CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 751:

  Which of the following protocols is the security administrator observing in this packet capture?

  12:33:43, SRC 192.168.4.3:3389, DST 10.67.33.20:8080, SYN/ACK

  A. HTTPS

  B. RDP

  C. HTTP

  D. SFTP

  Correct Answer: B

  Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection.

  Example of RDP tracing output:

  No. Time Delta Source Destination Protocol Length Info

  5782, 2013-01-06 09:52:15.407, 0.000 , SRC 10.7.3.187 , DST 10.0.107.58, TCP, 62, 3389 > 59193 [SYN, ACK]

  Incorrect Answers:

  A: The HTTPS packet format does not include SRC, DST and SYN/ACK attributes.

  C: The HTTP packet format does not include SRC, DST and SYN/ACK attributes.

  D: The SFTP packet format does not include SRC, DST and SYN/ACK attributes.

  References: http://en.wikipedia.org/wiki/Remote_Desktop_Protocol Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 76, 274

• Question 752:

  Which of the following algorithms has well documented collisions? (Select TWO).

  A. AES

  B. MD5

  C. SHA

  D. SHA-256

  E. RSA

  Correct Answer: BC

  B: MD5 biggest weakness is that it does not have strong collision resistance, and thus it is no longer recommended for use.

  C: SHA-1 (also known as SHA) is being retired from most government uses; the U.S. National Institute of Standards and Technology said, "Federal agencies should stop using SHA-1 for...applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010", though that was later relaxed. Note: The hashing algorithm must have few or no collisions. This means that hashing two different inputs does not give the same output. Cryptographic hash functions are usually designed to be collision resistant. But many hash functions that were once thought to be collision resistant were later broken. MD5 and SHA-1 in particular both have published techniques more efficient than brute force for finding collisions.

  Incorrect Answers:

  A: AES has much fewer hash collisions compared to both MD5 and SHA.

  D: SHA-256 (also known as SHA-2) has much fewer hash collisions compared to both MD5 and SHA.

  E: RSA has much fewer hash collisions compared to both MD5 and SHA.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 252, 255, 255-256

• Question 753:

  Which of the following offers the LEAST secure encryption capabilities?

  A. TwoFish

  B. PAP

  C. NTLM

  D. CHAP

  Correct Answer: B

  PAP transmits unencrypted ASCII passwords over the network and is therefore considered insecure. It is used as a last resort when the remote server does not support a stronger authentication protocol, like CHAP or EAP.

  Incorrect Answers:

  A: TwoFish provides stronger encryption compared to NTLM, CHAP and PAP. Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. Twofish is related to the earlier block cipher Blowfish.

  C: NTLM provides stronger encryption compared to CHAP and PAP. NT LAN Manager (NTLM) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users. NTLM is being replaced by Kerberos.

  D: CHAP provides a more secure encryption than PAP. CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 143, 251, 256

• Question 754:

  Connections using point-to-point protocol authenticate using which of the following? (Select TWO).

  A. RIPEMD

  B. PAP

  C. CHAP

  D. RC4

  E. Kerberos

  Correct Answer: BC

  B: A password authentication protocol (PAP) is an authentication protocol that uses a password. PAP is used by Point to Point Protocol to validate users before allowing them access to server resources.

  C: CHAP is an authentication scheme used by Point to Point Protocol (PPP) servers to validate the identity of remote clients. CHAP periodically verifies the identity of the client by using a three-way handshake.

  Incorrect Answers:

  A: RIPEMD (RACE Integrity Primitives Evaluation Message Digest) is a family of cryptographic hash functions. RIPEMD is not used for point-to-point protocol authentication.

  D: RC4 is not used for point-to-point protocol authentication. RC4 (Rivest Cipher 4) is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS).

  E: Kerberos is primarily at aimed a clientserver model, not at point-to-point connections, and it provides mutual authentication--both the user and the server verify each other's identity. It works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 147-148, 251, 255

• Question 755:

  A security administrator must implement a system to allow clients to securely negotiate encryption keys with the company's server over a public unencrypted communication channel.

  Which of the following implements the required secure key negotiation? (Select TWO).

  A. PBKDF2

  B. Symmetric encryption

  C. Steganography

  D. ECDHE

  E. Diffie-Hellman

  Correct Answer: DE

  Elliptic curve DiffieHellman (ECDH) is an anonymous key agreement protocol that allows two parties, each having an elliptic curve public-private key pair, to establish a shared secret over an insecure channel. This shared secret may be directly used as a key, or better yet, to derive another key which can then be used to encrypt subsequent communications using a symmetric key cipher. It is a variant of the DiffieHellman protocol using elliptic curve cryptography. Note: Adding an ephemeral key to Diffie-Hellman turns it into DHE (which, despite the order of the acronym, stands for Ephemeral Diffie-Hellman). Adding an ephemeral key to Elliptic Curve Diffie-Hellman turns it into ECDHE (again, overlook the order of the acronym letters, it is called Ephemeral Elliptic Curve Diffie-Hellman). It is the ephemeral component of each of these that provides the perfect forward secrecy.

  Incorrect Answers:

  A: PBKDF2 is to strengthen keys, but it would resolve the problem with the key exchange on an unsecure channel. PBKDF2 (Password-Based Key Derivation Function 2) is part of PKCS #5 v. 2.01. It applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key.

  B: Symmetric encryption would not in itself help on an unsecure channel.

  C: Steganography is the process of hiding one message in another. Steganography is not used for secure key negotiation.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 248, 249-251, 254, 256

  QUESTIO5N NO: 53

  An administrator has two servers and wants them to communicate with each other using a secure algorithm.

  Which of the following choose to provide both CRC integrity checks and RCA encryption?

