CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 201:

  Which of the following is a security risk regarding the use of public P2P as a method of collaboration?

  A. Data integrity is susceptible to being compromised.
  B. Monitoring data changes induces a higher cost.
  C. Users are not responsible for data usage tracking.
  D. Limiting the amount of necessary space for data storage.
  A. Data integrity is susceptible to being compromised.

  ---

  Peer-to-peer (P2P) networking is commonly used to share files such as movies and music, but you must not allow users to bring in devices and create their own little networks. All networking must be done through administrators and not on a P2P basis. Data integrity can easily be compromised when using public P2P networking. Incorrect Answers: B: Data changes occur whether using P2P or any other type of networking where data files are concerned. C: Users are not responsible for this task, rather the security administrators are. D: Limiting storage space is not a security risk when making use of public P2P collaboration. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 404

• Question 202:

  The BEST methods for a web developer to prevent the website application code from being vulnerable to cross-site request forgery (XSRF) are to: (Select TWO).

  A. Permit redirection to Internet-facing web URLs.
  B. Ensure all HTML tags are enclosed in angle brackets, e.g., "".
  C. Validate and filter input on the server side and client side.
  D. Use a web proxy to pass website requests between the user and the application.
  E. Restrict and sanitize use of special characters in input and URLs.
  C. Validate and filter input on the server side and client side.
  E. Restrict and sanitize use of special characters in input and URLs.

  ---

  XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application's trust of a user who known or is supposed to have been authenticated. This is often accomplished without the user's knowledge. XSRF can be prevented by adding a randomization string (called a nonce) to each URL request and session establishment and checking the client HTTP request header referrer for spoofing. Incorrect Answers: A: Permitting redirection to Internet-facing web URLs is to do with redirecting data traffic. It is not used to prevent XSS attacks. B: Ensuring all HTML tags are enclosed in angle brackets is not used to prevent XSS attacks. The use of angle brackets is standard practice in HTML code. Without angle brackets, the HTML code would not work. D: Web proxies tend to be used for caching web page content and/or restricting access to websites to aid compliance with company Internet usage policies. Web proxies are not used to prevent XSS attacks. References: http://en.wikipedia.org/wiki/Cross-site_scripting http://en.wikipedia.org/wiki/Cross-site_scripting#Reducing_the_threat

• Question 203:

  Four weeks ago, a network administrator applied a new IDS and allowed it to gather baseline data. As rumors of a layoff began to spread, the IDS alerted the network administrator that access to sensitive client files had risen far above normal. Which of the following kind of IDS is in use?

  A. Protocol based
  B. Heuristic based
  C. Signature based
  D. Anomaly based
  D. Anomaly based

• Question 204:

  Which of the following protocols is used by IPv6 for MAC address resolution?

  A. NDP
  B. ARP
  C. DNS
  D. NCP
  A. NDP

  ---

  The Neighbor Discovery Protocol (NDP) is a protocol in the Internet protocol suite used with Internet Protocol Version 6 (IPv6). Incorrect Answers: B: Address Resolution Protocol (ARP) is a telecommunication protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. C: Domain name system (DNS) is the hierarchical naming scheme used in both public and private networks. D: NCP is used to access file, print, directory, clock synchronization, messaging, remote command execution and other network service functions. References: http://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol http://en.wikipedia.org/wiki/Address_Resolution_Protocol Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 42. http://en.wikipedia.org/wiki/NetWare_Core_Protocol

• Question 205:

  A new network administrator is setting up a new file server for the company. Which of the following would be the BEST way to manage folder security?

  A. Assign users manually and perform regular user access reviews
  B. Allow read only access to all folders and require users to request permission
  C. Assign data owners to each folder and allow them to add individual users to each folder
  D. Create security groups for each folder and assign appropriate users to each group
  D. Create security groups for each folder and assign appropriate users to each group

  ---

  Creating a security group for each folder and assigning necessary users to each group would only allow users belonging to the folder's security group access to the folder. It will make assigning folder privileges much easier, while also being more secure. Incorrect Answers: A: Assigning users manually and performing regular user access reviews would take longer than option `D'. The question asks for the best way to achieve the goal. B: Allowing read only access to all folders and requiring users to request permission would require a lot of administrative effort. The question asks for the best way to achieve the goal. C: Assigning data owners to each folder and allowing them to add individual users to each folder could defeat the principle of least privileges. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 294.

• Question 206:

  Which of the following BEST describes the type of attack that is occurring? (Select TWO).

