CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 331:

  Ann would like to forward some Personal Identifiable Information to her HR department by email, but she is worried about the confidentiality of the information. Which of the following will accomplish this task securely?

  A. Digital Signatures
  B. Hashing
  C. Secret Key
  D. Encryption
  D. Encryption

  ---

  Encryption is used to prevent unauthorized users from accessing data. Data encryption will support the confidentiality of the email. Incorrect Answers: A: A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. The message is encrypted using the encryption system, and a second piece of information, the digital signature, is added to the message. B: Hashing is used to protect the integrity of the email, meaning that it will not be tampered with, not secure confidentiality. C: Secret keys are used in encryption. It is also referred to as a symmetric key in cryptography. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251-258, 262, 404, 414 http://en.wikipedia.org/wiki/Email_encryption

• Question 332:

  A company has decided to move large data sets to a cloud provider in order to limit the costs of new infrastructure. Some of the data is sensitive and the Chief Information Officer wants to make sure both parties have a clear understanding of the controls needed to protect the data.

  Which of the following types of interoperability agreement is this?

  A. ISA
  B. MOU
  C. SLA
  D. BPA
  A. ISA

  ---

  ISA/ Interconnection Security Agreement is an agreement between two organizations that have connected systems. The agreement documents the technical requirements of the connected systems. Incorrect Answers: B: MOU/ Memorandum of Understanding is a document is used in many settings in the information industry. It is a brief summary of which party is responsible for what portion of the work. C: SLA/ Service-Level Agreement define the level of service to be provided. For example, with a company providing technical support, the SLA will determine the response time (for example, will a tech be on site within 4 hours? 8 hours?) and the level of response (will there be a replacement part if needed?). D: BPO/ Blanket Purchase Order is usually applicable to government agencies. It is an Agreement between a government agency and a private company for ongoing purchases of goods or services. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 398

• Question 333:

  Sara, a security administrator, is noticing a slow down in the wireless network response. Sara launches a wireless sniffer and sees a large number of ARP packets being sent to the AP. Which of the following type of attacks is underway?

  A. IV attack
  B. Interference
  C. Blue jacking
  D. Packet sniffing
  A. IV attack

  ---

  In this question, it's likely that someone it trying to crack the wireless network security. An initialization vector is a random number used in combination with a secret key as a means to encrypt data. This number is sometimes referred to as a nonce, or "number occurring once," as an encryption program uses it only once per session. An initialization vector is used to avoid repetition during the data encryption process, making it impossible for hackers who use dictionary attack to decrypt the exchanged encrypted message by discovering a pattern. This is known as an IV attack. A particular binary sequence may be repeated more than once in a message, and the more it appears, the more the encryption method is discoverable. For example if a one-letter word exists in a message, it may be either "a" or "I" but it can't be "e" because the word "e" is non-sensical in English, while "a" has a meaning and "I" has a meaning. Repeating the words and letters makes it possible for software to apply a dictionary and discover the binary sequence corresponding to each letter. Using an initialization vector changes the binary sequence corresponding to each letter, enabling the letter "a" to be represented by a particular sequence in the first instance, and then represented by a completely different binary sequence in the second instance. WEP (Wireless Equivalent Privacy) is vulnerable to an IV attack. Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way the IV was used also opened WEP to a related key attack. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets. Incorrect Answers: B: There can be many sources of interference to network communications especially in wireless networks. However, interference would not cause large numbers of ARP packets to be sent to the wireless access point. Therefore, this answer is incorrect. C: Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth- enabled device via the OBEX protocol. Bluetooth has a very limited range, usually around 10 metres (32.8 ft) on mobile phones, but laptops can reach up to 100 metres (328 ft) with powerful (Class 1) transmitters. Bluejacking is usually harmless, but because bluejacked people generally don't know what has happened, they may think that their phone is malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it's possible to send images or sounds as well. Bluejacking has been used in guerrilla marketing campaigns to promote advergames. Bluejacking would not cause large numbers of ARP packets to be sent to the wireless access point. Therefore, this answer is incorrect. D: Packet sniffing is the process of intercepting data as it is transmitted over a network. A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn't generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. The NIC is put into promiscuous mode, and it reads communications between computers within a particular segment. This allows the sniffer to seize everything that is flowing in the network, which can lead to the unauthorized access of sensitive data. A packet sniffer can take the form of either a hardware or software solution. A sniffer is also known as a packet analyzer. Packet sniffing would not cause large numbers of ARP packets to be sent to the wireless access point. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/26858/initialization-vector http://en.wikipedia.org/wiki/Bluejacking http://www.techopedia.com/definition/4113/sniffer

• Question 334:

  At an organization, unauthorized users have been accessing network resources via unused network wall jacks. Which of the following would be used to stop unauthorized access?

