CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 341:

  A security technician needs to open ports on a firewall to allow for domain name resolution. Which of the following ports should be opened? (Select TWO).

  A. TCP 21
  B. TCP 23
  C. TCP 53
  D. UDP 23
  E. UDP 53
  C. TCP 53
  E. UDP 53

  ---

  DNS uses TCP and UDP port 53. TCP port 53 is used for zone transfers, whereas UDP port 53 is used for queries. Incorrect Answers: A: FTP uses TCP port 21. B. D: Telnet uses port 23. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 51. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 342:

  Who should be contacted FIRST in the event of a security breach?

  A. Forensics analysis team
  B. Internal auditors
  C. Incident response team
  D. Software vendors
  C. Incident response team

  ---

  A security breach is an incident and requires a response. The incident response team would be better equipped to deal with any incident insofar as all their procedures are concerned. Their procedures in addressing incidents are: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Incorrect Answers: A: A forensics analysis involves the evidence found in computers and on digital storage media and incident response encompasses forensics and refers to the process of identifying, investigating, repairing, documenting, and adjusting procedures to prevent another incident. B: Internal auditing is part of the job description of the incident response team when they perform their documenting and recording of the costs involved addressing the incident. D: Software vendors are only contacted when the incident response team deems it necessary. Thus the first contact in the event of a security breach is the incident response team. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 429, 446

• Question 343:

  A CRL is comprised of.

  A. Malicious IP addresses.
  B. Trusted CA's.
  C. Untrusted private keys.
  D. Public keys.
  D. Public keys.

  ---

  A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key. By checking the CRL you can check if a particular certificate has been revoked. The certificates for which a CRL should be maintained are often X.509/public key certificates, as this format is commonly used by PKI schemes. Incorrect Answers: A: The CRL contains certificates and keys, not IP addresses. B: Trusted CAs are not listed in the CRL. C: Public keys, not private keys, might be included in the CRL. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 278-285, 279-280, 285

• Question 344:

  Which of the following allows an organization to store a sensitive PKI component with a trusted third party?

  A. Trust model
  B. Public Key Infrastructure
  C. Private key
  D. Key escrow
  D. Key escrow

  ---

  Sensitive PKI data, such as private keys, can be put into key escrow data. The key escrow data can be kept at a trusted third party. Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. These third parties may include businesses, who may want access to employees' private communications, or governments, who may wish to be able to view the contents of encrypted communications. Incorrect Answers: A: A trust Model is collection of rules that informs application on how to decide the legitimacy of a Digital Certificate. A trust model cannot store sensitive information. B: A PKI cannot store sensitive information. The Public-Key Infrastructure (PKI) is intended to offer a means of providing security to messages and transactions on a grand scale. The need for universal systems to support e- commerce, secure transactions, and information privacy is one aspect of the issues being addressed with PKI. C: A private key is a secret key. It is not used to stored sensitive information through a third party. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285, 285-289

• Question 345:

  The Chief Technology Officer (CTO) wants to improve security surrounding storage of customer passwords.

  The company currently stores passwords as SHA hashes. Which of the following can the CTO implement requiring the LEAST change to existing systems?

