CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 1021:

  A security engineer is reviewing log data and sees the output below:

  POST: /payload.php HTTP/1.1 HOST: localhost Accept: */* Referrer: http://localhost/ ******* HTTP/1.1 403 Forbidden Connection: close

  Log: Access denied with 403. Pattern matches form bypass Which of the following technologies was MOST likely being used to generate this log?

  A. Host-based Intrusion Detection System

  B. Web application firewall

  C. Network-based Intrusion Detection System

  D. Stateful Inspection Firewall

  E. URL Content Filter

  Correct Answer: B

  A web application firewall is a device, server add-on, virtual service, or system filter that defines a strict set of communication rules for a website and all visitors. It's intended to be an application-specific firewall to prevent cross-site scripting, SQL injection, and other web application attacks.

  Incorrect Answers:

  A: A host-based IDS (HIDS) watches the audit trails and log fi les of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host.

  C: NIDS is reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host.

  D: A stateful inspection firewall is aware that any valid outbound communication will trigger a corresponding response or reply from the external entity.

  E: URL filtering involves blocking websites (or sections of websites) based solely on the URL, restricting access to specified websites and certain web-based applications.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 6, 19, 20, 21.

• Question 1022:

  Which of the following should the security administrator implement to limit web traffic based on country of origin? (Select THREE).

  A. Spam filter

  B. Load balancer

  C. Antivirus

  D. Proxies

  E. Firewall

  F. NIDS

  G. URL filtering

  Correct Answer: DEG

  A proxy server is a server that acts as an intermediary for requests from clients seeking resources from other servers. Firewalls manage traffic using a rule or a set of rules. A URL is a reference to a resource that specifies the location of the resource. A URL filter is used to block access to a site based on all or part of a URL.

  Incorrect Answers:

  A: A spam filter deals with identifying and blocking/filtering/removing unsolicited messages.

  B: A load balancer is used to acquire more optimal infrastructure utilization, reduce response time, maximize throughput, decrease overloading, and remove bottlenecks.

  C: An antivirus monitors the local system for the presence of malware in memory, in active processes, and in storage.

  F: NIDS is reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 10, 18-21.

• Question 1023:

  Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?

  A. WAF

  B. NIDS

  C. Routers

  D. Switches

  Correct Answer: A

  A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as cross-site scripting (XSS) and SQL injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.

  As the protocols used to access a web server (typically HTTP and HTTPS) run in layer 7 of the OSI model, then web application firewall (WAF) is the correct answer.

  Incorrect Answers:

  B: A NIDS (Network Intrusion Detection System) operates in layer 2 of the OSI model, not layer 7.

  C: Routers operate in layer 3 of the OSI model, not layer 7.

  D: Switches operate in layer 2 of the OSI model, not layer 7.

  References: https://owasp.org/index.php/Web_Application_Firewall http://en.wikipedia.org/wiki/OSI_model

• Question 1024:

  A review of the company's network traffic shows that most of the malware infections are caused by users visiting gambling and gaming websites. The security manager wants to implement a solution that will block these websites, scan all web traffic for signs of malware, and block the malware before it enters the company network. Which of the following is suited for this purpose?

  A. ACL

  B. IDS

  C. UTM

  D. Firewall

  Correct Answer: C

  An all-in-one appliance, also known as Unified Threat Management (UTM) and Next Generation Firewall (NGFW), is one that provides a good foundation for security. A variety is available; those that you should be familiar with for the exam fall under the categories of providing URL filtering, content inspection, or malware inspection.

  Malware inspection is the use of a malware scanner to detect unwanted software content in network traffic. If malware is detected, it can be blocked or logged and/ or trigger an alert.

  Incorrect Answers:

  A: Access control lists (ACLs) are used to define who is allowed to or denied permission to perform a specified activity or action.

  B: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations.

  D: The basic purpose of a firewall is to isolate one network from another.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 119. Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 19, 21, 24.

• Question 1025:

  Pete, an employee, attempts to visit a popular social networking site but is blocked. Instead, a page is displayed notifying him that this site cannot be visited. Which of the following is MOST likely blocking Pete's access to this site?

  A. Internet content filter

  B. Firewall

  C. Proxy server

  D. Protocol analyzer

  Correct Answer: A

  Web filtering software is designed to restrict or control the content a reader is authorised to access, especially when utilised to restrict material delivered over the Internet via the Web, e- mail, or other means.

  Incorrect Answers:

  B: The basic purpose of a firewall is to isolate one network from another.

  C: A proxy server is a variation of an application firewall or circuit-level firewall, and used as a middleman between clients and servers. Often a proxy serves as a barrier against external threats to internal clients.

  D: The terms protocol analyzer and packet sniffer are interchangeable. They refer to the tools used in the process of monitoring the data that is transmitted across a network.

  References:

  http://en.wikipedia.org/wiki/Content-control_software

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 11, 96, 342.

