CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 411:

  A recent audit of a company's identity management system shows that 30% of active accounts belong to people no longer with the firm. Which of the following should be performed to help avoid this scenario? (Select TWO).

  A. Automatically disable accounts that have not been utilized for at least 10 days.
  B. Utilize automated provisioning and de-provisioning processes where possible.
  C. Request that employees provide a list of systems that they have access to prior to leaving the firm.
  D. Perform regular user account review / revalidation process.
  E. Implement a process where new account creations require management approval.
  B. Utilize automated provisioning and de-provisioning processes where possible.
  D. Perform regular user account review / revalidation process.

  ---

  Provisioning and de-provisioning processes can occur manually or automatically. Since the manual processes are so time consuming, the automated option should be used as it is more efficient. Revalidating user accounts would determine which users are no longer active. Incorrect Answers: A: Disabling the accounts would work for users who would return, but these users will not be returning. Therefore, they must be removed. C: This this option will tell which systems you need to access to manually remove users. This would take a long time, and might allow users to access those systems after they have left. E: Account creation is not the problem in this case. It is the fact that accounts aren't being removed when users have left. References: https://technet.microsoft.com/en-us/library/dn487455.aspx

• Question 412:

  The recovery agent is used to recover the:

  A. Root certificate
  B. Key in escrow
  C. Public key
  D. Private key
  D. Private key

  ---

  A key recovery agent is an entity that has the ability to recover a private key, key components, or plaintext messages as needed. Using the recovered key the recovery agent can decrypt encrypted data. Incorrect Answers: A: The key recovery agent recovers the private key, not the root certificate. B: The key recovery agent recovers the private key, not key in escrow. C: The key recovery agent recovers the private key, not the public key. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285

• Question 413:

  Three of the primary security control types that can be implemented are.

  A. Supervisory, subordinate, and peer.
  B. Personal, procedural, and legal.
  C. Operational, technical, and management.
  D. Mandatory, discretionary, and permanent.
  C. Operational, technical, and management.

  ---

  The National Institute of Standards and Technology (NIST) places controls into various types. The control types fall into three categories: Management, Operational, and Technical. Incorrect Answers: A: Supervisory, subordinate and peer are not primary security control types. B: Personal, procedural and legal controls are subsections of managerial control types. D: Mandatory, discretionary and permanent control types are methods of access control that can be implemented. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 26-27 http://www.professormesser.com/security-plus/sy0-401/control-types-2/

• Question 414:

  Company XYZ recently salvaged company laptops and removed all hard drives, but the Chief Information Officer (CIO) is concerned about disclosure of confidential information. Which of the following is the MOST secure method to dispose of these hard drives?

  A. Degaussing
  B. Physical Destruction
  C. Lock up hard drives in a secure safe
  D. Wipe
  B. Physical Destruction

  ---

  The physical description of hard drives is the only secure means of disposing hard drives. This can include incineration, an acid bath, and crushing. Incorrect Answers: A, D. Data wiping is the process of securely removing data remnants from a storage device so that the data cannot be easily recovered. Degaussing is one method of data wiping. However, data wiping does not provide a guarantee that the data is completely unrecoverable. C: Locking hard drives in a safe still represents a risk should the attackers gain access to the safe. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 256

• Question 415:

  The common method of breaking larger network address space into smaller networks is known as:

  A. subnetting.
  B. phishing.
  C. virtualization.
  D. packet filtering.
  A. subnetting.

• Question 416:

  The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as which of the following?

  A. Stream ciphers
  B. Transport encryption
  C. Key escrow
  D. Block ciphers
  B. Transport encryption

  ---

  Transport encryption is the process of encrypting data ready to be transmitted over an insecure network. A common example of this would be online banking or online purchases where sensitive information such as account numbers or credit card numbers is transmitted. Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL). Incorrect Answers: A: A stream cipher is used for encrypting data when the size of the data is unknown (such as streaming a movie). The data is encrypted one bit at a time as it is streamed. RC4 is a commonly used stream cipher. A stream cipher is a specific description of something that is used to encrypt a stream of data. It is not a concept of securing data between two points. C: Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. It is not a concept of securing data between two points. D: A block cipher is used to encrypt a chunk of data (block) before transmitting the data. A block cipher is a specific description of something that is used to encrypt a block of data. It is not a concept of securing data between two points. References: http://en.wikipedia.org/wiki/Transport_Layer_Security Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249, 250, 262

• Question 417:

  Which of the following practices is used to mitigate a known security vulnerability?

