CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 421:

  Environmental control measures include which of the following?

  A. Access list

  B. Lighting

  C. Motion detection

  D. EMI shielding

  Correct Answer: D

  Environmental controls include HVAC, Fire Suppression, EMI Shielding, Hot and Cold Aisles, Environmental monitoring as well as Temperature and Humidity controls.

  Incorrect Answers:

  A: Access lists are used in implementing physical security.

  B: Lighting, and in particular proper lighting is used in implementing physical security.

  C: Motion Detections forms part of physical security implementation.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp.373, 376, 377

• Question 422:

  Which of the following should be considered to mitigate data theft when using CAT5 wiring?

  A. CCTV

  B. Environmental monitoring

  C. Multimode fiber

  D. EMI shielding

  Correct Answer: D

  EMI Shielding refers to the process of preventing electronic emissions from your computer systems from being used to gather intelligence and preventing outside electronic emissions from disrupting your information-processing abilities. Thus all wiring should be shielded to mitigate data theft.

  Incorrect Answers:

  A: CCTV is used to record everything it sees, thus creating evidence in case of theft. Though data theft can also occur over a network and a camera will only record the area where it is set up. Shielding is a more important data theft mitigation measure.

  B: Environmental monitoring is carried out by means of a HVAC system and furthermore shielding the wiring is part of environmental monitoring.

  C: Multimode fiber is not used to mitigate data theft.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 380

• Question 423:

  When implementing fire suppression controls in a datacenter it is important to:

  A. Select a fire suppression system which protects equipment but may harm technicians.

  B. Ensure proper placement of sprinkler lines to avoid accidental leakage onto servers.

  C. Integrate maintenance procedures to include regularly discharging the system.

  D. Use a system with audible alarms to ensure technicians have 20 minutes to evacuate.

  Correct Answer: B

  Water-based systems can cause serious damage to all electrical equipment and the sprinkler lines in a fire suppression control system should be placed in such a way so as not to leak onto computers when it do get activated because it works with overhead nozzles.

  Incorrect Answers:

  A: A datacenter will require a fixed system fire suppression and this is usually water-based systems which works with sprinklers to suppress the fire should one occur. This a water-based system a hardly likely to harm the technicians.

  C: You would not want to discharge the water of a fire suppression system on a regular basis as it would mean that you may spill water over your equipment which can cause serious damage.

  D: Audible alarms will only server to warn people to evacuate and not safeguard the equipment.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 378

• Question 424:

  Which of the following fire suppression systems is MOST likely used in a datacenter?

  A. FM-200

  B. Dry-pipe

  C. Wet-pipe

  D. Vacuum

  Correct Answer: A

  FM200 is a gas and the principle of a gas system is that it displaces the oxygen in the room, thereby removing this essential component of a fi re. in a data center is is the preferred choice of fire suppressant.

  Incorrect Answers:

  B: Dry-pipe fire suppression is not the optimal fire suppressant to be used.

  C: Wet-pipe fire suppression will douse a fire, but will also case extensive damage to electrical equipment.

  D: A vacuum suppression will also result in more damage to components in the area of the vacuum, whereas a gas system will just starve the fire of oxygen which is more preferable in a data center to use as a fire suppressant.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 380

• Question 425:

  Which of the following is a security benefit of providing additional HVAC capacity or increased tonnage in a datacenter?

  A. Increased availability of network services due to higher throughput

  B. Longer MTBF of hardware due to lower operating temperatures

  C. Higher data integrity due to more efficient SSD cooling

  D. Longer UPS run time due to increased airflow

  Correct Answer: B

  The mean time between failures (MTBF) is the measure of the anticipated incidence of failure for a system or component. This measurement determines the component's anticipated lifetime. If the MTBF of a cooling system is one year, you can anticipate that the system will last for a one-year period; this means that you should be prepared to replace or rebuild the system once a year. If the system lasts longer than the MTBF, your organization receives a bonus. MTBF is helpful in evaluating a system's reliability and life expectancy. Thus longer MTBF due to lower operating temperatures is a definite advantage

  Incorrect Answers:

  A: Availability means simply to make sure that the data and systems are available for authorized users. Data backups, redundant systems, and disaster recovery plans all support availability.

