CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 451:

  Joe, a network administrator, is able to manage the backup software console by using his network login credentials. Which of the following authentication services is he MOST likely using?

  A. SAML
  B. LDAP
  C. iSCSI
  D. Two-factor authentication
  B. LDAP

• Question 452:

  Which of the following is a directional antenna that can be used in point-to-point or point-to-multi-point WiFi communication systems? (Select TWO).

  A. Backfire
  B. Dipole
  C. Omni
  D. PTZ
  E. Dish
  A. Backfire
  E. Dish

• Question 453:

  An access point has been configured for AES encryption but a client is unable to connect to it. Which of the following should be configured on the client to fix this issue?

  A. WEP
  B. CCMP
  C. TKIP
  D. RC4
  B. CCMP

  ---

  CCMP is an encryption protocol designed for Wireless LAN products that implement the standards of the IEEE 802.11i amendment to the original IEEE 802.11 standard. CCMP is an enhanced data cryptographic encapsulation mechanism designed for data confidentiality and based upon the Counter Mode with CBC-MAC (CCM) of the AES standard. Incorrect Answers: A: WEP is based on RC4, and does not use AES. C: TKIP is a basis for WPA. D: RC4 is the basis of WEP. References: http://en.wikipedia.org/wiki/CCMP Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 59, 60.

• Question 454:

  A security administrator is concerned about the strength of user's passwords. The company does not want to implement a password complexity policy. Which of the following can the security Administrator implement to mitigate the risk of an online password attack against users with weak passwords?

  A. Increase the password length requirements
  B. Increase the password history
  C. Shorten the password expiration period
  D. Decrease the account lockout time
  C. Shorten the password expiration period

  ---

  Reducing the password expiration period will require passwords to be changed at the end of that period. A password needs to be changed if it doesn't meet the compliance requirements of the company's password policy, or is evidently insecure. It will also need to be changed if it has been reused, or due to possible compromise as a result of a system intrusion. This will give online password attackers less time to crack the weak passwords. Incorrect Answers: A: Increasing the password length will not make the new passwords less susceptible to online password attackers. B: Password history tracks previous passwords to prevent password reuse. It will not make the new passwords less susceptible to online password attackers. D: Account lockout automatically disables an account due to repeated failed log on attempts. When the account is unlocked it will still have the same weak password, and still susceptible to online password attacks. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 292- 294.

• Question 455:

  Jane, a security administrator, has been tasked with explaining authentication services to the company's management team. The company runs an active directory infrastructure. Which of the following solutions BEST relates to the host authentication protocol within the company's environment?

  A. Kerberos
  B. Least privilege
  C. TACACS+
  D. LDAP
  A. Kerberos

  ---

  Kerberos was accepted by Microsoft as the chosen authentication protocol for Windows 2000 and Active Directory domains that followed. Incorrect Answers: B: Least privilege requires that users are allowed only the minimum required access, permissions, and privileges necessary to complete their work tasks. Furthermore, it is not an authentication protocol. C: TACACS+ is a protocol that uses the authentication, authorization, and accounting (AAA) architecture. It is used for remote authentication. D: LDAP allows clients to access resources within a directory service. References: http://en.wikipedia.org/wiki/NT_LAN_Manager Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 82, 271, 273.

• Question 456:

  Which of the following ports and protocol types must be opened on a host with a host-based firewall to allow incoming SFTP connections?

  A. 21/UDP
  B. 21/TCP
  C. 22/UDP
  D. 22/TCP
  D. 22/TCP

  ---

  SSH uses TCP port 22. All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22. Incorrect Answers: A, C: FTP ,and SSH do not make use of UDP ports. B: FTP uses TCP port 21. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 51.

• Question 457:

  Users have been reporting that their wireless access point is not functioning. They state that it allows slow connections to the internet, but does not provide access to the internal network. The user provides the SSID and the technician logs into the company's access point and finds no issues. Which of the following should the technician do?

