CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 1011:

  Matt, the network engineer, has been tasked with separating network traffic between virtual machines on a single hypervisor. Which of the following would he implement to BEST address this requirement? (Select TWO).

  A. Virtual switch

  B. NAT

  C. System partitioning

  D. Access-list

  E. Disable spanning tree

  F. VLAN

  Correct Answer: AF

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. A virtual switch is a software application that allows communication between virtual machines. A combination of the two would best satisfy the question.

  Incorrect Answers:

  B: NAT converts the IP addresses of internal systems found in the header of network packets into public IP addresses.

  C: System partitioning has to do with separating data on a physical hard disk.

  D: The purpose of an access list is to identify specifically who can enter a facility.

  E: STP creates a spanning tree within a network of connected layer-2 bridges (typically Ethernet switches), and disables those links that are not part of the spanning tree. Disabling it will not solve the problem

  References:

  http://www.techopedia.com/definition/27140/virtual-switch-vswitch Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 23, 39.

  http://en.wikipedia.org/wiki/Spanning_Tree_Protocol

• Question 1012:

  The security administrator needs to manage traffic on a layer 3 device to support FTP from a new remote site. Which of the following would need to be implemented?

  A. Implicit deny

  B. VLAN management

  C. Port security

  D. Access control lists

  Correct Answer: D

  In the OSI model, IP addressing and IP routing are performed at layer 3 (the network layer). In this question we need to configure routing. When configuring routing, you specify which IP range (in this case, the IP subnet of the remote site) is allowed to route traffic through the router to the FTP server.

  Traffic that comes into the router is compared to ACL entries based on the order that the entries occur in the router. New statements are added to the end of the list. The router continues to look until it has a match. If no matches are found when the router reaches the end of the list, the traffic is denied. For this reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic that is not permitted.

  Incorrect Answers:

  A: Implicit deny is used in access control lists in applications, firewalls or routers. The idea is that everything is implicitly denied except what is allowed. For example, in a firewall ACL, you create ACL entries to allow traffic at the top of the list. If traffic coming in doesn't match the conditions in a allow ACL entry, then the traffic is implicitly denied. However, in this question, we need to configure an allow entry in an ACL to allow the remote site to connect to the FTP server. Therefore, implicit deny is not the correct answer.

  B: VLAN management is the process of managing VLANs in network switches. Switches (and therefore VLANs) work in Layer 2 of the OSI model.

  C: Port security works at level 2 of the OSI model and allows an administrator to configure switch ports so that only certain MAC addresses can use the port.

  References:

  http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html http://en.wikipedia.org/wiki/Virtual_LAN Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis,

  2014, p 157.

• Question 1013:

  Joe, a technician at the local power plant, notices that several turbines had ramp up in cycles during the week. Further investigation by the system engineering team determined that a timed .exe file had been uploaded to the system control console during a visit by international contractors. Which of the following actions should Joe recommend?

  A. Create a VLAN for the SCADA

  B. Enable PKI for the MainFrame

  C. Implement patch management

  D. Implement stronger WPA2 Wireless

  Correct Answer: A

  VLANs are used for traffic management. VLANs can be used to isolate traffic between network segments. This can be accomplished by not defining a route between different VLANs or by specifying a deny filter between certain VLANs (or certain members of a VLAN). Any network segment that doesn't need to communicate with another in order to accomplish a work task/function shouldn't be able to do so.

  Incorrect Answers:

  B: PKI focuses on proving the identity of communication partners, providing a means to securely exchange session-based symmetric encryption keys through asymmetric cryptographic solutions, and providing a means to protect message integrity through the use of hashing.

  C: Patch management is the formal process of ensuring that updates and patches are properly tested and applied to production systems.

  D: Implementing stronger WPA2 Wireless will not solve the problem of keeping the networks separate.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 21, 23, 350.

• Question 1014:

  A router has a single Ethernet connection to a switch. In the router configuration, the Ethernet interface has three sub-interfaces, each configured with ACLs applied to them and 802.1q trunks. Which of the following is MOST likely the reason for the sub-interfaces?

  A. The network uses the subnet of 255.255.255.128.

  B. The switch has several VLANs configured on it.

  C. The sub-interfaces are configured for VoIP traffic.

  D. The sub-interfaces each implement quality of service.

  Correct Answer: B

  A subinterface is a division of one physical interface into multiple logical interfaces. Routers commonly employ subinterfaces for a variety of purposes, most common of these are for routing traffic between VLANs. Also, IEEE 802.1Q is the

  networking standard that supports virtual LANs (VLANs) on an Ethernet network.

  Incorrect Answers:

  A, C, D: Subnets, VoIP, and QoS do not make use of this standard.

  References:

  http://en.wikipedia.org/wiki/Subinterface

  http://en.wikipedia.org/wiki/IEEE_802.1Q

• Question 1015:

  A technician is deploying virtual machines for multiple customers on a single physical host to reduce power consumption in a data center. Which of the following should be recommended to isolate the VMs from one another?