  A. Application fuzzing
  B. Patch management
  C. Password cracking
  D. Auditing security logs
  B. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from new attacks and vulnerabilities that have recently become known. Incorrect Answers: A: Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. C: Password cracking is an attempt to find weakness in users' passwords. However, password strength and complexity would be used to mitigate against weakness in users' passwords. D: Security logs record information about security related events, such as user access to resource objects, users performing privileged operations, or events detected by sentry devices such as firewalls, IDS/IPS, and routers and switches. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 218, 220 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 202, 229, 231-232

• Question 418:

  Joe, a user, wants to protect sensitive information stored on his hard drive. He uses a program that encrypted the whole hard drive. Once the hard drive is fully encrypted, he uses the same program to create a hidden volume within the

  encrypted hard drive and stores the sensitive information within the hidden volume.

  This is an example of which of the following? (Select TWO).

  A. Multi-pass encryption
  B. Transport encryption
  C. Plausible deniability
  D. Steganography
  E. Transitive encryption
  F. Trust models
  C. Plausible deniability
  D. Steganography

• Question 419:

  When employees that use certificates leave the company they should be added to which of the following?

  A. PKI
  B. CA
  C. CRL
  D. TKIP
  C. CRL

  ---

  The certificates of the leaving employees must be made unusable. This is done by revoking them. The revoke certificates end up in the CRL. Note: The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release. Incorrect Answers: A: You can't add revoked certificates to a PKI. A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. B: You can't add revoked certificates to a CA. D: TKIP is a wireless protocol and cannot manage certificates. Temporal Key Integrity Protocol or TKIP was a stopgap security protocol used in the IEEE 802.11 wireless networking standard. TKIP was designed by the IEEE 802.11i task group and the Wi-Fi Alliance as an interim solution to replace WEP without requiring the replacement of legacy hardware. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 279-280, 279-285, 285

• Question 420:

  Which of the following is BEST utilized to actively test security controls on a particular system?

  A. Port scanning
  B. Penetration test
  C. Vulnerability scanning
  D. Grey/Gray box
  B. Penetration test

  ---

  Penetration testing is the most intrusive type of testing because you are actively trying to circumvent the system's security controls to gain access to the system. Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit. Pen tests can be automated with software applications or they can be performed manually. Either way, the process includes gathering information about the target before the test (reconnaissance), identifying possible entry points, attempting to break in (either virtually or for real) and reporting back the findings. The main objective of penetration testing is to determine security weaknesses. A pen test can also be used to test an organization's security policy compliance, its employees' security awareness and the organization's ability to identify and respond to security incidents. Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. Pen test strategies include: Targeted testing Targeted testing is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a "lights-turned-on" approach because everyone can see the test being carried out. External testing This type of pen test targets a company's externally visible servers or devices including domain name servers (DNS), e-mail servers, Web servers or firewalls. The objective is to find out if an outside attacker can get in and how far they can get in once they've gained access. Internal testing This test mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause. Blind testing A blind test strategy simulates the actions and procedures of a real attacker by severely limiting the information given to the person or team that's performing the test beforehand. Typically, they may only be given the name of the company. Because this type of test can require a considerable amount of time for reconnaissance, it can be expensive. Double blind testing Double blind testing takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double- blind tests can be useful for testing an organization's security monitoring and incident identification as well as its response procedures. Incorrect Answers: A: A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine. Port scanning does not actively test security controls on a system. Therefore, this answer is incorrect. C: A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. A vulnerability scan is considered passive in that it doesn't actually attempt to circumvent the security controls of a system to gain access (unlike a penetration test). Therefore, this answer is incorrect. D: Gray box testing, also called gray box analysis, is a strategy for software debugging in which the tester has limited knowledge of the internal details of the program. A gray box is a device, program or system whose workings are partially understood. Gray box testing does not actively test security controls on a system. Therefore, this answer is incorrect. References: http://searchsoftwarequality.techtarget.com/definition/penetration-testing http://en.wikipedia.org/wiki/Port_scanner http://searchsoftwarequality.techtarget.com/definition/gray-box