A. System audit files may be susceptible to access or modification attacks.

B. System audit files do not need to be reviewed for unusual events.

C. System audit files don't hold much information.

D. System audit files do not contain critical systems information that attackers can use to

gather more detailed data about your network.

Answer: A

Explanation: 

System audit files can be deleted, scrambled, modified, and admi nistrators can be

prevented from knowing what is happening in the site

Incorrect answers:

B: System audit files can be deleted, scrambled, modified, and administrators can be

prevented from knowing what is happening in the site.

C: The amount and volume of information these files contain can be overwhelming

D: These files may also be susceptible to access or modification attacks. These files often

contain critical systems information including resource sharin g, security status, etc. The

attacker may be able to use this informati on to gather more detailed data about your

network.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 88

QUESTION 166:

Choose the network mapping tool (scanner) which uses ICMP (Internet Control

Message Protocol).

A. A port scanner.

B. A map scanner.

C. A ping scanner.

D. A share scanner.

Answer: C

Explanation: 

Ping confirms a connection by sendi ng and receiving ICMP packets.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A: Port scan is an automate d procedure of initiating sessi ons on every specified TCP port

to see whether the host replies.

B: Map scanning is mainly used to identify targets for attack.

Reference:

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Chapter

3

QUESTION 167:

Which of the following actions can an attacker perform when network services are

enabled on a target system?

A. An attacker can install a rootkit on the ta rget system.

B. An attacker can check the services file.

C. An attacker can enable logging on the target system.

D. An attacker can run a port scan against the target system.

Answer: D

Explanation: 

A TCP/IP network makes many of the ports av ailable to outside users through the router.

These ports will respond in a predictable manner when queried. An attacker can

systematically query a network to determine which services and ports are open. This

process is called port scanning, and it can re veal a great deal about your network. Port

scans can be performed both internally and  externally. Many router s, unless configured

appropriately, will let all the protocols pass through them.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 69

QUESTION 168:

One type of port scan can determine which ports are in a listening state on the

network, and can then perform a two way handshake.

Which type of port scan can perform this set of actions?

A. A TCP (transmission Control Protocol) SYN (Synchronize) scan

B. A TCP (transmission Control Protocol) connect scan

C. A TCP (transmission Control Protocol) fin scan

D. A TCP (transmission Control Protocol) null scan

Answer: A

Explanation: 

In SYN scanning, a TCP SYN packet is sent to the port(s) to be scanned. If the port

SY0-101 

Actualtests.com - The Power of Knowing

responds with a TCP SYN ACK packet, then the port is listening. If it replies with a TCP

RST packet, then it is not.

Incorrect answers:

B: TCP connect scans are used to identify potential targets and services. This type of

scan utilizes the full TCP three-way handshake.

C: When a basic firewall or router blocks other TCP scans, the TCP FIN scan can be

used. It is used to identify listening TCP ports based on a response, or  lack of a response,

to a finish (FIN) packet.

D: A TCP scan designed to penetrate firewalls and filtering routers is the TCP NULL

scan. A NULL scan is similar to the XMAS  scan in that TCP sequence numbers are zero,

but the NULL scan passes no flags at all.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press, Redmond, 2003, Chapter 11, Lesson 1 

QUESTION 169:

Which of the following would originally link UNIX systems together in a dial-up

environment?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)

C. VPN

D. RADIUS (Remote Authentication Dial-In User Service)

Answer: A

Explanation: 

SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems.

Incorrect answers:

B: PPP has largely replaced SLIP. PPP offers multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

C: VPNs are used to make connections  between private networks across a public

network, such as the Internet. These connections are not guaranteed to be secure unless a

tunneling protocol, such as PPTP, and an encr yption system, such as IPSec, is used. A

wide range of options, includi ng proprietary technologies, is available for VPN support.

D: RADIUS is a mechanism that allows authentication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

SY0-101 

Actualtests.com - The Power of Knowing

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 170:

Which of the following has largely replaced SLIP?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)

C. VPN

D. RADIUS (Remote Authentication Dial-In User Service)

Answer: B

Explanation: 

PPP has largely replaced SLIP. PPP offers  multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

Incorrect answers:

A: SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems.

C: VPNs are used to make connections  between private networks across a public

network, such as the Internet. These connections are not guaranteed to be secure unless a

tunneling protocol, such as PPTP, and an encr yption system, such as IPSec, is used. A

wide range of options, includi ng proprietary technologies, is available for VPN support.

D: RADIUS is a mechanism that allows authentication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 171:

Which of the following are used to make connections between private networks

across a public network?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)

C. VPN

SY0-101 

Actualtests.com - The Power of Knowing

D. RADIUS (Remote Authentication Dial-In User Service)

Answer: C

Explanation: 

VPNs are used to make connections between private networks acro ss a public network,

such as the Internet. These connections are not  guaranteed to be secure unless a tunneling

protocol, such as PPTP, and an encryption syst em, such as IPSec, is used. A wide range

of options, including proprietary technologies, is av ailable for VPN support.

Incorrect answers:

A: SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems.

B: PPP has largely replaced SLIP. PPP offers multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

D: RADIUS is a mechanism that allows authentication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 172:

Which of the following is a mechanism that allows authentication of dial-in and

other network connections?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)

C. VPN

D. RADIUS (Remote Authentication Dial-In User Service)

Answer: D

Explanation: 

RADIUS is a mechanism that allows auth entication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems.

B: PPP has largely replaced SLIP. PPP offers multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

C: VPNs are used to make connections  between private networks across a public

network, such as the Internet. These connections are not guaranteed to be secure unless a

tunneling protocol, such as PPTP, and an encr yption system, such as IPSec, is used. A

wide range of options, includi ng proprietary technologies, is available for VPN support.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 173:

Which of the following definitions fit correctly to SLIP (Serial Line Internet

Protocol)?

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk,

IPX, and DECnet

C. are used to make connections between private networks across  a public network, such

as the Internet

D. is a mechanism that allows authenticati on of dial-in and other network connections

Answer: A

Explanation: 

SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems

Incorrect answers:

B: This refers to PPP

C: This refers to VPN

D: This refers to RADIUS

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 174:

Which of the following definitions fit correctly to PPP (Point-to-Point Protocol)?

SY0-101 

Actualtests.com - The Power of Knowing

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk,

IPX, and DECnet

C. are used to make connections between private networks across  a public network, such

as the Internet

D. is a mechanism that allows authenticati on of dial-in and other network connections

Answer: B

Explanation: 

PPP has largely replaced SLIP. PPP offers  multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

Incorrect answers:

A: This refers to SLIP

C:This refers to VPN

D: This refers to RADIUS

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 175:

Which of the following definitions fit correctly to VPN?

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk,

IPX, and DECnet

C. are used to make connections between private networks across  a public network, such

as the Internet

D. is a mechanism that allows authenticati on of dial-in and other network connections

Answer: C

Explanation: 

VPNs are used to make connections between private networks acro ss a public network,

such as the Internet. These connections are not  guaranteed to be secure unless a tunneling

protocol, such as PPTP, and an encryption syst em, such as IPSec, is used. A wide range

of options, including proprietary technologies, is av ailable for VPN support.

Incorrect answers:

A: This refers to SLIP

B:This refers to PPP

D: This refers to RADIUS

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 176:

Which of the following definitions fit correctly to RADIUS?

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk,

IPX, and DECnet

C. are used to make connections between private networks across  a public network, such

as the Internet

D. is a mechanism that allows authenticati on of dial-in and other network connections

Answer: D

Explanation: 

RADIUS is a mechanism that allows auth entication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

Incorrect answers:

A: This refers to SLIP

B:This refers to PPP

C: This refers to VPN

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 177:

Which of the following would allow credentials to be accepted from multiple

methods, including Kerberos?

A. SLIP (Serial Line Internet Protocol)

B. PPP (Point-to-Point Protocol)

C. TACACS (Terminal Access Controller Access Control System)

D. RADIUS (Remote Authentication Dial-In User Service)

Answer: C

Explanation: 

Terminal Access Controller Access Control System (TACACS) is a

client/server-oriented envir onment, and it operates in a si milar manner to RADIUS. The

most current method or level of TACACS is TACACS/+. TACACS/+ allows credentials

SY0-101 

Actualtests.com - The Power of Knowing

to be accepted from multiple methods, including Kerberos.

Incorrect answers:

A: SLIP was originally designed to connect UNIX systems together in a dial-up

environment, and it supports only serial comm unications. SLIP is a very simple protocol

that is used to pass TCP/IP tr affic. The protocol is not secu re, nor is it efficient. Many

systems still support SLIP strictly for legacy systems.

B: PPP has largely replaced SLIP. PPP offers multiple protocol support including

AppleTalk, IPX, and DECnet. PPP works with POTS, Integrated Services Digital

Network (ISDN), and other faster connections such as T1. PPP does not provide data

security, but it does provide  authentication using CHAP.

D: RADIUS is a mechanism that allows authentication of dial-in and other network

connections. A RADIUS server  can be managed centrally, and the servers that allow

access to a network can verify with a RADIUS  server whether or not an incoming caller

is authorized. In a large network with many  connections, this allows a single server to

perform all authentications.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 178:

Which of the following definitions fit correctly to TACACS?

A. Is an older protocol that was used in early remote access environments

B. Has largely replaced SLIP and offers multiple protocol support including AppleTalk,

IPX, and DECnet

C. are used to make connections between private networks across  a public network, such

as the Internet

D. It allows credentials to be accepted from multiple methods, including Kerberos.

Answer: D

Explanation: 

Terminal Access Controller Access Control System (TACACS) is a

client/server-oriented envir onment, and it operates in a si milar manner to RADIUS. The

most current method or level of TACACS is TACACS/+. TACACS/+ allows credentials

to be accepted from multiple methods, including Kerberos.

Incorrect answers:

A: This refers to SLIP

B:This refers to PPP

C: This refers to VPN

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 179:

Which of the following tunneling protocol s supports encapsulation in a single

point-to-point environment?

A. PPTP

B. L2F

C. L2TP

D. SSH

Answer: A

Explanation: 

PPTP supports encapsulation in a single point-to-point environment. PPTP encapsulates

and encrypts PPP packets. This makes PPTP a favorite low-end protocol for networks.

The negotiation between the two ends of a PPT P connection is done in the clear. Once

the negotiation is performed, the channel is encrypted

Incorrect answers:

B: 2F was created by Cisco as a method of creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

does provide authentication, but it  does not provide encryption

C: Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP.

D: Secure Shell (SSH) is a tunneling protocol originally designed for UNIX systems.

SSH uses encryption to establish a secure  connection between two systems. SSH also

provides security equivalent programs such as Telnet, FTP, and many of the other

communications-oriented programs under UNIX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 180:

Which of the following tunneling protocol s was created by Cisco as a method of

creating tunnels primarily for dial-up connections?

A. PPTP

B. L2F

C. L2TP

D. SSH

Answer: B

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

2F was created by Cisco as a method of creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

does provide authentication, but it  does not provide encryption

Incorrect answers:

A: PPTP supports encapsulation in a single point-to-point environment. PPTP

encapsulates and encrypts PPP packets. This makes PPTP a favorite low-end protocol for

networks. The negotiation between the two e nds of a PPTP connection is done in the

clear. Once the negotiation is perf ormed, the channel is encrypted

C: Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP.

D: Secure Shell (SSH) is a tunneling protocol originally designed for UNIX systems.

SSH uses encryption to establish a secure  connection between two systems. SSH also

provides security equivalent programs such as Telnet, FTP, and many of the other

communications-oriented programs under UNIX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 181:

Which of the following tunneling protocols is primarily a point -to-point protocol?

A. PPTP

B. L2F

C. L2TP

D. SSH

Answer: C

Explanation: 

Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP

Incorrect answers:

A: PPTP supports encapsulation in a single point-to-point environment. PPTP

encapsulates and encrypts PPP packets. This makes PPTP a favorite low-end protocol for

networks. The negotiation between the two e nds of a PPTP connection is done in the

clear. Once the negotiation is perf ormed, the channel is encrypted

B: 2F was created by Cisco as a method of creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

SY0-101 

Actualtests.com - The Power of Knowing

does provide authentication, but it  does not provide encryption.

D: Secure Shell (SSH) is a tunneling protocol originally designed for UNIX systems.

SSH uses encryption to establish a secure  connection between two systems. SSH also

provides security equivalent programs such as Telnet, FTP, and many of the other

communications-oriented programs under UNIX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 182:

Which of the following is a tunneling protocol originally designed for UNIX

systems?

A. PPTP

B. L2F

C. L2TP

D. SSH

Answer: D

Explanation: 

Secure Shell (SSH) is a tunneling protocol originally designed for UNIX systems. SSH

uses encryption to establish a secure connect ion between two systems. SSH also provides

security equivalent programs such as  Telnet, FTP, and many of the other

communications-oriented programs under UNIX

Incorrect answers:

A: PPTP supports encapsulation in a single point-to-point environment. PPTP

encapsulates and encrypts PPP packets. This makes PPTP a favorite low-end protocol for

networks. The negotiation between the two e nds of a PPTP connection is done in the

clear. Once the negotiation is perf ormed, the channel is encrypted

B: L2F was created by Cisco as a method of  creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

does provide authentication, but it  does not provide encryption.

C: Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 183:

Which of the following definitions fit correctly to PPTP?

SY0-101 

Actualtests.com - The Power of Knowing

A. It supports encapsulation in a single point-to-point environment

B. It was created by Cisco as a method of creating tunnels primarily for dial-up

connections

C. It is primarily a point-to-point protocol

D. It is a tunneling protocol originally designed for UNIX systems.

Answer: A

Explanation: 

PPTP supports encapsulation in a single point-to-point environment. PPTP encapsulates

and encrypts PPP packets. This makes PPTP a favorite low-end protocol for networks.

The negotiation between the two ends of a PPT P connection is done in the clear. Once

the negotiation is performed, the channel is encrypted.

Incorrect answers:

B: This refers to L2F

C:This refers to L2TP

D: This refers to SSH

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 184:

From the options, which is a VPN (Virtual Private Network) prot ocol that operates

at the Network layer (Layer 3) of the OSI (Open Systems Interconnect) model?

A. PPP (Point-to-Point Protocol) protocol

B. SSL (Secure Sockets Layer) protocol

C. L2TP (Layer Two Tunneling Protocol) protocol

D. IPSec (Internet Protocol Security)

Answer: D

Explanation: 

IPSec works at the network layer of the OSI  layer model and is a key factor in VPNs.

Incorrect answers:

A: PPP is a full-duplex line protocol that supersedes SLIP (Serial Line Internet Protocol)

often used in dial-up connections operating at layer 2.

B: SSL is a protocol that secures message s by operating between the Application layer

(HTTP) and the Transport layer.

C: L2TP is a tunneling protocol  that adds functionality to  PPP. This protocol was created

by Microsoft and Cisco and is often used with virtual private networks (VPNs) operating

at layer 2.

Reference:

SY0-101 

Actualtests.com - The Power of Knowing

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 5, Lesson 2

QUESTION 185:

From the options, which is a tunneling protocol that can only work on IP networks

because it requires IP connectivity?

A. IPX protocol

B. L2TP protocol

C. PPTP protocol

D. SSH

Answer: C

Explanation: 

You can access a private network through the Internet or other public network by using a

virtual private network (VPN) connection wi th the Point-to-Point Tunneling Protocol

(PPTP). It was developed as an extension  of the Point-to-Point Protocol (PPP), PPTP

tunnels and/or encapsulates IP, IPX, or NetBEUI protocols inside of PPP datagrams.

PPTP does not require a dial- up connection. It does, however , require IP connectivity

between your computer and the server.

Incorrect answers:

A: IPX is a connectionless, routable network protocol based on the Xerox XNS

architecture. It's the default protocol for versions of NetWare before NetWare 5 and

operates at the Network layer of the OSI model and is responsible for addressing and

routing packets to workstations  or servers on other networks.

