CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 381:

  Ann wants to send a file to Joe using PKI. Which of the following should Ann use in order to sign the file?

  A. Joe's public key
  B. Joe's private key
  C. Ann's public key
  D. Ann's private key
  D. Ann's private key

  ---

  The sender uses his private key, in this case Ann's private key, to create a digital signature. The message is, in effect, signed with the private key. The sender then sends the message to the receiver. The receiver uses the public key attached to the message to validate the digital signature. If the values match, the receiver knows the message is authentic. The receiver uses a key provided by the sender--the public key--to decrypt the message. Most digital signature implementations also use a hash to verify that the message has not been altered, intentionally or accidently, in transit. Incorrect Answers: A: The sender's (Ann's) not Joe's key must be used. B: The sender's (Ann's) not Joe's key must be used. C: The sender's private key, not her public key, is used to sign the message file. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285

• Question 382:

  A software developer is responsible for writing the code on an accounting application. Another software developer is responsible for developing code on a system in human resources. Once a year they have to switch roles for several weeks.

  Which of the following practices is being implemented?

  A. Mandatory vacations
  B. Job rotation
  C. Least privilege
  D. Separation of duties
  B. Job rotation

  ---

  A job rotation policy defines intervals at which employees must rotate through positions. Incorrect Answers: A: A mandatory vacation policy requires all users to take time away from work to refresh. C: A least privilege policy should be used when assigning permissions. Give users only the permissions that they need to do their work and no more. D: A separation of duties policy means the segregation of duties and separation of environments as a way to reduce the likelihood of misuse of systems or information. Separation of duties means that users are granted only the permissions they need to do their work and no more. More so it means that there is differentiation between users, employees and duties per se which form part of best practices. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 24, 25, 26, 153 http://en.wikipedia.org/wiki/Job_rotation

• Question 383:

  After a user performed a war driving attack, the network administrator noticed several similar markings where WiFi was available throughout the enterprise. Which of the following is the term used to describe these markings?

  A. IV attack
  B. War dialing
  C. Rogue access points
  D. War chalking
  D. War chalking

  ---

  War chalking is the act of making chalk marks on outdoor surfaces (walls, sidewalks, buildings, sign posts, trees) to indicate the existence of an open wireless network connection, usually offering an Internet connection so that others can benefit from the free wireless access. The open connections typically come from the access points of wireless networks located within buildings to serve enterprises. The chalk symbols indicate the type of access point that is available at that specific spot. Incorrect Answers: A: An initialization vector is a random number used in combination with a secret key as a means to encrypt data. This number is sometimes referred to as a nonce, or "number occurring once," as an encryption program uses it only once per session. An initialization vector is used to avoid repetition during the data encryption process, making it impossible for hackers who use dictionary attack to decrypt the exchanged encrypted message by discovering a pattern. This is known as an IV attack. A particular binary sequence may be repeated more than once in a message, and the more it appears, the more the encryption method is discoverable. For example if a one-letter word exists in a message, it may be either "a" or "I" but it can't be "e" because the word "e" is non-sensical in English, while "a" has a meaning and "I" has a meaning. Repeating the words and letters makes it possible for software to apply a dictionary and discover the binary sequence corresponding to each letter. Using an initialization vector changes the binary sequence corresponding to each letter, enabling the letter "a" to be represented by a particular sequence in the first instance, and then represented by a completely different binary sequence in the second instance. An IV attack does not involve marking external surfaces to indicate open Wifi networks. Therefore, this answer is incorrect. B: War dialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems and fax machines. Hackers use the resulting lists for various purposes: hobbyists for exploration, and crackers - malicious hackers who specialize in computer security - for guessing user accounts (by capturing voicemail greetings), or locating modems that might provide an entry-point into computer or other electronic systems. It may also be used by security personnel, for example, to detect unauthorized devices, such as modems or faxes, on a company's telephone network. War dialing does not involve marking external surfaces to indicate open Wifi networks. Therefore, this answer is incorrect. C: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. This is not what is described in the question. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/W/warchalking.html http://www.techopedia.com/definition/26858/initialization-vector http://en.wikipedia.org/wiki/War_dialing http://en.wikipedia.org/wiki/Rogue_access_point

• Question 384:

  A security administrator discovered that all communication over the company's encrypted wireless network is being captured by savvy employees with a wireless sniffing tool and is then being decrypted in an attempt to steal other employee's credentials. Which of the following technology is MOST likely in use on the company's wireless?

