CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 741:

  A certificate authority takes which of the following actions in PKI?

  A. Signs and verifies all infrastructure messages

  B. Issues and signs all private keys

  C. Publishes key escrow lists to CRLs

  D. Issues and signs all root certificates

  Correct Answer: D

  A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is part of a public key infrastructure (PKI) scheme. The most common commercial variety is based on the ITU-T X.509 standard, which

  normally includes a digital signature from a certificate authority (CA). Note: In cryptography and computer security, a root certificate is an unsigned public key certificate (also called self-signed certificate) that identifies the Root Certificate

  Authority (CA).

  Incorrect Answers:

  A: A CA does not sign or verify infrastructure messages.

  B: The CA issues and sign public keys, not private keys. In cryptography, a PKI(Public key infrastructure) is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). The primary role of the

  CA is to digitally sign and publish the public key bound to a given user.

  C: A CA would not publish key escrow lists.

  Key escrow is the process of storing keys or certificates for use by law enforcement. Law enforcement has the right, under subpoena, to conduct investigations using these keys.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 278-290

• Question 742:

  Deploying a wildcard certificate is one strategy to:

  A. Secure the certificate's private key.

  B. Increase the certificate's encryption key length.

  C. Extend the renewal date of the certificate.

  D. Reduce the certificate management burden.

  Correct Answer: D

  A wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. This saves money and reduces the management burden of managing multiple certificates, one for each subdomain.

  A single Wildcard certificate for *.example.com, will secure all these domains: payment.example.com contact.example.com login-secure.example.com www.example.com

  Because the wildcard only covers one level of subdomains (the asterisk doesn't match full stops), these domains would not be valid for the certificate: test.login.example.com

  Incorrect Answers:

  A: A wildcard certificate is not used to secure the certificate's private key. A private key is typically installed into a certificates store on a server.

  B: The certificate's encryption key length is specified when the certificate is requested whether it's a wildcard certificate or a single domain certificate. To increase the certificate's encryption key length, you would need to request a new certificate. A wildcard certificate is not used increase the certificate's encryption key length.

  C: You cannot extend the renewal date of a certificate. A certificate when requested will be valid for a set period of time, typically one or two years. When the certificate expires, it must be renewed by requesting a new certificate.

  References: http://en.wikipedia.org/wiki/Wildcard_certificate

• Question 743:

  A security engineer is asked by the company's development team to recommend the most secure method for password storage. Which of the following provide the BEST protection against brute forcing stored passwords? (Select TWO).

  A. PBKDF2

  B. MD5

  C. SHA2

  D. Bcrypt

  E. AES

  F. CHAP

  Correct Answer: AD

  A: PBKDF2 (Password-Based Key Derivation Function 2) is part of PKCS #5 v. 2.01. It applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key.

  D: bcrypt is a key derivation function for passwords based on the Blowfish cipher. Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it

  slower, so it remains resistant to brute-force search attacks even with increasing computation power.

  The bcrypt function is the default password hash algorithm for BSD and many other systems.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 109-110, 139, 143, 250, 255-256, 256

• Question 744:

  Which of the following protocols provides transport security for virtual terminal emulation?

  A. TLS

  B. SSH

  C. SCP

  D. S/MIME

  Correct Answer: B

  Secure Shell (SSH) is a tunneling protocol originally designed for Unix systems. It uses encryption to establish a secure connection between two systems. SSH also provides alternative, security-equivalent programs for such Unix standards as Telnet, FTP, and many other communications-oriented applications. SSH is available for use on Windows systems as well. This makes it the preferred method of security for Telnet and other cleartext oriented programs in the Unix environment.

  Incorrect Answers:

  A: TLS is used to provide a secure channel, not to establish a telnet connection. The Secure Socket Layer (SSL) and Transport Layer Security (TLS) is the most widely deployed security protocol used today. It is essentially a protocol that provides a secure channel between two machines operating over the Internet or an internal network.

  C: Secure copy or SCP is a means of securely transferring computer files between a local host and a remote host or between two remote hosts. It is based on the Secure Shell (SSH) protocol. SCP is not used to establish a telnet connection.

  D: S/MIME is for e-mail and other electronic messaging applications, not for telnet connections. S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity, non-repudiation of origin (using digital signatures), privacy and data security (using encryption).

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 76, 91, 270, 271

• Question 745:

  Which of the following would be used as a secure substitute for Telnet?

  A. SSH

  B. SFTP

  C. SSL

  D. HTTPS

  Correct Answer: A

  Secure Shell (SSH) is a tunneling protocol originally designed for Unix systems. It uses encryption to establish a secure connection between two systems. SSH also provides alternative, security-equivalent programs for such Unix standards as Telnet, FTP, and many other communications-oriented applications. SSH is available for use on Windows systems as well. This makes it the preferred method of security for Telnet and other cleartext oriented programs in the Unix environment.

  Incorrect Answers:

  B: SFTP is for File transfers, not for telnet.

  The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream.

  C: SSL is used to provide a secure channel, not to establish a telnet connection. The Secure Socket Layer (SSL) and Transport Layer Security (TLS) is the most widely deployed security protocol used today. It is essentially a protocol that

  provides a secure channel between two machines operating over the Internet or an internal network.

  D: HTTPS is not used for telnet connections.

  HTTPS is a communications protocol for secure communication over a computer network, with especially wide deployment on the Internet.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 76, 91, 268-269, 271, 274

• Question 746:

  A new MPLS network link has been established between a company and its business partner.

  The link provides logical isolation in order to prevent access from other business partners. Which of the following should be applied in order to achieve confidentiality and integrity of all data across the link?