B: L2TP is an industry-standard Internet tunneling protocol with roughly the same

functionality as the Point- to-Point Tunneling Protocol  (PPTP). Like PPTP, L2TP

encapsulates Point-to-Point Prot ocol (PPP) frames, which in turn encapsulate IP, IPX, or

NetBEUI protocols

D: SSH is a replacement for rlogin in Unix/Linux that includes s ecurity. rlogin allowed

one host to establish a connection with another with no real security being employed

SSH replaces it with slogin and digital certificates.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 122

QUESTION 186:

You work as the security administrator at Certkiller .com. You must open ports on

your firewall to support L2TP (Layer Two Tunneling Protocol) and PPTP

(Point-to-Point Tunneling  Protocol) connections.

Which ports should you open to support both protocols?

A. Open TCP (Transmission Control Protocol) port 635, and open UDP (User Datagram

SY0-101 

Actualtests.com - The Power of Knowing

Protocol) port 654

B. Open TCP (Transmission Control Protocol) port 749, and open UDP (User Datagram

Protocol) port 781

C. Open TCP (transmission Control Protocol) port 1723), and open UDP (User Datagram

Protocol) port 1701.

D. Open TCP (Transmission Control Protocol) port 1812 and open UDP (User Datagram

Protocol) port 1813

Answer: C

Explanation: 

L2TP uses UDP port 1701 while PPTP uses port 1723 and TCP for connections.

Incorrect answers:

A: TCP port 635 is used by RLZ Dbase and UDP port 654 is used by OADV.

B: TCP port 749 is used for Kerberos Admin, UDP port 781 is used by HP Performance

data collector.

D: This is used by RADIUS accounting.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 120

http://www.iana.org/assignments/port-numbers

QUESTION 187:

From the list of protocols, which two ar e VPN (Virtual Private Network) tunneling

protocols? Choose two protocols.

A. PPP (Point-to-Point Protocol).

B. SLIP (Serial Line Internet Protocol).

C. L2TP (Layer Two Tunneling Protocol).

D. SMTP (Simple Mail Transfer Protocol).

E. PPTP (Point-to-Point Tunneling Protocol).

Answer: C, E

Explanation: 

PPTP and L2TP are both VPN tunneling protocols. L2TP is more sophisticated and

gaining more popularity.

Incorrect answers:

A: PPP is an encapsulation protocol usually associated with ISDN.

B: SLIP is an old protocol used for direct  serial line connections between two computers.

D: Simple Mail Transfer Protocol (SMTP) is a protocol for sending e-mail between

SMTP servers.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 120

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 188:

You work as the security administrator at Certkiller .com. You must configure the

network to allow AH (Authentication H eader) and ESP (Encapsulating Security

Payload) tunnel-encapsulated IPSec (Inter net Protocol Security) traffic to pass

between a client and your firewall.

You open the L2TP (Layer Two Tunneling Protocol) and IKE (Internet Key

Exchange) Transport layer ports on the  perimeter router and on the firewall.

What else should you do to allow AH and ESP tunnel-encapsulated IPSec (Internet

Protocol Security) traffic to pass between a client and your firewall?

A. Configure the perimeter router and fire wall to allow inbound pr otocol number 51 for

ESP encapsulated IPSec traffic

B. Configure the perimeter router and fire wall to allow inbound pr otocol number 49 for

ESP encapsulated IPSec traffic

C. Configure the perimeter router and fire wall to allow inbound pr otocol numbers 50 and

51 for AH and ESP encapsulated IPSec traffic

D. Configure the perimeter router and fire wall to allow inbound pr otocol numbers 52 and

53 for AH and ESP encapsulated IPSec traffic

Answer: C

Explanation: 

The most secure firewall configuration is  one in which the firewall permits only IKE and

IPSec traffic to flow between the specific IP  addresses of the peers. However, if these

addresses are not static, or if there are many addresses, a less secure configuration might

be required to permit IPSec and IKE traffic to flow between subnets.

When a firewall or filtering router exists between IPSec peers, it must be configured to

forward IPSec traffic on UDP source and dest ination port 500, IP protocol 50 (ESP), or

IP protocol 51 (AH).

Incorrect answers:

A: This alone will not allow traffic flow between a client and a firewall.

B: This option will not allow AH and ESP IPSec traffic between client and firewall.

D: Port 53 is used for DNS server lookups and SQL client name lookup.

References:

http://www.microsoft.com/resources/docum entation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=

QUESTION 189:

You work as the security administrator  at Certkiller .com. You must choose a

technology or standard to both authenticat e and encrypt IP (Internet Protocol)

traffic.

Which should you use?

SY0-101 

Actualtests.com - The Power of Knowing

A. ESP (Encapsulating Security Payload)

B. S/MIME (Secure Multipurpose Internet Mail Extensions)

C. IPSec (Internet Protocol Security)

D. IPv2 (Internet Protocol version 2)

Answer: C

IPSec provides secure authentication and encryp tion of data and headers. IPSec can work

in tunneling mode or transport mode. In tunne ling mode, the data or payload and message

headers are encrypted. Transport mode encrypts only the payload.

Incorrect answers:

A: ESP is a header used to provide a mix of security services in IPv4 and IPv6. ESP can

be used alone or in combination with the IP Authentication Header (AH). But this is not

enough to authenticate and encrypt IP traffic.

B: S/MIME is a standard used for encrypting e-mail not IP traffic.

D: IPv2 does not authenticate and encrypt IP traffic.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 127

QUESTION 190:

Choose the correct combination of VPN (Virtual Private Network) tunneling

protocols.

A. IPSec (Internet Protocol Security), L2TP (Layer Two Tunneling Protocol), and SSL

(Secure Sockets Layer)

B. IPSec (Internet Protocol Security), L2TP (Layer Two Tunneling Protocol), and PPP

(Point-to-Point Protocol)

C. PPTP (Point-to-Point Tunneling Protocol), L2TP (Layer Two Tunneling Protocol),

and SSL (Secure Sockets Layer)

D. PPTP (Point-to-Point Tunneling Protocol), L2TP (Layer Two Tunneling Protocol),

and IPSec (Internet Protocol Security)

Answer: D

Explanation: 

Tunneling refers creating a virtual dedicated connection between two systems or

networks. You create the tunnel between the two ends by encapsulating the data in a

mutually-agreed-upon protocol for transmission. In most tunnels, the data passed through

the tunnel appears at the other side as part  of the network. It's obvious that L2TP and

PPTP are tunneling protocols because the word  tunneling is in the acronyms for their

name, but IPSec is also considered a tunneling  protocol because it creates a secure tunnel

connection.

Incorrect answers:

A, C: SSL is not a tunneling protocol.

B: PPP is not a tunneling protocol.

SY0-101 

Actualtests.com - The Power of Knowing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 30-32

QUESTION 191:

From the list of options, which specifies the primary benefit of using RADIUS

(Remote Authentication Dial-in User Servic e) for a multi-site VPN (Virtual Private

Network) that supports a large number of remote users?

A. RADIUS (Remote Authentication Dial-in User Service) provides for a centralized

user database.

B. RADIUS (Remote Authentication Dial-in User Service) provides for a decentralized

user database.

C. No user database is required with RADIUS (Remote Authentication Dial-in User

Service).

D. User database is replicated and  stored locally on all remote systems.

Answer: A

Explanation: 

Since RADIUS keeps its credentials and keys in a centralized database, it's ideal for a

large population of remote users. RADIUS au thenticates the dial-in user by means of a

private symmetric key; and stores a user profile to grant user authorization.

Incorrect answers:

B: This is incorrect.

C: This is incorrect as a database is used in RADIUS.

D: There is no replication of user database  as RADIUS gives you a single source for the

authentication to take place.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 121-122

QUESTION 192:

You work as the security administrator at Certkiller .com. You must configure the

firewall to support TACACS.

Which port(s) should you open on the firewall?

A. Port 21

B. Port 161

C. Port 53

D. Port 49

Answer: D

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

TACACS uses both TCP and UDP port 49.

Incorrect answers:

A: This port is used for FTP's control channel.

B: UDP port 161 is used by SNMP.

C: Port 53 is used for DNS.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 64

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 2

QUESTION 193:

You work as the security administrator at Certkiller .com. You must configure the

firewall to support SSH (Secure Shell).

Which port(s) should you open on the firewall?

A. Port 22

B. Port 69

C. Port 179

D. Port 17

Answer: A

Explanation: 

SSH uses port 22 and TCP for connections.

Incorrect answers:

B: UDP port 69 is used for TFTP.

C, D: Port 17 is used for the quote of the day and port 179 is used for Border gateway

protocol. SSH does not require the us e of these ports for functionality.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 64,127

http://www.iana.org/assignments/port-numbers

QUESTION 194:

You work as the security administrator at  Certkiller .com. You want to implement an

alternative to using Telnet to establish  secure connections between two systems.

Which technology or standard should you use?

A. DES (Data Encryption Standard).

B. S-Telnet.

C. SSH (Secure Shell).

D. PKI (Public Key Infrastructure).

SY0-101 

Actualtests.com - The Power of Knowing

Answer: C

Explanation: 

Secure Shell is like telnet in the sense that an administrator may enter commands into a

remote server, except that it uses an encrypted and authenticated connection [(RSA)

eryptography for connection and authenticatio n; and IDEA, Blowfish,or DES for data

stream encryption.] instead of Telnet's cleartext.

SSH is a tunneling protocol originally designed for Unix systems. It uses encryption to

establish a secure connecti on between two systems. SSH also provides alternative,

security-equivalent, programs for such Unix  standards as Telnet, FTP, and many other

communications-oriented programs. SSH is  now available for use on Windows systems

as well. This makes it the preferred method  of security for Telnet and other clear

text-oriented programs in the Unix environment. SSH uses port 22 and TCP for

connections.

Incorrect answers:

A: The Data Encryption Standard (DES) is a strong and efficient  algorithm based on a

56-bit key. (Strong refers to the fact that it's  hard to break.) DES has several modes that

offer security and integrity. However, it has become a little dated as a result of advances

in computer technology, and it's being repla ced. For its time, it was one of the best

standards available.

B: This cannot be used as an alternative to Telnet.

D: This is not an alternative to Telnet.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 120 

QUESTION 195:

What is the main reason why e-mail security concepts do not work?

A. The workers lack of interest in updating virus definitions

B. A lack of suitable software

C. The rate at which new viruses are being developed

D. Viruses are unstoppable

Answer: A

Explanation: 

The software typically uses a virus definition file that is updated regularly by the

manufacturer. Fortunately, these virus definition files are usua lly updated every two

weeks or so. If these files are kept up to date, the computer system will be relatively

secure. Unfortunately, most people don't keep them up to date. Users will exclaim that a

new virus is out, because they just got it. Upon examination, you will discover that in

most cases their virus definition file is months out of date.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

B: It cannot be blamed on the software because for virus there is a method of prevention.

C: This can be combated by updating your virus definitions regularly.

D: For every virus created the will be a method of prevention

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 64,130

QUESTION 196:

Which of the following network attacks cannot occur in an e-mail attack?

A. Dictionary attack

B. Trojan Horse

C. Phage Virus

D. Polymorphic Virus

Answer: A

Explanation: 

A Dictionary attack involves guessing possible passwords for entering as another user.

The attacker must have access to the network.

Incorrect answers:

B, C, D: These viruses are spread via e-mail.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 129

QUESTION 197:

When does your antivirus software scan your e-mails for possible viruses?

A. While receiving

B. While opening

C. While sending

D. All of the above

Answer: A

Explanation: 

Your antivirus software should scan all your incoming mail before you can even read it.

Incorrect answers:

B, C, D: It is only necessary to scan your e-mails once and the antivirus software should

pick up possible risks on  receiving the mail.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 129

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 198:

Which of the following attacks are being referred to if someone is accessing your

e-mail server and sending inflammatory information to others?

A. Trojan Horse.

B. Phage Virus.

C. Repudiation Attack.

D. Polymorphic Virus.

Answer: C

Explanation: 

Repudiation attacks make data or information that is used invalid or misleading, which

can be even worse. An example of a repudiation attack might be someone accessing your

e-mail server and sending inflammatory information to others. This information can

prove embarrassing to you or your company  if this happens. Repudiation attacks are

fairly easy to accomplish because most e-mail systems do not check outbound mail for

validity. Repudiation attacks usua lly begin as access attacks.

Incorrect answers:

A, B, D: These attacks are not e-mail based.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 129

QUESTION 199:

What type of attack would involve a customer who claims that they never received a

service for which they were billed. In this  situation, the burden  of proof is on the

company to prove that the information us ed to generate the invoice is accurate?

This attack is done via e-mail.

A. Trojan Horse.

B. Phage Virus.

C. Repudiation Attack.

D. Polymorphic Virus.

Answer: C

Explanation: 

A common type of repudiation attack would involve a customer who claims that they

never received a service for which they were bi lled. In this situation, the burden of proof

is on the company to prove that the information used to generate the invoice is accurate.

If the data has been modified by an external attacker, accuracy verification of the

information may be difficult.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A, B, D: These attacks are not e-mail based.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 129.

QUESTION 200:

Which of the following protocols make use of port 25?

A. SMTP

B. FTP

C. Telnet

D. SNMP

Answer: A

Explanation: 

Simple Mail Transfer Protocol makes use of  this port for server to server communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 201:

Which of the following protocols make use of port 110?

A. POP3

B. FTP

C. Telnet

D. SNMP

Answer: A

Explanation: 

Post Office Protocol Version: 3 makes use of this port for client to server communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 202:

Which of the following protocols make use of port 143?

A. IMAP4

B. FTP

C. Telnet

D. SNMP

Answer: A

Explanation: 

Internet Message Access Protocol Version: 4 ma kes use of this port for client to server

communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 203:

Which of the following ports does SMTP use?

A. 25.

B. 20.

C. 23.

D. 162.

Answer: A

Explanation: 

Simple Mail Transfer Protocol makes use of  this port for server to server communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 204:

Which of the following ports does POP3 use?

A. 110.

B. 20.

C. 23.

D. 162.

Answer: A

Explanation: 

Post Office Protocol Version: 3 makes use of this port for client to server communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 205:

Which of the following ports does IMAP4 use?

A. 143.

B. 20.

C. 23.

D. 162.

Answer: A

Explanation: 

Internet Message Access Protocol Version: 4 ma kes use of this port for client to server

communication.

Incorrect answers:

B: FTP makes use of port 20

C: Telnet makes use of port 23

D: SNMP makes use of port 162

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 206:

By which means do most network bound viruses spread?

SY0-101 

Actualtests.com - The Power of Knowing

A. E-mail.

B. Floppy

C. CD-Rom

D. Mass storage devices

Answer: A

Explanation: 

E-mail is the reason for the high speed at  which viruses are spread over the network.

Incorrect answers:

B, C, D: Removable storage such as floppy a nd CD's are not vital in a system and your

antivirus software should reject the device immediat ely and prompt removal.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 67

QUESTION 207:

Which of the following options would be the primary firewall to protect you from

e-mail viruses?

A. E-mail servers.

B. Antivirus software.

C. SMTP.

D. IMAP4.

Answer: A

Explanation: 

E-mail servers detect the viruses in the me ssages received from various sources and send

warnings to the recipient to warn him/her of  the risky mail. This server has the necessary

means to reject infected mail content. E-mail servers have their ow n virus scanners to

filter all the incoming mail before it reaches th e server. An e-mail server is a middle man

in the delivery of the message.

Incorrect answers:

B: Antivirus software only tackles the virus once it reaches the recipient therefore the

recipient should have the latest virus definitions to stay immune.

C, D: This is a mail protocol and sole purpose is to form a platform on which mail is

sent.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 273.

QUESTION 208:

SY0-101 

Actualtests.com - The Power of Knowing

Which of the following definitions should BEST suit the functions of an e-mail

server?

A. Detect the viruses in the messages received from various sources and send warnings to

the recipient to warn hi m/her of the risky mail.

B. Notify you that a message carries a virus.

C. Forms a platform on which messages are sent.

D. Makes use of a port used specifica lly for messages to be sent through.

Answer: A

Explanation: 

E-mail servers detect the viruses in the me ssages received from various sources and send

warnings to the recipient to warn him/her of  the risky mail. This server has the necessary

means to reject infected mail content. E-mail servers have their ow n virus scanners to

filter all the incoming mail before it reaches th e server. An e-mail server is a middle man

in the delivery of the message.