  A. WPA with TKIP
  B. VPN over open wireless
  C. WEP128-PSK
  D. WPA2-Enterprise
  C. WEP128-PSK

  ---

  WEP's major weakness is its use of static encryption keys. When you set up a router with a WEP encryption key, that one key is used by every device on your network to encrypt every packet that's transmitted. But the fact that packets are encrypted doesn't prevent them from being intercepted, and due to some esoteric technical flaws it's entirely possible for an eavesdropper to intercept enough WEP-encrypted packets to eventually deduce what the key is. This problem used to be something you could mitigate by periodically changing the WEP key (which is why routers generally allow you to store up to four keys). But few bother to do this because changing WEP keys is inconvenient and time-consuming because it has to be done not just on the router, but on every device that connects to it. As a result, most people just set up a single key and then continue using it ad infinitum. Even worse, for those that do change the WEP key, new research and developments reinforce how even changing WEP keys frequently is no longer sufficient to protect a WLAN. The process of 'cracking' a WEP key used to require that a malicious hacker intercept millions of packets plus spend a fair amount of time and computing power. Researchers in the computer science department of a German university recently demonstrated the capability to compromise a WEP-protected network very quickly. After spending less than a minute intercepting data (fewer than 100,000 packets in all) they were able to compromise a WEP key in just three seconds. Incorrect Answers: B: WPA (WiFi Protected Access) is the new security standard adopted by the WiFi Alliance consortium. WiFi compliance ensures interoperability between different manufacturer's wireless equipment. WPA is a much improved encryption standard that delivers a level of security beyond anything that WEP can offer. It bridges the gap between WEP and 802.11i (WPA2) networks. WPA uses Temporal Key Integrity Protocol (TKIP), which is designed to allow WEP to be upgraded through corrective measures that address the existing security problems. WPA is able to achieve over 500 trillion possible key combinations and re-keying of global encryption keys is required. The encryption key is changed after every frame using TKIP. This allows key changes to occur on a frame by frame basis and to be automatically synchronized between the access point and the wireless client. The TKIP encryption algorithm is stronger than the one used by WEP. WPA is compatible with many older access points and network cards. WPA with TKIP is considered more secure than WEP. Therefore, this answer is incorrect. C: It's very unlikely that each computer connected to the wireless access point is configured to use a VPN connection. Furthermore, VPN connections are secure. Therefore, this answer is incorrect. D: WPA2 is the latest implementation of WPA and provides stronger data protection and network access control. It provides WiFi users with a higher level of assurance that only authorized users can access their wireless networks. WPA2 is based on the IEEE 802.11i standard and provides government grade security. 802.11i describes the encrypted transmission of data between systems of 802.11a and 802.11b wireless LANs. It defines new encryption key protocols including the Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES). There are two versions of WPA2: WPA2 Personal and WPA2 Enterprise. WPA2 Personal protects unauthorized network access by utilizing a setup password. WPA2 Enterprise verifies network users through a server. WPA2 is much more secure than WEP. Therefore, this answer is incorrect. References: http://www.webopedia.com/DidYouKnow/Computer_Science/WEP_WPA_wireless_security.as p http://www.onlinecomputertips.com/networking/wep_wpa.html

• Question 385:

  Ann, the security administrator, wishes to implement multifactor security. Which of the following should be implemented in order to compliment password usage and smart cards?

