CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 391:

  Which of the following identifies certificates that have been compromised or suspected of being compromised?

  A. Certificate revocation list
  B. Access control list
  C. Key escrow registry
  D. Certificate authority
  A. Certificate revocation list

  ---

  Certificates that have been compromised or are suspected of being compromised are revoked. A CRL is a locally stored record containing revoked certificates and revoked keys. Incorrect Answers: B: Access control lists (ACLs) enable devices in your network to ignore requests from specified users or systems or to grant them access to certain network capabilities. ACLs cannot be used for certificates or keys. C: Key escrow is not related to revoked certificates. Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question. D: In cryptography, a certificate authority or certification authority (CA) is an entity that issues digital certificates. You don't use a CA to store revoked certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 156-157, 262, 279-280, 285

• Question 392:

  Symmetric encryption utilizes __________, while asymmetric encryption utilizes _________.

  A. Public keys, one time
  B. Shared keys, private keys
  C. Private keys, session keys
  D. Private keys, public keys
  D. Private keys, public keys

  ---

  Symmetrical systems require the key to be private between the two parties. With asymmetric systems, each circuit has one key. In more detail: * Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. A symmetric key, sometimes referred to as a secret key or private key, is a key that isn't disclosed to people who aren't authorized to use the encryption system. * Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes. Incorrect Answers: A: Symmetric encryption uses private keys, not public keys. B: Symmetric encryption uses private keys, not shared keys. C: Asymmetric encryption does not use session keys, it uses a public key to encrypt data. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251, 262

• Question 393:

  Which of the following will allow Pete, a security analyst, to trigger a security alert because of a tracking cookie?

  A. Network based firewall
  B. Anti-spam software
  C. Host based firewall
  D. Anti-spyware software
  D. Anti-spyware software

  ---

  Spyware monitors a user's activity and uses network protocols to reports it to a third party without the user's knowledge. This is usually accomplished using a tracking cookie. Incorrect Answers: A: A firewall protects a system from possible attack over a network by restricting or filtering the types of communications that are allowed to pass into the system. It does not detect tracking cookies. B: A spam filter is a software or hardware solution used to identify and block, filter, or remove unwanted messages sent via email or instant messaging (IM). It does not block tracking cookies. C: A host-based firewall is installed on a client system and is used to protect the client system from the activities of the user as well as from communication from the network or Internet. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 5-6, 18-19, 300 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 246

• Question 394:

  A software company has completed a security assessment. The assessment states that the company should implement fencing and lighting around the property. Additionally, the assessment states that production releases of their software should be digitally signed. Given the recommendations, the company was deficient in which of the following core security areas? (Select TWO).

  A. Fault tolerance
  B. Encryption
  C. Availability
  D. Integrity
  E. Safety
  F. Confidentiality
  D. Integrity
  E. Safety

  ---

  Aspects such as fencing, proper lighting, locks, CCTV, Escape plans Drills, escape routes and testing controls form part of safety controls. Integrity refers to aspects such as hashing, digital signatures, certificates and non-repudiation all of which has to do with data integrity. Incorrect Answers: A: Fault tolerance refers to the availability of resources to the users in the company in the event of a failure of any of those resources. B: Encryption is a method of ensuring the confidentiality of data. C: Availability is all about making sure that the data and systems are available for authorized users. F: Confidentiality means preventing unauthorized users from accessing data. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 401, 414

• Question 395:

  An administrator is investigating a system that may potentially be compromised, and sees the following log entries on the router.

  *Jul 15 14:47:29.779:%Router1: list 101 permitted tcp 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 3 packets.

  *Jul 15 14:47:38.779:%Router1: list 101 permitted tcp 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 6 packets.

  *Jul 15 14:47:45.779:%Router1: list 101 permitted tcp 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 8 packets.

  Which of the following BEST describes the compromised system?

  A. It is running a rogue web server
  B. It is being used in a man-in-the-middle attack
  C. It is participating in a botnet
  D. It is an ARP poisoning attack
  C. It is participating in a botnet

• Question 396:

  Several employees submit the same phishing email to the administrator. The administrator finds that the links in the email are not being blocked by the company's security device. Which of the following might the administrator do in the short term to prevent the emails from being received?

