B. RDP Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. Example of RDP tracing output: No. Time Delta Source Destination Protocol Length Info 5782, 2013-01-06 09:52:15.407, 0.000 , SRC 10.7.3.187 , DST 10.0.107.58, TCP, 62, 3389 > 59193 [SYN, ACK] Incorrect Answers: A: The HTTPS packet format does not include SRC, DST and SYN/ACK attributes. C: The HTTP packet format does not include SRC, DST and SYN/ACK attributes. D: The SFTP packet format does not include SRC, DST and SYN/ACK attributes. References: http://en.wikipedia.org/wiki/Remote_Desktop_Protocol Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 76, 274
Question 322:
A security administrator develops a web page and limits input into the fields on the web page as well as filters special characters in output. The administrator is trying to prevent which of the following attacks?
A. Spoofing B. XSS C. Fuzzing D. Pharming
B. XSS Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. By validating user input and preventing special characters, we can prevent the injection of client- side scripting code. Incorrect Answers: A: There are several kinds of spoofing including email, caller ID, MAC address, and uniform resource locator (URL) spoof attacks. All types of spoofing are designed to imitate something or someone. Email spoofing (or phishing), used by dishonest advertisers and outright thieves, occurs when email is sent with falsified "From:" entry to try and trick victims that the message is from a friend, their bank, or some other legitimate source. Any email that claims it requires your password or any personal information could be a trick. In a caller ID attack, the spoofer will falsify the phone number he/she is calling from. Input validation is not used to prevent spoofing. Therefore, this answer is incorrect. C: Fuzz testing or fuzzing is a software testing technique used to discover coding errors and security loopholes in software, operating systems or networks by inputting massive amounts of random data, called fuzz, to the system in an attempt to make it crash. If a vulnerability is found, a tool called a fuzz tester (or fuzzer), indicates potential causes. Fuzz testing was originally developed by Barton Miller at the University of Wisconsin in 1989. This is not what is described in this question. Input validation is not used to prevent fuzzing. Therefore, this answer is incorrect. D: Similar in nature to e-mail phishing, pharming seeks to obtain personal or private (usually financial related) information through domain spoofing. Rather than being spammed with malicious and mischievous e-mail requests for you to visit spoof Web sites which appear legitimate, pharming 'poisons' a DNS server by infusing false information into the DNS server, resulting in a user's request being redirected elsewhere. Your browser, however will show you are at the correct Web site, which makes pharming a bit more serious and more difficult to detect. Phishing attempts to scam people one at a time with an e-mail while pharming allows the scammers to target large groups of people at one time through domain spoofing. Input validation is not used to prevent pharming. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Cross-site_scripting http://searchsecurity.techtarget.com/definition/fuzz-testing http://www.webopedia.com/TERM/P/pharming.html
Question 323:
A company needs to receive data that contains personally identifiable information. The company requires both the transmission and data at rest to be encrypted. Which of the following achieves this goal? (Select TWO).
A. SSH B. TFTP C. NTLM D. TKIP E. SMTP F. PGP/GPG
A. SSH F. PGP/GPG We can use SSH to encrypt the transmission and PGP/GPG to encrypt the data at rest (on disk). A: Secure Shell (SSH) is a cryptographic protocol that can be used to secure network communication. It establishes a secure tunnel over an insecure network. F: Pretty Good Privacy (PGP) is a data encryption and decryption solution that can be used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Incorrect Answers: B: TFTP (Trivial File Transfer Protocol) is used for transferring files. However, it offers no encryption capability. C: NTLM (NT Lan Manager) is a Microsoft authentication mechanism used in older Windows operating systems. It is now superseded by Kerberos authentication. NTLM does provide hashing but it does not provide encryption capability. D: TKIP (Temporal Key Integrity Protocol) is an encryption protocol included as part of the IEEE 802.11i standard for wireless LANs (WLANs). TKIP is used with WPA to secure wireless connection. However, TKIP on its own cannot encrypt the data or network connection. E: SMTP (Simple Mail Transfer Protocol) is used to sending email. However, it offers no encryption capability. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 76, 145, 171, 256, 271, 272 http://en.wikipedia.org/wiki/Secure_Shell http://en.wikipedia.org/wiki/Pretty_Good_Privacy
Question 324:
Which of the following is the MOST secure protocol to transfer files?
A. FTP B. FTPS C. SSH D. TELNET
B. FTPS FTPS refers to FTP Secure, or FTP SSL. It is a secure variation of File Transfer Protocol (FTP). Incorrect Answers: A: FTP traffic is vulnerable to packet sniffing and other forms of eavesdropping. It is, therefore, not secure. C: SSH allows a user to run commands on a machine's command prompt without being near the machine physically. D: TELNET, by default, does not encrypt any data sent over the connection, and so it is often practical to eavesdrop on the communications and use the password later for malicious purposes. It is, therefore, not secure. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 46, 49, 51.
Question 325:
A company has several conference rooms with wired network jacks that are used by both employees and guests. Employees need access to internal resources and guests only need access to the Internet. Which of the following combinations is BEST to meet the requirements?
