CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 361:

  An administrator is assigned to monitor servers in a data center. A web server connected to the Internet suddenly experiences a large spike in CPU activity. Which of the following is the MOST likely cause?

  A. Spyware
  B. Trojan
  C. Privilege escalation
  D. DoS
  D. DoS

  ---

  A Distributed Denial of Service (DDoS) attack is a DoS attack from multiple computers whereas a DoS attack is from a single computer. In terms of the actual method of attack, DDoS and DoS attacks are the same. One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such attacks usually lead to a server overload. A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This after all will end up completely crashing a website for periods of time. Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack. Incorrect Answers: A: Spyware is software that aids in gathering information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge. "Spyware" is mostly classified into four types: system monitors, trojans, adware, and tracking cookies. Spyware is mostly used for the purposes of tracking and storing Internet users' movements on the Web and serving up pop-up ads to Internet users. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users. It's more likely that a DoS attack would cause a spike in CPU activity. Therefore, this answer is incorrect. B: A Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus. It's more likely that a DoS attack would cause a spike in CPU activity. Therefore, this answer is incorrect. C: Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. Privilege escalation would not cause a spike in CPU activity. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Denial-of-service_attack http://en.wikipedia.org/wiki/Spyware http://searchsecurity.techtarget.com/definition/Trojan-horse

• Question 362:

  Which of the following is an advantage of implementing individual file encryption on a hard drive which already deploys full disk encryption?

  A. Reduces processing overhead required to access the encrypted files
  B. Double encryption causes the individually encrypted files to partially lose their properties
  C. Individually encrypted files will remain encrypted when copied to external media
  D. File level access control only apply to individually encrypted files in a fully encrypted drive
  C. Individually encrypted files will remain encrypted when copied to external media

  ---

  With full disk encryption a file is encrypted as long as it remains on the disk. This is because the data on the disk is decrypted when the user logs on, thus the data is in a decrypted form when it is copied to another disk. Individually encrypted files on the other hand remain encrypted. Incorrect Answers: A: Encrypting individual files do not reduce the processing overhead but increases it as the full disk encryption must be decrypted as well as the file encryption. Full disk decryption usually occurs when the user logos on to the system. B: Double encryption does not cause individually encrypted files to partially lose their properties. File properties are typically not encrypted with individual file encryption. D: Encryption is not a requirement for file-level access control and it can be applied to files whether they are encrypted or not. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251- http://en.wikipedia.org/wiki/Disk_encryption

• Question 363:

  Protecting the confidentiality of a message is accomplished by encrypting the message with which of the following?

  A. Sender's private key
  B. Recipient's public key
  C. Sender's public key
  D. Recipient's private key
  B. Recipient's public key

• Question 364:

  Which of the following can hide confidential or malicious data in the whitespace of other files (e.g. JPEGs)?

  A. Hashing
  B. Transport encryption
  C. Digital signatures
  D. Steganography
  D. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message. Incorrect Answers: A: A hash function is used to map digital data of variable size to digital data of fixed length. B: Transport encryption encrypt the payload data C: A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 249, 255, 261, 323 http://en.wikipedia.org/wiki/Steganography

• Question 365:

  The system administrator is tasked with changing the administrator password across all 2000 computers in the organization. Which of the following should the system administrator implement to accomplish this task?

  A. A security group
  B. A group policy
  C. Key escrow
  D. Certificate revocation
  B. A group policy

  ---

  Group policy is used to manage Windows systems in a Windows network domain environment by means of a Group Policy Object (GPO). GPO's include a number of settings related to credentials, such as password complexity requirements, password history, password length, account lockout settings. Incorrect Answers: A: Active Drectory security groups are used to assign permissions to shared resources. It will not assist the system administrator in changing the administrator password across all 2000 computers in the organization. C: Key escrow allows for copies of private keys and/or secret keys are retained securely by a centralized management system as a means of insurance or recovery in the event of a lost or corrupted key. It will not assist the system administrator in changing the administrator password across all 2000 computers in the organization. D: Revoking a certificate will not assist the system administrator in changing the administrator password across all 2000 computers in the organization. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 291, 319. https://technet.microsoft.com/en-us/library/dn579255.aspx

• Question 366:

  Deploying a wildcard certificate is one strategy to:

  A. Secure the certificate's private key.
  B. Increase the certificate's encryption key length.
  C. Extend the renewal date of the certificate.
  D. Reduce the certificate management burden.
  D. Reduce the certificate management burden.

