CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 791:

  A security analyst discovered data such as images and word documents hidden within different types of files. Which of the following cryptographic concepts describes what was discovered?

  A. Symmetric encryption

  B. Non-repudiation

  C. Steganography

  D. Hashing

  Correct Answer: C

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.

  Incorrect Answers:

  A: Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext.

  B: Nonrepudiation prevents one party from denying actions they carried out.

  D: A hash function is used to map digital data of variable size to digital data of fixed length.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249-252, 255, 262, 323 http://en.wikipedia.org/wiki/Steganography

• Question 792:

  A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by camouflaging data inside of other files?

  A. Integrity

  B. Confidentiality

  C. Steganography

  D. Availability

  Correct Answer: C

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.

  Incorrect Answers:

  A: Integrity it computing terms proves that a person, file, computer or data is who it says it is. Hashing is used to prove the integrity of data to prove that it hasn't been modified. Integrity is not the process of camouflaging data inside of other files.

  B: Confidentiality defines who should be able to view information. Confidentiality is not the process of camouflaging data inside of other files.

  D: Availability in computing terms is used to ensure that a system remains online and accessible (available) in the event of a failure of a component. Availability is not the process of camouflaging data inside of other files.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 323, 259, 414 http://en.wikipedia.org/wiki/Steganography

• Question 793:

  Which of the following concepts is used by digital signatures to ensure integrity of the data?

  A. Non-repudiation

  B. Hashing

  C. Transport encryption

  D. Key escrow

  Correct Answer: B

  Most digital signature implementations also use a hash to verify that the message has not been altered, intentionally or accidently, in transit.

  Incorrect Answers:

  A: Regarding digital security, the cryptographical meaning and application of non-repudiation shifts to mean:

  *

  A service that provides proof of the integrity and origin of data.

  *

  An authentication that can be asserted to be genuine with high assurance.

  B: Digital signatures are not implemented through transport encryption.

  D: Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home

  mortgages) and made available if that third party requests them.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249, 255, 261, 262

• Question 794:

  All of the following are valid cryptographic hash functions EXCEPT:

  A. RIPEMD.

  B. RC4.

  C. SHA-512.

  D. MD4.

  Correct Answer: B

  RC4 is not a hash function. RC4 is popular with wireless and WEP/WPA encryption.

  Incorrect Answers:

  A: The RACE Integrity Primitives Evaluation Message Digest (RIPEMD) algorithm was based on MD4 hashing algorithm.

  C: The Secure Hash Algorithm (SHA) was designed to ensure the integrity of a message. SHA is a one-way hash that provides a hash value that can be used with an encryption protocol. This algorithm produces a 160-bit hash value. SHA-2 has several sizes: 224, 256, 334, and 512 bit.

  D: The Message Digest Algorithm (MD) also creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251, 255-256

• Question 795:

  Which of the following concepts is enforced by certifying that email communications have been sent by who the message says it has been sent by?

  A. Key escrow

  B. Non-repudiation

  C. Multifactor authentication

  D. Hashing

  Correct Answer: B

  Regarding digital security, the cryptological meaning and application of non-repudiation shifts to mean:

  *

  A service that provides proof of the integrity and origin of data.

  *

  An authentication that can be asserted to be genuine with high assurance.

  Incorrect Answers:

  A: Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them.

  C: A multifactor authentication method uses two or more processes for logon. A twofactor method might use smart cards and biometrics for logon.

  D: A hash function is used to map digital data of variable size to digital data of fixed length. A hash function is not used to verify the sender of an e-mail.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 133, 255, 262, 414

• Question 796:

  Which of the following ports should be opened on a firewall to allow for NetBIOS communication? (Select TWO).

  A. 110

  B. 137

  C. 139

  D. 143

  E. 161

  F. 443

  Correct Answer: BC

  NetBIOS provides four distinct services:

  Name service for name registration and resolution (port: 137/udp) Name service for name registration and resolution (port: 137/tcp) Datagram distribution service for connectionless communication (port: 138/udp) Session service for

  connection-oriented communication (port: 139/tcp)

  Incorrect Answers:

  A: POP3 uses port 110. NetBIOS does not use port 110.