• Question 1026:

  Layer 7 devices used to prevent specific types of html tags are called:

  A. Firewalls

  B. Content filters

  C. Routers

  D. NIDS

  Correct Answer: B

  A content filter is a is a type of software designed to restrict or control the content a reader is authorised to access, particularly when used to limit material delivered over the Internet via the Web, e-mail, or other means. Because the user and

  the OSI layer interact directly with the content filter, it operates at Layer 7 of the OSI model.

  Incorrect Answers:

  A, C, D: These devices deal with controlling how devices in a network gain access to data and permission to transmit it, as well as controlling error checking and packet synchronization. It, therefore, operates at Layer 2 of the OSI model.

  References:

  http://en.wikipedia.org/wiki/Content-control_software#Types_of_filtering http://en.wikipedia.org/wiki/OSI_model

• Question 1027:

  The administrator receives a call from an employee named Joe. Joe says the Internet is down and he is receiving a blank page when typing to connect to a popular sports website. The administrator asks Joe to try visiting a popular search engine site, which Joe reports as successful. Joe then says that he can get to the sports site on this phone. Which of the following might the administrator need to configure?

  A. The access rules on the IDS

  B. The pop up blocker in the employee's browser

  C. The sensitivity level of the spam filter

  D. The default block page on the URL filter

  Correct Answer: D

  A URL filter is used to block access to a site based on all or part of a URL. There are a number of URL-filtering tools that can acquire updated master URL block lists from vendors, as well as allow administrators to add or remove URLs from a custom list.

  Incorrect Answers:

  A: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations.

  B: Pop-up blockers prevent websites from opening further web browser windows without your approval.

  C: A spam filter deals with identifying and blocking/filtering/removing unsolicited messages.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 18, 19, 21, 246.

• Question 1028:

  Pete, the system administrator, wants to restrict access to advertisements, games, and gambling web sites. Which of the following devices would BEST achieve this goal?

  A. Firewall

  B. Switch

  C. URL content filter

  D. Spam filter

  Correct Answer: C

  URL filtering, also known as web filtering, is the act of blocking access to a site based on all or part of the URL used to request access. URL filtering can focus on all or part of a fully qualified domain name (FQDN), specific path names, specific filenames, specific fi le extensions, or entire specific URLs. Many URL-filtering tools can obtain updated master URL block lists from vendors as well as allow administrators to add or remove URLs from a custom list.

  Incorrect Answers:

  A: The basic purpose of a firewall is to isolate one network from another. Firewalls are available as appliances, meaning they're installed as the primary device separating two networks.

  B: Switches are multiport devices that improve network efficiency.

  D: A spam filter is a software or hardware tool whose primary purpose is to identify and block/filter/remove unwanted messages (that is, spam).

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 18, 19. Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 102.

• Question 1029:

  Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites?

  A. Spam filter

  B. URL filter

  C. Content inspection

  D. Malware inspection

  Correct Answer: B

  The question asks how to prevent access to peer-to-peer file sharing websites. You access a website by browsing to a URL using a Web browser or peer-to-peer file sharing client software. A URL filter is used to block URLs (websites) to prevent users accessing the website.

  Incorrect Answer:

  A: A spam filter is used for email. All inbound (and sometimes outbound) email is passed through the spam filter to detect spam emails. The spam emails are then discarded or tagged as potential spam according to the spam filter configuration. Spam filters do not prevent users accessing peer-to-peer file sharing websites.

  C: Content inspection is the process of inspecting the content of a web page as it is downloaded. The content can then be blocked if it doesn't comply with the company's web policy. Content- control software determines what content will be available or perhaps more often what content will be blocked. Content inspection does not prevent users accessing peer-to-peer file sharing websites (although it could block the content of the sites as it is downloaded).

  D: Malware inspection is the process of scanning a computer system for malware. Malware inspection does not prevent users accessing peer-to-peer file sharing websites.

  References:

  http://www.provision.ro/threat-management/web-application-security/url-filtering#pagei-1| pagep-1| Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 18, 19.

• Question 1030:

  Which the following flags are used to establish a TCP connection? (Select TWO).

  A. PSH

  B. ACK

  C. SYN

  D. URG

  E. FIN

  Correct Answer: BC

  To establish a TCP connection, the three-way (or 3-step) handshake occurs:

  SYN: The active open is performed by the client sending a SYN to the server. The client sets the segment's sequence number to a random value A. SYN-ACK: In response, the server replies with a SYN-ACK. The acknowledgment number is set to one more than the received sequence number i.e. A+1, and the sequence number that the server chooses for the packet is another random number, B. ACK: Finally, the client sends an ACK back to the server. The sequence number is set to the received acknowledgement value i.e. A+1, and the acknowledgement number is set to one more than the received sequence number i.e. B+1.

  Incorrect Answers:

  A: The PSH flag tells the TCP stack to flush all buffers and send any outstanding data up to and including the data that had the PSH flag set.

  D: URG indicates that the urgent pointer field has a valid pointer to data that should be treated urgently and be transmitted before non-urgent data.

  E: FIN is used to indicate that the client will send no more data.

  References: http://linuxpoison.blogspot.com/2007/11/what-are-tcp-control-bits.html