CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 1101:

  Digital certificates can be used to ensure which of the following? (Select TWO).

  A. Availability
  B. Confidentiality
  C. Verification
  D. Authorization
  E. Non-repudiation
  B. Confidentiality
  E. Non-repudiation

  ---

  Digital Signatures is used to validate the integrity of the message and the sender. Digital certificates refer to cryptography which is mainly concerned with Confidentiality, Integrity, Authentication, Nonrepudiation and Access Control. Nonrepudiation prevents one party from denying actions they carried out. Incorrect Answers: A: Availability is concerned with making data and systems available to authorized users. C: Verification is the act of ensuring integrity. And PKI uses verification to check the validity of a certificate. D: Authorization is concerned with which users have access. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 291, 414

• Question 1102:

  A security administrator wants to check user password complexity. Which of the following is the BEST tool to use?

  A. Password history
  B. Password logging
  C. Password cracker
  D. Password hashing
  C. Password cracker

  ---

  The most important countermeasure against password crackers is to use long, complex passwords, which are changed regularly. Password-cracking tools compare hashes from potential passwords with the hashes stored in the accounts database. Each potential password is hashed, and that hash value is compared with the accounts database. If a match is found, the password- cracker tool has discovered a password for a user account. Incorrect Answers: A: Password History tracks previous passwords so as to prevent password reuse. It does not check password complexity. B: Password logging will not check password complexity. D: Passwords are usually stored in a hashed format. It does not check password complexity. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 292, 318.

• Question 1103:

  An insurance company requires an account recovery process so that information created by an employee can be accessed after that employee is no longer with the firm. Which of the following is the BEST approach to implement this process?

  A. Employee is required to share their password with authorized staff prior to leaving the firm
  B. Passwords are stored in a reversible form so that they can be recovered when needed
  C. Authorized employees have the ability to reset passwords so that the data is accessible
  D. All employee data is exported and imported by the employee prior to them leaving the firm
  C. Authorized employees have the ability to reset passwords so that the data is accessible

  ---

  Since a user's password isn't stored on most operating systems (only a hash value is kept), most operating systems allow the administrator (or authorized person in this case) to change the value then the information/files/documents can be accessed. This is the safest way of recovery by an authorized person and is not dependent on those who leave the firm. Incorrect Answers: A: No user should be expected to share their password, regardless of the circumstances. Shared passwords goes against normal security procedures. B: Storing passwords in a reversible form is not best practice and thus not risk avoidance. D: This may not always be possible as the circumstances can differ vastly when employees leave the firm. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp.140-142

• Question 1104:

  The marketing department wants to distribute pens with embedded USB drives to clients. In the past this client has been victimized by social engineering attacks which led to a loss of sensitive data. The security administrator advises the marketing department not to distribute the USB pens due to which of the following?

  A. The risks associated with the large capacity of USB drives and their concealable nature
  B. The security costs associated with securing the USB drives over time
  C. The cost associated with distributing a large volume of the USB pens
  D. The security risks associated with combining USB drives and cell phones on a network
  A. The risks associated with the large capacity of USB drives and their concealable nature

  ---

  USB drive and other USB devices represent a security risk as they can be used to either bring malicious code into a secure system or to copy and remove sensitive data out of the system. Incorrect Answers: B, C: Cost is not a security concern and would not be raised by the security administrator. D: USB drives and cell phones represent separate security risks as USB drives cannot easily be inserted in cell phones. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 204 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 247

• Question 1105:

  An administrator finds that non-production servers are being frequently compromised, production servers are rebooting at unplanned times and kernel versions are several releases behind the version with all current security fixes.

  Which of the following should the administrator implement?

  A. Snapshots
  B. Sandboxing
  C. Patch management
  D. Intrusion detection system
  C. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities. Incorrect Answers: A: Snapshots are backups of virtual machines that can be used to quickly recover from errors or poor updates. It does not ensure that the latest kernel version with all current security fixes is installed on the system. B: Sandboxing is the process of isolating a system before installing new applications on it so as to restrict any potential malware that may be embedded in the new application from being able to cause harm to production systems. It does not ensure that the latest kernel version with all current security fixes is installed on the system. D: An intrusion detection system (IDS) is an automated system that detects intrusions or security policy violations on networks or host systems. It does not ensure that the latest kernel version with all current security fixes is installed on the system. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 204-205, 220 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 21, 231-232, 249,

• Question 1106:

  A hacker has discovered a simple way to disrupt business for the day in a small company which relies on staff working remotely. In a matter of minutes the hacker was able to deny remotely working staff access to company systems with a script. Which of the following security controls is the hacker exploiting?