  A. Configure an access list.
  B. Configure spanning tree protocol.
  C. Configure port security.
  D. Configure loop protection.
  C. Configure port security.

  ---

  Port security in IT can mean several things. It can mean the physical control of all connection points, such as RJ-45 wall jacks or device ports, so that no unauthorized users or unauthorized devices can attempt to connect into an open port. This can be accomplished by locking down the wiring closet and server vaults and then disconnecting the workstation run from the patch panel (or punch-down block) that leads to a room's wall jack. Any unneeded or unused wall jacks can (and should) be physically disabled in this manner. Another option is to use a smart patch panel that can monitor the MAC address of any device connected to each and every wall port across a building and detect not just when a new device is connected to an empty port, but also when a valid device is disconnected or replaced by an invalid device. Incorrect Answers: A: In the realm of physical security, access controls are mechanisms designed to manage and control entrance into a location such as a building, a parking lot, a room, or even a specific box or server rack. B: Spanning Tree Protocol (STP) erects transmission blockades to prevent loops from being created. D: A loop in networking terms is a transmission pathway that repeats itself. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 24, 25, 27, 128, 129.

• Question 335:

  Which of the following uses both a public and private key?

  A. RSA
  B. AES
  C. MD5
  D. SHA
  A. RSA

  ---

  The RSA algorithm is an early public-key encryption system that uses large integers as the basis for the process. RSA uses both a public key and a secret. RSA key generation process: 1. Generate two large random primes, p and q, of approximately equal size such that their product, n = pq, is of the required bit length (such as 2048 bits, 4096 bits, and so forth). Let n = pq Let m = (p-1)(q-1) 2. Choose a small number e, co-prime to m (note: Two numbers are co-prime if they have no common factors). 3. Find d, such that de % m = 1 4. Publish e and n as the public key. Keep d and n as the secret key. Incorrect Answers: B: AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. C: The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2. D: The Secure Hash Algorithm (SHA) was designed to ensure the integrity of a message. SHA is a one-way hash that provides a hash value that can be used with an encryption protocol. This algorithm produces a 160-bit hash value. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256

• Question 336:

  Each server on a subnet is configured to only allow SSH access from the administrator's workstation. Which of the following BEST describes this implementation?

  A. Host-based firewalls
  B. Network firewalls
  C. Network proxy
  D. Host intrusion prevention
  A. Host-based firewalls

  ---

  A host-based firewall is installed on a client system and is used to protect the client system from the activities of the user as well as from communication from the network or Internet. These firewalls manage network traffic using filters to block certain ports and protocols while allowing others to pass through the system. Incorrect Answers: B: A network firewall protects the entire network from an untrusted public network, such as the Internet by filtering network traffic. It does not filter network traffic on the internal network. C: A network proxy is used to protect the local network from external attacks by hiding the IP configuration of the internal clients. It does not filter network traffic. D: A host-based IPS (HIPS) is an intrusion detection and prevention system that runs as a service on a host computer system. It is used to monitor the machine logs, system events, and application activity for signs of intrusion. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 111-112, 116-117 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 11, 13-16

• Question 337:

  At the outside break area, an employee, Ann, asked another employee to let her into the building because her badge is missing. Which of the following does this describe?