  A. NTLM

  B. RSA

  C. CHAP

  D. ECDHE

  Answer: D

  ECDHE provides both CRC integrity checks and RCA encryption. Adding an ephemeral key to Elliptic Curve Diffie-Hellman turns it into ECDHE. It is the ephemeral component of each of these that provides the perfect forward secrecy.

  Forward secrecy is a property of any key exchange system, which ensures that if one key is compromised, subsequent keys will not also be compromised. Perfect forward secrecy occurs when this process is unbreakable.

  Incorrect Answers:

  A: NTLM does not use RCA encryption.

  Microsoft replaced the LANMAN protocol with NTLM (NT LAN Manager) with the release of Windows NT. NTLM uses MD4/MD5 hashing algorithms. Several versions of this protocol exist (NTLMv1, NTLMv2), and it is still in widespread use

  despite the fact that Microsoft has pointed to Kerberos as being its preferred authentication protocol.

  B: RSA is one of the first practical public-key cryptosystems and is widely used for secure data transmission. However, RSA does not use RCA encryption.

  C: CHAP does use RCA encryption.

  CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret, although it

  is never sent over the network

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 143, 252, 254, 256

• Question 756:

  When using PGP, which of the following should the end user protect from compromise? (Select TWO).

  A. Private key

  B. CRL details

  C. Public key

  D. Key password

  E. Key escrow

  F. Recovery agent

  Correct Answer: AD

  A: In PGP only the private key belonging to the receiver can decrypt the session key. PGP combines symmetric-key encryption and public-key encryption. The message is encrypted using a symmetric encryption algorithm, which requires a symmetric key. Each symmetric key is used only once and is also called a session key.

  D: PGP uses a passphrase to encrypt your private key on your machine. Your private key is encrypted on your disk using a hash of your passphrase as the secret key. You use the passphrase to decrypt and use your private key.

  Incorrect Answers:

  B: A certificate revocation list (CRL) is a list of certificates. An end user of PGP does not have to be concerned with the CRL.

  C: The public key is available for everyone. It does need protection.

  E: Key escrow is not related to PGP. Key escrow is the process of storing keys or certificates for use by law enforcement.

  F: The recovery agent does not need to be protected by the end user.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 272-273, 285

• Question 757:

  Jane, a VPN administrator, was asked to implement an encryption cipher with a MINIMUM effective security of 128-bits. Which of the following should Jane select for the tunnel encryption?

  A. Blowfish

  B. DES

  C. SHA256

  D. HMAC

  Correct Answer: A

  Blowfish is an encryption system that performs a 64-bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). Among the alternatives listed above, it is the only cipher that can use a 128-bit key and which does provide additional security through a symmetric key.

  Incorrect Answers:

  B: DES does not provide 128 bit security. DES uses a 56-bit key.

  C: The hash size for the SHA256 algorithm is 256 bits.

  D: HMAC (Hash-Based Message Authentication Code) uses a hashing algorithm along with a symmetric key. HMAC with 128 bit would provide more additional security compared to Blowfish 128 bit as HMAC uses a symmetric key as well.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 250, 251, 255-256, 260

• Question 758:

  Sara, a security engineer, is testing encryption ciphers for performance. Which of the following ciphers offers strong encryption with the FASTEST speed?

  A. 3DES

  B. Blowfish

  C. Serpent

  D. AES256

  Correct Answer: B

  Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64- bit block cipher at very fast speeds. Blowfish is a fast, except when changing keys. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits).

  Incorrect Answers:

  A: 3DES would be slower than Blowfish.

  Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES.

  It increases the key length to 168 bits (using three 56-bit DES keys).

  C: Serpent would be slower than Blowfish.

  Serpent is a symmetric key block cipher that has a block size of 128 bits and supports a key size of 128, 192 or 256 bits.

  D: AES256 (also often written as AES-256) uses 256 bits instead of 128. This qualifies for U.S. government classification as Top Secret. AES256 would be slower than Blowfish.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256 http://en.wikipedia.org/wiki/Serpent_%28cipher%29

• Question 759:

  Which of the following should be used when a business needs a block cipher with minimal key size for internal encryption?

  A. AES

  B. Blowfish

  C. RC5

  D. 3DES

  Correct Answer: B

  Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64- bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits).

  Incorrect Answers:

  A: For AES there are three ciphers each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits.

  C: RC5 has a variable block size (32, 64 or 128 bits), key size (0 to 2040 bits) and number of rounds (0 to 255). The original suggested choice of parameters were a block size of 64 bits, a 128-bit key and 12 rounds.

  D: Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys).

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 760:

  Which of the following symmetric key algorithms are examples of block ciphers? (Select THREE).

  A. RC4

  B. 3DES

  C. AES

  D. MD5

  E. PGP

  F. Blowfish

  Correct Answer: BCF

  B: Triple DES (3DES) is the common name for the Triple Data Encryption Algorithm (TDEA or Triple DEA) symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block.

  C: Advanced Encryption Standard (AES) is a block cipher that has replaced DES as the current standard, and it uses the Rijndael algorithm. It was developed by Joan Daemen and Vincent Rijmen. AES is the current product used by U.S. governmental agencies.

  F: Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64-bit block cipher at very fast speeds.

  Incorrect Answers:

  A: RC4 is a stream cipher, not a block cipher. It is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS).

  D: MD5 is a hash function not a block cipher. It is a widely used cryptographic hash function producing a 128-bit (16-byte) hash value, typically expressed in text format as a 32 digit hexadecimal number.

  E: Pretty Good Privacy (PGP) is not a block cipher. It is a data encryption and decryption program that provides cryptographic privacy and authentication for data communication

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256, 272-273