  A. Smart cards
  B. TOTP
  C. Key stretching
  D. Asymmetric keys
  A. Smart cards

  ---

  Smart cards usually come in two forms. The most common takes the form of a rectangular piece of plastic with an embedded microchip. The second is as a USB token. It contains a built in processor and has the ability to securely store and process information. A "contact" smart card communicates with a PC using a smart card reader whereas a "contactless" card sends encrypted information via radio waves to the PC. Typical scenarios in which smart cards are used include interactive logon, e-mail signing, e-mail decryption and remote access authentication. However, smart cards are programmable and can contain programs and data for many different applications. For example smart cards may be used to store medical histories for use in emergencies, to make electronic cash payments or to verify the identity of a customer to an e-retailer. Microsoft provides two device independent APIs to insulate application developers from differences between current and future implementations: CryptoAPI and Microsoft Win32?SCard APIs. The Cryptography API contains functions that allow applications to encrypt or digitally sign data in a flexible manner, while providing protection for the user's sensitive private key data. All cryptographic operations are performed by independent modules known as cryptographic service providers (CSPs). There are many different cryptographic algorithms and even when implementing the same algorithm there are many choices to make about key sizes and padding for example. For this reason, CSPs are grouped into types, in which each supported CryptoAPI function, by default, performs in a way particular to that type. For example, CSPs in the PROV_DSS provider type support DSS Signatures and MD5 and SHA hashing. Incorrect Answers: B: A time-based one-time password (TOTP) is a temporary code, generated by an algorithm, for use in authenticating access to computer systems. The algorithm that generates each password uses the current time of day as one of its factors, ensuring that each password is unique. Time- based one-time passwords are commonly used for two-factor authentication and have seen growing adoption by cloud application providers. In two-factor authentication scenarios, a user must enter a traditional, static password and a TOTP to gain access. In this question, the company currently stores passwords as SHA hashes. This suggests that the passwords are not temporary passwords. Therefore this answer is incorrect. C: In cryptography, key stretching refers to techniques used to make a possibly weak key, typically a password or passphrase, more secure against a brute force attack by increasing the time it takes to test each possible key. Passwords or passphrases created by humans are often short or predictable enough to allow password cracking. Key stretching makes such attacks more difficult. Key stretching is used to make passwords stronger. One method is to apply a hash to the password. In this question, the passwords are already hashed. Therefore this answer is incorrect. D: Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes. Asymmetric keys are not used to further secure hashed passwords. Therefore this answer is incorrect. References: https://msdn.microsoft.com/en-us/library/ms953432.aspx http://searchconsumerization.techtarget.com/definition/time-based-one-time-password-TOTP http://en.wikipedia.org/wiki/Key_stretching

• Question 346:

  Due to hardware limitation, a technician must implement a wireless encryption algorithm that uses the RC4 protocol. Which of the following is a wireless encryption solution that the technician should implement while ensuring the STRONGEST level of security?

  A. WPA2-AES
  B. 802.11ac
  C. WPA-TKIP
  D. WEP
  C. WPA-TKIP

  ---

  WPA-TKIP uses the RC4 cipher. TKIP and the related WPA standard implement three new security features to address security problems encountered in WEP protected networks. First, TKIP implements a key mixing function that combines the secret root key with the initialization vector before passing it to the RC4 initialization. WEP, in comparison, merely concatenated the initialization vector to the root key, and passed this value to the RC4 routine. This permitted the vast majority of the RC4 based WEP related key attacks. Second, WPA implements a sequence counter to protect against replay attacks. Packets received out of order will be rejected by the access point. Finally, TKIP implements a 64-bit Message Integrity Check (MIC) To be able to run on legacy WEP hardware with minor upgrades, TKIP uses RC4 as its cipher. TKIP also provides a rekeying mechanism. TKIP ensures that every data packet is sent with a unique encryption key. Incorrect Answers: A: WPA2-AES does not use the RC4 protocol. B: 802.11ac does not use the RC4 protocol. D: WEP uses the RC4 protocol but is weaker in terms of security than WPA. WPA was created to replace WEP. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 172-173, 258 http://en.wikipedia.org/wiki/Temporal_Key_Integrity_Protocol http://www.diffen.com/difference/ WPA_vs_WPA2

• Question 347:

  Which of the following is an effective way to ensure the BEST temperature for all equipment within a datacenter?

  A. Fire suppression
  B. Raised floor implementation
  C. EMI shielding
  D. Hot or cool aisle containment
  D. Hot or cool aisle containment

  ---

  There are often multiple rows of servers located in racks in server rooms. The rows of servers are known as aisles, and they can be cooled as hot aisles and cold aisles. With a hot aisle, hot air outlets are used to cool the equipment, whereas with cold aisles, cold air intake is used to cool the equipment. Combining the two, you have cold air intake from below the aisle and hot air outtake above it, providing constant circulation. This is a more effective way of controlling temperature to safeguard your equipment in a data center. Incorrect Answers: A: Fire suppression, as part of computer center design, refers to the act of extinguishing fire vs preventing a fire. B: Raised floor implementation is done as part of a hot and cold aisle implementation where the cold air used by the air handles is obtained from beneath the raised floor. C: EMI shielding means that a computer system does not emit any significant amounts of EMI or RFI, or be susceptible to fall victim to EMI or RFI attacks. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 382

• Question 348:

  Ann, a security analyst, has discovered that her company has very high staff turnover and often user accounts are not disabled after an employee leaves the company. Which of the following could Ann implement to help identify accounts that are still active for terminated employees?