  A. Implement a virtual firewall

  B. Install HIPS on each VM

  C. Virtual switches with VLANs

  D. Develop a patch management guide

  Correct Answer: C

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. VLANs can be used to isolate traffic between network segments.

  Incorrect Answers:

  A: A virtual firewall (VF)is a network firewall service or appliance running entirely within a virtualized environment and which provides the usual packet filtering and monitoring provided via a physical network firewall.

  B: HIPS watch the audit trails and log files of a host system.

  D: Patch management is the formal process of ensuring that updates and patches are properly tested and applied to production systems.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 12, 23, 246.

  http://en.wikipedia.org/wiki/Virtual_firewall

• Question 1016:

  Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote sites through a VPN connection. How could Sara BEST accommodate the vendor?

  A. Allow incoming IPSec traffic into the vendor's IP address.

  B. Set up a VPN account for the vendor, allowing access to the remote site.

  C. Turn off the firewall while the vendor is in the office, allowing access to the remote site.

  D. Write a firewall rule to allow the vendor to have access to the remote site.

  Correct Answer: D

  Firewall rules are used to define what traffic is able pass between the firewall and the internal network. Firewall rules block the connection, allow the connection, or allow the connection only if it is secured. Firewall rules can be applied to inbound traffic or outbound traffic and any type of network.

  Incorrect Answers:

  A: Doing this will not allow the vendor access to the network. It will only allow the vendor to receive IPSec encrypted messages.

  B: This will allow the vendor to access the remote site from anywhere.

  C: turning off the firewall will remove all rules configured, making the network vulnerable.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 103, 157.

• Question 1017:

  A security administrator suspects that an increase in the amount of TFTP traffic on the network is due to unauthorized file transfers, and wants to configure a firewall to block all TFTP traffic.

  Which of the following would accomplish this task?

  A. Deny TCP port 68

  B. Deny TCP port 69

  C. Deny UDP port 68

  D. Deny UDP port 69

  Correct Answer: D

  Trivial File Transfer Protocol (TFTP) is a simple file-exchange protocol that doesn't require authentication. It operates on UDP port 69.

  Incorrect Answers:

  A, C: Port 68 TCP/UDP is used by Bootstrap Protocol (BOOTP) Client; as well Dynamic Host Configuration Protocol (DHCP).

  B: Because TFTP operates on UDP port 69, this option is incorrect.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 55. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 1018:

  Which of the following firewall rules only denies DNS zone transfers?

  A. deny udp any any port 53

  B. deny ip any any

  C. deny tcp any any port 53

  D. deny all dns packets

  Correct Answer: C

  DNS operates over TCP and UDP port 53. TCP port 53 is used for zone transfers.

  Incorrect Answers:

  A: UDP port 53 is used for most typical DNS queries.

  B: An access-list has a deny ip any any implicitly at the end of any access-list. If traffic is related to a DHCP request and if it is not explicitly permitted, the traffic is dropped.

  D: The question requires DNS zone transfers to be blocked only, not all DNS.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 44. http://www.cisco.com/c/en/us/support/docs/security/ios- firewall/23602-confaccesslists.html

• Question 1019:

  A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Which of the following should be implemented to secure the devices without risking availability?

  A. Host-based firewall

  B. IDS

  C. IPS

  D. Honeypot

  Correct Answer: B

  An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and

  approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor

  expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for

  other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every

  organization.

  IDPSes typically record information related to observed events, notify security administrators of important observed events and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding.

  They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall) or changing the attack's content.

  Incorrect Answers:

  A: The question states: The administrator wants to monitor device security without changing their baseline configuration. Installing and configure host-based firewalls would change the baseline configuration. A host-based or personal software firewall can often limit communications to only approved applications and protocols and can usually prevent externally initiated connections. It will not monitor device security.

  C: The question states: The administrator wants to monitor device security without changing their baseline configuration. The word `monitor' is an important distinction. It doesn't say block or prevent. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent/block intrusions that are detected.

  D: A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies. A honeypot is not used to monitor device security.

  References:

  http://en.wikipedia.org/wiki/Intrusion_detection_system

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 213, 246.

  http://en.wikipedia.org/wiki/Intrusion_prevention_system

• Question 1020:

  An administrator would like to review the effectiveness of existing security in the enterprise. Which of the following would be the BEST place to start?

  A. Review past security incidents and their resolution

  B. Rewrite the existing security policy

  C. Implement an intrusion prevention system

  D. Install honey pot systems

  Correct Answer: C

  The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it

  Incorrect Answers:

  A: If the incidents have been resolved, the system would be configured to deal with those incidents. It is the new incidents that are the issue.

  B: Rewriting the security policy could be a step further down the line, after requirements have been determined.

  D: A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

  References:

  http://en.wikipedia.org/wiki/Intrusion_prevention_system Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 213.