CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 481:

  Which of the following would be MOST appropriate to secure an existing SCADA system by preventing connections from unauthorized networks?

  A. Implement a HIDS to protect the SCADA system
  B. Implement a Layer 2 switch to access the SCADA system
  C. Implement a firewall to protect the SCADA system
  D. Implement a NIDS to protect the SCADA system
  C. Implement a firewall to protect the SCADA system

• Question 482:

  Mike, a network administrator, has been asked to passively monitor network traffic to the company's sales websites. Which of the following would be BEST suited for this task?

  A. HIDS
  B. Firewall
  C. NIPS
  D. Spam filter
  C. NIPS

  ---

  Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. Incorrect Answers: A: A host-based IDS (HIDS) watches the audit trails and log fi les of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. B: Firewalls provide protection by controlling traffic entering and leaving a network. D: A spam filter is a software or hardware tool whose primary purpose is to identify and block/filter/remove unwanted messages (that is, spam). Spam is most commonly associated with email, but spam also exists in instant messaging (IM), short message service (SMS), Usenet, and web discussions/forums/comments/ blogs. References: http://en.wikipedia.org/wiki/Intrusion_prevention_system Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 47.

• Question 483:

  A security administrator is tasked with ensuring that all devices have updated virus definition files before they are allowed to access network resources. Which of the following technologies would be used to accomplish this goal?

  A. NIDS
  B. NAC
  C. DLP
  D. DMZ
  E. Port Security
  B. NAC

• Question 484:

  After an audit, it was discovered that the security group memberships were not properly adjusted for employees' accounts when they moved from one role to another. Which of the following has the organization failed to properly implement? (Select TWO).

  A. Mandatory access control enforcement.
  B. User rights and permission reviews.
  C. Technical controls over account management.
  D. Account termination procedures.
  E. Management controls over account management.
  F. Incident management and response plan.
  B. User rights and permission reviews.
  E. Management controls over account management.

  ---

  Reviewing user rights and permissions can be used to determine that all groups, users, and other accounts have the appropriate privileges assigned according to the policies of the corporation and their job descriptions since they were all moved to different roles. Control over account management would have taken into account the different roles that employees have and adjusted the rights and permissions of these roles accordingly. Incorrect Answers: A: Mandatory access control enforcement just means that all access would be pre-defined. Thus it will not take into account the different roles now occupied by different employees. C: Technical controls include things such as firewalls, IDS, IPS, etc. and as such are preventative, detective and even compensating and not administrative control. D: Account termination procedures are carried out in the event of employees leaving the company and not when they are being moved within the company. F: Incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). And the Incidence Response PLan outlines what steps are needed and who is responsible for deciding how to handle a situation. In this case an audit was conducted. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 26-27

• Question 485:

  Pete, a network administrator, is capturing packets on the network and notices that a large amount of the traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from the other traffic?

  A. Connect the WAP to a different switch.
  B. Create a voice VLAN.
  C. Create a DMZ.
  D. Set the switch ports to 802.1q mode.
  B. Create a voice VLAN.

  ---

  It is a common and recommended practice to separate voice and data traffic by using VLANs. Separating voice and data traffic using VLANs provides a solid security boundary, preventing data applications from reaching the voice traffic. It also gives you a simpler method to deploy QoS, prioritizing the voice traffic over the data. Incorrect Answers: A: Doing this will not segment voice and data traffic. C: The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall. D: IEEE 802.1Q is the networking standard that supports virtual LANs (VLANs) on an Ethernet network. It does not, however, segment certain traffic from other traffic References: http://www.ciscopress.com/articles/article.asp?p=1745631andseqNum=3 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 39. http://en.wikipedia.org/wiki/IEEE_802.1Q

• Question 486:

  Which of the following concepts is enforced by certifying that email communications have been sent by who the message says it has been sent by?

  A. Key escrow
  B. Non-repudiation
  C. Multifactor authentication
  D. Hashing
  B. Non-repudiation

  ---

  Regarding digital security, the cryptological meaning and application of non-repudiation shifts to mean: * A service that provides proof of the integrity and origin of data. * An authentication that can be asserted to be genuine with high assurance. Incorrect Answers: A: Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. C: A multifactor authentication method uses two or more processes for logon. A twofactor method might use smart cards and biometrics for logon. D: A hash function is used to map digital data of variable size to digital data of fixed length. A hash function is not used to verify the sender of an e-mail. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 133, 255, 262, 414

• Question 487:

  The system administrator is reviewing the following logs from the company web server:

  12:34:56 GET /directory_listing.php?user=adminandpass=admin1

  12:34:57 GET /directory_listing.php?user=adminandpass=admin2

  12:34:58 GET /directory_listing.php?user=adminandpass=1admin

  12:34:59 GET /directory_listing.php?user=adminandpass=2admin

  Which of the following is this an example of?

  A. Online rainbow table attack
  B. Offline brute force attack
  C. Offline dictionary attack
  D. Online hybrid attack
  D. Online hybrid attack

• Question 488:

  A recent vulnerability scan found that Telnet is enabled on all network devices. Which of the following protocols should be used instead of Telnet?

  A. SCP
  B. SSH
  C. SFTP
  D. SSL
  B. SSH

  ---

  SSH transmits both authentication traffic and data in a secured encrypted form, whereas Telnet transmits both authentication credentials and data in clear text. Incorrect Answers: A: Secure Copy Protocol (SCP) is a secure file-transfer facility based on SSH and Remote Copy Protocol (RCP). C: SFTP encrypts authentication and data traffic between the client and server by making use of SSH to provide secure FTP communications. D: Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are used to encrypt traffic between a web browser and a web server. This allows web surfers to make online purchases, interact with banks, and access private information without disclosing the contents of their communications. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 45, 47, 50.

• Question 489:

  A company has just deployed a centralized event log storage system. Which of the following can be used to ensure the integrity of the logs after they are collected?

  A. Write-once drives
  B. Database encryption
  C. Continuous monitoring
  D. Role-based access controls
  A. Write-once drives

• Question 490:

  A technician has implemented a system in which all workstations on the network will receive security updates on the same schedule. Which of the following concepts does this illustrate?

  A. Patch management
  B. Application hardening
  C. White box testing
  D. Black box testing
  A. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities. A part of patch management is testing the effects of vendor updates on a test system before applying the updates on a production system, and scheduling updates. Incorrect Answers: B: Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing or disabling unnecessary functions and features, removing or disabling unnecessary user accounts, disabling unnecessary protocols and ports, and disabling unnecessary services. C: White box testing is a form of penetration testing in which the tester has significant knowledge of the system and how it functions. This simulates an attack from an insider. D: Black box testing is a form of penetration testing in which the tester has absolutely no knowledge of the system or it how it functions. This simulates an attack from an outsider. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 221, 231-232 Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 215-217, 220, 459