CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 631:

  A user ID and password together provide which of the following?

  A. Authorization

  B. Auditing

  C. Authentication

  D. Identification

  Correct Answer: C

  Authentication generally requires one or more of the following:

  Something you know: a password, code, PIN, combination, or secret phrase.

  Something you have: a smart card, token device, or key.

  Something you are: a fingerprint, a retina scan, or voice recognition; often referred to as biometrics, discussed later in this chapter.

  Somewhere you are: a physical or logical location.

  Something you do: typing rhythm, a secret handshake, or a private knock.

  Incorrect Answers:

  A: Authorization occurs after authentication, and ensures that the requested activity or object access is possible given the rights and privileges assigned to the authenticated identity. Authorization indicates who is trusted to perform specific

  operations.

  B: Auditing is generally used for compliance testing.

  D: Identification is the claiming of an identity, only has to take place once per authentication or access process.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 118, 276, 280, 285.

• Question 632:

  Which of the following is an authentication method that can be secured by using SSL?

  A. RADIUS

  B. LDAP

  C. TACACS+

  D. Kerberos

  Correct Answer: B

  With secure LDAP (LDAPS), all LDAP communications are encrypted with SSL/TLS

  Incorrect Answers:

  A, C, D: None of these options have a version that is SSL encrypted.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 147.

  http://en.wikipedia.org/wiki/Radius

  http://en.wikipedia.org/wiki/TACACS

  http://en.wikipedia.org/wiki/Kerberos_(protocol)

• Question 633:

  Which of the following is an XML based open standard used in the exchange of authentication and authorization information between different parties?

  A. LDAP

  B. SAML

  C. TACACS+

  D. Kerberos

  Correct Answer: B

  Security Assertion Markup Language (SAML) is an open-standard data format centred on XML. It is used for supporting the exchange of authentication and authorization details between systems, services, and devices.

  Incorrect Answers:

  A, C, D: None of these options are based on XML.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 270- 274.

• Question 634:

  A system administrator is configuring UNIX accounts to authenticate against an external server. The configuration file asks for the following information DC=ServerName and DC=COM. Which of the following authentication services is being used?

  A. RADIUS

  B. SAML

  C. TACACS+

  D. LDAP

  Correct Answer: D

  The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

  An entry can look like this when represented in LDAP Data Interchange Format (LDIF) (LDAP itself is a binary protocol): dn: cn=John Doe,dc=example,dc=com cn: John Doe givenName: John sn: Doe telephoneNumber: +1 888 555 6789 telephoneNumber: +1 888 555 1232 mail: [email protected] manager: cn=Barbara Doe,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top

  "dn" is the distinguished name of the entry; it is neither an attribute nor a part of the entry. "cn=John Doe" is the entry's RDN (Relative Distinguished Name), and "dc=example,dc=com" is the DN of the parent entry, where "dc" denotes 'Domain Component'. The other lines show the attributes in the entry. Attribute names are typically mnemonic strings, like "cn" for common name, "dc" for domain component, "mail" for e-mail address, and "sn" for surname.

  Incorrect Answers:

  A: A RADIUS server is a server with a database of user accounts and passwords used as a central authentication database for users requiring network access. The authentication method described in this question is not using a RADIUS server.

  B: Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. The authentication method described in this question is not SAML.

  C: Terminal Access Controller Access-Control System (TACACS) refers to a family of related protocols handling remote authentication and related services for networked access control through a centralized server. The authentication method described in this question is not TACACS+.

  References: http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol#Directory_structure

• Question 635:

  Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

  A. Kerberos

  B. TACACS+

  C. RADIUS

  D. LDAP

  Correct Answer: D

  The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services

  play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any

  organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

  A common usage of LDAP is to provide a "single sign on" where one password for a user is shared between many services, such as applying a company login code to web pages (so that staff log in only once to company computers, and then

  are automatically logged into the company intranet). LDAP is based on a simpler subset of the standards contained within the X.500 standard. Because of this relationship, LDAP is sometimes called X.500-lite.

  A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS. Global Catalog is available by default on ports 3268, and 3269 for

  LDAPS. The client then sends an operation request to the server, and the server sends responses in return.

  The client may request the following operations:

  StartTLS -- use the LDAPv3 Transport Layer Security (TLS) extension for a secure connection

  Incorrect Answers:

  A: Kerberos is a computer network authentication protocol which works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed it primarily at a clientserver model and it provides mutual authentication--both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks. Kerberos builds on symmetric key cryptography and requires a trusted third party, and optionally may use public- key cryptography during certain phases of authentication. Kerberos uses UDP port 88 by default. Kerberos is not based on a previous X.500 specification as is LDAP.

