CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 1081:

  Which of the following would Pete, a security administrator, do to limit a wireless signal from penetrating the exterior walls?

  A. Implement TKIP encryption

  B. Consider antenna placement

  C. Disable the SSID broadcast

  D. Disable WPA

  Correct Answer: B

  Cinderblock walls, metal cabinets, and other barriers can reduce signal strength significantly. Therefore, antenna placement is critical.

  Incorrect Answers:

  A: This option deals with encryption, not signal strength.

  C: This option would "cloak" the network, not limit its signal strength.

  D: This option deals with authentication, not signal strength.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 173, 177, 183.

• Question 1082:

  A security team has identified that the wireless signal is broadcasting into the parking lot. To reduce the risk of an attack against the wireless network from the parking lot, which of the following controls should be used? (Select TWO).

  A. Antenna placement

  B. Interference

  C. Use WEP

  D. Single Sign on

  E. Disable the SSID

  F. Power levels

  Correct Answer: AF

  Placing the antenna in the correct position is crucial. You can then adjust the power levels to exclude the parking lot. Incorrect Answers:

  B: Interference could disrupt the signal in the building as well.

  C: WEP is not a secure encryption protocol.

  D: This allows users access to all the applications and systems they need when they log on.

  E: This option would "cloak" the network, not limit its signal strength.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 149, 171, 177, 183.

• Question 1083:

  Jane, an administrator, needs to make sure the wireless network is not accessible from the parking area of their office. Which of the following would BEST help Jane when deploying a new access point?

  A. Placement of antenna

  B. Disabling the SSID

  C. Implementing WPA2

  D. Enabling the MAC filtering

  Correct Answer: A

  You should try to avoid placing access points near metal (which includes appliances) or near the ground. Placing them in the center of the area to be served and high enough to get around most obstacles is recommended. On the chance that the signal is actually traveling too far, some access points include power level controls, which allow you to reduce the amount of output provided.

  Incorrect Answers:

  B: This option would "cloak" the network, not limit its signal strength.

  C: This deals with authentication and would not make sure that the network is inaccessible from the parking area.

  D: This would require clients to furnish the security administrator with their device's MAC address.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 177, 178, 183.

• Question 1084:

  A system administrator wants to enable WPA2 CCMP. Which of the following is the only encryption used?

  A. RC4

  B. DES

  C. 3DES

  D. AES

  Correct Answer: D

  Cipher Block Chaining Message Authentication Code Protocol (CCMP) makes use of 128-bit AES encryption with a 48-bit initialization vector.

  Incorrect Answers:

  A, B, C: These are not used by CCMP

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 250.

• Question 1085:

  The security administrator has been tasked to update all the access points to provide a more secure connection. All access points currently use WPA TKIP for encryption. Which of the following would be configured to provide more secure connections?

  A. WEP

  B. WPA2 CCMP

  C. Disable SSID broadcast and increase power levels

  D. MAC filtering

  Correct Answer: B

  CCMP makes use of 128-bit AES encryption with a 48-bit initialization vector. This initialization vector makes cracking a bit more difficult.

  Incorrect Answers:

  A: WEP is not a secure encryption protocol.

  C: This will only cloak the network, and increase the signal strength.

  D: MAC filtering is vulnerable to spoof attacks.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 178.

• Question 1086:

  A security administrator wishes to increase the security of the wireless network. Which of the following BEST addresses this concern?

  A. Change the encryption from TKIP-based to CCMP-based.

  B. Set all nearby access points to operate on the same channel.

  C. Configure the access point to use WEP instead of WPA2.

  D. Enable all access points to broadcast their SSIDs.

  Correct Answer: A

  CCMP makes use of 128-bit AES encryption with a 48-bit initialization vector. This initialization vector makes cracking a bit more difficult.

  Incorrect Answers:

  B: Wireless APs with overlapping signals should use unique channel frequencies to reduce interference between them.

  C: WEP is not a secure encryption protocol.

  D: This will make the network visible, and open for attacks.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 178.

  https://technet.microsoft.com/en-us/library/cc783011(v=ws.10).aspx

• Question 1087:

  An access point has been configured for AES encryption but a client is unable to connect to it. Which of the following should be configured on the client to fix this issue?

