CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 771:

  A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. Which of the following is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of transactional data?

  A. AES

  B. 3DES

  C. RC4

  D. WPA2

  Correct Answer: B

  3DES (Triple DES) is based on DES.

  In cryptography, Triple DES (3DES) is the common name for the Triple Data Encryption Algorithm symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. The electronic

  payment industry uses Triple DES and continues to develop and promulgate standards based upon it (e.g. EMV). Microsoft OneNote, Microsoft Outlook 2007, and Microsoft System Center Configuration Manager 2012, use Triple DES to

  password protect user content and system data.

  Incorrect Answers:

  A: AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. DES and AES are completely different whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler.

  C: RC4 is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS). DES and AES are different protocols used for different purposes whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler.

  D: WPA2 (Wireless Protected Access 2) is used for securing wireless network connections. DES and WPA2 are different protocols used for different purposes whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler.

  References: http://en.wikipedia.org/wiki/Triple_DES http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172-173, 250, 251, 255-256

• Question 772:

  Which of the following are restricted to 64-bit block sizes? (Select TWO).

  A. PGP

  B. DES

  C. AES256

  D. RSA

  E. 3DES

  F. AES

  Correct Answer: BE

  B: The Data Encryption Standard (DES) has been used since the mid-1970s. It was the primary standard used in government and industry until it was replaced by AES. It's based on a 56-bit key and has several modes that offer security and integrity. It is now considered insecure because of the small key size.

  E: Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys).

  Incorrect Answers:

  A: International Data Encryption Algorithm (IDEA) was developed by a Swiss consortium. It's an algorithm that uses a 128-bit key. This product is similar in speed and capability to DES, but it's more secure. IDEA is used in Pretty Good Privacy (PGP), a public domain encryption system used by many for email.

  C: AES256 (also often written as AES-256) uses 256 bits instead of 128.

  D: RSA is not restricted to 64-bit keys. 1024 and 2048 bit keys can be used, for example.

  F: AES supports key sizes of 128, 192, and 256 bits, with 128 bits being the default.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256, 272-273

• Question 773:

  Which of the following provides additional encryption strength by repeating the encryption process with additional keys?

  A. AES

  B. 3DES

  C. TwoFish

  D. Blowfish

  Correct Answer: B

  Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys).

  Incorrect Answers:

  A: Advanced Encryption Standard (AES) has replaced DES as the current standard, and it uses the Rijndael algorithm. It was developed by Joan Daemen and Vincent Rijmen. AES is the current product used by U.S. governmental agencies. It supports key sizes of 128, 192, and 256 bits, with 128 bits being the default.

  C: Twofish is quite similar to Blowfish and works on 128-bit blocks.

  D: Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64-bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits).

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 774:

  To ensure compatibility with their flagship product, the security engineer is tasked to recommend an encryption cipher that will be compatible with the majority of third party software and hardware vendors. Which of the following should be recommended?

  A. SHA

  B. MD5

  C. Blowfish

  D. AES

  Correct Answer: D

  AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. AES is used to encrypt data, not to verify data integrity.

  Incorrect Answers:

  A: The first version of SHA is from 1993. SHA is not as widespread as AES. The Secure Hash Algorithm (SHA) was designed to ensure the integrity of a message. SHA is a one-way hash that provides a hash value that can be used with an encryption protocol. This algorithm produces a 160-bit hash value.

  B: MD5 is from 1992. Usage of MD5 is not as widespread as that of AES. The Message Digest Algorithm (MD) also creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

  C: Compared to AES Blowfish is newer and much less widespread. Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64- bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 775:

  Which of the following can be implemented with multiple bit strength?

  A. AES

  B. DES

  C. SHA-1

  D. MD5

  E. MD4

  Correct Answer: A

  AES (a symmetric algorithm) uses key sizes of 128, 192, or 256 bits.

  Incorrect Answers:

  B: The Data Encryption Standard (DES) has been used since the mid-1970s. It was the primary standard used in government and industry until it was replaced by AES. It's based on a 56-bit key and has several modes that offer security and integrity.

  C: The Secure Hash Algorithm (SHA) was designed to ensure the integrity of a message. SHA is a one-way hash that provides a hash value that can be used with an encryption protocol. This algorithm produces a 160-bit hash value. SHA-2 has several sizes: 224, 256, 334, and 512 bit.

  D: The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2. MD5 is the newest version of the algorithm. It produces a 128-bit hash, but the algorithm is more complex than its predecessors and offers greater security.