Incorrect answers:

B: This is the function of antivirus software

C, D: These are messaging protocols.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 273.

QUESTION 209:

Which of the following would be the correct sequence for SSH?

A. E-mail client, SSH server, E-mail client, SSH Tunnel, SSH Server, E-mail server.

B. E-mail client, SSH Tunnel, SSH server, E-mail server.

C. E-mail client, SSH Tunnel, SSH server, E-mail client, E-mail server.

D. E-mail client, SSH server, SSH Tunnel, E-mail server, SSH server, E-mail client.

Answer: A

Explanation: 

Secure Shell (SSH) is the t unneling protocol originally used on UNIX systems. SSH is

now available for both UNIX and Windows  environments. The handshake process

between the client and server is similar to  the process described in SSL. SSH is primarily

intended for interactive terminal sessions. The  first phase is a secure channel to negotiate

the channel connection. The second phase is  a secure channel used  to establish the

connection.

Incorrect answers:

B, C, D: These do not apply as any part of the SSH tunneling protocol.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 396.

QUESTION 210:

On which of the following should Anti-Vi rus software be installed to provide

optimum protection on a network?

A. On all workstations connected to the Internet.

B. On all network servers.

C. On all workstations and servers.

D. On all terminals.

Answer: C

To provide optimum protection on the network, you should ensure that all systems,

workstations and servers included, have Anti-Virus software in stalled on them.

Incorrect Answers:

A: Installing Anti-Virus software on only the workstations connected to the internet will

leave the other workstations and servers vul nerable to LAN based viruses that can be

introduced to the network through disk dives.

B: Installing

Anti-Virus software on only the servers will  leave all workstations vulnerable to LAN

based viruses that can be intr oduced to the network through disk dives and Internet based

viruses.

D: Installing Anti-Virus software on only the terminals will leave the other workstations

and servers vulnerable to Internet based viruses.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 392-394.

QUESTION 211:

Files with which of the following file exte nsions CANNOT be infected by a virus?

A. .txt

B. .com

C. .dll

D. .exe

Answer: A

Plain text documents cannot be infected by viruses.

Incorrect Answers:

B, C, D: Executable files such as .com, .exe and .dll files can be  infected by viruses.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 392-394.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 212:

Which of the following should be scanned for viruses?

A. Plain text documents.

B. Microsoft Word documents.

C. Executable files.

D. All of the above.

Answer: B, C

Incorrect Answers:

A: Plain text documents cannot be infected by viruses and do not need to be scanned.

D: Executable files such as .com, .exe and .dll files and Microsoft Word documents can

be infected by viruses and should be scanned.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 392-394.

QUESTION 213:

Choose the primary disadvantage of using a third party mail relay.

A. Spammers can utilize the third party mail relay.

B. A third party mail relay limits access to specific users.

C. A third party mail relay restricts the types of e-mail that maybe sent.

D. A third party mail relay restricts spammers from gaining access.

Answer: A

Explanation: 

Using a third party email relay can put you in an advantage of getting unnecessary spam.

Anyone on the internet can relay an unsolicited email through an SMTP server, and the

message will appear to be legitimate coming from the email server, and it makes it much

more difficult to trace the spammer.

Incorrect answers:

B: Relay actually lends itself to be ing exploited by unso licited spammers.

C: This is not the main disadvantage of a relay.

D: The relay does not restrict spammers from gaining access.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 129

QUESTION 214:

Choose the option that correctly defines the purpose of S/MIME (Secure

SY0-101 

Actualtests.com - The Power of Knowing

Multipurpose Internet Mail Extensions).

A. S/MIME is used to encrypt user names and profiles to ensure privacy.

B. S/MIME is used to encrypt messages and files.

C. S/MIME is used to encrypt network  sessions acting as a VPN (Virtual Private

Network) client.

D. S/MIME is used to automatically encrypt all outbound messages.

Answer: B

Explanation: 

Secure MIME (S/MIME) is a standard used for encrypting e-mail. S/MIME can also

contain signature data. S/MIME provides en cryption, integrity, and authentication when

used in conjunction with PKI.

Incorrect answers:

A: S/MIME is meant to encrypt messages  and files, not user names and profiles.

C: A VPN is a private network that provides security over an otherwise unsecure

environment. This is not what S/MIME does.

D: It is not only outbound messages that are encrypted.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 330

QUESTION 215:

S/MIME requires the implementation of wh ich of the following in order to operate?

A. A digital certificate.

B. A server side certificate.

C. A SSL (Secure Sockets Layer) certificate.

D. A public certificate.

Answer: A

Explanation: 

What differentiates S/MIME from MIME is that it uses RSA asymmetric encryption and

it relies on a digital certificate for authentication.

Incorrect answers:

B: You need a digital certificate and not a server si de certificate.

C: This is not necessary for S/MIME.

D: You need a digital certificate with S/MIME instead.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 330

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 216:

A malformed MIME (Multipurpose Internet  Mail Extensions) header can have a

negative impact on the system. Choose th e option that correctly details this.

A. Can lead to the creation of a back door, which will enable a ttackers to access the

internal network.

B. Can create a virus that infects the computers of users.

C. Can result in the unauthorized disclosure of private information.

D. Can result in an e-mail server crashing.

Answer: D

Explanation: 

Microsoft Exchange Server 5.0 & 5.5 had a vulnerability that made it suspect to crashes

following a malformed MIME header. Pa tches have since been released.

Incorrect answers:

A: It does not create a backdoor. This is usually the result of a Trojan horse.

B: Viruses are not created due to malformed MIME.

C: This is not a result of malformed MIME.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 330

QUESTION 217:

Choose the standard typically us ed to encrypt e-mail messages.

A. S/MIME

B. BIND

C. DES

D. SSL

Answer: A

Explanation: 

Secure MIME (S/MIME) is a standard used for encrypting e-mail. S/MIME can also

contain signature data. S/MIME provides en cryption, integrity, and authentication when

used in conjunction with PKI.

Incorrect answers:

B: BINDING allows zone transfers to be signed.

C: DES is a strong and efficient algorithm based on a 56-bit key. But it has been

replaced.

D: SSL is a protocol that secures message s by operating between the Application layer

(HTTP) and the Transport layer.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 368

QUESTION 218:

Choose the option that details one of the primary benefits of using S/MIME /Secure

Multipurpose Internet Mail Extension)?

A. S/MIME allows users to send both encrypted and digitally signed e-mail messages.

B. S/MIME allows users to send anonymous e-mail messages.

C. S/MIME allows users to send e-mail messages with a return receipt.

D. S/MIME expedites the delivery of e-mail messages.

Answer: A

Explanation: 

Secure MIME (S/MIME) is a standard used for encrypting e-mail. S/MIME can also

contain signature data. S/MIME provides en cryption, integrity, and authentication when

used in conjunction with PKI.

Incorrect answers:

B : S/MIME allows for digitally signed, more secure e-mail, anonymity is thus out of the

question.

C: This is not an S/MIME benefit.

D: This is not the main benefit of S/MIME.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 368

QUESTION 219:

Choose the option that correc tly specifies a likely negative technical impact of

receiving large quantifies of spam,

A. DoS (Denial of Service).

B. Processor underutilization.

C. Reduction in hard drive space requirements.

D. Increased network throughput.

Answer: A

Explanation: 

In systems where no email filters are set up, it is possible for some users to receive over a

hundred unsolicited emails a day! If every user  on a network received that much email,

the human time necessary to sort through those emails will be Herculean. The system

resources required to: process, download, and  store such email can potentially reduce a

network avalability to zero mthus denying service

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

B: Processor underutilization usually occurs when the buffer overflows.

C: DoS will occur before you experience hard drive space reduction.

D: This is a secondary result of spamming.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 221

QUESTION 220:

On the topic of comparing viruses and hoaxes, which statement is TRUE? Choose

the best TRUE statement.

A. Hoaxes can create as much damage as a real virus.

B. Hoaxes are harmless pranks and should be ignored.

C. Hoaxes can help educate users about a virus.

D. Hoaxes carry a malicious payload and can be destructive.

Answer: A

Explanation: Hoaxes do have the possibility  of causing as much damage as viruses.

Many hoaxes instruct the recipient to forw ard the message to everyone that they

know and thus causes network congestion and heavy e-mail activity. Hoaxes also

often instruct the user to delete files  on their computer that may cause their

computer or a program to quit functioning.

Incorrect answers:

B: Hoaxes are not harmless and can in fact cause a lot of damage.

C: It does not educate users.

D: This is false.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 79

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 6, Lesson 1

QUESTION 221:

Which of the following is the primary attribute associated with e-mail hoaxes?

A. E-mail hoaxes create unnecessary e-mail traffic and panic in non-technical users.

B. E-mail hoaxes take up large am ounts of server disk space.

C. E-mail hoaxes can cause buffer overflows on the e-mail server.

D. E-mail hoaxes can encourage malicious users.

Answer: A

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

Although answer choices B,C,D have a degree  of truth to them;the BEST answer is A.

Email hoaxes often create unnecessary traffic because they ask users to forward an email

to everyone in address book, and whether it is a computer vi rus or a blind, crippled,

starving, cancer victim child suffering from  Herpes it creates undue panic and emotion in

the work setting.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 79

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 6, Lesson 1

QUESTION 222:

From the list of options, chose the primary attribute associated with e-mail hoaxes.

A. E-mail hoaxes create unnecessary e-mail traffic, as well as panic in users that are not

technically inclined.

B. E-mail hoaxes consume large quantities of server disk space.

C. E-mail hoaxes can result in buffer overflows on the e-mail server.

D. E-mail hoaxes tend to encourage malicious users.

Answer: A

Explanation: 

Although answer choices B,C,D have a degree  of truth to them;the BEST answer is A.

Email hoaxes often create unnecessary traffic because they ask users to forward an email

to everyone in address book, and whether it is a computer vi rus or a blind, crippled,

starving, cancer victim child suffering from  Herpes it creates undue panic and emotion in

the work setting.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 79

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 6, Lesson 1

QUESTION 223:

Choose the scheme or system used by PG P (Pretty Good Privacy) to encrypt data.

A. Asymmetric scheme

B. Symmetric scheme

C. Symmetric key distribution system

D. Asymmetric key distribution system

Answer: A

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

PGP is a shareware implementation of RSA  encryption. Pretty Good Privacy (PGP) is a

set of software tools that allows you to encr ypt, decrypt, and digitally sign computer data

and e-mail. PGP's encryption and decryption services are asymmetric.

Incorrect answers:

B, C, and D: Symmetric algorithms require both ends of an encrypted message to have

the same key and processing al gorithms. Symmetric  algorithms generate a secret key that

must be protected. A secret key-sometimes referred to as a private key-is a key that isn't

disclosed to people who aren't authorized to  use the encryption system. The disclosure of

a private key breaches the security of the encrypt ion system. If a key is lost or stolen, the

entire process is breached. DES, 3DES, CAST , RC, Blowfish and IDEA Blowfish are all

examples of encryption using a symmetric scheme.

Asymmetric algorithms use two keys to encryp t and decrypt data. These keys are referred

to as the public key and the private key. The public key can be used by the sender to

encrypt a message, and the private key can be used by the receiver to decrypt the

message. As you may recall, symmetrical systems require the key to be private between

the two parties. With asymmetric systems, each circuit has one key. RSA,

Diffie-Hellman, ECC and El Ga mal are examples of encryption using asymmetrical

schemes.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 292-294

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 6, Lesson 1

QUESTION 224:

Choose the standard that relies on "Web of Trust" in its key management scheme.

A. Secure Multipurpose Internet Mail extensions (S/MIME)

B. Pretty Good Privacy (PGP)

C. MIME Object Security Services (MOSS)

D. Privacy Enhanced Mail (PEM)

Answer: B

Explanation: 

"PGP does not use a hierarchy of CAs, or any type of formal trust certificates, but relies

on a "web of trust" in its key management a pproach. Each user gene rates and distributes

his or her public key, and users sign each other's public keys, which creates a community

of users who trust each other. This is differe nt than the CA approach where no one trusts

each other, they only trust the CA.

Incorrect answers:

A: S/MIME contains signature data. It uses the PKCS #7 standard (Cryptographic

Message Syntax Standard) and is the most widely supported standard used to secure

SY0-101 

Actualtests.com - The Power of Knowing

e-mail communications.

C: MIME is the predecessor of S/MIME.

D: PEM is created with three digital signature algorithms.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 292-294

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 6, Lesson 1

QUESTION 225:

One of these concepts has a goal of verifying that an e-mail message received has not

been tampered with while  in transit. Which is it?

A. Authorization

B. Non-repudiation

C. Integrity

D. Cryptographic mapping

Answer: C

Explanation: 

The goal of integrity is to verify that information being used is accurate and hasn't been

tampered with. Integrity is coupled with account ability to ensure that data is accurate and

that a final authority exists to verify this, if needed.

Incorrect answers:

A: Authorization has to do  with an access to issue.

B: Non-repudiation The ability (by whatever means) to verify that data was seen by an

intended party. It makes sure they received the data and can't repudiate (dispute) that it

arrived.

D: Cryptographic mapping does not verify whether e-mail has been tampered with or not.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 286

QUESTION 226:

Choose the measure that best protects both the confidentiality and integrity of an

e-mail message.

A. SHA-1 (Secure Hashing Algorithm 1)

B. IPSec (Internet Protocol Security)

C. Digital signature

D. S/MIME (Secure Multipurpose Internet Mail Extensions)

Answer: D

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

Secure Multipurpose Internet Mail Extensions (S/MIME) is a standard used for

encrypting e-mail.

S/MIME contains signature data. It uses the PKCS #7 standard (Cryptographic Message

Syntax

Standard) and is the most widely supported standard used to secure e-mail

communications.

Incorrect answers:

A: The Secure Hash Algorithm (SHA) was designed to ensure the integrity of a message.

The SHA is a one-way hash that provides  a hash value that can be used with an

encryption protocol

B: IPSec is a set of protocols that enable encryption, authen tication, and integrity over IP.

C: A digital signature is an el ectronic signature whose sole purpose is to authenticate the

sender.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 330

QUESTION 227:

Which of the following statements regarding a firewall is TRUE?

A. A firewall protects hosts on a private network from attackers on a public network.

B. A firewall protects hosts on a public netw ork from attackers on a private network.

C. A firewall protects hosts on a priv ate network from virus attacks.

D. A firewall provides authentication services.

Answer: A

A firewall protects hosts on a private netw ork from attackers on a public network by

means of packet filtering, port fi ltering, or IP address filtering.

Incorrect Answers:

B: A firewall protects hosts on a private network from attackers on a public network

rather than hosts on a public network from attackers on a  private network.

C, D: A firewall provides packet filtering, port filtering, or IP address filtering. It does

not provide authentication  or anti-virus protection.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 331-343.

QUESTION 228:

Which of the following statements best describes a demilitarized zone (DMZ)?

A. A DMZ is a separate network segment that contains Internet accessible servers and is

separated from the Internet and the rest of  the private network by means of a firewall.

SY0-101 

Actualtests.com - The Power of Knowing

B. A DMZ is a separate DNS namespace reserved for Internet accessible servers and is

protected by means of a firewall.

C. A DMZ is another term used to describe a private network th at is protected by a

firewall from attackers on a public network.

D. A DMZ is a bank of remote access servers that is protected by a firewall from

attackers on a public network.

Answer: A

A DMZ is a separate network segment that c ontains Internet accessible servers such as

access web servers, FTP servers, and mail-relay servers and is separated from the Internet

and the rest of the private network by means of a firewall

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 331-343.

QUESTION 229:

Which of the following are NOT features of a firewall? (Choose all that apply)

A. Access control lists.

B. Dynamic packet filtering.

C. Virus protection.

D. Authentication.

Answer: C, D

A firewall provides packet filtering, port filtering, or IP addre ss filtering. It does not

provide authentication or anti-virus protection.

Incorrect Answers:

A, B: Access control lists and dynamic pack et filtering are features of firewalls.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 331-343.

