CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 431:

  Which of the following attacks would cause all mobile devices to lose their association with corporate access points while the attack is underway?

  A. Wireless jamming
  B. Evil twin
  C. Rogue AP
  D. Packet sniffing
  A. Wireless jamming

  ---

  When most people think of frequency jamming, what comes to mind are radio, radar and cell phone jamming. However, any communication that uses radio frequencies can be jammed by a strong radio signal in the same frequency. In this manner, Wi-Fi may be attacked with a network jamming attack, reducing signal quality until it becomes unusable or disconnects occur. With very similar methods, a focused and aimed signal can actually break access point hardware, as with equipment destruction attacks. Incorrect Answers: B: An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits. An evil twin access point would not cause all mobile devices to lose their association with corporate access points. Therefore, this answer is incorrect. C: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. A rogue access point would not cause all mobile devices to lose their association with corporate access points. Therefore, this answer is incorrect. D: Packet sniffing is the process of intercepting data as it is transmitted over a network. A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn't generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. The NIC is put into promiscuous mode, and it reads communications between computers within a particular segment. This allows the sniffer to seize everything that is flowing in the network, which can lead to the unauthorized access of sensitive data. A packet sniffer can take the form of either a hardware or software solution. A sniffer is also known as a packet analyzer. Packet sniffing would not cause all mobile devices to lose their association with corporate access points. Therefore, this answer is incorrect. References: http://whatis.techtarget.com/definition/frequency-jammer http://www.techopedia.com/definition/5057/evil-twin http://en.wikipedia.org/wiki/Rogue_access_point http://www.techopedia.com/definition/4113/sniffer

• Question 432:

  Pete, an IT Administrator, needs to secure his server room. Which of the following mitigation methods would provide the MOST physical protection?

  A. Sign in and sign out logs
  B. Mantrap
  C. Video surveillance
  D. HVAC
  B. Mantrap

  ---

  Mantraps are designed to contain an unauthorized, potentially hostile person/individual physically until authorities arrive. Mantraps are typically manufactured with bulletproof glass, high-strength doors, and locks and to allow the minimal amount of individuals depending on its size. Some mantraps even include scales that will weigh the person. The doors are designed in such a way as to open only when the mantrap is occupied or empty and not in-between. This means that the backdoor must first close before the front door will open. Mantraps are in most cases also combined with guards. This is the most physical protection any one measure will provide. Incorrect Answers: A: Sign in and sign out logs is not the most physical of access control measures to be employed. C: Video surveillance includes the use of a camera and implies the recording of events to gather as evidence - not a physical method. D: HVAC is used to control the physical environment factors such as heating, ventilation and air conditioning. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 371

• Question 433:

  An organization's security policy states that users must authenticate using something you do. Which of the following would meet the objectives of the security policy?

  A. Fingerprint analysis
  B. Signature analysis
  C. Swipe a badge
  D. Password
  B. Signature analysis

• Question 434:

  Which of the following is the MOST important step for preserving evidence during forensic procedures?

  A. Involve law enforcement
  B. Chain of custody
  C. Record the time of the incident
  D. Report within one hour of discovery
  B. Chain of custody

  ---

  Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. The evidence must always be within your custody, or you're open to dispute about possible evidence tampering. Thus to preserve evidence during a forensic procedure the chain of custody is of utmost importance. Incorrect Answers: A: Law enforcement can only come to fruition if the chain of custody is properly observed. C: Recording the time of the incident is part of the forensic procedure and not necessarily the preservation of evidence. D: Reporting an incident an hour after discovery violates the Acting in Oder of Volatility measures. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 448

• Question 435:

  Which of the following is the BEST way to prevent Cross-Site Request Forgery (XSRF) attacks?

  A. Check the referrer field in the HTTP header
  B. Disable Flash content
  C. Use only cookies for authentication
  D. Use only HTTPS URLs
  A. Check the referrer field in the HTTP header

  ---

  XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application's trust of a user who known or is supposed to have been authenticated. This is accomplished by changing values in the HTTP header and even in the user's cookie to falsify access. It can be prevented by embedding additional authentication data into requests that allows the web application to detect requests from unauthorized locations. Examples are synchronizer token patterns, cookie-to-header tokens, and checking the HTTP Referrer header and the HTTP Origin header. Incorrect Answers: B: Flash content is not used on Cross-Site Request Forgery (XSRF) attacks. Disabling flash content would thus not prevent Cross-Site Request Forgery (XSRF) attacks. C: Cookies are plain-text files that a browser stores on a user's hard disk to provide a persistent, customized web experience for each visit to a web site. It typically contains information about the user but is not used for authentication. D: HTTP Secure (HTTPS) combines HTTP with SSL/TLS to provide encrypted communication. This does not prevent XSRF. References: http://en.wikipedia.org/wiki/Cross-site_request_forgery Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 75, 335, 339, 340-341

• Question 436:

  Which of the following data security techniques will allow Matt, an IT security technician, to encrypt a system with speed as its primary consideration?