  A. Change the access point from WPA2 to WEP to determine if the encryption is too strong
  B. Clear all access logs from the AP to provide an up-to-date access list of connected users
  C. Check the MAC address of the AP to which the users are connecting to determine if it is an imposter
  D. Reconfigure the access point so that it is blocking all inbound and outbound traffic as a troubleshooting gap
  C. Check the MAC address of the AP to which the users are connecting to determine if it is an imposter

  ---

  The users may be connecting to a rogue access point. The rogue access point could be hosting a wireless network that has the same SSID as the corporate wireless network. The only way to tell for sure if the access point the users are connecting to is the correct one is to check the MAC address. Every network card has a unique 48-bit address assigned. A media access control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used as a network address for most IEEE 802 network technologies, including Ethernet and WiFi. Logically, MAC addresses are used in the media access control protocol sublayer of the OSI reference model. MAC addresses are most often assigned by the manufacturer of a network interface controller (NIC) and are stored in its hardware, such as the card's read-only memory or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address (BIA). It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. This can be contrasted to a programmed address, where the host device issues commands to the NIC to use an arbitrary address. A network node may have multiple NICs and each NIC must have a unique MAC address. MAC addresses are formed according to the rules of one of three numbering name spaces managed by the Institute of Electrical and Electronics Engineers (IEEE): MAC-48, EUI-48, and EUI-64. Incorrect Answers: A: Strong encryption would not cause slow connections to the internet. WPA2 is the standard wireless network encryption method today and all new computers are capable of using it. Therefore, this answer is incorrect. B: Clearing all access logs on the access point would not resolve the connectivity issues. Therefore, this answer is incorrect. D: Blocking all inbound and outbound traffic on the access point will render the access point useless as it will not be able to send or receive data. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/MAC_address

• Question 458:

  The Chief Information Officer (CIO) receives an anonymous threatening message that says "beware of the 1st of the year". The CIO suspects the message may be from a former disgruntled employee planning an attack.

  Which of the following should the CIO be concerned with?

  A. Smurf Attack
  B. Trojan
  C. Logic bomb
  D. Virus
  C. Logic bomb

  ---

  A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs". To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs. Incorrect Answers: A: A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network. A smurf attack is not what is described in this question. Therefore, this answer is incorrect. B: In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus. A Trojan is not what is being described in this question. The term comes from Greek mythology about the Trojan War, as told in the Aeneid by Virgil and mentioned in the Odyssey by Homer. According to legend, the Greeks presented the citizens of Troy with a large wooden horse in which they had secretly hidden their warriors. During the night, the warriors emerged from the wooden horse and overran the city. A Trojan is not what is described in this question. Therefore, this answer is incorrect. D: A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man-made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems. Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs. A computer virus is not what is described in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Logic_bomb http://www.webopedia.com/TERM/S/smurf.html http://www.webopedia.com/TERM/V/virus.html http://searchsecurity.techtarget.com/definition/Trojan-horse

• Question 459:

  Which of the following would a security administrator implement in order to identify change from the standard configuration on a server?

  A. Penetration test
  B. Code review
  C. Baseline review
  D. Design review
  C. Baseline review

  ---

  The standard configuration on a server is known as the baseline. The IT baseline protection approach is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. This is known as a baseline. A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline). Incorrect Answers: A: Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. By performing a penetration test on a server, you are actively trying to circumvent its security controls to gain unauthorized or privileged access to the server. A penetration test is not used to identify change from the standard configuration on a server. Therefore, this answer is incorrect. B: A code review is the process of reviewing the code in an application. It is not used to identify change from the standard configuration on a server. Therefore, this answer is incorrect. D: A design review is the process of reviewing the design of something; examples include reviewing the design of the network or the design of a software application. It is not used to identify change from the standard configuration on a server. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/IT_baseline_protection

• Question 460:

  Which of the following BEST explains the use of an HSM within the company servers?

  A. Thumb drives present a significant threat which is mitigated by HSM.
  B. Software encryption can perform multiple functions required by HSM.
  C. Data loss by removable media can be prevented with DLP.
  D. Hardware encryption is faster than software encryption.
  D. Hardware encryption is faster than software encryption.

  ---

  Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. It provides a fast solution for the for large asymmetrical encryption calculations and is much faster than software-based cryptographic solutions. Incorrect Answers: A: Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. HSM is usually used in conjunction with PKI to enhance security with certification authorities (CAs). PKI secures communication. It does not secure thumb drives. B: Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. HSM is usually used in conjunction with PKI to enhance security with certification authorities (CAs). It provides encryption functions rather than requiring it. C: Data loss prevention (DLP) is designed detect and prevent unauthorized access to sensitive information. It may involve content inspection, storage and transmission encryption, contextual assessment, monitoring authorizations, and centralized management. It can make use of software-based cryptographic solutions, of hardware-based cryptographic solutions such as HSM. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 238, 278 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 254