QUESTION 230:

Which of the following statements regarding a proxy server are TRUE? (Choose all

that apply)

A. A proxy server is a type of firewall that  completely separates packets from internal

hosts and from external hosts.

B. A proxy server connects two dissimilar networks by providing Network Address

Translation.

C. A proxy server operates at the lower layers of the OSI reference model.

D. A proxy server can cache frequently ac cessed Web pages and can increase network

security by filtering out Web content that is considered insecure, such as executables,

scripts, or viruses.

SY0-101 

Actualtests.com - The Power of Knowing

Answer: A, D

A proxy server caches web pages for future retrie val, allowing a user's request to be filled

quicker and reducing Internet tr affic. A proxy server also hides the IP addresses of all

hosts on the internal network  by replacing the private IP ad dress of any requesting host

with its own public IP address. Thus providing Network Address Translation.

Incorrect Answers:

A: A proxy server can provide Network Address Translation but it connects an LAN to

the Internet, not to a dissimilar network.

C: A proxy server operates at th e Application Layer of the OSI.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 134-13, 142-144.

QUESTION 231:

Which of the following CANNOT be performed by a proxy server?

A. Network Address Translation.

B. Web page caching.

C. Packet filtering.

D. Data encryption.

Answer: D

A proxy server does not provide data encryption.

Incorrect Answers:

A: A proxy server also hides the IP addresses of all hosts on the internal network by

replacing the private IP address of any reque sting host with its ow n public IP address.

Thus providing Network Address Translation.

B: A proxy server caches web pages for future  retrieval, allowing a user's request to be

filled quicker and reducing Internet traffic.

C: A proxy server inspects the entire packet  and can be configured to filter packets that

pass through it based on a number of criteria.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 134-13, 142-144.

QUESTION 232:

You work as a security administrator at Certkiller .com. You have installed a new

firewall on the Certkiller .com network. A few days later Certkiller .com users

complain that they can send outgoing e- mail but cannot receive any e-mail. What

should you do?

A. Ensure that inbound traffic on port 25 is permitted on the firewall.

B. Ensure that outbound traffic on port 25 is permitted on the firewall.

SY0-101 

Actualtests.com - The Power of Knowing

C. Ensure that inbound traffic on port 110 is permitted on the firewall.

D. Ensure that outbound traffic on port 110 is permitted on the firewall.

Answer: C

The firewall is probably blocking inbound POP3 traffic which is used for email retrieval.

POP3 uses port 110. Therefore we should en sure that inbound tr affic on port 110 is

permitted on the firewall.

Incorrect Answers:

A, B: SMTP uses port 25 to transfer email between email servers. However, the problem

lies with clients sending email rather  than servers transferring them.

D: Users can send email, therefore outbound POP3 traffic is not blocked on the firewall.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 134-13, 142-144.

QUESTION 233:

You work as a network administrator at Certkiller .com. The Ce rtkiller .com network

uses an IP proxy that provides Network Address Translation (NAT). You have

implemented IPSec for all internet bound tr affic; however, Internet access is now

no longer possible. What should is  the cause of this problem?

A. Network Address Translation (NAT) does not work with IPSec.

B. The IP proxy is blocking egress and ingress traffic on port 80.

C. The IP proxy is blocking egress and ingress traffic on port 1293.

D. The IP proxy is blocking egress and ingress traffic on port 8080.

Answer: A

Network Address Translation (NAT) is not compatible with IPSec because NAT changes

the IP address in the IP head er of each packet. IPSec does  not allow this and drops the

packet.

Incorrect Answers:

B: Port 80 is used for HTTP traffic. Howe ver, Internet access was possible before the

switch t o IPSec. Therefore the probl em does not lie with port blocking.

C: Port 1293 is used for IPSec traffic. If this port is blocked, IPSec traffic would not

pass. However, the problem here is that Network Address Translation (NAT) changes the

IP address in the IP header of each p acket which is not permitted in IPSec.

D: Port 8080 is an alternate port for HTTP  and is commonly used for proxy servers.

However, the problem here is that Networ k Address Translation (NAT) changes the IP

address in the IP header of each pack et which is not permitted in IPSec.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 134-13, 142-144.

QUESTION 234:

SY0-101 

Actualtests.com - The Power of Knowing

Which of the following web vulnerabilities is being referred to when it is a

programming language that allows access to  system resources of the system running

the script?

A. JavaScript.

B. Java Applets.

C. Signed Applets.

D. ActiveX

Answer: A

Explanation: 

JavaScript is a programming language that allows access to system resources of the

system running the script. These scripts can  interface with all aspects of an operating

system just like programming languages, su ch as the C language. This means that

JavaScript scripts, when executed, can potentially damage systems or be used to send

information to unauthorized persons.

Incorrect answers:

B: A Java applet is a small, self-contained Java script that is downloaded from a server to

a client and then run from the browser. The  client browser must have the ability to run

Java applets in a virtual mach ine on the client. Java applets are used extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development.

C: Signed applets are similar  to Java applets-with one ke y difference. A signed applet

does not run in the Java sandbox, and it has higher system access capabilities. Signed

applets are not usually downloaded from the Internet. This type of applet is usually

provided by in-house or custom-programming efforts. These applets  can also include a

digital signature to verify authenticity. If the applet is verified as authentic, it will be

installed. Users should never download a signed  applet unless they are sure that the

provider is trusted.

D: ActiveX is a technology that was implemented by Microsoft. ActiveX allows

customized controls, icons, and other features to increase the usability of web enabled

systems. ActiveX uses a method called authentic ode for security. Authenticode is a type

of certificate technology that allows ActiveX components to be va lidated by a server.

ActiveX runs on the client.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 235:

Which of the following web vulnerabilities is being referred to when the client

browser must have the ability to run Java  applets in a virtual  machine on the client?

A. JavaScript.

B. Java Applets.

SY0-101 

Actualtests.com - The Power of Knowing

C. Signed Applets.

D. ActiveX

Answer: B

Explanation: 

A Java applet is a small, self-contained Java sc ript that is downloaded from a server to a

client and then run from the browser. The client browser must have the ability to run Java

applets in a virtual machine on the client.  Java applets are used  extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development.

Incorrect answers:

A: JavaScript is a programming language that allows access to system resources of the

system running the script. These scripts can  interface with all aspects of an operating

system just like programming languages, su ch as the C language. This means that

JavaScript scripts, when executed, can potentially damage systems or be used to send

information to unauthorized persons.

C: Signed applets are similar  to Java applets-with one ke y difference. A signed applet

does not run in the Java sandbox, and it has higher system access capabilities. Signed

applets are not usually downloaded from the Internet. This type of applet is usually

provided by in-house or custom-programming efforts. These applets  can also include a

digital signature to verify authenticity. If the applet is verified as authentic, it will be

installed. Users should never download a signed  applet unless they are sure that the

provider is trusted.

D: ActiveX is a technology that was implemented by Microsoft. ActiveX allows

customized controls, icons, and other features to increase the usability of web enabled

systems. ActiveX uses a method called authentic ode for security. Authenticode is a type

of certificate technology that allows ActiveX components to be va lidated by a server.

ActiveX runs on the client.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 236:

Which of the following web vulnerabilities is being referred to when it can also

include a digital signature  to verify authenticity?

A. JavaScript.

B. Java Applets.

C. Signed Applets.

D. ActiveX

Answer: C

Explanation: 

SY0-101 

Actualtests.com - The Power of Knowing

Signed applets are similar to Java applets-with  one key difference. A signed applet does

not run in the Java sandbox, and it has highe r system access capabilities. Signed applets

are not usually downloaded from the Internet. Th is type of applet is  usually provided by

in-house or custom-programming efforts. Th ese applets can also  include a digital

signature to verify authenticity.  If the applet is verified as  authentic, it will be installed.

Users should never download a signed applet unless they are sure that the provider is

trusted.

Incorrect answers:

A: JavaScript is a programming language that allows access to system resources of the

system running the script. These scripts can  interface with all aspects of an operating

system just like programming languages, su ch as the C language. This means that

JavaScript scripts, when executed, can potentially damage systems or be used to send

information to unauthorized persons.

B: A Java applet is a small, self-contained Java script that is downloaded from a server to

a client and then run from the browser. The  client browser must have the ability to run

Java applets in a virtual mach ine on the client. Java applets are used extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development.

D: ActiveX is a technology that was implemented by Microsoft. ActiveX allows

customized controls, icons, and other features to increase the usability of web enabled

systems. ActiveX uses a method called authentic ode for security. Authenticode is a type

of certificate technology that allows ActiveX components to be va lidated by a server.

ActiveX runs on the client.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 237:

Which of the following web vulnerabilities is being referred to when it allows

customized controls, icons, and other feat ures to increase the usability of web

enabled systems?

A. JavaScript.

B. Java Applets.

C. Signed Applets.

D. ActiveX

Answer: D

Explanation: 

ActiveX is a technology that was implemented  by Microsoft. ActiveX allows customized

controls, icons, and other features to increase the usability of web enabled systems.

ActiveX uses a method called authenticode for security. Authenticode is a type of

certificate technology that allows ActiveX components to be validated by a server.

ActiveX runs on the client.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A: JavaScript is a programming language that allows access to system resources of the

system running the script. These scripts can  interface with all aspects of an operating

system just like programming languages, su ch as the C language. This means that

JavaScript scripts, when executed, can potentially damage systems or be used to send

information to unauthorized persons.

B: A Java applet is a small, self-contained Java script that is downloaded from a server to

a client and then run from the browser. The  client browser must have the ability to run

Java applets in a virtual mach ine on the client. Java applets are used extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development.

C: Signed applets are similar  to Java applets-with one ke y difference. A signed applet

does not run in the Java sandbox, and it has higher system access capabilities. Signed

applets are not usually downloaded from the Internet. This type of applet is usually

provided by in-house or custom-programming efforts. These applets  can also include a

digital signature to verify authenticity. If the applet is verified as authentic, it will be

installed. Users should never download a signed  applet unless they are sure that the

provider is trusted.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 238:

Which of the following web vulnerabilities is being referre d to when it receives more

data than it is programmed to accept?

A. Buffer Overflows.

B. Cookies.

C. CGI.

D. SMTP Relay

Answer: A

Explanation: 

Buffer overflows occur when an  application receives more da ta than it is programmed to

accept. This situation can cause an applicati on to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

Incorrect answers:

B: Cookies are text files that a browser maintains on the user's hard disk. A cookie will

typically contain information  about the user. Cookies are us ed to provide a persistent,

customized web experience for each visit. A cookie can contain the history of a client to

improve customer service.

C: Common Gateway Interface (CGI) is an older form of scripting that was used

extensively in early web systems. CGI scripts  could be used to capture data from a user

SY0-101 

Actualtests.com - The Power of Knowing

using simple forms. CGI scripts are not widely used in new systems and are being

replaced by Java, ActiveX, and  other technologies. The CGI script ran on the web server,

and it interacted with the client browser.

D: SMTP relay is a feature designed into many e-mail servers that allows them to

forward e-mail to other e-mail servers. Initia lly, the SMTP relay function was intended to

help bridge between systems. This capability  allows e-mail connections between systems

across the Internet to be made easily. Unfortunately, this feature has been used to

generate a great deal of spam on the Internet.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 239:

Which of the following web vulnerabilities is being referred to when it

is used to provide a persistent, cust omized web experience for each visit?

A. Buffer Overflows.

B. Cookies.

C. CGI.

D. SMTP Relay

Answer: B

Explanation: 

Cookies are text files that a browser maintains on the user's hard disk. A cookie will

typically contain information  about the user. Cookies are us ed to provide a persistent,

customized web experience for each visit. A cookie can contain the history of a client to

improve customer service.

Incorrect answers:

A: Buffer overflows occur when an applicati on receives more data than it is programmed

to accept. This situation can cau se an application to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

C: Common Gateway Interface (CGI) is an older form of scripting that was used

extensively in early web systems. CGI scripts  could be used to capture data from a user

using simple forms. CGI scripts are not widely used in new systems and are being

replaced by Java, ActiveX, and  other technologies. The CGI script ran on the web server,

and it interacted with the client browser.

D: SMTP relay is a feature designed into many e-mail servers that allows them to

forward e-mail to other e-mail servers. Initia lly, the SMTP relay function was intended to

help bridge between systems. This capability  allows e-mail connections between systems

across the Internet to be made easily. Unfortunately, this feature has been used to

generate a great deal of spam on the Internet.

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 240:

Which of the following web vulnerabilities is being referre d to when it's an older

form of scripting that was used  extensively in early web systems?

A. Buffer Overflows.

B. Cookies.

C. CGI.

D. SMTP Relay

Answer: C

Explanation: 

Common Gateway Interface (CGI) is an older form of scripting that was used extensively

in early web systems. CGI scripts could be used to capture data from a user using simple

forms. CGI scripts are not widely used in  new systems and are being replaced by Java,

ActiveX, and other technologies. The CGI script ran on the we b server, and it interacted

with the client browser.

Incorrect answers:

A: Buffer overflows occur when an applicati on receives more data than it is programmed

to accept. This situation can cau se an application to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

B: Cookies are text files that a browser maintains on the user's hard disk. A cookie will

typically contain information  about the user. Cookies are us ed to provide a persistent,

customized web experience for each visit. A cookie can contain the history of a client to

improve customer service.

D: SMTP relay is a feature designed into many e-mail servers that allows them to

forward e-mail to other e-mail servers. Initia lly, the SMTP relay function was intended to

help bridge between systems. This capability  allows e-mail connections between systems

across the Internet to be made easily. Unfortunately, this feature has been used to

generate a great deal of spam on the Internet.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 241:

Which of the following web vulnerabilities is being referre d to when it has a feature

designed into many e-mail servers that allows them to forward e-mail to other

e-mail servers?

A. Buffer Overflows.

SY0-101 

Actualtests.com - The Power of Knowing

B. Cookies.

C. CGI.

D. SMTP Relay

Answer: D

Explanation: 

SMTP relay is a feature designed into many e- mail servers that allows them to forward

e-mail to other e-mail servers. Initially, the SMTP relay function was intended to help

bridge between systems. This capability allows e-mail connections between systems

across the Internet to be made easily. Unfortunately, this feature has been used to

generate a great deal of spam on the Internet.

Incorrect answers:

A: Buffer overflows occur when an applicati on receives more data than it is programmed

to accept. This situation can cau se an application to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system.

B: Cookies are text files that a browser maintains on the user's hard disk. A cookie will

typically contain information  about the user. Cookies are us ed to provide a persistent,

customized web experience for each visit. A cookie can contain the history of a client to

improve customer service.

C: Common Gateway Interface (CGI) is an older form of scripting that was used

extensively in early web systems. CGI scripts  could be used to capture data from a user

using simple forms. CGI scripts are not widely used in new systems and are being

replaced by Java, ActiveX, and  other technologies. The CGI script ran on the web server,

and it interacted with the client browser.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 242:

Which of the following definitions BEST suit JavaScript?

A. It is a programming language that allows access to system resources of the system

running the script

B. The client browser must have the ability to run Java applets in a virtual machine on the

client

C. It can also include a digital signature to verify authenticity

D. It allows customized controls, icons, and  other features to increase the usability of

web enabled systems

Answer: A

Explanation: 

A Java applet is a small, self-contained Java sc ript that is downloaded from a server to a

SY0-101 

Actualtests.com - The Power of Knowing

client and then run from the browser. The client browser must have the ability to run Java

applets in a virtual machine on the client.  Java applets are used  extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development

Incorrect answers:

B: This refers to Java Applet

C: This refers to Signed Applet

D: This refers to ActiveX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 243:

Which of the following definitions BEST suit Java Applet?

A. It is a programming language that allows access to system resources of the system

running the script

B. The client browser must have the ability to run Java applets in a virtual machine on the

client

C. It can also include a digital signature to verify authenticity

D. It allows customized controls, icons, and  other features to increase the usability of

web enabled systems

Answer: B

Explanation: 

A Java applet is a small, self-contained Java sc ript that is downloaded from a server to a

client and then run from the browser. The client browser must have the ability to run Java

applets in a virtual machine on the client.  Java applets are used  extensively in web

servers today, and they are becoming one of  the most popular tools used for website

development.