  A. WEP

  B. CCMP

  C. TKIP

  D. RC4

  Correct Answer: B

  CCMP is an encryption protocol designed for Wireless LAN products that implement the standards of the IEEE 802.11i amendment to the original IEEE 802.11 standard. CCMP is an enhanced data cryptographic encapsulation mechanism designed for data confidentiality and based upon the Counter Mode with CBC-MAC (CCM) of the AES standard.

  Incorrect Answers:

  A: WEP is based on RC4, and does not use AES.

  C: TKIP is a basis for WPA.

  D: RC4 is the basis of WEP.

  References:

  http://en.wikipedia.org/wiki/CCMP

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 59, 60.

• Question 1088:

  A network administrator has been tasked with securing the WLAN. Which of the following cryptographic products would be used to provide the MOST secure environment for the WLAN?

  A. WPA2 CCMP

  B. WPA

  C. WPA with MAC filtering

  D. WPA2 TKIP

  Correct Answer: A

  CCMP is the standard encryption protocol for use with the WPA2 standard and is much more secure than the WEP protocol and TKIP protocol of WPA. CCMP provides the following security services: Data confidentiality; ensures only authorized parties can access the information Authentication; provides proof of genuineness of the user Access control in conjunction with layer management

  Because CCMP is a block cipher mode using a 128-bit key, it is secure against attacks to the 264 steps of operation.

  Incorrect Answers:

  B: The Wi-Fi Alliance intended WPA as an intermediate measure to take the place of WEP pending the availability of the full IEEE 802.11i standard. The WPA protocol implements much of the IEEE 802.11i standard. Specifically, the Temporal Key Integrity Protocol (TKIP) was adopted for WPA. WEP used a 40-bit or 104- bit encryption key that must be manually entered on wireless access points and devices and does not change. TKIP employs a per-packet key, meaning that it dynamically generates a new 128-bit key for each packet and thus prevents the types of attacks that compromised WEP. WPA also includes a message integrity check. This is designed to prevent an attacker from capturing, altering and/or resending data packets. This replaces the cyclic redundancy check (CRC) that was used by the WEP standard. CRC's main flaw was that it did not provide a sufficiently strong data integrity guarantee for the packets it handled. Well tested message authentication codes existed to solve these problems, but they required too much computation to be used on old network cards. WPA uses a message integrity check algorithm called Michael to verify the integrity of the packets. Michael is much stronger than a CRC, but not as strong as the algorithm used in WPA2.

  C: WPA even with the added security of MAC filtering is still inherently less secure than WPA2.

  D: CCMP is the standard encryption protocol for use with the WPA2 standard and is much more secure than the TKIP protocol of WPA.

  References: http://en.wikipedia.org/wiki/CCMP http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access

• Question 1089:

  Which of the following wireless security technologies continuously supplies new keys for WEP?

  A. TKIP

  B. Mac filtering

  C. WPA2

  D. WPA

  Correct Answer: A

  TKIP is a suite of algorithms that works as a "wrapper" to WEP, which allows users of legacy WLAN equipment to upgrade to TKIP without replacing hardware. TKIP uses the original WEP programming but "wraps" additional code at the beginning and end to encapsulate and modify it.

  Incorrect Answers:

  B: Networks can use MAC address filtering, only allowing devices with specific MAC addresses to connect to a network. It does not continuously supply new keys for WEP.

  C: WPA2 makes use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) and is a more secure standard that WEP or WPA.

  D: WPA replaces WEP, and also uses TKIP.

  References:

  http://www.howtogeek.com/192173/how-and-why-to-change-your-mac-address-on-windows- linux-and-mac/ Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 172, 173.

• Question 1090:

  Jane, the security administrator, sets up a new AP but realizes too many outsiders are able to connect to that AP and gain unauthorized access. Which of the following would be the BEST way to mitigate this issue and still provide coverage where needed? (Select TWO).

  A. Disable the wired ports

  B. Use channels 1, 4 and 7 only

  C. Enable MAC filtering

  D. Disable SSID broadcast

  E. Switch from 802.11a to 802.11b

  Correct Answer: CD

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless

  packet sniffer. Thus, the SSID should be disabled if the network isn't for public use.

  A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a WAP to block access to all unauthorized devices.

  Incorrect Answers:

  A: Disabling the wired ports will not prevent outsiders from connecting to the AP and gaining unauthorized access.

  B: Selecting the correct channels will prevent interference, not unauthorized access.

  E: Doing this will decrease the bandwidth and increase the risk of interference.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 61. https://technet.microsoft.com/en-us/library/cc783011(v=ws.10).aspx