  A. Hard tokens
  B. Fingerprint readers
  C. Swipe badge readers D. Passphrases
  B. Fingerprint readers

  ---

  A multifactor authentication method uses two or more processes for logon. A twofactor method might use smart cards and biometrics for logon. For obvious reasons, the two or more factors employed should not be from the same category. Incorrect Answers: A: Hard tokens would fall in the same category as smart cards. C: Swipe badge readers are in the same category as smart cards. D: Passphrases fall in the same category as password usage. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 133

• Question 386:

  During a security assessment, an administrator wishes to see which services are running on a remote server. Which of the following should the administrator use?

  A. Port scanner
  B. Network sniffer
  C. Protocol analyzer
  D. Process list
  A. Port scanner

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine. Incorrect Answers: B: A network sniffer is another name for a protocol analyzer. A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It may be possible to determine which services are open on a server by analyzing the network traffic to and from the server. However, it would be administratively difficult. A port scanner is a much simpler solution. Therefore, this answer is incorrect. C: A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It may be possible to determine which services are open on a server by analyzing the network traffic to and from the server. However, it would be administratively difficult. A port scanner is a much simpler solution. Therefore, this answer is incorrect. D: A process list would list all processes running on a computer, including services. However, this question is asking about a remote server. It would be difficult to obtain a process list from a remote server without having full access to the server. You can scan the server for open ports without having full access to the server. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Port_scanner

• Question 387:

  An organization has introduced token-based authentication to system administrators due to risk of password compromise. The tokens have a set of numbers that automatically change every 30 seconds. Which of the following type of authentication mechanism is this?

  A. TOTP
  B. Smart card
  C. CHAP
  D. HOTP
  A. TOTP

  ---

  Time-based one-time password (TOTP) tokens are devices or applications that generate passwords at fixed time intervals. In this case, it's every 30 seconds. Incorrect Answers: B: A smart card is sometimes referred to as an identity token containing integrated circuits. It does not generate passwords based on time. C: The Challenge-Handshake Authentication Protocol (CHAP) is used primarily over dial-up connections to provide a secure transport mechanism for logon credentials. It does not generate passwords based on time. D: HMAC-based one-time password (HOTP) tokens are devices that generate passwords based on a nonrepeating one-way function. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 282,283.

• Question 388:

  Several employees clicked on a link in a malicious message that bypassed the spam filter and their PCs were infected with malware as a result. Which of the following BEST prevents this situation from occurring in the future?

  A. Data loss prevention
  B. Enforcing complex passwords
  C. Security awareness training
  D. Digital signatures
  C. Security awareness training

• Question 389:

  An administrator implements SELinux on a production web server. After implementing this, the web server no longer serves up files from users' home directories. To rectify this, the administrator creates a new policy as the root user. This is an example of which of the following? (Select TWO).

  A. Enforcing SELinux in the OS kernel is role-based access control
  B. Enforcing SELinux in the OS kernel is rule-based access control
  C. The policy added by the root user is mandatory access control
  D. Enforcing SELinux in the OS kernel is mandatory access control
  E. The policy added by the root user is role-based access control
  F. The policy added by the root user is rule-based access control
  D. Enforcing SELinux in the OS kernel is mandatory access control
  F. The policy added by the root user is rule-based access control

• Question 390:

  Which of the following authentication services requires the use of a ticket-granting ticket (TGT) server in order to complete the authentication process?

  A. TACACS+
  B. Secure LDAP
  C. RADIUS
  D. Kerberos
  D. Kerberos

  ---

  The basic process of Kerberos authentication is as follows: The subject provides logon credentials. The Kerberos client system encrypts the password and transmits the protected credentials to the KDC. The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client. The client receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm. The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC. The KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime. The client receives the ST. The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved. Incorrect Answers: A: TACACS+ makes use of Kerberos as an authentication mechanism. B: Lightweight Directory Access Protocol is used to allow clients to interact with directory service resources. Secure LDAP is the implementation of LDAP using security, such as protected authentication and encrypted data exchanges, specifically provided by SASL. C: Radius does not make use of tickets. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 270- 275.