CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 441:

  Jane, a security analyst, is reviewing logs from hosts across the Internet which her company uses to gather data on new malware. Which of the following is being implemented by Jane's company?

  A. Vulnerability scanner
  B. Honeynet
  C. Protocol analyzer
  D. Port scanner
  B. Honeynet

  ---

  The Internet hosts used to gather data on new malware are known as honeypots. A collection of honeypots is known as a honeynet. A honeynet is a network set up with intentional vulnerabilities; its purpose is to invite attack, so that an attacker's activities and methods can be studied and that information used to increase network security. A honeynet contains one or more honey pots, which are computer systems on the Internet expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. Although the primary purpose of a honeynet is to gather information about attackers' methods and motives, the decoy network can benefit its operator in other ways, for example by diverting attackers from a real network and its resources. The Honeynet Project, a non-profit research organization dedicated to computer security and information sharing, actively promotes the deployment of honeynets. In addition to the honey pots, a honeynet usually has real applications and services so that it seems like a normal network and a worthwhile target. However, because the honeynet doesn't actually serve any authorized users, any attempt to contact the network from without is likely an illicit attempt to breach its security, and any outbound activity is likely evidence that a system has been compromised. For this reason, the suspect information is much more apparent than it would be in an actual network, where it would have to be found amidst all the legitimate network data. Applications within a honeynet are often given names such as "Finances" or "Human Services" to make them sound appealing to the attacker. A virtual honeynet is one that, while appearing to be an entire network, resides on a single server. Incorrect Answers: A: A vulnerability scanner is software designed to assess computers, computer systems, networks or applications for weaknesses. This includes applications or default configurations posing a security risk. In this question, we have computers set up with the aim of being attacked to enable Jane to gather data on new malware. The question is asking about the computers themselves, not the tools used to assess the computers. These computers form a honeynet. Therefore, this answer is incorrect. C: A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. This is not what is described in this question. Therefore, this answer is incorrect. D: A port scanner is typically a software application used to scan a system such as a computer or firewall for open ports. A malicious user would attempt to access a system through an open port. A security administrator would compare the list of open ports against a list of ports that need to be open so that unnecessary ports can be closed thus reducing the vulnerability of the system. This is not what is described in this question. Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/honeynet

• Question 442:

  Encryption used by RADIUS is BEST described as:

  A. Quantum
  B. Elliptical curve
  C. Asymmetric
  D. Symmetric
  D. Symmetric

  ---

  The RADIUS server uses a symmetric encryption method. Note: Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. Incorrect Answers: A: Quantum encryption is a hypothetical encryption method not yet in use. B: Elliptical curve cryptography (ECC) is an approach to public-key cryptography, but the RADIUS protocol uses a private(secret) key. C: RADIUS uses a symmetric, not an asymmetric, encryption method. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249-251, 251-254, 257 http://www.studymode.com/essays/Elliptic-Curve-Cryptography-And-Its-Applications- 1560318.html http://en.wikipedia.org/wiki/Elliptic_curve_cryptography

• Question 443:

  A company's security administrator wants to manage PKI for internal systems to help reduce costs. Which of the following is the FIRST step the security administrator should take?

  A. Install a registration server.
  B. Generate shared public and private keys.
  C. Install a CA
  D. Establish a key escrow policy.
  C. Install a CA

  ---

  PKI is a two-key, asymmetric system with four main components: certificate authority (CA), registration authority (RA), RSA (the encryption algorithm), and digital certificates. When you implement a PKI you should start by installing a CA. Incorrect Answers: A: When you implement a PKI you are not required to install a registration server. You can rely on a public registration authority server. B: To generate shared public and private keys you would need a CA. D: A key escrow policy is not required for a PKI. Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 278-290

• Question 444:

  A hospital IT department wanted to secure its doctor's tablets. The IT department wants operating system level security and the ability to secure the data from alteration. Which of the following methods would MOST likely work?

  A. Cloud storage
  B. Removal Media
  C. TPM
  D. Wiping
  C. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: A: Cloud storage involves using an online storage provider to host data. The operating system would most likely not be installed on cloud storage. Therefore securing removable media would not provide operating system level security. B: Removable media includes tape drives, recordable compact disks (CD-Rs), diskettes, memory cards, etc. The operating system would most likely not be installed on removable media. Therefore securing removable media would not provide operating system level security. D. Wiping is the process of removing data from a device so that it is no longer recoverable. This is usually done when the device is to be decommissioned or discarded. It does not provide data security while the device is in use. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 206, 237 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 252

• Question 445:

  Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote sites through a VPN connection. How could Sara BEST accommodate the vendor?