  A. Shoulder surfing
  B. Tailgating
  C. Whaling
  D. Impersonation
  B. Tailgating

  ---

  Although Ann is an employee and therefore authorized to enter the building, she does not have her badge and therefore strictly she should not be allowed to enter the building. Just as a driver can tailgate another driver's car by following too closely, in the security sense, tailgating means to compromise physical security by following somebody through a door meant to keep out intruders. Tailgating is actually a form of social engineering, whereby someone who is not authorized to enter a particular area does so by following closely behind someone who is authorized. Incorrect Answers: A: Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand. Incinerating documents will not prevent shoulder surfing. Ann is not trying to view sensitive information. Therefore this answer is incorrect. C: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats. There is no malicious intent by Ann entering the building. Therefore this answer is incorrect. D: Impersonation is where a person, computer, software application or service pretends to be someone it's not. Impersonation is commonly non-maliciously used in client/server applications. However, it can also be used as a security threat. Ann is not trying to `impersonate' someone else. Therefore this answer is incorrect. References: http://www.yourdictionary.com/tailgating http://searchsecurity.techtarget.com/definition/shoulder-surfing http://www.techopedia.com/definition/28643/whaling

• Question 338:

  A security administrator needs to determine which system a particular user is trying to login to at various times of the day. Which of the following log types would the administrator check?

  A. Firewall
  B. Application
  C. IDS
  D. Security
  D. Security

  ---

  The security log records events such as valid and invalid logon attempts, as well as events related to resource use, such as the creating, opening, or deleting of files. For example, when logon auditing is enabled, an event is recorded in the security log each time a user attempts to log on to the computer. You must be logged on as Administrator or as a member of the Administrators group in order to turn on, use, and specify which events are recorded in the security log. Incorrect Answers: A: A firewall is a hardware device or a software application designed to restrict what data traffic can enter or leave the network. A firewall log logs which traffic has been allowed through the firewall and which traffic it has blocked. It does not record attempted logon events. Therefore, this answer is incorrect. B: The Application log contains events logged by applications or programs. For example, a database program might record a file error in the application log. Program developers decide which events to log. It does not record attempted logon events. Therefore, this answer is incorrect. C: An IDS (Intrusion Detection System) is used to detect attempts to access computer systems on a network. The IDS log will log intrusion attempts to access the systems. It does not record attempted logon events specifically as a security event log does. Therefore, this answer is incorrect. References: https://technet.microsoft.com/en-us/library/cc722404.aspx?f=255andMSPPError=-2147217396

• Question 339:

  Key elements of a business impact analysis should include which of the following tasks?

  A. Develop recovery strategies, prioritize recovery, create test plans, post-test evaluation, and update processes.
  B. Identify institutional and regulatory reporting requirements, develop response teams and communication trees, and develop press release templates.
  C. Employ regular preventive measures such as patch management, change management, antivirus and vulnerability scans, and reports to management.
  D. Identify critical assets systems and functions, identify dependencies, determine critical downtime limit, define scenarios by type and scope of impact, and quantify loss potential.
  D. Identify critical assets systems and functions, identify dependencies, determine critical downtime limit, define scenarios by type and scope of impact, and quantify loss potential.

  ---

  The key components of a Business impact analysis (BIA) include: Identifying Critical Functions Prioritizing Critical Business Functions Calculating a Timeframe for Critical Systems Loss Estimating the Tangible and Intangible Impact on the Organization Incorrect Answers: A: Recovery strategy development is not part of the Business impact analysis. B: Identifying institutional and regulatory reporting requirements are not part of the Business impact analysis. C: Employing regular preventive measures is not part of the Business impact analysis. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 4, 29-30, 431

• Question 340:

  Jane, a VPN administrator, was asked to implement an encryption cipher with a MINIMUM effective security of 128-bits. Which of the following should Jane select for the tunnel encryption?

  A. Blowfish
  B. DES
  C. SHA256
  D. HMAC
  A. Blowfish

  ---

  Blowfish is an encryption system that performs a 64-bit block cipher at very fast speeds. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). Among the alternatives listed above, it is the only cipher that can use a 128-bit key and which does provide additional security through a symmetric key. Incorrect Answers: B: DES does not provide 128 bit security. DES uses a 56-bit key. C: The hash size for the SHA256 algorithm is 256 bits. D: HMAC (Hash-Based Message Authentication Code) uses a hashing algorithm along with a symmetric key. HMAC with 128 bit would provide more additional security compared to Blowfish 128 bit as HMAC uses a symmetric key as well. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 250, 251, 255-256, 260