A. NAT and DMZ B. VPN and IPSec C. Switches and a firewall D. 802.1x and VLANs
D. 802.1x and VLANs 802.1x is a port-based authentication mechanism. It's based on Extensible Authentication Protocol (EAP) and is commonly used in closed-environment wireless networks. 802.1x was initially used to compensate for the weaknesses of Wired Equivalent Privacy (WEP), but today it's often used as a component in more complex authentication and connection-management systems, including Remote Authentication Dial-In User Service (RADIUS), Diameter, Cisco System's Terminal Access Controller Access-Control System Plus (TACACS+), and Network Access Control (NAC). A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. By default, all ports on a switch are part of VLAN 1. But as the switch administrator changes the VLAN assignment on a port-by-port basis, various ports can be grouped together and be distinct from other VLAN port designations. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function. Incorrect Answers: A: NAT converts the IP addresses of internal systems found in the header of network packets into public IP addresses. A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. B: A virtual private network (VPN) is a communication tunnel between two entities across an intermediary network. In most cases, the intermediary network is an untrusted network, such as the Internet, and therefore the communication tunnel is also encrypted. Internet Protocol Security (IPSec) is both a stand-alone VPN protocol and a module that can be used with L2TP. C: A switch is a networking device used to connect other devices together and potentially implement traffic management on their communications. Firewalls manage traffic using filters. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 6, 11, 21, 23, 27, 39, 53.
Question 326:
An active directory setting restricts querying to only secure connections. Which of the following ports should be selected to establish a successful connection?
A. 389 B. 440 C. 636 D. 3286
C. 636
Question 327:
A security administrator looking through IDS logs notices the following entry: (where [email protected] and passwd= `or 1==1')
Which of the following attacks had the administrator discovered?
A. SQL injection B. XML injection C. Cross-site script D. Header manipulation
A. SQL injection The code in the question is an example of a SQL Injection attack. The code `1==1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table. SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. Incorrect Answers: A: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. The code in this question in not used for an XSS attack. Therefore, this answer is incorrect. B: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. The code in this question in not XML code. This is therefore not an XML Injection attack. D: Header manipulation is an attack on an application that access web pages or web services. It involves introducing unvalidated data in an HTTP response header which can enable cache- poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation or open redirect. The code in the question is not the code you would expect to see in a header manipulation attack. This answer is therefore incorrect. References: http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/Cross-site_scripting Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337
Question 328:
The Chief Information Security Officer (CISO) has mandated that all IT systems with credit card data be segregated from the main corporate network to prevent unauthorized access and that access to the IT systems should be logged. Which of the following would BEST meet the CISO's requirements?
A. Sniffers B. NIDS C. Firewalls D. Web proxies E. Layer 2 switches
C. Firewalls The basic purpose of a firewall is to isolate one network from another. Incorrect Answers: A: The terms protocol analyzer and packet sniffer are interchangeable. They refer to the tools used in the process of monitoring the data that is transmitted across a network. B: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks. D: Web proxies are used to forward HTTP requests. E: Layer 2 switching uses the media access control address (MAC address) from the host's network interface cards (NICs) to decide where to forward frames. Layer 2 switching is hardware based, which means switches use application-specific integrated circuit (ASICs) to build and maintain filter tables (also known as MAC address tables or CAM tables). References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 342. http://en.wikipedia.org/wiki/Intrusion_prevention_system http://en.wikipedia.org/wiki/LAN_switching http:// en.wikipedia.org/wiki/Proxy_server#Web_proxy_servers
Question 329:
Which of the following controls should critical application servers implement to protect themselves from other potentially compromised application services?
A. NIPS B. Content filter C. NIDS D. Host-based firewalls
D. Host-based firewalls
Question 330:
The incident response team has received the following email message.
A copyright infringement alert was triggered by IP address 13.10.66.5 at 09: 50: 01 GMT. After reviewing the following web logs for IP 13.10.66.5, the team is unable to correlate and identify the incident.
Which of the following is the MOST likely reason why the incident response team is unable to identify and correlate the incident?
A. The logs are corrupt and no longer forensically sound. B. Traffic logs for the incident are unavailable. C. Chain of custody was not properly maintained. D. Incident time offsets were not accounted for.
D. Incident time offsets were not accounted for. It is quite common for workstation times to be off slightly from actual time, and that can happen with servers as well. Since a forensic investigation is usually dependent on a step-by-step account of what has happened, being able to follow events in the correct time sequence is critical. Because of this, it is imperative to record the time offset on each affected machine during the investigation. One method of assisting with this is to add an entry to a log file and note the time that this was done and the time associated with it on the system. Incorrect Answers: A: Corrupted logs would indicate that it had been tampered with and in this case there is no mention of logs being corrupted, in fact it can still be reviewed successfully. B: The logs have been reviewed is mentioned in the question thus it is not a matter of it being unavailable. C: The chain of custody in forensics refers to how evidence is secured, where it is stored, and who has access to it. In this case the evidence is clearly available, etc. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 453, 448
Nowadays, the certification exams become more and more important and required by more and more
enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare
for the exam in a short time with less efforts? How to get a ideal result and how to find the
most reliable resources? Here on Vcedump.com, you will find all the answers.
Vcedump.com provide not only CompTIA exam questions,
answers and explanations but also complete assistance on your exam preparation and certification
application. If you are confused on your JK0-022 exam preparations
and CompTIA certification application, do not hesitate to visit our
Vcedump.com to find your solutions here.