  ---

  A wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. This saves money and reduces the management burden of managing multiple certificates, one for each subdomain. A single Wildcard certificate for *.example.com, will secure all these domains: payment.example.com contact.example.com login-secure.example.com www.example.com Because the wildcard only covers one level of subdomains (the asterisk doesn't match full stops), these domains would not be valid for the certificate: test.login.example.com Incorrect Answers: A: A wildcard certificate is not used to secure the certificate's private key. A private key is typically installed into a certificates store on a server. B: The certificate's encryption key length is specified when the certificate is requested whether it's a wildcard certificate or a single domain certificate. To increase the certificate's encryption key length, you would need to request a new certificate. A wildcard certificate is not used increase the certificate's encryption key length. C: You cannot extend the renewal date of a certificate. A certificate when requested will be valid for a set period of time, typically one or two years. When the certificate expires, it must be renewed by requesting a new certificate. References: http://en.wikipedia.org/wiki/Wildcard_certificate

• Question 367:

  Matt, the Chief Information Security Officer (CISO), tells the network administrator that a security company has been hired to perform a penetration test against his network. The security company asks Matt which type of testing would be most beneficial for him. Which of the following BEST describes what the security company might do during a black box test?

  A. The security company is provided with all network ranges, security devices in place, and logical maps of the network.
  B. The security company is provided with no information about the corporate network or physical locations.
  C. The security company is provided with limited information on the network, including all network diagrams.
  D. The security company is provided with limited information on the network, including some subnet ranges and logical network diagrams.
  B. The security company is provided with no information about the corporate network or physical locations.

  ---

  The term black box testing is generally associated with application testing. However, in this question the term is used for network testing. Black box testing means testing something when you have no knowledge of the inner workings. Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings. This method of test can be applied to virtually every level of software testing: unit, integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well. Specific knowledge of the application's code/internal structure and programming knowledge in general is not required. The tester is aware of what the software is supposed to do but is not aware of how it does it. For instance, the tester is aware that a particular input returns a certain, invariable output but is not aware of how the software produces the output in the first place. Incorrect Answers: A: In this answer, the tester is given detailed information about the inner workings of the network. Testing the network with detailed knowledge of the network would be considered a white-box test. Black box testing means testing something when you have no knowledge of the inner workings. Therefore, this answer is incorrect. C: In this answer, the tester is given some information but not detailed information about the inner workings of the network. Testing the network with limited knowledge of the network would be considered a gray-box test. Black box testing means testing something when you have no knowledge of the inner workings. Therefore, this answer is incorrect. D: In this answer, the tester is given some information but not detailed information about the inner workings of the network. Testing the network with limited knowledge of the network would be considered a gray-box test. Black box testing means testing something when you have no knowledge of the inner workings. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Black-box_testing

• Question 368:

  Which of the following is an application security coding problem?

  A. Error and exception handling
  B. Patch management
  C. Application hardening
  D. Application fuzzing
  A. Error and exception handling

  ---

  Exception handling is an aspect of secure coding. When errors occur, the system should revert back to a secure state. This must be coded into the system by the programmer, and should capture errors and exceptions so that they could be handled by the application. Incorrect Answers: B: Patch management is the process of maintaining the latest source code for applications and operating systems. This helps protect a systems from known attacks and vulnerabilities, and is provided by the vendor in response to newly discovered vulnerabilities in the software. C: Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing unnecessary functions and features, removing unnecessary usernames or logins and disabling unnecessary services. D: Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 218, 220 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 229, 230, 231-232

• Question 369:

  A security analyst performs the following activities: monitors security logs, installs surveillance cameras and analyzes trend reports. Which of the following job responsibilities is the analyst performing? (Select TWO).