Incorrect answers:

A: This refers to JavaScript

C: This refers to Signed Applet

D: This refers to ActiveX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 244:

Which of the following definitions BEST suit Singed Applet?

A. It is a programming language that allows access to system resources of the system

running the script

SY0-101 

Actualtests.com - The Power of Knowing

B. The client browser must have the ability to run Java applets in a virtual machine on the

client

C. It can also include a digital signature to verify authenticity

D. It allows customized controls, icons, and  other features to increase the usability of

web enabled systems

Answer: C

Explanation: 

Signed applets are similar to Java applets-with  one key difference. A signed applet does

not run in the Java sandbox, and it has highe r system access capabilities. Signed applets

are not usually downloaded from the Internet. Th is type of applet is  usually provided by

in-house or custom-programming efforts. Th ese applets can also  include a digital

signature to verify authenticity.  If the applet is verified as  authentic, it will be installed.

Users should never download a signed applet unless they are sure that the provider is

trusted.

Incorrect answers:

A: This refers to JavaScript

B: This refers to Java Applet

D: This refers to ActiveX

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 245:

Which of the following definitions BEST suit ActiveX?

A. It is a programming language that allows access to system resources of the system

running the script

B. The client browser must have the ability to run Java applets in a virtual machine on the

client

C. It can also include a digital signature to verify authenticity

D. It allows customized controls, icons, and  other features to increase the usability of

web enabled systems

Answer: D

Explanation: 

ActiveX is a technology that was implemented  by Microsoft. ActiveX allows customized

controls, icons, and other features to increase the usability of web enabled systems.

ActiveX uses a method called authenticode for security. Authenticode is a type of

certificate technology that allows ActiveX components to be validated by a server.

ActiveX runs on the client.

Incorrect answers:

A: This refers to JavaScript

SY0-101 

Actualtests.com - The Power of Knowing

B: This refers to Java Applet

C: This refers to Singed Applet

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 246:

Which of the following definitions BEST suit Buffer Overflow?

A. It receives more data than it is programmed to accept.

B. It is used to provide a persistent, customized web experience for each visit.

C. It's an older form of scripting that  was used extensively in early web systems

D. It has a feature designed into many e-mail servers that allows th em to forward e-mail

to other e-mail servers

Answer: A

Explanation: 

Buffer overflows occur when an  application receives more da ta than it is programmed to

accept. This situation can cause an applicati on to terminate. The termination may leave

the system sending the data with temporary access to privileged levels in the attacked

system

Incorrect answers:

B: This refers to Cookies

C: This refers to CGI

D: This refers to SMTP Relay

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 247:

Which of the following definitions BEST suit Cookies?

A. It receives more data than it is programmed to accept.

B. It is used to provide a persistent, customized web experience for each visit.

C. It's an older form of scripting that  was used extensively in early web systems

D. It has a feature designed into many e-mail servers that allows th em to forward e-mail

to other e-mail servers

Answer: B

Explanation: 

Cookies are text files that a browser maintains on the user's hard disk. A cookie will

typically contain information  about the user. Cookies are us ed to provide a persistent,

SY0-101 

Actualtests.com - The Power of Knowing

customized web experience for each visit. A cookie can contain the history of a client to

improve customer service.

Incorrect answers:

A: This refers to Buffer Overflow

C: This refers to CGI

D: This refers to SMTP Relay

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 248:

Which of the following definitions BEST suit CGI?

A. It receives more data than it is programmed to accept.

B. It is used to provide a persistent, customized web experience for each visit.

C. It's an older form of scripting that  was used extensively in early web systems

D. It has a feature designed into many e-mail servers that allows th em to forward e-mail

to other e-mail servers

Answer: C

Explanation: 

Common Gateway Interface (CGI) is an older form of scripting that was used extensively

in early web systems. CGI scripts could be used to capture data from a user using simple

forms. CGI scripts are not widely used in new systems and are being replaced by Java,

ActiveX, and other technologies. The CGI script ran on the we b server, and it interacted

with the client browser.

Incorrect answers:

A: This refers to Buffer Overflow

B: This refers to Cookies

D: This refers to SMTP Relay

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 249:

Which of the following definitions BEST suit SMTP Relay?

A. It receives more data than it is programmed to accept.

B. It is used to provide a persistent, customized web experience for each visit.

C. It's an older form of scripting that  was used extensively in early web systems

D. It has a feature designed into many e-mail servers that allows th em to forward e-mail

to other e-mail servers

SY0-101 

Actualtests.com - The Power of Knowing

Answer: D

Explanation: 

SMTP relay is a feature designed into many e- mail servers that allows them to forward

e-mail to other e-mail servers. Initially, the SMTP relay function was intended to help

bridge between systems. This capability allows e-mail connections between systems

across the Internet to be made easily. Unfortunately, this feature has been used to

generate a great deal of spam on the Internet.

Incorrect answers:

A: This refers to Buffer Overflow

B: This refers to Cookies

C: This refers to CGI

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 134-135

QUESTION 250:

Which of the following statements are true regarding FTP Connections?

A. FTP is a protocol, a client, and a server.

B. Security was based on the honor system.

C. As discussed earlier, SSH is a program  that allows connections to be secured by

encrypting the session between the client and the server.

D. When files are stored on a  workstation, the connection is referred to as a peer-to-peer

connection.

Answer: A

Explanation: 

FTP has three separate functions. FTP is a pr otocol, a client, and a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

that defines the command structure and inte ractions between the client and server.

Incorrect answers:

B: This refers to Blind FTP/Anonymous

C: This refers to FTP Secure

D: This refers to File Sharing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 251:

Which of the following statements are true regarding Blind FTP/Anonymous?

SY0-101 

Actualtests.com - The Power of Knowing

A. FTP is a protocol, a client, and a server.

B. Security was based on the honor system.

C. As discussed earlier, SSH is a program  that allows connections to be secured by

encrypting the session between the client and the server.

D. When files are stored on a  workstation, the connection is referred to as a peer-to-peer

connection.

Answer: B

Explanation: 

Early FTP servers did not offer security. Security was based on the honor system. Most

logons to an FTP site used the anonymous  logon. By convention, the logon ID was the

user's e-mail address, and the password was anonymous. This honor system is still used

in systems where public access to files is want ed. In this situation, the only security

offered is what is configured by the operating system.

Incorrect answers:

A: This refers to FTP Connections

C: This refers to FTP Secure

D: This refers to File Sharing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 252:

Which of the following statements are true regarding FTP Secure?

A. FTP is a protocol, a client, and a server.

B. Security was based on the honor system.

C. As discussed earlier, SSH is a program  that allows connections to be secured by

encrypting the session between the client and the server.

D. When files are stored on a  workstation, the connection is referred to as a peer-to-peer

connection.

Answer: C

Explanation: 

Secure FTP (S/FTP) is accomplished using a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner.

Incorrect answers:

A: This refers to FTP Connections

B: This refers to Blind FTP/Anonymous

SY0-101 

Actualtests.com - The Power of Knowing

D: This refers to File Sharing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 253:

Which of the following statements are true regarding File Sharing?

A. FTP is a protocol, a client, and a server.

B. Security was based on the honor system.

C. As discussed earlier, SSH is a program  that allows connections to be secured by

encrypting the session between the client and the server.

D. When files are stored on a  workstation, the connection is referred to as a peer-to-peer

connection.

Answer: D

Explanation: 

File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shared  files at the record level.

Incorrect answers:

A: This refers to FTP Connections

B: This refers to Blind FTP/Anonymous

C: This refers to FTP Secure

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 254:

Which one of the following File Transfer Protocol does the statement "FTP is a

protocol, a client, and a server" refer to?

A. FTP Connections

B. Blind FTP/Anonymous

C. FTP Secure

D. File Sharing

Answer: A

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

FTP has three separate functions. FTP is a pr otocol, a client, and a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

that defines the command structure and inte ractions between the client and server.

Incorrect answers:

B : Early FTP servers did not offer security.  Security was based on the honor system. Most

logons to an FTP site used the anonymous  logon. By convention, the logon ID was the

user's e-mail address, and the password was anonymous. This honor system is still used

in systems where public access to files is want ed. In this situation, the only security

offered is what is configured by the operating system

C: Secure FTP (S/FTP) is accomplished using  a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner

D: File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shar ed files at the record level

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 255:

Which one of the following File Transfer Protocol does the statement "Security was

based on the honor system" refer to?

A. FTP Connections

B. Blind FTP/Anonymous

C. FTP Secure

D. File Sharing

Answer: B

Explanation: 

Early FTP servers did not offer security. Security was based on the honor system. Most

logons to an FTP site used the anonymous  logon. By convention, the logon ID was the

user's e-mail address, and the password was anonymous. This honor system is still used

in systems where public access to files is want ed. In this situation, the only security

offered is what is configured by the operating system.

SY0-101 

Actualtests.com - The Power of Knowing

Incorrect answers:

A: FTP has three separate functions. FTP is a protocol, a client, and  a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

that defines the command structure and inte ractions between the client and server

C: Secure FTP (S/FTP) is accomplished using  a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner

D: File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shar ed files at the record level

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 256:

Which one of the following File Transfer Protocol does the statement "As discussed

earlier, SSH is a program that allows c onnections to be secured by encrypting the

session between the client and the server" refer to?

A. FTP Connections

B. Blind FTP/Anonymous

C. FTP Secure

D. File Sharing

Answer: C

Explanation: 

Secure FTP (S/FTP) is accomplished using a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner.

Incorrect answers:

A: FTP has three separate functions. FTP is a protocol, a client, and  a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

SY0-101 

Actualtests.com - The Power of Knowing

that defines the command structure and inte ractions between the client and server

B: Early FTP servers did not offer security. Security was based on the honor system.

Most logons to an FTP site used the anonymous logon. By convention, the logon ID was

the user's e-mail address, and the password was anonymous. This honor system is still

used in systems where public access to files is wanted. In this situ ation, the only security

offered is what is configured by the operating system.

D: File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shar ed files at the record level

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 257:

Which one of the following File Transfer Protocol does the statement "When files

are stored on a workstation, the connec tion is referred to as a peer-to-peer

connection" refer to?

A. FTP Connections

B. Blind FTP/Anonymous

C. FTP Secure

D. File Sharing

Answer: D

Explanation: 

File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shared  files at the record level.

Incorrect answers:

A: FTP has three separate functions. FTP is a protocol, a client, and  a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

that defines the command structure and inte ractions between the client and server

B: Early FTP servers did not offer security. Security was based on the honor system.

Most logons to an FTP site used the anonymous logon. By convention, the logon ID was

SY0-101 

Actualtests.com - The Power of Knowing

the user's e-mail address, and the password was anonymous. This honor system is still

used in systems where public access to files is wanted. In this situ ation, the only security

offered is what is configured by the operating system.

C: Secure FTP (S/FTP) is accomplished using  a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 258:

Which one of the following File Transfer Protocol does the statement "The user ID

and password are not encrypt ed and are subject to packet capture" refer to?

A. FTP Connections

B. Blind FTP/Anonymous

C. FTP Secure

D. Vulnerabilities and Sniffing

Answer: D

Explanation: 

FTP has a major flaw. The user ID and password are not encrypted and are subject to

packet capture. This creates a major security breach-especially if you are connecting to

an FTP server across the Internet.

Incorrect answers:

A: FTP has three separate functions. FTP is a protocol, a client, and  a server. The client

system runs a program called FTP. The server  runs a service called FTP server. The FTP

client and server communicate using the FTP protocol. The client requests a connection

to a server that runs the FTP service. The  client and server communicate using a protocol

that defines the command structure and inte ractions between the client and server

B: Early FTP servers did not offer security. Security was based on the honor system.

Most logons to an FTP site used the anonymous logon. By convention, the logon ID was

the user's e-mail address, and the password was anonymous. This honor system is still

used in systems where public access to files is wanted. In this situ ation, the only security

offered is what is configured by the operating system.

C: Secure FTP (S/FTP) is accomplished using  a protocol called Secure Shell (SSH). As

discussed earlier, SSH is a program that al lows connections to be secured by encrypting

the session between the client and the server. SSH is available for UNIX and other

systems that provide similar cap abilities to FTP. SSH is a t ype of tunneling protocol that

allows access to remote systems in a secure manner

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 259:

You work as the security administrator at  Certkiller .com. You have been instructed

to perform the configuration which will allow only HTTP (Hypertext Transfer

Protocol) traffic for outbound Internet connections. In addition to this requirement,

only specific users must have permissions to browse the web.

Which solution should you use to enforce your requirements?

A. Implement a packet filtering firewall.

B. Implement a protocol analyzer.

C. Implement a proxy server.

D. Implement a stateful firewall.

Answer: C

Explanation: 

A proxy server is a type of se rver that makes a single Internet connection and services

requests on behalf of many users. It is a serv er that is situated between a client and a

server; that intercessors requests. Proxy servers are used for two reasons;

* To filter requests, so a strict parent or company can prevent their kids or employees

from viewing the wrong sties.

* The increase performance, so multiple users accessing the same information (like a

school, or a library,) can fetch comm on information from the proxy server.

Incorrect answers:

A: A proxy server would be more suited to the needs of the company.

B: A protocol analyzer is not used to set permissions to  allow only certain users access to

browse the web.

D: A stateful firewall not only examine pack ets at the Network layer, but also gather

information about the packet's communicati ons session from all layers to determine

whether a packet is valid in the context in whic h it is received. But this is all proxy-able.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 463

QUESTION 260:

You work as the security administrator at Certkiller .com. While monitoring e-mail

traffic, you discover that your e-mail se rver is currently relaying e-mail for

whichever e-mail server is requesting relaying. You find that this includes spam.

Upon some in-depth investigation, you find the existence of /etc/mail/relay domains.

You want to configure the relay domains file so as to prevent relaying for

non-explicitly named domains.

What should you do next?

SY0-101 

Actualtests.com - The Power of Knowing

A. Move the .* entry to the end of the relay domains file.

Restart the e-mail system.

B. Move the .* entry to the st art of the relay domains file.

Restart the e-mail system.

C. Delete the .* entry in the relay domains file.

Restart the e-mail system.

D. Delete the relay domains file from the /etc/mail folder.

Restart the e-mail system.

Answer: C

Explanation: 

The symbol: *.* is known as a wild card mask, and just like in poker when a file matches

a wild card anything goes. By deleting the wild card, it prevents ANY email server

(including the SPAM servers) from relaying information.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 129-130

QUESTION 261:

One of these options best defines the main purpose of implementing an e-mail relay

server. Which is it?

A. An e-mail relay server is used to block  all spam. This results in the e-mail system

functioning more efficiently, and wit hout the additional load of spam.

B. An e-mail relay server is used to prevent inward bound viruses.

C. An e-mail relay server is used to protect the primary e-mail server and therefore

assists in reducing the effects of  viruses and port scan attacks.

D. An e-mail relay server is used to eliminate e-mail vulnerabilities, simply because all

e-mail moves through the relay server first.

Answer: C

Explanation: 

An email relay will essentially make your mail server invisible to the internet, so you can

protect yourself from port scans, viruses, and arbitrary access.

Incorrect answers:

A: This is but one function of how it can be used.

B: This will not prevent viruses from entering the network.

D: It cannot eliminate vulnerabilities.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 129-130

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 262:

Choose the primary reason why you should configure your e-mail server to prevent

e-mail relay.

A. Can result in untraceable, unwanted, unsolicited e-mail messages being sent.

B. Can result in an attacker gaining access to  the server and eventually controlling the

server.

C. Can result in confidential information in the e-mail boxes hosted on the server being

read by using the relay.

D. Can result in an attacker using the open relay to gain control of nodes on other

networks.

Answer: A

Explanation: 

If someone can find a way to relay ema il through the relay server, they can send

thousands of unsolicited emails a day without  the recipients having  a way to pinpoint the

source.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 129-130

QUESTION 263:

An attacker can use a specific method to exploit the clear-text attribute of

Instant-Messaging sessions. Which is it?

