CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 21:

  Which of the following types of encryption will help in protecting files on a PED?

  A. Mobile device encryption

  B. Transport layer encryption

  C. Encrypted hidden container

  D. Database encryption

  Correct Answer: A

  Device encryption encrypts the data on a Personal Electronic Device (PED). This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

  Incorrect Answers:

  B: The transport layer provides network communication. It does not involve files on a Personal Electronic Device (PED).

  C: Encrypting hidden containers would protect the files in those containers. It will not protect the rest of the files on the Personal Electronic Device (PED).

  D: Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the data base. This often offers granular encryption options which allows for the encryptions of the entire database, specific database tables, or specific database fields, such as a credit card number field. However, a database would typically be stored on a server and not a Personal Electronic Device (PED).

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236, 237, 252

• Question 22:

  Which of the following can be used to mitigate risk if a mobile device is lost?

  A. Cable lock

  B. Transport encryption

  C. Voice encryption

  D. Strong passwords

  Correct Answer: D

  Passwords are the most likely mechanism that can be used to mitigate risk when a mobile device is lost. A strong password would be more difficult to crack.

  Incorrect Answers:

  A: Cable locks are theft deterrent devices that can be used to tether a device to a fixed point keep smaller devices from being easy to steal.

  B: Transport encryption is a mechanism used to encrypt network communications in which only the payload is encrypted.

  C: Voice encryption is used to protect audio (voice) transmission.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249, 369, 407

• Question 23:

  A security administrator has concerns regarding employees saving data on company provided mobile devices. Which of the following would BEST address the administrator's concerns?

  A. Install a mobile application that tracks read and write functions on the device.

  B. Create a company policy prohibiting the use of mobile devices for personal use.

  C. Enable GPS functionality to track the location of the mobile devices.

  D. Configure the devices so that removable media use is disabled.

  Correct Answer: D

  Mobile devices can be plugged into computers where they appear as an additional disk in the same way as a USB drive. This is known as removable media. This would enable users to copy company data onto the mobile devices. By disabling removable media use, the users will not be able to copy data onto the mobile devices.

  Incorrect Answers:

  A: A mobile application that tracks read and write functions on the device (if such an application exists) would only monitor the activity. It wouldn't stop data being written to the device.

  B: Policies provide guidelines. A policy prohibiting the use of mobile devices for personal use would not stop data being written to the device as the policy would still need to be enforced.

  C: Global Positioning System (GPS) tracking can be used to identify its location of a stolen device and can allow authorities to recover the device. However, for GPS tracking to work, the device must have an Internet connection or a wireless phone service over which to send its location information. This would not prevent data being written to the device.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 24:

  A team of firewall administrators have access to a `master password list' containing service account passwords. Which of the following BEST protects the master password list?

  A. File encryption

  B. Password hashing

  C. USB encryption

  D. Full disk encryption

  Correct Answer: A

  File encryption can be used to protect the contents of individual files. It uses randomly generated symmetric encryption keys for the file and stores the key in an encrypted form using the user's public key on the encrypted file.

  Incorrect Answers:

  B: Hashing is a form of cryptography that produces a unique identifier known as a hash value. This hash value serves as an ID code to detect when the original data source has been altered. It, however, does not prevent access to the data.

  C: USB encryption is provided by the vendor of the USB device or by a tool from a third party. It is used to encrypt the data on the USB device, ensuring that the data cannot be accessed in a useable form should the device be stolen or misplaced.

  D: Full-disk encryption encrypts the data on the hard drive of the device. This feature ensures that the data cannot be accessed in a useable form should the device be stolen or misplaced.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251- 252, 255, 315-316

• Question 25:

  Which of the following is an advantage of implementing individual file encryption on a hard drive which already deploys full disk encryption?

  A. Reduces processing overhead required to access the encrypted files

  B. Double encryption causes the individually encrypted files to partially lose their properties

  C. Individually encrypted files will remain encrypted when copied to external media

  D. File level access control only apply to individually encrypted files in a fully encrypted drive

  Correct Answer: C

  With full disk encryption a file is encrypted as long as it remains on the disk. This is because the data on the disk is decrypted when the user logs on, thus the data is in a decrypted form when it is copied to another disk. Individually encrypted files on the other hand remain encrypted.

  Incorrect Answers:

  A: Encrypting individual files do not reduce the processing overhead but increases it as the full disk encryption must be decrypted as well as the file encryption. Full disk decryption usually occurs when the user logos on to the system.

  B: Double encryption does not cause individually encrypted files to partially lose their properties. File properties are typically not encrypted with individual file encryption.

  D: Encryption is not a requirement for file-level access control and it can be applied to files whether they are encrypted or not.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251- http://en.wikipedia.org/wiki/Disk_encryption

• Question 26:

  A database administrator would like to start encrypting database exports stored on the SAN, but the storage administrator warns that this may drastically increase the amount of disk space used by the exports. Which of the following explains the reason for the increase in disk space usage?

