CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 351:

  Which of the following hardware based encryption devices is used as a part of multi-factor authentication to access a secured computing system?

  A. Database encryption
  B. USB encryption
  C. Whole disk encryption
  D. TPM
  D. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: A: Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the data base. Encryption protects data on storage devices it is not an authentication mechanism. B: USB encryption is provided by the vendor of the USB device or by a tool from a third party. Encrypting the data on a USB protects the data on the USB; it is not an authentication mechanism. C: Whole disk encryption protects the data on hard drives of devices it is not an authentication mechanism. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 237 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 252,

• Question 352:

  A security administrator wants to implement a solution which will allow some applications to run under the user's home directory and only have access to files stored within the same user's folder, while other applications have access to shared folders. Which of the following BEST addresses these requirements if the environment is concurrently shared by multiple users?

  A. OS Virtualization
  B. Trusted OS
  C. Process sandboxing
  D. File permission
  C. Process sandboxing

• Question 353:

  Which of the following would the security engineer set as the subnet mask for the servers below to utilize host addresses on separate broadcast domains?

  Server 1: 192.168.100.6 Server 2: 192.168.100.9 Server 3: 192.169.100.20

  A. /24
  B. /27
  C. /28
  D. /29
  E. /30
  D. /29

  ---

  Using this option will result in all three servers using host addresses on different broadcast domains. Incorrect Answers: A. B: Using these options results in all three servers using host addresses on the same broadcast domain. C: Using this option results in two of the servers using host addresses on the same broadcast domain. E: Using this option results in Server 3 not including a host. References: http://www.subnetmask.info/

• Question 354:

  Several users' computers are no longer responding normally and sending out spam email to the users' entire contact list. This is an example of which of the following?

  A. Trojan virus
  B. Botnet
  C. Worm outbreak
  D. Logic bomb
  C. Worm outbreak

  ---

  A worm is similar to a virus but is typically less malicious. A virus will usually cause damage to the system or files whereas a worm will usually just spread itself either using the network or by sending emails. A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer. Incorrect Answers: A: In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus. In this question, no actual damage was done to the computers. Emails were sent to spread the worm. Therefore, this answer is incorrect. B: A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network. The term is usually used with a negative or malicious connotation. Computers can be co-opted into a botnet when they execute malicious software. This can be accomplished by luring users into making a drive-by download, exploiting web browser vulnerabilities, or by tricking the user into running a Trojan horse program, which may come from an email attachment. This malware will typically install modules that allow the computer to be commanded and controlled by the botnet's operator. Many computer users are unaware that their computer is infected with bots. Depending on how it is written, a Trojan may then delete itself, or may remain present to update and maintain the modules. Botnets can be used to send spam emails but this would be done by someone controlling the computers to target an individual or entity with the spam. A worm would use its own programming to send emails to everyone in a contact list with the aim of spreading itself. Therefore, this answer is incorrect. D: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs". To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs. A logic bomb may contain a worm but it is the worm that is sending the emails. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Computer_worm http://searchsecurity.techtarget.com/definition/Trojan-horse http://en.wikipedia.org/wiki/Botnet http://en.wikipedia.org/wiki/Logic_bomb

• Question 355:

  Which of the following is the MOST specific plan for various problems that can arise within a system?

  A. Business Continuity Plan
  B. Continuity of Operation Plan
  C. Disaster Recovery Plan
  D. IT Contingency Plan
  D. IT Contingency Plan

  ---

  An IT contingency plan would focus on the IT aspect in particular to ensure business continuity. Incorrect Answers: A: Business continuity planning (BCP) is the process of implementing policies, controls, and procedures to counteract the effects of losses, outages, or failures of critical business processes. BCP is primarily a management tool that ensures that critical business functions can be performed when normal business operations are disrupted. B: Continuity of operations plan is the effort to ensure the continued performance of critical business functions during a wide range of potential emergencies C: A disaster-recovery plan, or scheme, helps an organization respond effectively when a disaster occurs. Disasters may include system failure, network failure, infrastructure failure, and natural disaster. The primary emphasis of such a plan is reestablishing services and minimizing losses. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 29, 433-434

• Question 356:

  Which of the following can only be mitigated through the use of technical controls rather that user security training?

  A. Shoulder surfing
  B. Zero-day
  C. Vishing
  D. Trojans
  B. Zero-day

  ---

  A zero day vulnerability is an unknown vulnerability in a software application. This cannot be prevented by user security training. A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. Incorrect Answers: A: Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand. Shoulder surfing can be mitigated through the use of user security training. Therefore, this answer is incorrect. C: Vishing (voice or VoIP phishing) is an electronic fraud tactic in which individuals are tricked into revealing critical financial or personal information to unauthorized entities. Vishing works like phishing but does not always occur over the Internet and is carried out using voice technology. A vishing attack can be conducted by voice email, VoIP (voice over IP), or landline or cellular telephone. The potential victim receives a message, often generated by speech synthesis, indicating that suspicious activity has taken place in a credit card account, bank account, mortgage account or other financial service in their name. The victim is told to call a specific telephone number and provide information to "verify identity" or to "ensure that fraud does not occur." If the attack is carried out by telephone, caller ID spoofing can cause the victim's set to indicate a legitimate source, such as a bank or a government agency. Vishing can be mitigated through the use of user security training. Therefore, this answer is incorrect. D: In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus. Trojans can be mitigated through the use of user security training. Therefore, this answer is incorrect. References: http://www.pctools.com/security-news/zero-day-vulnerability/ http://searchsecurity.techtarget.com/definition/shoulder-surfing http:// searchunifiedcommunications.techtarget.com/definition/vishing http://searchsecurity.techtarget.com/definition/ Trojan-horse

• Question 357:

  Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw.