  A. Allow incoming IPSec traffic into the vendor's IP address.
  B. Set up a VPN account for the vendor, allowing access to the remote site.
  C. Turn off the firewall while the vendor is in the office, allowing access to the remote site.
  D. Write a firewall rule to allow the vendor to have access to the remote site.
  D. Write a firewall rule to allow the vendor to have access to the remote site.

  ---

  Firewall rules are used to define what traffic is able pass between the firewall and the internal network. Firewall rules block the connection, allow the connection, or allow the connection only if it is secured. Firewall rules can be applied to inbound traffic or outbound traffic and any type of network. Incorrect Answers: A: Doing this will not allow the vendor access to the network. It will only allow the vendor to receive IPSec encrypted messages. B: This will allow the vendor to access the remote site from anywhere. C: turning off the firewall will remove all rules configured, making the network vulnerable. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 103, 157.

• Question 446:

  A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Which of the following should be implemented to secure the devices without risking availability?

  A. Host-based firewall
  B. IDS
  C. IPS
  D. Honeypot
  B. IDS

• Question 447:

  The systems administrator notices that many employees are using passwords that can be easily guessed or are susceptible to brute force attacks. Which of the following would BEST mitigate this risk?

  A. Enforce password rules requiring complexity.
  B. Shorten the maximum life of account passwords.
  C. Increase the minimum password length.
  D. Enforce account lockout policies.
  A. Enforce password rules requiring complexity.

  ---

  Password complexity often requires the use of a minimum of three out of four standard character types for a password. The more characters in a password that includes some character complexity, the more resistant it is to brute force attacks. Incorrect Answers: B: Reducing the maximum life of account passwords will require passwords to be changed at the end of that period. This will not make the new passwords less susceptible to brute force attacks. C: Increasing the password length will not make the new passwords less susceptible to brute force attacks. D: Account lockout automatically disables an account due to repeated failed log on attempts. It will not make the new passwords less susceptible to brute force attacks. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 292, 293.

• Question 448:

  Joe, the information security manager, is tasked with calculating risk and selecting controls to protect a new system. He has identified people, environmental conditions, and events that could affect the new system. Which of the following does he need to estimate NEXT in order to complete his risk calculations?

  A. Vulnerabilities
  B. Risk
  C. Likelihood
  D. Threats
  A. Vulnerabilities

• Question 449:

  Which of the following should be implemented to stop an attacker from mapping out addresses and/or devices on a network?

  A. Single sign on
  B. IPv6
  C. Secure zone transfers
  D. VoIP
  C. Secure zone transfers

  ---

  C: A primary DNS server has the "master copy" of a zone, and secondary DNS servers keep copies of the zone for redundancy. When changes are made to zone data on the primary DNS server, these changes must be distributed to the secondary DNS servers for the zone. This is done through zone transfers. If you allow zone transfers to any server, all the resource records in the zone are viewable by any host that can contact your DNS server. Thus you will need to secure the zone transfers to stop an attacker from mapping out your addresses and devices on your network. Incorrect Answers: A: Single sign-on is about having one password for all resources on a given network. This is not designed to stop attackers from mapping addresses on your network. B: IPv6 in the TCP/IP protocol is designed to support 128-bit addresses it is not designed to stop attackers mapping addresses on your network. D: Voice over IP (VoIP) is a methodology and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. IT is not meant to keep attackers from mapping addresses on your network. References: https://technet.microsoft.com/en-us/library/ee649273%28v=ws.10%29.aspx Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 148.

• Question 450:

  A company uses PGP to ensure that sensitive email is protected. Which of the following types of cryptography is being used here for the key exchange?

  A. Symmetric
  B. Session-based
  C. Hashing
  D. Asymmetric
  A. Symmetric

  ---

  PGP combines symmetric-key encryption and public-key encryption. The message is encrypted using a symmetric encryption algorithm, which requires a symmetric key. Each symmetric key is used only once and is also called a session key. Incorrect Answers: B: They key is a session key, but it is calculated using symmetric encryption. C: PGP using hashing to create a digital signature from the plaintext, not for the key exchange. D: PGP uses symmetric-key encryption, not asymmetric. References: http://en.wikipedia.org/wiki/Pretty_Good_Privacy Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 272-273