  A. Detect security incidents
  B. Reduce attack surface of systems
  C. Implement monitoring controls
  D. Hardening network devices
  E. Prevent unauthorized access
  A. Detect security incidents
  C. Implement monitoring controls

  ---

  By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is implementing monitoring controls. With the monitoring controls in place, by monitoring the security logs, reviewing the footage from the security cameras and analyzing trend reports, the security analyst is able to detect security incidents. Incorrect Answers: B: By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is not reducing the attack surface of systems. The security analyst is not making any changes to the systems; he is just monitoring activities on the systems. Therefore, this answer is incorrect. D: By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is not hardening the network devices. The security analyst is not making any changes to the network devices; he is just monitoring activities on the systems. Therefore, this answer is incorrect. E: By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is not preventing unauthorized access. The security analyst is not making any changes to the systems and so cannot prevent unauthorized access; he is just monitoring activities on the systems. Therefore, this answer is incorrect.

• Question 370:

  Joe a company's new security specialist is assigned a role to conduct monthly vulnerability scans across the network. He notices that the scanner is returning a large amount of false positives or failed audits. Which of the following should Joe recommend to remediate these issues?

  A. Ensure the vulnerability scanner is located in a segmented VLAN that has access to the company's servers
  B. Ensure the vulnerability scanner is configured to authenticate with a privileged account
  C. Ensure the vulnerability scanner is attempting to exploit the weaknesses it discovers
  D. Ensure the vulnerability scanner is conducting antivirus scanning
  A. Ensure the vulnerability scanner is located in a segmented VLAN that has access to the company's servers

  ---

  The vulnerability scanner is returning false positives because it is trying to scan servers that it doesn't have access to; for example, servers on the Internet. We need to ensure that the local network servers only are scanned. We can do this by locating the vulnerability scanner in a segmented VLAN that has access to the company's servers. A false positive is an error in some evaluation process in which a condition tested for is mistakenly found to have been detected. In spam filters, for example, a false positive is a legitimate message mistakenly marked as UBE --unsolicited bulk email, as junk email is more formally known. Messages that are determined to be spam -- whether correctly or incorrectly -- may be rejected by a server or client-side spam filter and returned to the sender as bounce e-mail. One problem with many spam filtering tools is that if they are configured stringently enough to be effective, there is a fairly high chance of getting false positives. The risk of accidentally blocking an important message has been enough to deter many companies from implementing any anti-spam measures at all. False positives are also common in security systems. A host intrusion prevention system (HIPS), for example, looks for anomalies, such as deviations in bandwidth, protocols and ports. When activity varies outside of an acceptable range for example, a remote application attempting to open a normally closed port -- an intrusion may be in progress. However, an anomaly, such as a sudden spike in bandwidth use, does not guarantee an actual attack, so this approach amounts to an educated guess and the chance for false positives can be high. False positives contrast with false negatives, which are results indicating mistakenly that some condition tested for is absent. Incorrect Answers: B: The vulnerability scanner should not be configured to authenticate with a privileged account. This is not required for a successful scan and is not the cause of the false positives and failed audits. Therefore, this answer is incorrect. C: The vulnerability scanner should not be attempting to exploit the weaknesses it discovers. It should just log the weaknesses. Attempting to exploit weaknesses is performed in a penetration test. This is not the job of a vulnerability scanner. Therefore, this answer is incorrect. D: The vulnerability scanner should not be conducting antivirus scanning. This is not the job of a vulnerability scanner and is not the cause of the false positives and failed audits. Therefore, this answer is incorrect. References: http://whatis.techtarget.com/definition/false-positive