CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 311:

  A user has forgotten their account password. Which of the following is the BEST recovery strategy?

  A. Upgrade the authentication system to use biometrics instead.
  B. Temporarily disable password complexity requirements.
  C. Set a temporary password that expires upon first use.
  D. Retrieve the user password from the credentials database.
  C. Set a temporary password that expires upon first use.

  ---

  Since a user's password isn't stored on most operating systems (only a hash value is kept), most operating systems allow the administrator to change the value for a user who has forgotten theirs. This new value allows the user to log in and then immediately change it to another value that they can (ideally) remember. Also setting a temporary password to expire upon first use will not allow a hacker the opportunity or time to use it. Incorrect Answers: A: Using a biometric system is not going to recover a forgotten password. B: Disabling password complexity requirements is not a recovery strategy rather it would be compromising your password policy. D: This is not sound practice to keep user passwords on a credentials database since most operating systems store user passwords hashed and the administrator will be able to change the value for a user who has forgotten theirs. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp. 140-141

• Question 312:

  A computer is put into a restricted VLAN until the computer's virus definitions are up-to-date. Which of the following BEST describes this system type?

  A. NAT
  B. NIPS
  C. NAC
  D. DMZ
  C. NAC

  ---

  Network Access Control (NAC) means controlling access to an environment through strict adherence to and implementation of security policies. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control. Incorrect Answers: A: NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request. B: Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. D: A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39, 40. http://en.wikipedia.org/wiki/Intrusion_prevention_system

• Question 313:

  A Windows-based computer is infected with malware and is running too slowly to boot and run a malware scanner. Which of the following is the BEST way to run the malware scanner?

  A. Kill all system processes
  B. Enable the firewall
  C. Boot from CD/USB
  D. Disable the network connection
  C. Boot from CD/USB

• Question 314:

  In which of the following steps of incident response does a team analyse the incident and determine steps to prevent a future occurrence?

  A. Mitigation
  B. Identification
  C. Preparation
  D. Lessons learned
  D. Lessons learned

  ---

  Incident response procedures involves in chronological order: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Thus lessons are only learned after the mitigation occurred. For only then can you `step back' and analyze the incident to prevent the same occurrence in future. Incorrect Answers: A: Mitigation is accomplished anytime that any steps has been taken to reduce risk. B: When responding to an incident the identification of the incident is essential to know how to handle the incident and then take steps. This happens way before an incident is analyzed to determine which steps to take to prevent the same occurrence in future. C: Preparation involves all the preventative measures that are taken to prevent any risk incident. This does not means that an incident already occurred as is alluded to in the question. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 429

• Question 315:

  The security team would like to gather intelligence about the types of attacks being launched against the organization. Which of the following would provide them with the MOST information?

  A. Implement a honeynet
  B. Perform a penetration test
  C. Examine firewall logs
  D. Deploy an IDS
  A. Implement a honeynet

  ---

  A honeynet is a network set up with intentional vulnerabilities; its purpose is to invite attack, so that an attacker's activities and methods can be studied and that information used to increase network security. A honeynet contains one or more honey pots, which are computer systems on the Internet expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. Although the primary purpose of a honeynet is to gather information about attackers' methods and motives, the decoy network can benefit its operator in other ways, for example by diverting attackers from a real network and its resources. The Honeynet Project, a non-profit research organization dedicated to computer security and information sharing, actively promotes the deployment of honeynets. In addition to the honey pots, a honeynet usually has real applications and services so that it seems like a normal network and a worthwhile target. However, because the honeynet doesn't actually serve any authorized users, any attempt to contact the network from without is likely an illicit attempt to breach its security, and any outbound activity is likely evidence that a system has been compromised. For this reason, the suspect information is much more apparent than it would be in an actual network, where it would have to be found amidst all the legitimate network data. Applications within a honeynet are often given names such as "Finances" or "Human Services" to make them sound appealing to the attacker. A virtual honeynet is one that, while appearing to be an entire network, resides on a single server. Incorrect Answers: B: Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. You perform a penetration test by attempting to gain access to the system. However, to do this, you are trying to exploit weaknesses that you know about. An attacker might use a different method. To view all methods used by attackers, you need to set up a honeynet. Therefore, this answer is incorrect. C: The firewall logs will provide information about network connections that are allowed or blocked. However, an attacker would connect to the network by using an allowed port. Therefore, the firewall logs will not provide information about methods of attack. Therefore, this answer is incorrect. D: An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. An IDS can monitor malicious activities. However, an attacker may use a method that is not detected by the IDS as an intrusion attempt. This question is asking for the BEST answer. A honeypot is a better answer because it is designed to be attacked to enable you to view the methods used for the attacks. Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/honeynet http://en.wikipedia.org/wiki/Intrusion_detection_system

• Question 316:

  RC4 is a strong encryption protocol that is generally used with which of the following?