  A. DoS
  B. Account lockout
  C. Password recovery
  D. Password complexity
  B. Account lockout

  ---

  B: Account lockout automatically disables an account due to repeated failed log on attempts. The hacker must have executed a script to repeatedly try logging on to the remote accounts, forcing the account lockout policy to activate. Incorrect Answers: A: Denial of service (DoS) is a form of attack whose principal objective is preventing the victimized system from performing valid actions or responding to valid traffic. C: The users did not forget their passwords, they were locked out. Furthermore, most times users would be required to change their passwords instead of recovering them as it is not a secure solution. D: since the hacker did not gain access to the system, password complexity would not be exploited as it forms part of the company's password policy. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 2913- 293.

• Question 1107:

  Which of the following tools would a security administrator use in order to identify all running services throughout an organization?

  A. Architectural review
  B. Penetration test
  C. Port scanner
  D. Design review
  C. Port scanner

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine. Incorrect Answers: A: An architectural review is a review of the network structure (servers, switches, routers, network topology etc.). It does not list running services on computers. Therefore, this answer is incorrect. B: Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. It is not used to list services running on computers. Therefore, this answer is incorrect. D: A design review is the process of reviewing the design of something; examples include reviewing the design of the network or the design of a software application. It is not used to list services running on computers. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Port_scanner

• Question 1108:

  Which of the following ports would be blocked if Pete, a security administrator, wants to deny access to websites?

  A. 21
  B. 25
  C. 80
  D. 3389
  C. 80

  ---

  Port 80 is used by HTTP, which is the foundation of data communication for the World Wide Web. Incorrect Answers: A: FTP uses TCP port 21. B: SMTP uses TCP port 25. D: Remote Desktop Protocol (RDP) uses TCP port 3389. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 51, 52.

• Question 1109:

  A process in which the functionality of an application is tested without any knowledge of the internal mechanisms of the application is known as:

  A. Black box testing
  B. White box testing
  C. Black hat testing
  D. Gray box testing
  A. Black box testing

  ---

  Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings. This method of test can be applied to virtually every level of software testing: unit, integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well. Specific knowledge of the application's code/internal structure and programming knowledge in general is not required. The tester is aware of what the software is supposed to do but is not aware of how it does it. For instance, the tester is aware that a particular input returns a certain, invariable output but is not aware of how the software produces the output in the first place. Incorrect Answers: B: White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural testing) is a method of testing software that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing an internal perspective of the system, as well as programming skills, are used to design test cases. The tester chooses inputs to exercise paths through the code and determine the appropriate outputs. This is analogous to testing nodes in a circuit, e.g. in-circuit testing (ICT). White-box testing can be applied at the unit, integration and system levels of the software testing process. Although traditional testers tended to think of white-box testing as being done at the unit level, it is used for integration and system testing more frequently today. It can test paths within a unit, paths between units during integration, and between subsystems during a systemlevel test. This question is asking about testing the application without any knowledge of the internal mechanisms. Therefore, this answer is incorrect. C: Black hat is used to describe a hacker (or, if you prefer, cracker) who breaks into a computer system or network with malicious intent. Unlike a white hat hacker, the black hat hacker takes advantage of the break-in, perhaps destroying files or stealing data for some future purpose. The black hat hacker may also make the exploit known to other hackers and/or the public without notifying the victim. This gives others the opportunity to exploit the vulnerability before the organization is able to secure it. Black hat testing is testing an application for malicious purposes. Therefore, this answer is incorrect. D: Gray box testing, also called gray box analysis, is a strategy for software debugging in which the tester has limited knowledge of the internal details of the program. A gray box is a device, program or system whose workings are partially understood. Gray box testing can be contrasted with black box testing, a scenario in which the tester has no knowledge or access to the internal workings of a program, or white box testing, a scenario in which the internal particulars are fully known. Gray box testing is commonly used in penetration tests. Gray box testing is considered to be non-intrusive and unbiased because it does not require that the tester have access to the source code. With respect to internal processes, gray box testing treats a program as a black box that must be analyzed from the outside. During a gray box test, the person may know how the system components interact but not have detailed knowledge about internal program functions and operation. A clear distinction exists between the developer and the tester, thereby minimizing the risk of personnel conflicts. This question is asking about testing the application without any knowledge of the internal mechanisms. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Black-box_testing http://en.wikipedia.org/wiki/White-box_testing http://searchsecurity.techtarget.com/definition/black-hat http://searchsoftwarequality.techtarget.com/definition/gray-box

• Question 1110:

  A security administrator suspects that an increase in the amount of TFTP traffic on the network is due to unauthorized file transfers, and wants to configure a firewall to block all TFTP traffic.

  Which of the following would accomplish this task?

  A. Deny TCP port 68
  B. Deny TCP port 69
  C. Deny UDP port 68
  D. Deny UDP port 69
  D. Deny UDP port 69

  ---

  Trivial File Transfer Protocol (TFTP) is a simple file-exchange protocol that doesn't require authentication. It operates on UDP port 69. Incorrect Answers: A, C: Port 68 TCP/UDP is used by Bootstrap Protocol (BOOTP) Client; as well Dynamic Host Configuration Protocol (DHCP). B: Because TFTP operates on UDP port 69, this option is incorrect. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 55. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers