CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 781:

  Which of the following is a concern when encrypting wireless data with WEP?

  A. WEP displays the plain text entire key when wireless packet captures are reassembled

  B. WEP implements weak initialization vectors for key transmission

  C. WEP uses a very weak encryption algorithm

  D. WEP allows for only four pre-shared keys to be configured

  Correct Answer: B

  The initialization vector (IV) that WEP uses for encryption is 24-bit, which is quite weak and means that IVs are reused with the same key. By examining the repeating result, it was easy for attackers to crack the WEP secret key. This is known as an IV attack.

  Incorrect Answers:

  A: WEP does not display the entire key as plain text.

  B: The WEP encryption algorithm is not the main WEP weakness.

  D: WEP has no restrictions on the number of pre-shared keys.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 258

• Question 782:

  Which of the following provides the strongest authentication security on a wireless network?

  A. MAC filter

  B. WPA2

  C. WEP

  D. Disable SSID broadcast

  Correct Answer: B

  The Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) authentication protocols were designed to address the core, easy-to-crack problems of WEP.

  Incorrect Answers:

  A: MAC filtering would increase the security, but an authentication protocol such as WPA2 would still be required. Note: When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so.

  C: WEP is weak compared to WPA2. WEP has many vulnerabilities.

  D: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258

• Question 783:

  Joe, the systems administrator, is setting up a wireless network for his team's laptops only and needs to prevent other employees from accessing it. Which of the following would BEST address this?

  A. Disable default SSID broadcasting.

  B. Use WPA instead of WEP encryption.

  C. Lower the access point's power settings.

  D. Implement MAC filtering on the access point.

  Correct Answer: D

  If MAC filtering is turned off, any wireless client that knows the values looked for (MAC addresses) can join the network. When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so.

  Incorrect Answers:

  A: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast.

  B: WPA offers better protection than WEP, but is not the best solution here.

  C: On the chance that the signal is actually traveling too far, some access points include power level controls, which allow you to reduce the amount of output provided. However, this would help here. Employees would still be in the range of the access point.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258

• Question 784:

  The IT department has installed new wireless access points but discovers that the signal extends far into the parking lot. Which of the following actions should be taken to correct this?

  A. Disable the SSID broadcasting

  B. Configure the access points so that MAC filtering is not used

  C. Implement WEP encryption on the access points

  D. Lower the power for office coverage only

  Correct Answer: D

  On the chance that the signal is actually traveling too far, some access points include power level controls, which allow you to reduce the amount of output provided.

  Incorrect Answers:

  A: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast.

  B: Disabling MAC filtering would lower the network security. If MAC filtering is turned off, any wireless client that knows the values looked for (MAC addresses) can join the network. When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so.

  C: WEP encryption is weak and has many vulnerabilities.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258

• Question 785:

  A security technician is attempting to access a wireless network protected with WEP. The technician does not know any information about the network. Which of the following should the technician do to gather information about the configuration of the wireless network?

  A. Spoof the MAC address of an observed wireless network client

  B. Ping the access point to discover the SSID of the network

  C. Perform a dictionary attack on the access point to enumerate the WEP key

  D. Capture client to access point disassociation packets to replay on the local PC's loopback

  Correct Answer: A

  With ARP spoofing (also known as ARP poisoning), the MAC (Media Access Control) address of the data is faked. By faking this value, it is possible to make it look as if the data came from a network that it did not. This can be used to gain access to the network, to fool the router into sending data here that was intended for another host, or to launch a DoS attack. In all cases, the address being faked is an address of a legitimate user, and that makes it possible to get around such measures as allow/deny lists. Note: As an example, the initialization vector (IV) that WEP uses for encryption is 24-bit, which is quite weak and means that IVs are reused with the same key. By examining the repeating result, it was easy for attackers to crack the WEP secret key. This is known as an IV attack.

  Incorrect Answers:

  B: An SSID would not provide much information about the network.

  C: A dictionary attack uses a dictionary of common words to attempt to find the user's password. It is not of particular use to gain access to WEP networks.

  D: In order to do a forged dissociation attack the attacker sends a spoofed Disassociation frame where the source MAC address is set to that of the AP.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 258, 321-322

• Question 786:

  Which of the following types of cryptography should be used when minimal overhead is necessary for a mobile device?

  A. Block cipher

  B. Elliptical curve cryptography

  C. Diffie-Hellman algorithm

  D. Stream cipher

  Correct Answer: B

  Regarding the performance of ECC applications on various mobile devices, ECC is the most suitable PKC (Public-key cryptography) scheme for use in a constrained environment. Note: Elliptic curve cryptography (ECC) is an approach to

  public-key cryptography based on the algebraic structure of elliptic curves over finite fields. One of the main benefits in comparison with non-ECC cryptography (with plain Galois fields as a basis) is the same level of security provided by keys

  of smaller size. Using smaller key size would be faster.

  Incorrect Answers:

  A, D: Block cipher and stream cipher are cryptography subtypes.'=

  C: Diffie-Hellman would require longer keys which would increase overhead.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 245-246, 253 http://www.studymode.com/essays/Elliptic-Curve-Cryptography-And-Its-Applications- 1560318.html http://

  en.wikipedia.org/wiki/Elliptic_curve_cryptography

• Question 787:

  Matt, a security analyst, needs to select an asymmetric encryption method that allows for the same level of encryption strength with a lower key length than is typically necessary. Which of the following encryption methods offers this capability?

  A. Twofish

  B. Diffie-Hellman

  C. ECC

  D. RSA

  Correct Answer: C

  Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. One of the main benefits in comparison with non-ECC cryptography (with plain Galois fields as a basis) is the same level of security provided by keys of smaller size.

  Incorrect Answers:

  A: Blowfish is an encryption system that performs a 64-bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). Twofish is quite similar and works on 128-bit blocks.

  B: Diffie-Hellman would require longer keys.

  D: Elliptic Curve Cryptography (ECC) provides similar functionality to RSA but uses smaller key sizes to obtain the same level of security.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251, 252, 253, 254 http://www.studymode.com/essays/Elliptic-Curve-Cryptography-And-Its-Applications- 1560318.html http://

  en.wikipedia.org/wiki/Elliptic_curve_cryptography

• Question 788:

  Digital Signatures provide which of the following?

  A. Confidentiality

  B. Authorization

  C. Integrity

  D. Authentication

  E. Availability

  Correct Answer: C

  A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender.

  Incorrect Answers:

  A: A cryptographic system would be needed to provide Confidentiality.

  B: Digital signatures are not used for authorization.

  D: Digital signature is one methods of verifying authenticity but there are other methods as well.

  E: Digital signatures are not helpful in providing availability.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 414

• Question 789:

  Which of the following must a user implement if they want to send a secret message to a coworker by embedding it within an image?

  A. Transport encryption

  B. Steganography

  C. Hashing

  D. Digital signature

  Correct Answer: B

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.

  Incorrect Answers:

  A: Transport encryption encrypt the payload data

  C: A hash function is used to map digital data of variable size to digital data of fixed length.

  D: A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 249, 155, 261, 323 http://en.wikipedia.org/wiki/Steganography

• Question 790:

  Which of the following can hide confidential or malicious data in the whitespace of other files (e.g. JPEGs)?

  A. Hashing

  B. Transport encryption

  C. Digital signatures

  D. Steganography

  Correct Answer: D

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.

  Incorrect Answers:

  A: A hash function is used to map digital data of variable size to digital data of fixed length.

  B: Transport encryption encrypt the payload data

  C: A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 249, 255, 261, 323 http://en.wikipedia.org/wiki/Steganography