  D: IMAP uses port 143. NetBIOS does not use port 143.

  E: SNM

  F: HTTPS uses port 433. NetBIOS does not use port 433.

  References: http://en.wikipedia.org/wiki/NetBIOS_over_TCP/IP Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 81-83

• Question 797:

  Which of the following transportation encryption protocols should be used to ensure maximum security between a web browser and a web server?

  A. SSLv2

  B. SSHv1

  C. RSA

  D. TLS

  Correct Answer: D

  HTTP Secure HTTP Secure (HTTPS) is the protocol used for "secure" web pages that users should see when they must enter personal information such as credit card numbers, passwords, and other identifiers. It combines HTTP with SSL/ TLS to provide encrypted communication. Transport Layer Security (TLS) is a security protocol that expands upon SSL. Many industry analysts predict that TLS will replace SSL, and it is also referred to as SSL 3.1.

  Incorrect Answers:

  A: SSLv2 is not as secure as TLS(also known as SSL 3.1).

  B: Secure Shell, or SSH, is not used to secure browser sessions. SSH is a cryptographic (encrypted) network protocol for initiating text-based shell sessions on remote machines in a secure way.

  C: RSA is not used to encrypt browser sessions.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 252, 268-269, 271

• Question 798:

  The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as which of the following?

  A. Stream ciphers

  B. Transport encryption

  C. Key escrow

  D. Block ciphers

  Correct Answer: B

  Transport encryption is the process of encrypting data ready to be transmitted over an insecure network. A common example of this would be online banking or online purchases where sensitive information such as account numbers or credit

  card numbers is transmitted. Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may

  eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL).

  Incorrect Answers:

  A: A stream cipher is used for encrypting data when the size of the data is unknown (such as streaming a movie). The data is encrypted one bit at a time as it is streamed. RC4 is a commonly used stream cipher. A stream cipher is a specific description of something that is used to encrypt a stream of data. It is not a concept of securing data between two points.

  C: Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. It is not a concept of securing data between two points.

  D: A block cipher is used to encrypt a chunk of data (block) before transmitting the data. A block cipher is a specific description of something that is used to encrypt a block of data. It is not a concept of securing data between two points.

  References: http://en.wikipedia.org/wiki/Transport_Layer_Security Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249, 250, 262

• Question 799:

  A network stream needs to be encrypted. Sara, the network administrator, has selected a cipher which will encrypt 8 bits at a time before sending the data across the network. Which of the following has Sara selected?

  A. Block cipher

  B. Stream cipher

  C. CRC

  D. Hashing algorithm

  Correct Answer: A

  With a block cipher the algorithm works on chunks of data--encrypting one and then moving to the next. Example: Blowfish is an encryption system that performs a 64-bit block cipher at very fast speeds.

  Incorrect Answers:

  B: A stream cipher is used for encrypting data when the size of the data is unknown (such as streaming a movie). The data is encrypted one bit at a time as it is streamed.

  C: Cyclic redundancy check (CRC) is used for error-detecting, not for encryption.

  D: A hash function is used to map digital data of variable size to digital data of fixed length. A hash function is not used for encryption.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 255-256 http://en.wikipedia.org/wiki/Cyclic_redundancy_check

• Question 800:

  In order to securely communicate using PGP, the sender of an email must do which of the following when sending an email to a recipient for the first time?

  A. Import the recipient's public key

  B. Import the recipient's private key

  C. Export the sender's private key

  D. Export the sender's public key

  Correct Answer: A

  See step 4 below.

  1.

  When a user encrypts plaintext with PGP, PGP first compresses the plaintext.

  2.

  PGP then creates a session key, which is a one-time-only secret key.

  3.

  This session key works with a very secure, fast conventional encryption algorithm to encrypt the plaintext; the result is ciphertext.

  4.

  Once the data is encrypted, the session key is then encrypted to the recipient's public key. This public key-encrypted session key is transmitted along with the ciphertext to the recipient.

  Incorrect Answers:

  B: The recipient's public key, not the private key, is used. C, D: The sender's key is not used.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251, 272-273 http://www.pgpi.org/doc/pgpintro/