  Which of the following attacks has MOST likely occurred?

  A. Cookie stealing
  B. Zero-day
  C. Directory traversal
  D. XML injection
  B. Zero-day

  ---

  The vulnerability was unknown in that the IDS and antivirus did not detect it. This is zero day vulnerability. A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. Incorrect Answers: A: In computer science, session hijacking, sometimes also known as cookie hijacking or cookie stealing is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. This is not what is described in this question. Therefore, this answer is incorrect. C: Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server. Although some educated guesswork is involved in finding paths to restricted files on a Web server, a skilled hacker can easily carry out this type of attack on an inadequately protected server by searching through the directory tree. The risk of such attacks can be minimized by careful Web server programming, the installation of software updates and patches, filtering of input from browsers, and the use of vulnerability scanners. This is not what is described in this question. Therefore, this answer is incorrect. D: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. This is not what is described in this question. Therefore, this answer is incorrect. References: http://www.pctools.com/security-news/zero-day-vulnerability/ http://en.wikipedia.org/wiki/Session_hijacking http://searchsecurity.techtarget.com/definition/directory-traversal http://searchsecurity.techtarget.com/definition/directory-traversal Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337

• Question 358:

  A user casually browsing the Internet is redirected to a warez site where a number of pop-ups appear. After clicking on a pop-up to complete a survey, a drive-by download occurs. Which of the following is MOST likely to be contained in the download?

  A. Backdoor
  B. Spyware
  C. Logic bomb
  D. DDoS
  E. Smurf
  B. Spyware

  ---

  Spyware is software that is used to gather information about a person or organization without their knowledge and sends that information to another entity. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users. Incorrect Answers: A: A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit. A backdoor is not what is described in this question. Therefore, this answer is incorrect. C: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. A logic bomb is not what is described in this question. Therefore, this answer is incorrect. D: A Distributed Denial of Service (DDoS) attack is an attack from several different computers targeting a single computer. Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack. ADDoS attack is not what is described in this question. E: A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network. A smurf attack is not what is described in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Spyware http://en.wikipedia.org/wiki/Logic_bomb http://en.wikipedia.org/wiki/Denial-of-service_attack http://www.webopedia.com/TERM/S/smurf.html

• Question 359:

  Sara, the Chief Security Officer (CSO), has had four security breaches during the past two years. Each breach has cost the company $3,000. A third party vendor has offered to repair the security hole in the system for $25,000. The breached system is scheduled to be replaced in five years.

  Which of the following should Sara do to address the risk?

  A. Accept the risk saving $10,000.
  B. Ignore the risk saving $5,000.
  C. Mitigate the risk saving $10,000.
  D. Transfer the risk saving $5,000.
  D. Transfer the risk saving $5,000.

  ---

  Risk transference involves sharing some of the risk burden with someone else, such as an insurance company. The cost of the security breach over a period of 5 years would amount to $30,000 and it is better to save $5,000. Incorrect Answers: A: Risk acceptance is often the choice you must make when the cost of implementing any of the other four choices exceeds the value of the harm that would occur if the risk came to fruition. In this case there is no saving and the risk already happened. B: Ignoring the risk will not save you $5,000 since the system is due to be replaced within a 5 year period which will cost your company $30,000. C: Risk mitigation is accomplished any time you take steps to reduce risk. This category includes installing antivirus software, educating users about possible threats, monitoring network traffic, adding a firewall, and so on. You should however address the security breach else there will be no saving. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 9

• Question 360:

  Matt, a security analyst, needs to implement encryption for company data and also prevent theft of company data. Where and how should Matt meet this requirement?

  A. Matt should implement access control lists and turn on EFS.
  B. Matt should implement DLP and encrypt the company database.
  C. Matt should install Truecrypt and encrypt the company server.
  D. Matt should install TPMs and encrypt the company database.
  B. Matt should implement DLP and encrypt the company database.

  ---

  Data loss prevention (DLP) systems monitor the contents of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access) and transmitting the data. Encryption is used to protect data. Incorrect Answers: A: ACLs will enable devices in your network to ignore requests from specified users or to grant them access to certain network capabilities and EFS can also be used to help in risk mitigation. However Matt is supposed to employ encryption and prevent theft of company data. C: TrueCrypt is used to encrypt hard drives and partitions. Data is software and Truecrypt is used for hardware encryption. D: TPM can be used to assist with hash key generation, bu that is just it, it is hardware encryption, not data encryption per se. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 14-18, 156, 238, 290