  A. MPLS should be run in IPVPN mode.

  B. SSL/TLS for all application flows.

  C. IPSec VPN tunnels on top of the MPLS link.

  D. HTTPS and SSH for all application flows.

  Correct Answer: C

  IPSec can very well be used with MPLS. IPSec could provide VPN tunnels on top if the MPLS link. Internet Protocol Security (IPSec) isn't a tunneling protocol, but it's used in conjunction with tunneling protocols. IPSec is oriented primarily toward LAN-to-LAN connections, but it can also be used with dial-up connections. IPSec provides secure authentication and encryption of data and headers; this makes it a good choice for security.

  Incorrect Answers:

  A: MPLS tunnelling would not hide the logical MPLS link.

  B: SSL/TLS could provide encryption, but not the tunnelling required for the logical isolation.

  D: To provide the required logical isolation tunnelling should be used. HTTPS and SSH cannot provide tunnelling.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 91, 103-105, 268, 271, 274, 274-275 http:// www.networkworld.com/article/2297191/lan-wan/chapter-6--how-ipseccomplements- mpls.html

• Question 747:

  Which of the following protocols encapsulates an IP packet with an additional IP header?

  A. SFTP

  B. IPSec

  C. HTTPS

  D. SSL

  Correct Answer: B

  Authentication Header (AH) is a member of the IPsec protocol suite. AH operates directly on top of IP, using IP protocol number 51.

  Incorrect Answers:

  A: The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) does not encapsulate IP packets with an additional IP header. SFTP is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream.

  C: HTTPS does not add an extra IP header to IP packages. Technically, HTTPS is not a protocol in and of itself; rather, it is the result of simply layering the Hypertext Transfer Protocol (HTTP) on top of the SSL or TLS protocol, thus adding the security capabilities of SSL/TLS to standard HTTP communications.

  D: SSL does not encapsulate IP packets with an additional IP header. Secure Sockets Layer (SSL) is used to establish a secure communication connection between two TCP-based machines.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 76, 268-269, 274, 274-275

• Question 748:

  A security administrator has been tasked with setting up a new internal wireless network that must use end to end TLS. Which of the following may be used to meet this objective?

  A. WPA

  B. HTTPS

  C. WEP

  D. WPA 2

  Correct Answer: D

  Wi-Fi Protected Access 2 (WPA2) was intended to provide security that's equivalent to that on a wired network, and it implements elements of the 802.11i standard. In April 2010, the Wi-Fi Alliance announced the inclusion of additional Extensible Authentication Protocol (EAP) types to its certification programs for WPA- and WPA2- Enterprise certification programs. EAP-TLS is included in this certification program. Note: Although WPA mandates the use of TKIP, WPA2 requires Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). CCMP uses 128-bit AES encryption with a 48-bit initialization vector. With the larger initialization vector, it increases the difficulty in cracking and minimizes the risk of a replay attack.

  Incorrect Answers:

  A: The difference between WPA and WPA2 is that the former implements most, but not all, of 802.11i in order to be able to communicate with older wireless devices that might still need an update through their firmware in order to be compliant.

  B: HTTPS is not a protocol for wireless communication. HTTPS is a communications protocol for secure communication over a computer network, with especially wide deployment on the Internet.

  C: In 2003 the Wi-Fi Alliance announced that WEP had been superseded by Wi-Fi Protected Access (WPA). WEP does include support for TLS.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 171, 172-173, 274

• Question 749:

  Recent data loss on financial servers due to security breaches forced the system administrator to harden their systems. Which of the following algorithms with transport encryption would be implemented to provide the MOST secure web connections to manage and access these servers?

  A. SSL

  B. TLS

  C. HTTP

  D. FTP

  Correct Answer: B

  Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. Transport Layer Security (TLS) is a security protocol that expands upon SSL. Many industry analysts predict that TLS will replace SSL in the future. TLS 1.0 was first defined in RFC 2246 in January 1999 as an upgrade of SSL Version 3.0. As of February 2015, the latest versions of all major web browsers support TLS 1.0, 1.1, and 1.2, have them enabled by default.

  Incorrect Answers:

  A: As of 2014 the 3.0 version of SSL is considered insecure as it is vulnerable to the POODLE attack that affects all block ciphers in SSL; and RC4, the only non- block cipher supported by SSL 3.0, is also feasibly broken as used in SSL 3.0.

  B: The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, hypermedia information systems. HTTP is not a transport protocol.

  D: The File Transfer Protocol (FTP) is not a transport layer protocol. FTP is a standard network protocol used to transfer computer files from one host to another host over a TCP-based network, such as the Internet. FTP is built on a client-server architecture and uses separate control and data connections between the client and the server.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 268-269

• Question 750:

  Which of the following cryptographic related browser settings allows an organization to communicate securely?

  A. SSL 3.0/TLS 1.0

  B. 3DES

  C. Trusted Sites

  D. HMAC

  Correct Answer: A

  Secure Sockets Layer (SSL) is used to establish a secure communication connection between two TCP-based machines. Transport Layer Security (TLS) is a security protocol that expands upon SSL. Many industry analysts predict that TLS will replace SSL in the future. TLS 1.0 was first defined in RFC 2246 in January 1999 as an upgrade of SSL Version 3.0. As of February 2015, the latest versions of all major web browsers support TLS 1.0, 1.1, and 1.2, have them enabled by default.

  Incorrect Answers:

  B: You cannot configure your browser to user 3DES. Triple DES (3DES) is a symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block.

  C: You can configure trusted sites in your browser. This sets the level of security of that site. This would not guarantee secure communication, however.

  D: You cannot configure your browser to use HMAC to secure communication. A keyed-hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret cryptographic key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authentication of a message.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 250, 260, 268