  A. Configure an ACL
  B. Implement a URL filter
  C. Add the domain to a block list
  D. Enable TLS on the mail server
  C. Add the domain to a block list

  ---

  Blocking e-mail is the same as preventing the receipt of those e-mails and this is done by applying a filter. But the filter must be configured to block it. Thus you should add that specific domain from where the e-mails are being sent to the list of addresses that is to be blocked. Incorrect Answers: A: ACLs enable devices in your network to ignore requests from specified users or systems or to grant them access to certain network capabilities. B: URL filtering involves blocking websites (or sections of websites) based solely on the URL, restricting access to specified websites and certain web-based applications. D: TLS is a security protocol that further enhances SSL and though this is also a solution to establish a secure communication connection between two TCP- based machines, it is not short term to prevent emails from being received. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 119, 269

• Question 397:

  A user ID and password together provide which of the following?

  A. Authorization
  B. Auditing
  C. Authentication
  D. Identification
  C. Authentication

  ---

  Authentication generally requires one or more of the following: Something you know: a password, code, PIN, combination, or secret phrase. Something you have: a smart card, token device, or key. Something you are: a fingerprint, a retina scan, or voice recognition; often referred to as biometrics, discussed later in this chapter. Somewhere you are: a physical or logical location. Something you do: typing rhythm, a secret handshake, or a private knock. Incorrect Answers: A: Authorization occurs after authentication, and ensures that the requested activity or object access is possible given the rights and privileges assigned to the authenticated identity. Authorization indicates who is trusted to perform specific operations. B: Auditing is generally used for compliance testing. D: Identification is the claiming of an identity, only has to take place once per authentication or access process. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 118, 276, 280, 285.

• Question 398:

  An internal auditor is concerned with privilege creep that is associated with transfers inside the company. Which mitigation measure would detect and correct this?

  A. User rights reviews
  B. Least privilege and job rotation
  C. Change management
  D. Change Control
  A. User rights reviews

  ---

  A privilege audit is used to determine that all groups, users, and other accounts have the appropriate privileges assigned according to the policies of an organization. This means that a user rights review will reveal whether user accounts have been assigned according to their `new' job descriptions , or if there are privilege creep culprits after transfers has occurred. Incorrect Answers: B: Least privilege is used when permissions are assigned and job rotation means that people are rotating through jobs, these measures will not detect privilege creep, rather it would present opportunities to commit privilege creep. C: Change management is the structured approach that is followed to secure a company's assets. D: Change control does not allow one to detect privilege creep. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 9-10, 20

• Question 399:

  During which of the following phases of the Incident Response process should a security administrator define and implement general defense against malware?

  A. Lessons Learned
  B. Preparation
  C. Eradication
  D. Identification
  B. Preparation

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/ reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. It is important to stop malware before it ever gets hold of a system thus you should know which malware is out there and take defensive measures - this means preparation to guard against malware infection should be done. Incorrect Answers: A: Lessons learned is one of the latter phases in incident response after the event occurred this means that general defense has not been observed. C: Eradication is done after the infection already occurred and can thus not be considered general defense. D: Incident Identification presumes that the incident already occurred thus it cannot be considered general defense against malware. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 121-122, 429

• Question 400:

  Ann, the network administrator, is receiving reports regarding a particular wireless network in the building. The network was implemented for specific machines issued to the developer department, but the developers are stating that they are having connection issues as well as slow bandwidth. Reviewing the wireless router's logs, she sees that devices not belonging to the developers are connecting to the access point. Which of the following would BEST alleviate the developer's reports?

  A. Configure the router so that wireless access is based upon the connecting device's hardware address.
  B. Modify the connection's encryption method so that it is using WEP instead of WPA2.
  C. Implement connections via secure tunnel with additional software on the developer's computers.
  D. Configure the router so that its name is not visible to devices scanning for wireless networks.
  A. Configure the router so that wireless access is based upon the connecting device's hardware address.