  E: The MD4 Message-Digest Algorithm is a cryptographic hash function developed by Ronald Rivest in 1990. The digest length is 128 bits

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 776:

  Which of the following is used to verify data integrity? A.SHA

  B. 3DES

  C. AES

  D. RSA

  Correct Answer: A

  SHA stands for "secure hash algorithm". SHA-1 is the most widely used of the existing SHA hash functions, and is employed in several widely used applications and protocols including TLS and SSL, PGP, SSH, S/MIME, and IPsec. It is used

  to ensure data integrity.

  Note:

  A hash value (or simply hash), also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that it is extremely unlikely that some

  other text will produce the same hash value.

  Hashes play a role in security systems where they're used to ensure that transmitted messages have not been tampered with. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then

  decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they're the same, there is a very high probability that the message was transmitted intact. This is how hashing is

  used to ensure data integrity.

  Incorrect Answers:

  B: In cryptography, Triple DES (3DES) is the common name for the Triple Data Encryption Algorithm (TDEA or Triple DEA) symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. 3DES is used to encrypt data, not to verify data integrity.

  C: AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. AES is used to encrypt data, not to verify data integrity.

  D: RSA encryption is used for encrypting data in transit. RSA involves a public key and a private key. The public key can be known by everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted in a reasonable amount of time using the private key. RSA is used to encrypt data, not to verify data integrity.

  References: http://en.wikipedia.org/wiki/SHA-1 Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 777:

  Users report that after downloading several applications, their systems' performance has noticeably decreased. Which of the following would be used to validate programs prior to installing them?

  A. Whole disk encryption

  B. SSH

  C. Telnet

  D. MD5

  Correct Answer: D

  MD5 can be used to locate the data which has changed.

  The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

  Incorrect Answers:

  A: Disk encryption would not help in checking integrity of downloaded files.

  B: Secure Shell (SSH) is a tunnelling protocol originally used on Unix systems. It is not used to validate the integrity of files.

  C: Telnet cannot be used to protect integrity of program files. Telnet is an interactive terminal emulation protocol. It allows a remote user to conduct an interactive session with a Telnet server. This session can appear to the client as if it were a local session.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 76, 255, 271, 290

• Question 778:

  Joe, an employee, was escorted from the company premises due to suspicion of revealing trade secrets to a competitor. Joe had already been working for two hours before leaving the premises.

  A security technician was asked to prepare a report of files that had changed since last night's integrity scan. Which of the following could the technician use to prepare the report? (Select TWO).

  A. PGP

  B. MD5

  C. ECC

  D. AES

  E. Blowfish

  F. HMAC

  Correct Answer: BF

  B: MD5 can be used to locate the data which has changed. The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

  F: A common method of verifying integrity involves adding a message authentication code (MAC) to the message. HMAC (Hash-Based Message Authentication Code) uses a hashing algorithm along with a symmetric key.

  Incorrect Answers:

  A: Pretty Good Privacy (PGP) is a freeware email encryption system. It would not be of any use to locate files that have been changed.

  C: ECC is an encryption algorithm. It is not used to locate files that have changed.

  D: AES is an encryption algorithm. It is not used to locate files that have changed.

  E: Blowfish is an encryption system. It is not used to locate files that have changed.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 251, 253-254, 255, 260, 272

• Question 779:

  While setting up a secure wireless corporate network, which of the following should Pete, an administrator, avoid implementing?

  A. EAP-TLS

  B. PEAP

  C. WEP

  D. WPA

  Correct Answer: C

  WEP is one of the more vulnerable security protocols. The only time to use WEP is when you must have compatibility with older devices that do not support new encryption.

  Incorrect Answers:

  A, B: Extensible Authentication Protocol (EAP) provides a framework for authentication that is often used with wireless networks. Among the five EAP types adopted by the WPA/WPA2 standard are EAP-TLS, EAP-PSK, EAP-MD5, and two

  that you need to know for the exam:

  LEAP and PEAP.

  D: The Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) authentication protocols were designed to address the core, easy-to-crack problems of WEP.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 181-182, 182-183, 258

• Question 780:

  Which of the following provides the HIGHEST level of confidentiality on a wireless network?

  A. Disabling SSID broadcast

  B. MAC filtering

  C. WPA2

  D. Packet switching

  Correct Answer: C

  The Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) authentication protocols were designed to address the core, easy-to-crack problems of WEP. Incorrect Answers:

  A: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast.

  B: MAC filtering would increase the security, but an authentication protocol such as WPA2 would still be required. Note: When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so.

  D: Packet switching is a method of transferring data on an Ethernet network. Packet switching does not address wireless security.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258