CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 981:

  An administrator needs to segment internal traffic between layer 2 devices within the LAN. Which of the following types of network design elements would MOST likely be used?

  A. Routing

  B. DMZ

  C. VLAN

  D. NAT

  Correct Answer: C

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function.

  Incorrect Answers:

  A: Routing is the process of selecting best paths in a network.

  C: A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

  D: NAT converts the IP addresses of internal systems found in the header of network packets into public IP addresses.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39, 277.

  http://en.wikipedia.org/wiki/Routing

• Question 982:

  An administrator connects VoIP phones to the same switch as the network PCs and printers. Which of the following would provide the BEST logical separation of these three device types while still allowing traffic between them via ACL?

  A. Create three VLANs on the switch connected to a router

  B. Define three subnets, configure each device to use their own dedicated IP address range, and then connect the network to a router

  C. Install a firewall and connect it to the switch

  D. Install a firewall and connect it to a dedicated switch for each device type

  Correct Answer: A

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function.

  Incorrect Answers:

  B: Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections. C, D: Firewalls are used to protect one network from another, not separate it.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 5, 23, 29.

• Question 983:

  Pete, a network administrator, is capturing packets on the network and notices that a large amount of the traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from the other traffic?

  A. Connect the WAP to a different switch.

  B. Create a voice VLAN.

  C. Create a DMZ.

  D. Set the switch ports to 802.1q mode.

  Correct Answer: B

  It is a common and recommended practice to separate voice and data traffic by using VLANs. Separating voice and data traffic using VLANs provides a solid security boundary, preventing data applications from reaching the voice traffic. It also gives you a simpler method to deploy QoS, prioritizing the voice traffic over the data.

  Incorrect Answers:

  A: Doing this will not segment voice and data traffic.

  C: The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

  D: IEEE 802.1Q is the networking standard that supports virtual LANs (VLANs) on an Ethernet network. It does not, however, segment certain traffic from other traffic

  References:

  http://www.ciscopress.com/articles/article.asp?p=1745631andseqNum=3 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 39.

  http://en.wikipedia.org/wiki/IEEE_802.1Q

• Question 984:

  A network engineer is setting up a network for a company. There is a BYOD policy for the employees so that they can connect their laptops and mobile devices.

  Which of the following technologies should be employed to separate the administrative network from the network in which all of the employees' devices are connected?

  A. VPN

  B. VLAN

  C. WPA2

  D. MAC filtering

  Correct Answer: B

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function.

  Incorrect Answers:

  A: A virtual private network (VPN) is a communication tunnel between two entities across an intermediary network. In most cases, the intermediary network is an untrusted network, such as the Internet, and therefore the communication tunnel is also encrypted.

  C: WPA2 is a new encryption scheme known as the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), which is based on the Advanced Encryption Standard (AES) encryption scheme. To date, no real-world attack has compromised the encryption of a properly configured WPA2 wireless network.

  D: A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a WAP to block access to all unauthorized devices. Although it's a useful feature to implement, it can only be used in environments with a small (fewer than 20 wireless devices), static set of wireless clients.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 11, 23, 60, 61.

• Question 985:

  A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD users and 2 web servers without wireless access. Which of the following should the company configure to protect the servers from the user devices? (Select TWO).

  A. Deny incoming connections to the outside router interface.

  B. Change the default HTTP port

  C. Implement EAP-TLS to establish mutual authentication

  D. Disable the physical switch ports

  E. Create a server VLAN

  F. Create an ACL to access the server

  Correct Answer: EF

  We can protect the servers from the user devices by separating them into separate VLANs (virtual local area networks).

  The network device in the question is a router/switch. We can use the router to allow access from devices in one VLAN to the servers in the other VLAN. We can configure an ACL (Access Control List) on the router to determine who is able to access the server.

  In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers; such a domain is referred to as a virtual local area network, virtual LAN or VLAN. This is usually achieved on switch or router devices. Simpler devices only support partitioning on a port level (if at all), so sharing VLANs across devices requires running dedicated cabling for each VLAN. More sophisticated devices can mark packets through tagging, so that a single interconnect (trunk) may be used to transport data for multiple VLANs. Grouping hosts with a common set of requirements regardless of their physical location by VLAN can greatly simplify network design. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be grouped together more easily even if they are not on the same network switch. The network described in this question is a DMZ, not a VLAN.

  Incorrect Answers:

  A: The servers are web servers. It's therefore safe to assume the websites hosted by the web servers should be accessible externally. Denying incoming connections to the outside router interface would prevent external access to the websites. Furthermore, it would not protect the servers from the user devices.

  B: The servers are web servers. It's therefore safe to assume the websites hosted by the web servers should be accessible externally. If you change the default HTTP port, only people who know what the new port is would be able to access the websites. A member of the public looking to browse the company website would not be able to (without knowing the new port number). Furthermore, this would not protect the servers from the user devices.

  C: Implementing EAP-TLS to establish mutual authentication would ensure that connections to the wireless router are secure. It wouldn't protect the servers from the user devices though.

  D: The servers need to connect to the physical switch ports. Therefore disabling the ports would take the servers offline.

  References: http://en.wikipedia.org/wiki/Virtual_LAN

• Question 986:

  Which of the following is BEST used to break a group of IP addresses into smaller network segments or blocks?

  A. NAT

  B. Virtualization

  C. NAC

  D. Subnetting

  Correct Answer: D

  Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections.

  Incorrect Answers:

  A: NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request.

  B: Virtualization allows a single set of hardware to host multiple virtual machines.

  C: The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39,

• Question 987:

  Which of the following would the security engineer set as the subnet mask for the servers below to utilize host addresses on separate broadcast domains?

  Server 1: 192.168.100.6 Server 2: 192.168.100.9 Server 3: 192.169.100.20

  A. /24

  B. /27

  C. /28

  D. /29

  E. /30

  Correct Answer: D

  Using this option will result in all three servers using host addresses on different broadcast domains.

  Incorrect Answers:

  A. B: Using these options results in all three servers using host addresses on the same broadcast domain.

  C: Using this option results in two of the servers using host addresses on the same broadcast domain.

  E: Using this option results in Server 3 not including a host.

  References: http://www.subnetmask.info/

• Question 988:

  Which of the following IP addresses would be hosts on the same subnet given the subnet mask 255.255.255.224? (Select TWO).

  A. 10.4.4.125

  B. 10.4.4.158

  C. 10.4.4.165

  D. 10.4.4.189

  E. 10.4.4.199

  Correct Answer: CD

  With the given subnet mask, a maximum number of 30 hosts between IP addresses 10.4.4.161 and 10.4.4.190 are allowed. Therefore, option C and D would be hosts on the same subnet, and the other options would not.

  References: http://www.subnetonline.com/pages/subnet-calculators/ip-subnet-calculator.php

• Question 989:

  Which of the following would allow the organization to divide a Class C IP address range into several ranges?

  A. DMZ

  B. Virtual LANs

  C. NAT

  D. Subnetting

  Correct Answer: D

  Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections.

  Incorrect Answers:

  A: The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

  B: A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches.

  C: NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39,

• Question 990:

  Which of the following BEST describes a demilitarized zone?

  A. A buffer zone between protected and unprotected networks.

  B. A network where all servers exist and are monitored.

  C. A sterile, isolated network segment with access lists.

  D. A private network that is protected by a firewall and a VLAN.

  Correct Answer: A

  A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

  Incorrect Answers:

  B: The location and monitoring of servers would not occur in a DMZ as it is exposed to the public.

  C: This describes a VLAN.

  D: This describes a VPN.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 39.

  http://en.wikipedia.org/wiki/Virtual_private_network