  

  

  

  A. DNS spoofing
  B. Man-in-the-middle
  C. Backdoor
  D. Replay
  E. ARP attack
  F. Spear phishing
  G. Xmas attack
  A. DNS spoofing
  E. ARP attack

  ---

  We have a legit bank web site and a hacker bank web site. The hacker has a laptop connected to the network. The hacker is redirecting bank web site users to the hacker bank web site instead of the legit bank web site. This can be done using two methods: DNS Spoofing and ARP Attack (ARP Poisoning). A: DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) resolver's cache, causing the name server to return an incorrect IP address, diverting traffic to the attacker's computer (or any other computer). A domain name system server translates a human-readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn't know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again. When a DNS server has received a false translation and caches it for performance optimization, it is considered poisoned, and it supplies the false data to clients. If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer (in this case, the hacker bank web site server). E: Address Resolution Protocol poisoning (ARP poisoning) is a form of attack in which an attacker changes the Media Access Control (MAC) address and attacks an Ethernet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets. This modifies the layer -Ethernet MAC address into the hacker's known MAC address to monitor it. Because the ARP replies are forged, the target computer unintentionally sends the frames to the hacker's computer first instead of sending it to the original destination. As a result, both the user's data and privacy are compromised. An effective ARP poisoning attempt is undetectable to the user. ARP poisoning is also known as ARP cache poisoning or ARP poison routing (APR). Incorrect Answers: B: In cryptography and computer security, a man-in-the-middle attack (often abbreviated to MITM, MitM, MIM, MiM or MITMA) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. One example is active eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all relevant messages passing between the two victims and inject new ones. This is straightforward in many circumstances; for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle. This is not the attack illustrated in this question. Therefore, this answer is incorrect. C: A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit. A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system. Although the number of backdoors in systems using proprietary software (software whose source code is not publicly available) is not widely credited, they are nevertheless frequently exposed. Programmers have even succeeded in secretly installing large amounts of benign code as Easter eggs in programs, although such cases may involve official forbearance, if not actual permission. This is not the attack illustrated in this question. Therefore, this answer is incorrect. D: A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack). For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice's password (or hash) read from the last session, which Bob accepts thus granting access to Eve. This is not the attack illustrated in this question. Therefore, this answer is incorrect. F: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority. This is not the attack illustrated in this question. Therefore, this answer is incorrect. G: In information technology, a Christmas tree packet is a packet with every single option set for whatever protocol is in use. The term derives from a fanciful image of each little option bit in a header being represented by a different-colored light bulb, all turned on, as in, "the packet was lit up like a Christmas tree." It can also be known as a kamikaze packet, nastygram or a lamp test segment. Christmas tree packets can be used as a method of divining the underlying nature of a TCP/IP stack by sending the packets and awaiting and analyzing the responses. When used as part of scanning a system, the TCP header of a Christmas tree packets has the flags SYN, FIN, URG and PSH set. Many operating systems implement their compliance with the Internet Protocol standard (RFC 791) in varying or incomplete ways. By observing how a host responds to an odd packet, such as a Christmas tree packet, assumptions can be made regarding the host's operating system. Versions of Microsoft Windows, BSD/OS, HP-UX, Cisco IOS, MVS, and IRIX display behaviors that differ from the RFC standard when queried with said packets. A large number of Christmas tree packets can also be used to conduct a DoS attack by exploiting the fact that Christmas tree packets require much more processing by routers and end-hosts than the 'usual' packets do. Christmas tree packets can be easily detected by intrusion-detection systems or more advanced firewalls. From a network security point of view, Christmas tree packets are always suspicious and indicate a high probability of network reconnaissance activities. This is not the attack illustrated in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/DNS_spoofing http://www.techopedia.com/definition/27471/address-resolution-protocol-poisoning-arp- poisoning http://en.wikipedia.org/wiki/Man-in-the-middle_attack http://en.wikipedia.org/wiki/Backdoor_%28computing%29 http://en.wikipedia.org/wiki/Replay_attack http://searchsecurity.techtarget.com/definition/spear-phishing http://en.wikipedia.org/wiki/Christmas_tree_packet

• Question 207:

  An attacker crafts a message that appears to be from a trusted source, but in reality it redirects the recipient to a malicious site where information is harvested. The message is narrowly tailored so it is effective on only a small number of victims. This describes which of the following?

  A. Spear phishing
  B. Phishing
  C. Smurf attack
  D. Vishing
  A. Spear phishing

• Question 208:

  Which of the following solutions provides the most flexibility when testing new security controls prior to implementation?

  A. Trusted OS
  B. Host software baselining
  C. OS hardening
  D. Virtualization
  D. Virtualization

• Question 209:

  A company provides secure wireless Internet access for visitors and vendors working onsite. Some of the vendors using older technology report that they are unable to access the wireless network after entering the correct network information. Which of the following is the MOST likely reason for this issue?

  A. The SSID broadcast is disabled.
  B. The company is using the wrong antenna type.
  C. The MAC filtering is disabled on the access point.
  D. The company is not using strong enough encryption.
  A. The SSID broadcast is disabled.

  ---

  When the SSID is broadcast, any device with an automatic detect and connect feature is able to see the network and can initiate a connection with it. The fact that they cannot access the network means that they are unable to see it. Incorrect Answers: B: The antenna type deals with signal strength and direction. It will not have a bearing on whether technology is older. C: The network information is being given to the vendors, therefore MAC filtering is not the issue. D: The network information is being given to the vendors, therefore encryption is not the issue. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 61.

• Question 210:

  Which of the following password attacks is MOST likely to crack the largest number of randomly generated passwords?

  A. Hybrid
  B. Birthday attack
  C. Dictionary
  D. Rainbow tables
  D. Rainbow tables