  A. Hard drive encryption
  B. Infrastructure as a service
  C. Software based encryption
  D. Data loss prevention
  A. Hard drive encryption

  ---

  Disk and device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. It should be implemented using a hardware-based solution for greater speed. Incorrect Answers: B: The Infrastructure as a Service (IaaS) model is a cloud computing business model uses virtualization, with the clients paying for resources used. It is not a data security technique. C: Software based encryption is usually slower than hardware based encryption. D. Data loss prevention is the purpose of encryption; it is not a data security technique. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 437:

  A company has recently implemented a high density wireless system by having a junior technician install two new access points for every access point already deployed. Users are now reporting random wireless disconnections and slow network connectivity. Which of the following is the MOST likely cause?

  A. The old APs use 802.11a
  B. Users did not enter the MAC of the new APs
  C. The new APs use MIMO
  D. A site survey was not conducted
  D. A site survey was not conducted

  ---

  To test the wireless AP placement, a site survey should be performed. Incorrect Answers: A: 802.11a operates in the 5 GHz frequency spectrum, and is therefore less likely to have disconnections and slow network connectivity. B: Entering the MAC address will not prevent disconnections, or speed up network connectivity. C: This cannot be the cause because MIMO would increase network availability. References: https://technet.microsoft.com/en-us/library/dd348467(v=ws.10).aspx http://en.wikipedia.org/wiki/MIMO http://en.wikipedia.org/wiki/IEEE_802.11a-1999

• Question 438:

  Key cards at a bank are not tied to individuals, but rather to organizational roles. After a break in, it becomes apparent that extra efforts must be taken to successfully pinpoint who exactly enters secure areas. Which of the following security measures can be put in place to mitigate the issue until a new key card system can be installed?

  A. Bollards
  B. Video surveillance
  C. Proximity readers
  D. Fencing
  B. Video surveillance

  ---

  Video surveillance is making use of a camera, or CCTV that is able to record everything it sees and is always running. This way you will be able to check exactly who enters secure areas. Incorrect Answers: A: Bollards are physical barriers designed to keep large items, such as vehicles from breaching a perimeter and individuals will still be able to enter through the bollards. C: Proximity readers works with cards/identity cards, but in this case a new key card system is to be implemented and is at the present moment not an option. D: Fencing is used as a perimeter security measure and in this case the problem is on the inside of the bank. You also cannot keep out clients with a fence. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 371-372

• Question 439:

  Which of the following controls would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks?

  A. 802.1x
  B. Data encryption
  C. Password strength
  D. BGP
  A. 802.1x

  ---

  IEEE 802.1X (also known as Dot1x) is an IEEE Standard for Port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. 802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server. The supplicant is a client device (such as a laptop) that wishes to attach to the LAN/WLAN - though the term 'supplicant' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software supporting the RADIUS and EAP protocols. The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. An analogy to this is providing a valid visa at the airport's arrival immigration before being allowed to enter the country. With 802.1X port-based authentication, the supplicant provides credentials, such as user name/password or digital certificate, to the authenticator, and the authenticator forwards the credentials to the authentication server for verification. If the authentication server determines the credentials are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network. Incorrect Answers: B: Data encryption encrypts data whether it is in transit over a network or stored on a hard drive or other storage. It is not used to prevent access to network switches or other network devices. C: Password strength determines the length or complexity of a password. It is not used to prevent access to network switches or other network devices. D: BGP (Border Gateway Protocol) is a routing protocol. It is not used to prevent access to network switches or other network devices. References: http://en.wikipedia.org/wiki/IEEE_802.1X

• Question 440:

  Mandatory vacations are a security control which can be used to uncover which of the following?

  A. Fraud committed by a system administrator
  B. Poor password security among users
  C. The need for additional security staff
  D. Software vulnerabilities in vendor code
  A. Fraud committed by a system administrator

  ---

  Mandatory vacations also provide an opportunity to discover fraud apart from the obvious benefits of giving employees a chance to refresh and making sure that others in the company can fill those positions and make the company less dependent on those persons; a sort pf replication and duplication at all levels. Incorrect Answers: B: Poor password security is not the purpose of implementing mandatory vacations. C: Mandatory vacations will have the opposite effect to needing additional security staff. D: Software vulnerability can only be uncovered by looking at the software installed and its version and not by means by mandatory vacations. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 25