A. Packet sniffing.

B. Port scanning.

C. Cryptanalysis.

D. Reverse engineering.

Answer: A

Explanation: 

Since only clear unencrypted text is bei ng sent across the world through multitudes of

WAN equipment and routerss,it is easy for someone to sniff your conversation and

eavesdrop on every single word you type.

Incorrect answers:

B: Port scanning is when an attacker can systematically query your  network to determine

which services and ports are open.

C: This is the study and practice of finding weaknesses in ciphers.

D: Reverse engineering is the process of re-creating the functionality of an item by first

deciding what the result is and then creating something from sc ratch that serves the same

purpose.

SY0-101 

Actualtests.com - The Power of Knowing

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, pp. 183-184

QUESTION 264:

You work as a security administrator at Certkiller .com. The Ce rtkiller .com network

must be configured to support e-mail communication using SMTP (Simple Mail

Transfer Protocol).

Which ports must you open on the firewall to support SMTP connections?

A. Open TCP (Transmission Control  Protocol) port 110 to inbound and outbound

connections.

B. Open UDP (User Datagram Protocol) port 110 to inbound connections.

C. Open UDP (User Datagram Protocol) port 25 to inbound connections.

D. Open TCP (Transmission Control Pr otocol) port 25 to inbound and outbound

connections.

Answer: D

Explanation: 

TCP port 25 is reserved for SMTP  while port 110 is for POP3.

Incorrect answers:

A, B, C: SMTP is a protocol for sending e-mail between SMTP servers. Whereas POP3

is the protocol used to download e-mail from an SMTP e-mail server to a network client.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 64

QUESTION 265:

During the SSL (Secure Sockets Layer) handshake process between a client and

server, a specific number of steps are use d. Choose the option that correctly defines

the number of steps used.

A. Five steps

B. Six steps

C. Seven steps

D. Eight steps

Answer: B

Explanation: 

SSL establishes a stateful connection negotiated by a handshaking procedure between

client and server. During this handshake, the client and server exch ange the specifications

for the cipher that will be used for that se ssion. 1. The handshake begins when a browser

SY0-101 

Actualtests.com - The Power of Knowing

connects to an SSL-enabled server, and asks th e (2) server to send back its identification,

a digital certificate that usually contains th e server name, the trusted certifying authority,

and the server public encryption key. The brow ser can contact the se rver of the trusted

certifying authority and confirm that the certificate is authentic before proceeding.

The browser then presents a list of encryption algorithms and hashing functions (used to

generate a number from another);(3) the server picks the strongest encryption that it also

supports and notifies the client of the decision.

In order to generate the session keys used fo r the secure connection, the browser uses the

server public key from the certificate to encrypt a random number and send it to the

server. (4) The client can encrypt this data, but  only the server can decrypt it: this is the

one fact that makes the keys hidden from third  parties, since only the server and the client

have access to this data.

(5) The server replies with more random data  (which doesn't have to be encrypted), and

(6) then both parties use the selected hash  functions on the random data to generate the

session keys. This concludes the handshake and begins the secured  connection, which is

encrypted and decrypted with the session keys.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 4

QUESTION 266:

From the options below, which represents the first action performed by an SSL

(Secure Sockets Layer) enabled server when a user clicks to browse a secure page?

A. The server uses its digital certificate to identify itself to the browser.

B. The server validates the user by checking the CRL (Certificat e Revocation List).

C. The server requests the user to pro duce the CRL (Certificate Revocation List).

D. The server displays the page requested by the user on the browser,  and then provides

its IP (Internet Protocol) a ddress for verification purposes.

Answer: A

Explanation: 

The Secure Socket Layer is used to establish a secure communication connection

between two TCP-based machines. This prot ocol uses the handshake method. When a

connection request is made to the server, the server sends a message back to the client

indicating a secure connection is needed. The  client then sends the server a certificate

indicating the capabilities of  the client. The server then  evaluates the certificate and

responds with a session key and an encrypted private key. The session is  secure after this

process.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 365

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 267:

Choose the type of encryption used by SSL (Secure Sockets Layer).

A. Asymmetric key exchange.

B. Symmetric key exchange.

C. Public keys.

D. Secret encryption.

Answer: B

Explanation: 

The Secure Sockets Layer (SSL) protocol  uses both asymmetric and symmetric key

exchange. It uses asymmetric keys for  the SSL handshake. During the handshake,

the master key is encrypted with the recei vers public passes from the client to the

server. The client and server make their own session keys using the master key. The

session keys encrypt and decr ypt data for the remainder of the session. Symmetric

key exchange occurs during the exchange  of the cipher specification, or encryption

level.

Incorrect answers:

A: SSL makes use of symmetric key exchange not asymmetric keys.

C: Public keys are not necessarily symmetric and neither is it used in SSL.

D: Secret encryption does not  mean symmetric key exchange which is used by SSL.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 4

QUESTION 268:

SSL (Secure Socket Layer) establishes a stateful connection negotiated by a process

performed between client and server.

Identify the protocol (steps)  that allow for the following:

1. Client and server  authentication.

2. MAC (Mandatory Access Control) a nd encryption algorithm negotiation.

3. Selection of cryptographic keys.

A. SSL (Secure Sockets Layer) alert protocol.

B. SSL (Secure Sockets Layer)  change cipher spec protocol.

C. SSL (Secure Sockets Layer) record protocol.

D. SSL (Secure Sockets Layer) handshake protocol.

Answer: D

Explanation: 

SSL Handshake Protocol

* runs before any application data is transmitted

SY0-101 

Actualtests.com - The Power of Knowing

* provides mutual authentication

* establishes secret encryption keys

* establishes secret MAC keys

Incorrect answers:

A: Handshake protocol occurs before alert protocol.

B: The change cipher spec protocol only occurs after the application protocol.

C: Record protocol encompasses the handshake, alert and change cipher spec protocols

in SSL.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 4

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 178

QUESTION 269:

One of these protocols is used to encrypt traffic passed between a web browser and

web server. Which is it?

A. IPSec (Internet Protocol Security)

B. HTTP (Hypertext Transfer Protocol)

C. SSL (Secure Sockets Layer)

D. VPN (Virtual Private Network)

Answer: C

Explanation: 

The Secure Sockets Layer (SSL) is used to establish a secure  communication connection

between two TCP-based machines.

Incorrect answers:

A: IP Security (IPSec) is a security protoc ol that provides authentication and encryption

across the Internet.

B: HTTP is the protocol used for comm unication between a web server and a web

browser. Communication is not encryption.

D: A VPN is a system that uses the pub lic Internet as a backbone for a private

interconnection (network) between locations.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 365

QUESTION 270:

Choose the protocol used by a web server to encrypt data.

A. TCP/IP (Transmission Control Protocol/Internet Protocol)

B. ActiveX

SY0-101 

Actualtests.com - The Power of Knowing

C. IPSec (Internet Protocol Security)

D. SSL (Secure Sockets Layer)

Answer: D

Explanation: 

The Secure Socket Layer is used to establish a secure communication connection

between two TCP-based machines. This prot ocol uses the handshake method. When a

connection request is made to the server, the server sends a message back to the client

indicating a secure connection is needed. The  client then sends the server a certificate

indicating the capabilities of  the client. The server then  evaluates the certificate and

responds with a session key and an encrypted private key. The session is  secure after this

process.

Incorrect answers:

A: TCP/IP) is the protocol suite developed by the DoD in conjunction with the Internet.

It was designed as an internetworking protoc ol suite that could route information around

network failures.

B: ActiveX is a technology implemented by Microsoft that allows customized controls,

icons, and other features to increase th e usability of web-enabled systems.

C: IP Security (IPSec) is a security protoc ol that provides authentication and encryption

across the Internet.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 365

QUESTION 271:

The SSL (Secure Sockets Layer) protocol  offers session keys in two lengths or

strengths. Which is it? Choose two correct answers.

A. 40-bit

B. 64-bit.

C. 128-bit.

D. 1,024-bit.

Answer:  A. C

Explanation: 

SSL comes in two strengths, 40-bit and 128-bit, which refer to the length of the "session

key" generated by every encrypted transacti on. The longer the key, the more difficult it is

to break the encryption code.

Reference:

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 4

http://wp.netscape.com/security/techbriefs/ssl.html

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 272:

From the list of protocols, which is used to secure web transactions?

A. S/MIME (Secure Multipurpose Internet Mail Extensions)

B. XML (Extensible Makeup Language)

C. SSL (Secure Sockets Layer)

D. SMTP (Simple Mail Transfer Protocol)

Answer: C

Explanation: 

The Secure Socket Layer is used to establish a secure communication connection

between two TCP-based machines. This prot ocol uses the handshake method. When a

connection request is made to the server, the server sends a message back to the client

indicating a secure connection is needed. The  client then sends the server a certificate

indicating the capabilities of  the client. The server then  evaluates the certificate and

responds with a session key and an encrypted private key. The session is  secure after this

process.

Incorrect answers:

A: Secure Multipurpose Internet Mail Extensions (S/MIME) is a standard used for

encrypting e-mail.

B : XML can be used to generate standard or  fully customized content rich Web pages,

documents, and applications. XML is used to provide widely accessible services and data

to end users, exchange data among applications, and capture and repres ent data in a large

variety of custom and standard formats.

D: SMTP is a protocol for sending e-mail between SMTP servers.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 365

QUESTION 273:

One of the following options details the main advantage of why you should choose to

use SSL (Secure Sockets Layer) over using HTTPS (Hypertext Transfer Protocol

over Secure Sockets Layer). Which is it?

A. SSL provides full application security for HTTP whereas HTTPS does not.

B. SSL supports additional Application laye r protocols, for instance FTP (File Transfer

Protocol) and NNTP (Network News Transport Protocol), whereas HTTPS does not.

C. SSL and HTTPS are transparent to the application.

D. SSL supports user authentication whereas HTTPS does not.

Answer: B

Explanation: 

SY0-101 

Actualtests.com - The Power of Knowing

SSL on its own works at the session layer (layer 5) so it has more versatility in protocols

that it supports.

Incorrect answers:

A: This is not the main advantage.

C: This is not an advantage when both have the same capability.

D: This is an advantage, but not the main difference and advantage between SSL and

HTTPS.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

QUESTION 274:

For a SSL (Secure Sockets Layer) connec tion to be automatically established

between a web client and server, a specifi c element has to exist. Which is it?

A. Shared password.

B. Certificate signed by a trusted root CA (Certificate Authority).

C. Address on the same subnet.

D. Common operating system.

Answer: B

Explanation: 

For an SSL connection to compete, the web  client and server should have a trusted

certificate to confirm authenticity.

A shared password, address on the same s ubnet, and a common operating system are

ludicrous answers because they defy the reason why SSL exists.

Incorrect answers:

A: A shared password is not the way in which SSL allows a secure connection to be

established.

C: An address on the same subnet does not necessarily mean an automatic connection.

D: A common operating system does not automatically mean a connection.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

QUESTION 275:

SSLv3.0 (Secure Sockets Layer version 3.0) in troduces a specific new capability with

regard to security. Which is it?

A. The capability to act as  a CA (Certificate Authority).

B. The capability to force client side au thentication by using di gital certificates.

C. The capability to use X.400 certificates.

D. The capability to protect data in tr ansit by using 1024-bit symmetric encryption.

SY0-101 

Actualtests.com - The Power of Knowing

Answer: B

Explanation: 

There are three versions  of SSL out right now: SSL v.2, SSL v.3, and TLSv1 which is

still going through standardization. SSL v.2 ensu res encrypted data between client and

serer. The server can authenticate the client,  and the client can option to authenticate the

server. SSL v.3 was enhanced for security a nd efficiency. It includes data compression,

the ability of either the client or server  requesting a renegotiati on of the ciphers and

shared key at any moment, and  the use of certificate chains.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

QUESTION 276:

You work as a security administrator at Certkiller .com. The Ce rtkiller .com network

must be configured to support SSL (Secure Sockets Layer).

Which ports must you open on the firewall to support SSL connections?

A. Open UDP (User Datagram Protocol ) Transport layer protocol and port 80

B. Open TCP (Transmission Control Protocol) Transport layer protocol and port 80

C. Open TCP (Transmission Control Protocol) Transport layer protocol and port 443

D. Open UDP (User Datagram Protocol ) Transport layer protocol and port 69

Answer: C

Explanation: 

Secure Sockets Layer is secu re, so it would be natural to  assume that it uses the

connection orientated TCP instead of UD P. Secondly, TCP port 80 is HTTP, which

stands for (hyper text transfer protocol) TCP port 443 is HTTPS which stands for hyper

text transfer protocol over secure socket layer'

Incorrect answers:

A: UDP port 80 is meant for HTTP.

B: TCP port 80 is used for HTTP without the secure socket layer.

D: UDP port 69 is used for TFTP.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 2

QUESTION 277:

Choose the protocol or method that enable s secure access to a web page, no matter

what the browser type or vendor is.

SY0-101 

Actualtests.com - The Power of Knowing

A. Certificates with SSL (Secure Sockets Layer).

B. Integrated web with NOS (Network Operating System) security.

C. SSL (Secure Sockets Layer).

D. None of the above.

Answer: A

Explanation: 

Regardless of whether or not you use Netscape Navigator or Microsoft Internet Explorer,

if you come across a page with a security  certificate and an SSL connection (most likely

for banking, investments, or purchas es) you will have secure access.

Incorrect answers:

B: Integrated web with NOS security do not guarantee secure access.

C: SSL only would be browser or vendor specific.

D: This is irrelevant.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

QUESTION 278:

The SSL (Secure Sockets Layer) protocol  operates between specific layers of the

OSI (Open Systems Interconnection) reference model. Which is it? Choose all

correct answers.

A. Application Layer.

B. Transport Layer

C. Network Layer

D. Data Link Layer

E. Physical Layer

Answer: A, B

Explanation: 

SSL is associated with secure transactions (credit card purchas es and online banking)

over your web browser, so naturally it operates between the top two layers of the OSI

model. SSL is a protocol that secures messages by operating between the Application

layer (HTTP) and the Transport layer.

Incorrect answers:

C, D and E: The OSI model and SSL operate s between the application layer and the

transport layer not the Network, Data Link or Physical layers.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 128

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 279:

When compared to other messaging systems, which characteristic makes Instant

Messaging particularly insecure?

A. The Instant Messaging messaging system is  a peer-to-peer network that provides most

organizations with practically no control over it.

B. Nearly all Instant Messaging clients are actually Trojan Horses.

C. The Instant Messaging messaging system is  a centrally managed system that can be

closely monitored.

D. Instant Messaging uses the insecure Internet as a transmission medium.

Answer: A

Explanation: 

Answer: A seems to be the most correct of these answer.

Instant messaging is a form of immediate e- mail that takes place between two or more

users. IM clients are often prone to hostile code (usually in the form of file transfers) and

subject to social engineeri ng attacks, wherein a hacker  plays upon the culpability of a

user to get what they need.

Incorrect answers:

B: Is incorrect because IM client are not Trojan Horses, but they can be compromised by

Trojan Horses.

C: Is incorrect because the answer would make IM secure.

D: All IM messaging system that transver se the Internet uses it as a medium.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 21

QUESTION 280:

Choose the option that correctly  details the greatest vulnerability of using Instant

Messaging clients.

A. Results in theft of root user credentials.

B. Results in disconnection from the file server.

C. Results in malicious code being delivered by file transfer.

D. Results in slow Internet connections.

E. Results in loss of email privileges.

F. Results in Blue Screen of Death errors.

Answer: C

Explanation: 

Instant Messaging (IM) enables users to communicate in real-time using text messages

SY0-101 

Actualtests.com - The Power of Knowing

and to exchange files (pictures, music, and so on) with one another.  Thus IM clients can

also be compromised by malicious code, Trojan Horse programs, and traditional DoS

attacks. IM clients are often prone to hostile code (usually in the form of file transfers)

and subject to social engineering attacks, wh erein a hacker plays upon the culpability of a

user to get what they need.

Incorrect answers:

A: This is a result of spoofing.

B: This could result from a buffer overflow attack.