  B: Terminal Access Controller Access-Control System (TACACS) refers to a family of related protocols handling remote authentication and related services for networked access control through a centralized server. The original TACACS protocol, which dates back to 1984, was used for communicating with an authentication server, common in older UNIX networks. TACACS+ and RADIUS have generally replaced TACACS and XTACACS in more recently built or updated networks. TACACS+ is an entirely new protocol and is not compatible with its predecessors, TACACS and XTACACS. TACACS+ uses TCP (while RADIUS operates over UDP). Since TACACS+ uses the authentication, authorization, and accounting (AAA) architecture, these separate components of the protocol can be segregated and handled on separate servers. TACACS+ is not based on a previous X.500 specification as is LDAP.

  C: Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service. Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. RADIUS is not based on a previous X.500 specification as is LDAP.

  References: http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 http://en.wikipedia.org/wiki/TACACS http://en.wikipedia.org/wiki/RADIUS

• Question 636:

  An information bank has been established to store contacts, phone numbers and other records.

  An application running on UNIX would like to connect to this index server using port 88. Which of the following authentication services would this use this port by default?

  A. Kerberos

  B. TACACS+

  C. Radius

  D. LDAP

  Correct Answer: A

  Kerberos makes use of port 88.

  Incorrect Answers:

  B: TACACS makes use of TCP port 49 by default.

  C: RADIUS makes use of various UDP ports.

  D: LDAP makes use of port 389.

  References: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 637:

  Which of the following authentication services uses a ticket granting system to provide access?

  A. RADIUS

  B. LDAP

  C. TACACS+

  D. Kerberos

  Correct Answer: D

  The basic process of Kerberos authentication is as follows:

  The subject provides logon credentials.

  The Kerberos client system encrypts the password and transmits the protected credentials to the KDC. The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition

  of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client.

  The client receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm. The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC. The

  KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime.

  The client receives the ST.

  The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved.

  Incorrect Answers:

  A: Radius does not make use of tickets.

  B: The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

  C: TACACS+ makes use of Kerberos as an authentication mechanism.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 270- 274.

• Question 638:

  Which of the following types of authentication solutions use tickets to provide access to various resources from a central location?

  A. Biometrics

  B. PKI

  C. ACLs

  D. Kerberos

  Correct Answer: D

  The basic process of Kerberos authentication is as follows:

  The subject provides logon credentials.

  The Kerberos client system encrypts the password and transmits the protected credentials to the KDC. The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition

  of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client.

  The client receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm. The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC. The

  KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime.

  The client receives the ST.

  The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved.

  Incorrect Answers:

  A: Biometrics provides authentication based on physical characteristics or traits.

  B: Public Key Infrastructure (PKI) solutions are based on certificates and the use of a CA.

  C: ACLs provide authentication based on rules.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 24, 130, 271, 350.

• Question 639:

  Jane, a security administrator, has been tasked with explaining authentication services to the company's management team. The company runs an active directory infrastructure. Which of the following solutions BEST relates to the host authentication protocol within the company's environment?

  A. Kerberos

  B. Least privilege

  C. TACACS+

  D. LDAP

  Correct Answer: A

  Kerberos was accepted by Microsoft as the chosen authentication protocol for Windows 2000 and Active Directory domains that followed.

  Incorrect Answers:

  B: Least privilege requires that users are allowed only the minimum required access, permissions, and privileges necessary to complete their work tasks. Furthermore, it is not an authentication protocol.

  C: TACACS+ is a protocol that uses the authentication, authorization, and accounting (AAA) architecture. It is used for remote authentication.

  D: LDAP allows clients to access resources within a directory service.

  References:

  http://en.wikipedia.org/wiki/NT_LAN_Manager

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 82, 271, 273.

• Question 640:

  A security administrator has installed a new KDC for the corporate environment. Which of the following authentication protocols is the security administrator planning to implement across the organization?

  A. LDAP

  B. RADIUS

  C. Kerberos

  D. XTACACS

  Correct Answer: C

  The fundamental component of a Kerberos solution is the key distribution centre (KDC), which is responsible for verifying the identity of principles and granting and controlling access within a network environment through the use of secure cryptographic keys and tickets.

  Incorrect Answers:

  A: The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. B, D: RADIUS and XTACACS do not require a KDC to function.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 270- 274.