  C: Data integrity refers to keeping data unaltered.

  D: Longer UPS will allow you to continue to function in the absence of power and provide time to shut down gracefully in the event of power failures. It is thus a business continuity benefit.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 378, 456

• Question 426:

  Which of the following should be connected to the fire alarm system in order to help prevent the spread of a fire in a server room without data loss to assist in an FM-200 deployment?

  A. Water base sprinkler system

  B. Electrical

  C. HVAC

  D. Video surveillance

  Correct Answer: C

  HVAC refers to heating, ventilation and air-conditioning to allow for a zone-based environmental control measure. The fire-alarm system should ideally also be hooked up to the HVAC so that the HVAC can monitor the changes in heating and ventilation.

  Incorrect Answers:

  A: A water based sprinkler system is designed to extinguish a fire and not to prevent data loss. It can also cause extreme damage to computers and electrical equipment.

  B: Electrical systems are not designed to prevent the spread of fire.

  D: Video surveillance is used mainly as a deterrent and will not help to prevent the spread of fire.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 378-380

• Question 427:

  A company that purchased an HVAC system for the datacenter is MOST concerned with which of the following?

  A. Availability

  B. Integrity

  C. Confidentiality

  D. Fire suppression

  Correct Answer: A

  Availability means simply to make sure that the data and systems are available for authorized users. Data backups, redundant systems, and disaster recovery plans all support availability; as does environmental support by means of HVAC.

  Incorrect Answers:

  B: Integrity refers to data not being tampered with. HVAC does not tamper with data.

  C: Confidentiality refers to measures used to prevent unauthorized users from accessing data. HVAC does not keep users away or lure them.

  D: Fire Suppression is but a component of HVAC and refers to the act of extinguishing fire vs preventing a fire.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 378, 414

• Question 428:

  Which of the following is an attack vector that can cause extensive physical damage to a datacenter without physical access?

  A. CCTV system access

  B. Dial-up access

  C. Changing environmental controls

  D. Ping of death

  Correct Answer: C

  Environmental systems include heating, air conditioning, humidity control, fire suppression, and power systems. All of these functions are critical to a well-designed physical plant. A computer room will typically require full-time environmental control. Changing any of these controls (when it was set to its optimum values) will result in damage.

  Incorrect Answers:

  A: Closed Circuit TV (CCTV) surveillance can help lessen the success of unauthorized access attempts. This is an access control which prevents physical access to a data center. In this case the attack vendor should be one that can do damage without physical access.

  B: Dial-up access when unauthorized may result in technical damage and not physical damage.

  D: Ping of Death is a Denial of Service attack and involves technical controls and not an attack that results in physical damages.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 378

• Question 429:

  A security team has established a security awareness program. Which of the following would BEST prove the success of the program?

  A. Policies

  B. Procedures

  C. Metrics

  D. Standards

  Correct Answer: C

  All types of training should be followed up- be tested to see if it worked and how much was learned in the training process. You must follow up and gather training metrics to validate compliance and security posture. By training metrics, we mean some quantifiable method for determining the efficacy of training.

  Incorrect Answers:

  A, B: A user-awareness program helps individuals in an organization understand how to implement policies, procedures, and technologies to ensure effective security. Policies together with procedures are part of the training and concerns

  that employees should be made aware of during the training process.

  D: Standards refer to the types of policies and guidelines (the less formal type of policy) to measure risk and weighing risk.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 401

• Question 430:

  Which of the following statements is MOST likely to be included in the security awareness training about P2P?

  A. P2P is always used to download copyrighted material.

  B. P2P can be used to improve computer system response.

  C. P2P may prevent viruses from entering the network.

  D. P2P may cause excessive network bandwidth.

  Correct Answer: D

  P2P networking by definition involves networking which will reduce available bandwidth for the rest of the users on the network. Incorrect Answers:

  A: P2P connections are used commonly for sharing files, printers, even songs, etc. This can also be done with personally owned devices.

  B: P2P is not used to improve computer system response in a corporate setting.

  C: This is not necessarily correct since the virus may be introduced to the network with a P2P connection which is done within the network in a corporate setting.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 404