D: Slow internet connection could  be ping of death attack results.

E: Loss of e-mail privileges is dependent on company policy.

F: Blue screen of Death errors is the result of a Winnuke attack.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 21

QUESTION 281:

Choose the option that correctly  details the greatest flaw  associated with an Instant

Messaging messaging system.

A. Instant messaging is widely deployed a nd is therefore difficult to control and

administer.

B. Instant messaging was created without consideration to security.

C. Instant messaging can easily be spoofed.

D. Instant messaging is created with file sharing enabled.

Answer: B

Explanation: 

Instant messaging was created for speed and si mplicity. They wanted a program that was

feature rich, but not memory intensive so mo re people could be online more often. Since

the text is unencrypted, it's very easy for  someone to eavesdrop on a message, hijack the

conversation and send a virus that's disguised as an innocent graphic file.

Incorrect answers:

A: Other real time communication was designe d with security in mind as well and is

probable just as widely used.

C: A spoofing attack is an attempt by someone or something to masquerade as someone

else. But in Instant Messaging this is not neces sarily an attack. It could also be a safety

measure.

D: Messaging is not necessarily file sharing.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 21

QUESTION 282:

SY0-101 

Actualtests.com - The Power of Knowing

Choose the attack that Instant Messaging is most vulnerable to.

A. DoS (Denial of Service) attacks.

B. Fraud attacks.

C. Stability.

D. Sniffing attacks.

Answer: D

Explanation: 

Since instant messenger conversations are sent  unencrypted (in clear-text) it's very easy

for someone to use a sniffer on the line to eavesdrop on the entire conversation.

Incorrect answers:

A: DoS attacks are the result of flood attacks.

B: Fraud attacks do not usually  result from Instant Messaging.

C: Stability? This is irrelevant in this case.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 21

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 2

QUESTION 283:

Choose the privileges used to  execute ActiveX control.

A. Current user account

B. Administrator account

C. Guest account

D. System account

Answer: A

Explanation: 

When you are online and you execute an ActiveX control;the only thi ng that can control

it, are the individual user settings of the current user.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 128

QUESTION 284:

Choose the function that is  responsible for displaying an install dialog box for an

ActiveX component

A. Browser setting of the user.

SY0-101 

Actualtests.com - The Power of Knowing

B. <script> meta tag.

C. Condition of the sandbox.

D. Negotiation between the client and the server.

Answer: A

Explanation: 

ActiveX components are downloaded to the  client hard disk, potentially allowing

additional security breaches. Web browsers  can be configured so that they require

confirmation to accept an ActiveX control.

Incorrect answers:

B: This is not how ActiveX dialog boxes are installed.

C: The sandbox is a set of rules used when creating a Java applet that prevents certain

functions when the applet is sent as part of a web page. This is not responsible for

installing dialog boxes.

D: Negotiation between client and server is not how ActiveX dialog boxes are installed.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 135

QUESTION 285:

From the options, which is used to prove  where ActiveX controls originated from?

A. Encryption.

B. The location of ActiveX controls on the Web server.

C. SSL (Secure Sockets Layer) protocol.

D. Digital signatures.

Answer: D

Explanation: 

ActiveX controls are digitally signed with  an Authenticode signature, verified by a

Certificate Authority. The controls are restricted by that signature  only, not by the web

browser settings.

Incorrect answers:

A: Encryption does not reveal origin.

B: Location of ActiveX controls on the Web se rver will not reveal where the controls

originated from.

C: SSL is a protocol that secures message s by operating between the Application layer

(HTTP) and the Transport layer.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 128,135

Todd Bill, The Security+ Training Guide, Que Publishing, Indianapolis, 2003, Part 1,

Chapter 2

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 286:

Which scenario or element would typically cause a CGI (Common Gateway

Interface) security issue?

A. The HTTP (Hypertext Transfer Protocol) protocol.

B. The compiler or interpreter which runs the CGI script.

C. The web browser.

D. The external data provided by the user.

Answer: D

Explanation: 

Common Gateway Interface is an older form of scripting that was used extensively in

early web systems. CGI scripts could be used to capture data from a user using simple

forms. The CGI script ran on the web server, and it interacted with the client browser.

CGI is a doubtful choice in new applications because of its security issues, but it still

widely used in older systems.

Although the answer is not give n in the paragraph from the book, the answer would be D.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 136

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 5

QUESTION 287:

You work as a network administrator at Certkiller .com. The Ce rtkiller .com network

contains a web server with CGI (C ommon Gateway Interface) scripts.

You want to configure permissions for the directories for public view.

Which permissions should you set?

A. Read permissions.

B. Execute permissions.

C. Read and Write permissions.

D. Read, Write, and Execute permissions.

E. Full Control permissions.

Answer: B

Explanation: 

Common Gateway Interface is an older form of scripting that was used extensively in

early web systems. CGI scripts could be used to capture data from a user using simple

forms. The CGI script ran on the web server, and it interacted with the client browser.

CGI is frowned upon in new applications because of its security issues, but it still widely

SY0-101 

Actualtests.com - The Power of Knowing

used in older systems.

Incorrect answers:

A, C& D: CGI scripts are executed on the se rver and as such should have the execute

permission in directories for public view.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, pp. 136, 217

Kirk Hausman, Diane Barrett, Martin Weiss,  Security+ Exam Cram 2 (Exam SYO-101),

Que Publishing, Indianapolis, 2003, Chapter 5 

QUESTION 288:

Which of the following Directory Services does the statement that it is a

standardized directory access pr otocol that allows queries to be made of directories

refer to?

A. LDAP

B. Active Directory

C. X.500

D. eDirectory

Answer: A

Explanation: 

LDAP Lightweight Directory Access Protocols (LDAP) is a standardized directory

access protocol that allows queries to be made  of directories (specifically, a pared down

X.500-based directory). If a directory service supports LDAP, you can query that

directory with an LDAP client, but it is the protocol. LDAP  is growing in popularity and

is being used extensively in  online white and yellow pages.

Incorrect answers:

B: Active Directory Microsoft implemented  a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

C: The X.500 standard was implemented by the International Teleco mmunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

D: eDirectory is the backbone  for Novell networks. eDirectory stores information on all

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

SY0-101 

Actualtests.com - The Power of Knowing

wide acceptance in the community.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 289:

Which of the following Directory Services does the statement that it is the backbone

for all security, access, and network imple mentations from here on out refer to?

A. LDAP

B. Active Directory

C. X.500

D. eDirectory

Answer: B

Explanation: 

Active Directory Microsoft implemented a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

Incorrect answers:

A: LDAP Lightweight Directory Access Protocols (LDAP) is a standardized directory

access protocol that allows queries to be made  of directories (specifically, a pared down

X.500-based directory). If a directory service supports LDAP, you can query that

directory with an LDAP client, but it is the protocol. LDAP  is growing in popularity and

is being used extensively in  online white and yellow pages.

C: The X.500 standard was implemented by the International Teleco mmunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

D: eDirectory is the backbone  for Novell networks. eDirectory stores information on all

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

wide acceptance in the community.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 290:

Which of the following Directory Services does the statement that it was

implemented by the International Tel ecommunications Union (ITU) refer to?

A. LDAP

B. Active Directory

C. X.500

D. eDirectory

Answer: C

Explanation: 

The X.500 standard was implemented by the International Telecommunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

Incorrect answers:

A: LDAP Lightweight Directory Access Protocols (LDAP) is a standardized directory

access protocol that allows queries to be made  of directories (specifically, a pared down

X.500-based directory). If a directory service supports LDAP, you can query that

directory with an LDAP client, but it is the protocol. LDAP  is growing in popularity and

is being used extensively in  online white and yellow pages.

B: Active Directory Microsoft implemented  a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

D: eDirectory is the backbone  for Novell networks. eDirectory stores information on all

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

wide acceptance in the community.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 291:

Which of the following Directory Services does the statement that it stores

information on all system resources, user s, and any other relevant information

about systems attached to a NetWare server refer to?

SY0-101 

Actualtests.com - The Power of Knowing

A. LDAP

B. Active Directory

C. X.500

D. eDirectory

Answer: D

Explanation: 

eDirectory is the backbone for Novell networks. eDirectory stores information on all

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

wide acceptance in the community.

Incorrect answers:

A: LDAP Lightweight Directory Access Protocols (LDAP) is a standardized directory

access protocol that allows queries to be made  of directories (specifically, a pared down

X.500-based directory). If a directory service supports LDAP, you can query that

directory with an LDAP client, but it is the protocol. LDAP  is growing in popularity and

is being used extensively in  online white and yellow pages.

B: Active Directory Microsoft implemented  a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

C: The X.500 standard was implemented by the International Teleco mmunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

Reference:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 292:

Which of the following definitions refers to LDAP?

A. It is a standardized directory access protocol that allows queries to be made of

directories.

B. It is the backbone for all security, access, and network implementations from here on

out.

C. It was implemented by the Interna tional Telecommunications Union (ITU).

D. It stores information on all system resources, users, and any other relevant information

about systems attached to a NetWare server.

SY0-101 

Actualtests.com - The Power of Knowing

Answer: A

Explanation: 

LDAP Lightweight Directory Access Protocols (LDAP) is a standardized directory

access protocol that allows queries to be made  of directories (specifically, a pared down

X.500-based directory). If a directory service supports LDAP, you can query that

directory with an LDAP client, but it is the protocol. LDAP  is growing in popularity and

is being used extensively in  online white and yellow pages.

Incorrect answers:

B: This refers to Active Directory

C: This refers to eDirectory

D: This refers to X.500

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 293:

Which of the following definitions refers to Active Directory?

A. It is a standardized directory access protocol that allows queries to be made of

directories.

B. It is the backbone for all security, access, and network implementations from here on

out.

C. It was implemented by the Interna tional Telecommunications Union (ITU).

D. It stores information on all system resources, users, and any other relevant information

about systems attached to a NetWare server.

Answer: B

Explanation: 

Active Directory Microsoft implemented a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

Incorrect answers:

A: This refers to LDAP

C: This refers to eDirectory

D: This refers to X.500

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 294:

Which of the following definitions refers to X.500?

A. It is a standardized directory access protocol that allows queries to be made of

directories.

B. It is the backbone for all security, access, and network implementations from here on

out.

C. It was implemented by the Interna tional Telecommunications Union (ITU).

D. It stores information on all system resources, users, and any other relevant information

about systems attached to a NetWare server.

Answer: C

Explanation: 

The X.500 standard was implemented by the International Telecommunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

Incorrect answers:

A: This refers to LDAP

B: This refers to Active Directory

D: This refers to eDirectory

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 295:

Which of the following definitions refers to eDirectory?

A. It is a standardized directory access protocol that allows queries to be made of

directories.

B. It is the backbone for all security, access, and network implementations from here on

out.

C. It was implemented by the Interna tional Telecommunications Union (ITU).

D. It stores information on all system resources, users, and any other relevant information

about systems attached to a NetWare server.

Answer: D

Explanation: 

eDirectory is the backbone for Novell networks. eDirectory stores information on all

SY0-101 

Actualtests.com - The Power of Knowing

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

wide acceptance in the community.

Incorrect answers:

A: This refers to LDAP

B: This refers to Active Directory

C: This refers to X.500

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 296:

Which of the following Directory Services does the statement that it can identify an

individual computer system on the Internet refer to?

A. DNS

B. Active Directory

C. X.500

D. eDirectory

Answer: A

Explanation: 

DNS is one of the most popular directory services in use today. DNS can identify an

individual computer system on the Internet. DNS, as you may recall, maps IP addresses

to domain names and to individual systems..

Incorrect answers:

B: Active Directory Microsoft implemented  a directory service called Active Directory

(AD) with Windows 2000. For Microsoft produc ts, AD is the backbone for all security,

access, and network implementations from here on out. AD allows full control of

resources by administrators. It is a proprietary  directory service that  provides services for

other directory services, such as LDAP. AD functions are managed by one or more

servers. These servers are connected in a tree structure that allows information to be

shared or controlled thro ugh the entire AD structure.

C: The X.500 standard was implemented by the International Teleco mmunications Union

(ITU), an international standa rds group, for directory servic es in the late 1980s. The

X.500 directory structure was the basis for later models of directory  structure, such as

LDAP. The major problem in the industry in  implementing a full-blown X.500 structure

revolved around the complexity of the impl ementation. Novell was one of the first

manufacturers to implement X.500 in its NetWare NDS product.

D: eDirectory is the backbone  for Novell networks. eDirectory stores information on all

system resources, users, and any other relevant information about systems attached to a

NetWare server. eDirectory is an upgrade  and replacement for NDS, and it has gained

wide acceptance in the community.

Reference:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 297:

Which of the following definitions refers to DNS?

A. It is a standardized directory access protocol that allows queries to be made of

directories.

B. It is the backbone for all security, access, and network implementations from here on

out.

C. It was implemented by the Interna tional Telecommunications Union (ITU).

D. It can identify an individual computer system on the Internet.

Answer: D

Explanation: 

DNS is one of the most popular directory services in use today. DNS can identify an

individual computer system on the Internet. DNS, as you may recall, maps IP addresses

to domain names and to individual systems.

Incorrect answers:

A: This refers to LDAP

B: This refers to Active Directory

C: This refers to X.500

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 243.

QUESTION 298:

Choose the mechanism (standard) that is similar to SSLv3 (Secure Sockets Layer

version 3).

A. TLS (Transport Layer Security).

B. MPLS (Multi-Protocol Label Switching).

C. SASL (Simple Authentication and Security Layer).

D. MLS (Multi-Layer Switching).

Answer: A

Explanation: 

Transport Layer Security is an end-to-end encr yption protocol that is similar to and based

on SSL version 3.0 except it uses stronger encryp tion, and not entirely in teroperable. It is

specified in ISO 10736 as part of the transport layer in a protocol stack;defined in RFC

2246.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

B: MPLS (Multi-Protocol Label Switching) is not similar to SSLv3.

C: Strong authentication over LDAP v3 is provided through Simple Authentication and

Security Layer (SASL) communications defi ned in RFC 2222. This is not similar to

SSLv3

D: Multi-Layer Switching is not the same as SSLv3.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 8, Lesson 2

QUESTION 299:

You work as the security administrator  at Certkiller .com. The Certkiller .com

network must be configured to allow LDAP (Lightweight Directory Access

Protocol) traffic.

Which ports must you open on the firewall to allow LDAP traffic?

A. Open ports 389 and 636

B. Open ports 389 and 139

C. Open ports 636 and 137

D. Open ports 137 and 139

Answer: A

Explanation: 

The 'well known' LDAP ports are 38 9 for LDAP and 636 for LDAP SSL.

Incorrect answers:

B: Port 139 is the NetBIOS session service port.

C: NetBIOS services occurs via ports 137, 138, and 139

D: Port 139 is the NetBIOS session service port.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p. 64

http://www.iana.org/assignments/port-numbers

QUESTION 300:

Choose the terminology that correctly refers to the start (top) of a LDAP

(Lightweight Directory Access Protocol) directory.

A. Head

B. Root

C. Top

D. Tree

Answer: B

SY0-101 

Actualtests.com - The Power of Knowing

Explanation: 

LDAP directories are arranged as trees. The top of the hierarchy is called the LDAP

root. Below the topmost 'root' node, country in formation appears, followed by entries for

companies, states or national organizations.  Next comes entries for organizational units,

such as branch offices and departments. Finally we locate individuals, which in X.500

and LDAP include people, shared resources  such as printers, and documents. An LDAP

directory server thus makes it possible for a corporate user to find the information

resources she needs anywhere on the enterprise network.

Incorrect answers:

A: The top of the hierarchy is called the root and not the head.

C: This top is known as the root.

D: The whole directory is arranged as trees. And the top is called the root.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 8, Lesson 2

http://www.intranetjournal.com/foundation/ldap.shtml

QUESTION 301:

Choose the terminology that correctly refers to the way in which the LDAP

(Lightweight Directory Access Protocol) directory is structured.

A. As linked lists.

B. As trees.

C. As stacks.

D. As queues.

Answer: B

Explanation: 

Directories are displayed best as directory trees, so natura lly LDAP uses trees. LDAP is

based from an object-orientated access model built to directory enabled networking

(DEN) standards.