  A. WPA2 CCMP
  B. PEAP
  C. WEP
  D. EAP-TLS
  C. WEP

• Question 317:

  Which of the following provides a static record of all certificates that are no longer valid?

  A. Private key
  B. Recovery agent
  C. CRLs
  D. CA
  C. CRLs

  ---

  The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release. When a potential user attempts to access a server, the server allows or denies access based on the CRL entry for that particular user. Incorrect Answers: A: A private or secret key is an encryption/decryption key known only to the party or parties that exchange secret messages. A private key cannot provide a list of invalid certificates. B: A key recovery agent is an entity that has the ability to recover a key, key components, or plaintext messages as needed. A recovery agent does not provide a list of invalid certificates. D: A certificate authority (CA) is an organization, not a static record containing certificates. A CA is responsible for issuing, revoking, and distributing certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-280, 271-285, 285

• Question 318:

  An organization is recovering data following a datacenter outage and determines that backup copies of files containing personal information were stored in an unsecure location, because the sensitivity was unknown. Which of the following activities should occur to prevent this in the future?

  A. Business continuity planning
  B. Quantitative assessment
  C. Data classification
  D. Qualitative assessment
  C. Data classification

  ---

  Information classification is done by confidentiality and comprises of three categories, namely: public use, internal use and restricted use. Knowing how to apply these categories and matching it up with the appropriate data handling will address the situation of the data `unknown sensitivity' Incorrect Answers: A: Business continuity planning (BCP) is the process of implementing policies, controls, and procedures to counteract the effects of losses, outages, or failures of critical business processes. BCP is primarily a management tool that ensures that critical business functions can be performed when normal business operations are disrupted. B: Quantitative assessment is cost-based and objective risk assessment. D: Qualitative assessment is opinion-based and subjective risk assessment. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 7, 404, 431

• Question 319:

  Which of the following services are used to support authentication services for several local devices from a central location without the use of tokens?

  A. TACACS+
  B. Smartcards
  C. Biometrics
  D. Kerberos
  A. TACACS+

  ---

  ACACS allows a client to accept a username and password and send a query to a TACACS authentication server. It would determine whether to accept or deny the authentication request and send a response back. The TIP would then allow access or not based upon the response, not tokens. Incorrect Answers: B: Smartcards are also known as identity tokens containing integrated circuits. C: Biometrics is used for user authentication, not device authentication. D: Kerberos uses tickets, which lists the privileges of that user, much like a token. References: http://en.wikipedia.org/wiki/TACACS Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 275, 282, 285. Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 148.

• Question 320:

  A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD users and 2 web servers without wireless access. Which of the following should the company configure to protect the servers from the user devices? (Select TWO).

  A. Deny incoming connections to the outside router interface.
  B. Change the default HTTP port
  C. Implement EAP-TLS to establish mutual authentication
  D. Disable the physical switch ports
  E. Create a server VLAN
  F. Create an ACL to access the server
  E. Create a server VLAN
  F. Create an ACL to access the server

  ---

  We can protect the servers from the user devices by separating them into separate VLANs (virtual local area networks). The network device in the question is a router/switch. We can use the router to allow access from devices in one VLAN to the servers in the other VLAN. We can configure an ACL (Access Control List) on the router to determine who is able to access the server. In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers; such a domain is referred to as a virtual local area network, virtual LAN or VLAN. This is usually achieved on switch or router devices. Simpler devices only support partitioning on a port level (if at all), so sharing VLANs across devices requires running dedicated cabling for each VLAN. More sophisticated devices can mark packets through tagging, so that a single interconnect (trunk) may be used to transport data for multiple VLANs. Grouping hosts with a common set of requirements regardless of their physical location by VLAN can greatly simplify network design. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be grouped together more easily even if they are not on the same network switch. The network described in this question is a DMZ, not a VLAN. Incorrect Answers: A: The servers are web servers. It's therefore safe to assume the websites hosted by the web servers should be accessible externally. Denying incoming connections to the outside router interface would prevent external access to the websites. Furthermore, it would not protect the servers from the user devices. B: The servers are web servers. It's therefore safe to assume the websites hosted by the web servers should be accessible externally. If you change the default HTTP port, only people who know what the new port is would be able to access the websites. A member of the public looking to browse the company website would not be able to (without knowing the new port number). Furthermore, this would not protect the servers from the user devices. C: Implementing EAP-TLS to establish mutual authentication would ensure that connections to the wireless router are secure. It wouldn't protect the servers from the user devices though. D: The servers need to connect to the physical switch ports. Therefore disabling the ports would take the servers offline. References: http://en.wikipedia.org/wiki/Virtual_LAN