  A. Deduplication is not compatible with encryption

  B. The exports are being stored on smaller SAS drives

  C. Encrypted files are much larger than unencrypted files

  D. The SAN already uses encryption at rest

  Correct Answer: C

  Encryption adds overhead to the data which results in and increase in file size. This overhead is attached to each file and could include the encryption/decryption key, data recovery files and data decryption field in file header. As a result,

  requires increased storage space.

  Incorrect Answers:

  A: Data deduplication is a specialized data compression technique for identifying and eliminating duplicate copies of data. Modern cryptography often includes compression deduplication though some do not.

  B: A storage area network (SAN) is a secondary network that offers storage isolation by consolidating storage devices such as hard drives, drive arrays, optical jukeboxes, and tape libraries. The size of the storage device is irrelevant as it is part of the SAN.

  D: If the data is already encrypted it would not lead to an increase in storage space.

  References: http://en.wikipedia.org/wiki/Data_deduplication https://technet.microsoft.com/en-us/magazine/2006.05.howitworks.aspx Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251

• Question 27:

  Which of the following types of data encryption would Matt, a security administrator, use to encrypt a specific table?

  A. Full disk

  B. Individual files

  C. Database

  D. Removable media

  Correct Answer: C

  A table is stored in a database. Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the database. This often offers granular encryption options which allows for the

  encryptions of the entire database, specific database tables, or specific database fields, such as a credit card number field.

  Incorrect Answers:

  A, D: Full-disk encryption encrypts the data on the hard drive of the device. It can also be applied to removable media. This feature ensures that the data cannot be accessed in a useable form should the device or removable media be stolen

  or misplaced.

  B: File-level encryption would involve encrypting the entire database file rather than a table in the database.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251

• Question 28:

  A merchant acquirer has the need to store credit card numbers in a transactional database in a high performance environment. Which of the following BEST protects the credit card data?

  A. Database field encryption

  B. File-level encryption

  C. Data loss prevention system

  D. Full disk encryption

  Correct Answer: A

  Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the data base. This often offers granular encryption options which allows for the encryptions of the entire database, specific database tables, or specific database fields, such as a credit card number field.

  Incorrect Answers:

  B: File-level encryption would involve encrypting the entire database file. This would mean that accessing any data in the database would involve the overhead of decrypting the data.

  C: A data loss prevention system is a system designed to detect a potential data breach. It is not used to encrypt data.

  D: Full disk encryption would involve encrypting the entire hard disk. This would mean that accessing any data in the hard disk would involve the overhead of decrypting the data.

  References:

  http://docs.oracle.com/cd/B28359_01/network.111/b28530/asotrans.htm#g1011122 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 252

• Question 29:

  To protect corporate data on removable media, a security policy should mandate that all removable devices use which of the following?

  A. Full disk encryption

  B. Application isolation

  C. Digital rights management

  D. Data execution prevention

  Correct Answer: A

  Full-disk encryption encrypts the data on the hard drive of the device or on a removable drive. This feature ensures that the data on the device or removable drive cannot be accessed in a useable form should it be stolen.

  Incorrect Answers:

  B: Application Isolation is the process of ensuring that the application always uses the version of shared files with which it was installed, preventing component versioning conflicts. This is performed by the developer of the application.

  C: Digital rights management (DRM) is a set of technologies used by publishers, copyright holders, and individuals to control the after-sale use of digital content, most prominently, to curb piracy of digital content.

  D: Data Execution Prevention (DEP) is a security feature built into the operating system. It defines areas of memory as executable and nonexecutable. This protects against program errors, and some malicious exploits, such as buffer overflows.

  References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251- http://www.symantec.com/connect/articles/application-isolation- basics-and-directions http://en.wikipedia.org/wiki/Digital_rights_management http://en.wikipedia.org/wiki/Data_Execution_Prevention

• Question 30:

  Which of the following is the BEST method for ensuring all files and folders are encrypted on all corporate laptops where the file structures are unknown?

  A. Folder encryption

  B. File encryption

  C. Whole disk encryption

  D. Steganography

  Correct Answer: C

  Full-disk encryption encrypts the data on the hard drive of the device or on a removable drive. This feature ensures that the data on the device or removable drive cannot be accessed in a useable form should it be stolen. Furthermore, full-

  disk encryption is not dependant on knowledge of the file structure.

  Incorrect Answers:

  A, B: File and Folder encryption encrypts the content of individual files and folders respectively. To implement file or folder encryption effectively, the file structure has to be known.

  D: Steganography is a process of hiding one communication inside another communication. It can use passwords to prevent unauthorized extraction of the hidden communication and can also use encryption to mitigate against brute-force attempts at extraction. Steganography can also be used to detect theft, fraud, or modification when the hidden communication is a watermark.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251- 252, 323