The top of the hierarchy is called the LDAP root. The LDAP root server creates the

hierarchy and the rest of the structure (a nd resources) branch out from that location.

LDAP uses objects to represent computers, user accounts, shared resources, services, and

so on.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press,  Redmond, 2003, Chapter 8, Lesson 2

QUESTION 302:

Which of the following statements are true regarding Vulnerabilities and Sniffing?

A. FTP is a protocol, a client, and a server.

SY0-101 

Actualtests.com - The Power of Knowing

B. Security was based on the honor system.

C. As discussed earlier, SSH is a program  that allows connections to be secured by

encrypting the session between the client and the server.

D. The user ID and password are not encrypted and are subject to packet capture.

Answer: D

Explanation: 

File sharing is accomplished by storing files on an assigned location on the server or

workstation. When files are stored on a workstation, the connection is referred to as a

peer-to-peer connection. The  assigned location is typically  a subdirectory located on one

of the disk drives on the server or another  workstation. In an FTP connection, a file can

be uploaded from a client using the PUT command. A download with FTP is

accomplished using the GET command. Most mode rn servers and applications allow an

application program to access shared  files at the record level.

Incorrect answers:

A: This refers to FTP Connections

B: This refers to Blind FTP/Anonymous

C: This refers to FTP Secure

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p. 135

QUESTION 303:

Which of the following definitions fit correctly to SSH?

A. It supports encapsulation in a single point-to-point environment

B. It was created by Cisco as a method of creating tunnels primarily for dial-up

connections

C. It is primarily a point-to-point protocol

D. It is a tunneling protocol originally designed for UNIX systems.

Answer: D

Explanation: 

Secure Shell (SSH) is a tunneling protocol originally designed for UNIX systems. SSH

uses encryption to establish a secure connect ion between two systems. SSH also provides

security equivalent programs such as  Telnet, FTP, and many of the other

communications-oriented programs under UNIX.

Incorrect answers:

A: This refers to PPTP

B:This refers to L2F

C: This refers to L2TP

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 304:

Which of the following is not a tunneling protocol, but it is used in conjunction with

tunneling protocols?

A. PPTP

B. L2F

C. L2TP

D. IPSec

Answer: 

Explanation: 

IPSec (Internet Protocol Securi ty) is not a tunneling protocol,  but it is used in conjunction

with tunneling protocols. IPSec is oriented primarily toward LAN-to-LAN connections,

rather than dial-up connections. IPSec provi des secure authentication and encryption of

data and headers.

Incorrect answers:

A: PPTP supports encapsulation in a single point-to-point environment. PPTP

encapsulates and encrypts PPP packets. This makes PPTP a favorite low-end protocol for

networks. The negotiation between the two e nds of a PPTP connection is done in the

clear. Once the negotiation is perf ormed, the channel is encrypted

B: L2F was created by Cisco as a method of  creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

does provide authentication, but it  does not provide encryption.

C: Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 305:

Which of the following definitions fit correctly to IPSec?

A. It supports encapsulation in a single point-to-point environment

B. It was created by Cisco as a method of creating tunnels primarily for dial-up

connections

C. It is primarily a point-to-point protocol

D. It is not a tunneling protoc ol, but it is used in conjunc tion with tunneling protocols.

SY0-101 

Actualtests.com - The Power of Knowing

Answer: D

Explanation: 

IPSec (Internet Protocol Securi ty) is not a tunneling protocol,  but it is used in conjunction

with tunneling protocols. IPSec is oriented primarily toward LAN-to-LAN connections,

rather than dial-up connections. IPSec provi des secure authentication and encryption of

data and headers.

Incorrect answers:

A: This refers to PPTP

B:This refers to L2F

C: This refers to L2TP

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 306:

Which of the following definitions fit correctly to L2F?

A. It supports encapsulation in a single point-to-point environment

B. It was created by Cisco as a method of creating tunnels primarily for dial-up

connections

C. It is primarily a point-to-point protocol

D. It is a tunneling protocol originally designed for UNIX systems.

Answer: B

Explanation: 

L2F was created by Cisco as a method of  creating tunnels primarily for dial-up

connections. L2F is similar in capability to PPP and should not be used over WANs. L2F

does provide authentication, but it  does not provide encryption.

Incorrect answers:

A: This refers to PPTP

C:This refers to L2TP

D: This refers to SSH

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 307:

Which of the following definitions fit correctly to L2TP?

A. It supports encapsulation in a single point-to-point environment

B. It was created by Cisco as a method of creating tunnels primarily for dial-up

SY0-101 

Actualtests.com - The Power of Knowing

connections

C. It is primarily a point-to-point protocol

D. It is a tunneling protocol originally designed for UNIX systems.

Answer: C

Explanation: 

Relatively recently, Microsoft and Cisco agreed to combine their respective tunneling

protocols into one protocol: the Layer Two Tunneling Protocol (L2TP). L2TP is a hybrid

of PPTP and L2F. L2TP is primarily a point -to-point protocol. L2TP supports multiple

network protocols and can be used in networks besides TCP/IP. L2TP works over IPX,

SNA, and IP.

Incorrect answers:

A: This refers to PPTP

B:This refers to L2F

D: This refers to SSH

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 122-125.

QUESTION 308:

Choose the protocol that is most vulnerable to packet sniffing attacks aimed at

intercepting username and password information.

A. SSH (Secure Shell)

B. SSL (Secure Sockets Layer)

C. FTP (File Transfer Protocol)

D. HTTPS (Hypertext Transfer Protocol over Secure Sockets Layer)

Answer: C

Explanation: 

FTP has a major flaw. The user ID and password are not encrypted and are subject to

packet capture.

Incorrect answers:

A: Secure Shell (SSH) is a replacement for rlogin in Unix/Linux that includes security.

rlogin allowed one host to establish a connecti on with another with no  real security being

employed ;SSH replaces it with  slogin and digital certificates.

B: Secure Socket Layer (SSL) is a protocol that secures messages by operating between

the Application layer (HTTP) and the Transport layer.

D: Secure Hypertext Transfer Protocol  (S-HTTP) is a protocol used for secure

communications between a web server and a web browser.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 130

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 309:

You work as the security administrator at  Certkiller .com. You must secure the FTP

(File Transfer Protocol) server by allowing only authorized users access to it.

How will you accomplish this task?

A. Allow blind authentication.

B. Do not allow anonymous authentication.

C. Redirect FTP to a different port.

D. Provide the FTP server's address to only those users that must access it.

Answer: B

Explanation: 

Early FTP servers did not offer security. Security was based on the honor system. Most

logons to an FTP site used the anonymous  logon. By convention, the logon ID was the

user's email address, and the password was anonymous.

Incorrect answers:

A: Blind FTP is synonymous to anonymous  FTP and allowing blind FTP is not the way

to ensure that only authorized users access the FTP server.

C: Redirection will not prevent unauthorized access.

D: This is impractical as it will not prevent unauthorized access.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press, Redmond, 2003, Chapter 11, Lesson 1

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 137

QUESTION 310:

You work as the security administrator at Certkiller .com. You want to enable

anonymous FTP (File Transfer Pr otocol) read/write access.

Choose the important factor which you should consider and be aware of.

A. The upload and download directory for each user.

B. The detailed logging information for each user.

C. The storage and distribution of unlicensed software.

D. Less server connections and network bandwidth utilization.

Answer: C

Explanation: 

Anonymous FTP is based on good faith. But if it used to take advantage of the

non-secure logon, then answer C would seem to be the best answer.

Incorrect answers:

SY0-101 

Actualtests.com - The Power of Knowing

A: This is the legitimate use of an FTP site.

B

: You need to have a logon for any FTP (without anonymous access enabled) you want to

access.

D: This is not the answer.

Reference:

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press, Redmond, 2003, Chapter 11, Lesson 1

QUESTION 311:

You work as the security administrator at  Certkiller .com. You are investigating the

consequences of networks attacks aimed at FTP servers.

Which of the following states the aim of a FTP (File Transfer Protocol) bounce

attack?

A. The attack aims to exploit a buffer overflow vulnerability on the FTP server.

B. The attack aims to reboot the FTP server.

C. The attack aims to store and distribute malicious code.

D. The attack aims to establish a connection between the FTP server and another

computer.

Answer: D

Explanation: 

FTP bounce is a method that attackers use to  protect their identity when scanning your

network, by bouncing the scan off a vulnerable FTP server. In some implementations of

FTP daemons, the PORT command can be misused to open a connection to a port of the

attacker's choosing on a machine that the  attacker could not have accessed directly.

Incorrect answers:

A: In an attack, the buffer overflow condition can  be used to damage files, change data,

acquire confidential information, or execute  code on the target computer. The attacker

might even be able to gain full control over the target system.

B: Rebooting the server is not the aim of a FTP bounce attack.

C: The primary aim of a FTP bounce attack is to establish an illegitimate connection not

storing and distributing malicious code. This is secondary.

References:

http://www.cert.org/advisories/CA-1997-27.html

Microsoft Corporation with Andy Ruth & Kurt Hudson, Security+ Certification Training

Kit e-Book, Microsoft Press, Redmond, 2003, Chapter 11, Lesson 1

QUESTION 312:

You work as the security administrator  at Certkiller .com. The Certkiller .com

network must be configured to allow  FTP (File Transfer Protocol) traffic.

Which ports must you open on the firewall to allow FTP traffic?

SY0-101 

Actualtests.com - The Power of Knowing

A. Open ports 20 and 21.

B. Open ports 25 and 110.

C. Open ports 80 and 443.

D. Open ports 161 and 162.

Answer: A

Explanation: 

In basic FTP operations, port 20 is the data port and port 21 is the command port.

Incorrect answers:

B: Port 25 is for SMTP. Port 110 is for POP3

C: Port 80 is used by HTTP (used for th e World Wide Web) and port 443 for HTTPS

(used for secure web connections)

D: Ports 161 and 162 are used for SN MP messages and traps respectively.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 64

http://www.iana.org/assignments/port-numbers

QUESTION 313:

Choose the ports that are used to access the FTP (File Transfer Protocol) protocol.

A. Ports 80 and 443.

B. Ports 20 and 21.

C. Ports 21 and 23.

D. Ports 20 and 80.

Answer: B

Explanation: 

In basic FTP operations, port 20 is the data port and port 21 is the command port.

Incorrect answers:

A: Port 80 is used by HTTP (used for the World Wide Web) and port 443 for HTTPS

(used for secure web connections)

C: Port 23 is used by Telnet.

D: Port 80 is used by HTTP.

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda,

Sybex, 2004, p 64

http://www.iana.org/assignments/port-numbers 

QUESTION 314:

Which of the following Wireless standards has a maximum transmission speed of 54

SY0-101 

Actualtests.com - The Power of Knowing

Mbps? (Chose all that apply)

A. 802.11

B. 802.11a

C. 802.11b

D. 802.11g

Answer: B, D

IEEE 802.11a and IEEE 802.11g has transmission speeds of up to 54 Mbps.

Incorrect Answers:

A: IEEE 802.11, the original standard for wi reless networks opera tes at a maximum

speed of 2 Mbps.

C: IEEE 802.11b operates at a maximum speed of 11 Mbps.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, p. 66.

QUESTION 315:

Which of the following Wireless standards has a maximum transmission speed of 11

Mbps?

A. 802.11

B. 802.11a

C. 802.11b

D. 802.11g

Answer: C

IEEE 802.11b operates at a maximum speed of 11 Mbps.

Incorrect Answers:

A: IEEE 802.11, the original standard for wi reless networks opera tes at a maximum

speed of 2 Mbps.

B, D: IEEE 802.11a and IEEE 802.11g has transmission speeds of up to 54 Mbps.

Reference:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, p. 66.

QUESTION 316:

At what radio frequency does an IEEE 802.11g wireless network operate?

A. 2.4 GHz

B. 5.0 GHz

C. 5.4 GHz

D. 10 GHz

SY0-101 

Actualtests.com - The Power of Knowing

Answer: A

IEEE 802.11b and IEEE 802.11g uses the 2.4 GHz frequency band.

Incorrect Answers:

B: IEEE 802.11a uses the 5.0 GHz frequency band, not 802.11b.

C, D: NoIEEE wireless standard uses th e 5.4 GHz or the 10 GHz frequency bands.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 249-252.

QUESTION 317:

At what radio frequency does an IEEE 802.11a wireless network operate?

A. 2.4 GHz

B. 5.0 GHz

C. 5.4 GHz

D. 10 GHz

Answer: B

IEEE 802.11a uses the 5 GHz frequency band.

Incorrect Answers:

A: IEEE 802.11b and IEEE 802.11g uses the 2.4 GHz frequency band frequency band.

C, D: No IEEE wireless standard uses the 5.4 GHz or the 10 GHz frequency bands.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 249-252.

QUESTION 318:

At what radio frequency does Bluetooth operate?

A. 2.4 GHz

B. 5.0 GHz

C. 5.4 GHz

D. 10 GHz

Answer: A

Bluetooth uses the 2.4 GHz frequency band.

Incorrect Answers:

B: IEEE 802.11a uses the 5.0 GHz frequency band.

C, D: Bluetooth does not use the 5.4  GHz or the 10 GHz frequency bands.

References:

David Groth and Toby Skandier, Network+ Study Guide (4th Edition), Sybex, Alameda

CA, 2005, pp. 249-252.

SY0-101 

Actualtests.com - The Power of Knowing

QUESTION 319:

Which of the following characteristics form part of an IEEE (Institute of Electrical

and Electronics Engineers) connection?

A. A low-power transmitter

B. A wireless device

C. An access point

D. All of the above

Answer: D

Explanation: 

The primary method of connecting a wireless device to a network is with a wireless

portal. A wireless access point is a low-pow er transmitter/receiver, also known as a

transceiver, which is strate gically placed for access. The portable device and the access

point communicate using one of several communications protocols including IEEE

802.11 (also known as Wireless Ethernet).

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 109

QUESTION 320:

Which of the following is a hardware device that connects the digi tal signals from a

computer to the analog telephone line?

A. Modem

B. Cell Phone

C. WLAN

D. PC

Answer: A

Explanation: 

A modem is a hardware device that connects th e digital signals from a computer to the

analog telephone line. It allows these signals  to be transmitted longer distances than are

possible with digital signals. The word "modem" is an amalgam of the words

"modulator" and "demodulator," which ar e the two functions that occur during

transmission. Modems present a unique set of  challenges from a security perspective.

Incorrect answers:

B: This device has its own means to connect to the internet

C: This device is used  to connect computers

D: This device cannot connect to the internet without hardware such as a modem

References:

SY0-101 

Actualtests.com - The Power of Knowing

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 114.

QUESTION 321:

By which of the following means do most cellular phones use?

A. Infrared

B. Radio Frequencies

C. Microwaves

D. None of the above

Answer: A

Explanation: 

Infrared (IR) uses a type of radiation for communications. This infrared radiation allows

a point-to-point connection to be made between two IR transceiver-equipped devices. IR

is line of sight and is not secure, but the in terception device must be either in position

between the two connections or in an  area where a reflection has occurred.

Incorrect answers:

B, C, D: These don't apply

References:

Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Sybex,

Alameda, 2004, p 114.

QUESTION 322:

Which of the following wireless communications technologies accomplishes

communication by adding the data that is to be transmitted to a higher speed

transmission?

A. DSSS

B. FHSS

C. ODFM

D. WTLS

Answer: A

Explanation: 

DSSS accomplishes communication by adding the data that is to be transmitted to a

higher speed transmission. The higher speed transmission contains redundant information

to ensure data accuracy. Each packet can  then be reconstructed in the event of a

disruption.

Incorrect answers:

B: FHSS accomplishes communication by hopping the transmission over a range of

predefined frequencies. The changing or hoppi ng is synchronized  between both ends and

SY0-101 

Actualtests.com - The Power of Knowing

appears to be a single transmission channel to both ends.

C: ODFM accomplishes communication by breaking the data into subsignals and

transmitting them simultaneously. These transmissions occur on different frequencies or

subbands.