  A. Routine audits
  B. Account expirations
  C. Risk assessments
  D. Change management
  A. Routine audits

• Question 349:

  A security administrator is aware that a portion of the company's Internet-facing network tends to be non-secure due to poorly configured and patched systems. The business owner has accepted the risk of those systems being compromised, but the administrator wants to determine the degree to which those systems can be used to gain access to the company intranet. Which of the following should the administrator perform?

  A. Patch management assessment
  B. Business impact assessment
  C. Penetration test
  D. Vulnerability assessment
  C. Penetration test

  ---

  Penetration testing is the most intrusive type of testing because you are actively trying to circumvent the system's security controls to gain access to the system. It is also used to determine the degree to which the systems can be used to gain access to the company intranet (the degree of access to local network resources). Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit. Pen tests can be automated with software applications or they can be performed manually. Either way, the process includes gathering information about the target before the test (reconnaissance), identifying possible entry points, attempting to break in (either virtually or for real) and reporting back the findings. The main objective of penetration testing is to determine security weaknesses. A pen test can also be used to test an organization's security policy compliance, its employees' security awareness and the organization's ability to identify and respond to security incidents. Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. Pen test strategies include: Targeted testing Targeted testing is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a "lights-turned-on" approach because everyone can see the test being carried out. External testing This type of pen test targets a company's externally visible servers or devices including domain name servers (DNS), e-mail servers, Web servers or firewalls. The objective is to find out if an outside attacker can get in and how far they can get in once they've gained access. Internal testing This test mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause. Blind testing A blind test strategy simulates the actions and procedures of a real attacker by severely limiting the information given to the person or team that's performing the test beforehand. Typically, they may only be given the name of the company. Because this type of test can require a considerable amount of time for reconnaissance, it can be expensive. Double blind testing Double blind testing takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double- blind tests can be useful for testing an organization's security monitoring and incident identification as well as its response procedures. Incorrect Answers: A: Patch management is the process of managing the installation of security patches and updates on computer systems. An assessment of the patch management process is not performed to determine the degree to which computer systems can be used to gain access to the company intranet. Therefore, this answer is incorrect. B: A Business impact assessment is the assessment an event will have on the business; for example, a server failure. You could even perform a business impact assessment to assess the impact of a network intrusion. However, to test the possible extent of an intrusion, you need to perform a penetration test. Therefore, this answer is incorrect. D: A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. A vulnerability scan is considered passive in that it doesn't actually attempt to circumvent the security controls of a system to gain access (unlike a penetration test). It can therefore not be used to determine the degree to which computer systems can be used to gain access to the company intranet. Therefore, this answer is incorrect. References: http://searchsoftwarequality.techtarget.com/definition/penetration-testing

• Question 350:

  A system administrator needs to ensure that certain departments have more restrictive controls to their shared folders than other departments. Which of the following security controls would be implemented to restrict those departments?

  A. User assigned privileges
  B. Password disablement
  C. Multiple account creation
  D. Group based privileges
  D. Group based privileges

  ---

  Group-based privileges assign privileges or access to a resource to all members of a group. Group-based access control grants every member of the group the same level of access to a specific object. Incorrect Answers: A: These are permissions that are granted or denied on a specific individual user basis. This would not allow for a more restrictive control over the department's shared folders. B: Disabling a password would allow for a less restrictive control over the department's shared folders. C: Each user should only have one standard user account. Administrators can have more than one administrative account for different roles. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 290- 294.