CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 491:

  After Ann, a user, logs into her banking websites she has access to her financial institution mortgage, credit card, and brokerage websites as well. Which of the following is being described?

  A. Trusted OS
  B. Mandatory access control
  C. Separation of duties
  D. Single sign-on
  D. Single sign-on

  ---

  Single sign-on means that once a user (or other subject) is authenticated into a realm, re- authentication is not required for access to resources on any realm entity. The question states that when Ann logs into her banking websites she has access to her financial institution mortgage, credit card, and brokerage websites as well. This describes an SSO scenario. Incorrect Answers: A: Trusted OS requires a particular OS to be present in order to gain access to a resource. B: Mandatory Access Control allows access to be granted or restricted based on the rules of classification. C: Separation of duties divides administrator or privileged tasks into separate groupings. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 82, 246, 278, 284.

• Question 492:

  Which of the following is BEST carried out immediately after a security breach is discovered?

  A. Risk transference
  B. Access control revalidation
  C. Change management
  D. Incident management
  D. Incident management

  ---

  Incident management is the steps followed when security incident occurs. Incorrect Answers: A: Risk transference involves sharing some of the risk burden with someone else, such as an insurance company. B: Revalidating access control is a technical control type and is done mainly to test the existing access control measures in place. C: Change management is the structured approach that is followed to secure a company's assets. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 10

• Question 493:

  Joe is the accounts payable agent for ABC Company. Joe has been performing accounts payable function for the ABC Company without any supervision. Management has noticed several new accounts without billing invoices that were paid. Which of the following is the BEST management option for review of the new accounts?

  A. Mandatory vacation
  B. Job rotation
  C. Separation of duties
  D. Replacement
  A. Mandatory vacation

• Question 494:

  An encrypted message is sent using PKI from Sara, a client, to a customer. Sara claims she never sent the message. Which of the following aspects of PKI BEST ensures the identity of the sender?

  A. CRL
  B. Non-repudiation
  C. Trust models
  D. Recovery agents
  B. Non-repudiation

  ---

  Nonrepudiation prevents one party from denying actions they carried out. This means that the identity of the email sender will not be repudiated. Incorrect Answers: A: CRLs are literally a list of certificates that a specific CA stated should no longer be used. C: Trust models are used with PKIs. It is not used to ensure the identity of the email sender. D: Recovery Agents are used with certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 414

• Question 495:

  One of the servers on the network stops responding due to lack of available memory. Server administrators did not have a clear definition of what action should have taken place based on the available memory. Which of the following would have BEST kept this incident from occurring?

  A. Set up a protocol analyzer
  B. Set up a performance baseline
  C. Review the systems monitor on a monthly basis
  D. Review the performance monitor on a monthly basis
  B. Set up a performance baseline

  ---

  A performance baseline provides the input needed to design, implement, and support a secure network. The performance baseline would define the actions that should be performed on a server that is running low on memory. Incorrect Answers: A: A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It is not used to provide guidance on the actions that should be performed on a server that is running low on memory. Therefore, this answer is incorrect. C: Reviewing the systems monitor on a monthly basis may help to determine that the server is running low on memory. However, the server could run out of memory in between reviews. The system monitor also does not provide guidance on the actions that should be performed on a server that is running low on memory. Therefore this is not the best answer and is therefore incorrect. D: Reviewing the performance monitor on a monthly basis may help to determine that the server is running low on memory. However, the server could run out of memory in between reviews. The performance monitor also does not provide guidance on the actions that should be performed on a server that is running low on memory. Therefore this is not the best answer and is therefore incorrect.

• Question 496:

  Which of the following firewall types inspects Ethernet traffic at the MOST levels of the OSI model?

  A. Packet Filter Firewall
  B. Stateful Firewall
  C. Proxy Firewall
  D. Application Firewall
  B. Stateful Firewall

  ---

  Stateful inspections occur at all levels of the network. Incorrect Answers: A: Packet-filtering firewalls operate at the Network layer (Layer 3) and the Transport layer (Layer 4) of the Open Systems Interconnect (OSI) model. C: The proxy function can occur at either the application level or the circuit level. D: Application Firewalls operates at the Application layer (Layer7) of the OSI model. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 98-100. Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 6.

• Question 497:

  Which of the following implementation steps would be appropriate for a public wireless hot- spot?

  A. Reduce power level
  B. Disable SSID broadcast
  C. Open system authentication
  D. MAC filter
  C. Open system authentication

  ---

  For a public wireless hot-spot, you want members of the public to be able to access the wireless network without having to provide them with a password. Therefore, Open System Authentication is the best solution. Open System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are not encrypted. For OSA to work, the service set identifier (SSID) of the computer should match the SSID of the wireless access point. The SSID is a sequence of characters that uniquely names a wireless local area network (WLAN). The process occurs in three steps. First, the computer sends a request for authentication to the access point. Then the access point generates an authentication code, usually at random, intended for use only during that session. Finally, the computer accepts the authentication code and becomes part of the network as long as the session continues and the computer remains within range of the original access point. If it is necessary to exchange encrypted data between a WEP network access point and a wireless-equipped computer, a stronger authentication process called Shared Key Authentication (SKA) is required. Incorrect Answers: A: Reducing the power level of a wireless access point does not provide a mechanism for members of the public to connect to the wireless network. Reducing the power level of a wireless access point would just make the range of the wireless network smaller. B: Disabling SSID broadcasting for the wireless network would make the network invisible to users' computers. The user would need to know the name (SSID) of the network and enter it manually in order to connect to the network. This is not an appropriate solution for a public Wi- Fi hotspot. D: MAC filtering is the process of restricting network access to a list of known MAC addresses. As you will not know the MAC address of any user's computers, then this is not an appropriate solution for a public Wi-Fi hotspot. References: http://searchsecurity.techtarget.com/definition/Open-System-Authentication-OSA

• Question 498:

  During the analysis of a PCAP file, a security analyst noticed several communications with a remote server on port 53. Which of the following protocol types is observed in this traffic?

  A. FTP
  B. DNS
  C. Email
  D. NetBIOS
  B. DNS

  ---

  DNS (Domain Name System) uses port 53. Incorrect Answers: A: FTP (File Transfer Protocol) uses ports 20 and 21, not port 53. C: Email uses multiple ports depending on what aspect of `email' we're talking about. For example SMTP (Simple Mail Transfer Protocol) used for sending email uses port 25. POP3 and IMAP, two methods of accessing and downloading email use ports 110 and 143 respectively. D: NetBIOS uses ports 137, 138 and 139. References: http://en.wikipedia.org/wiki/Domain_Name_System http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 499:

  Which of the following is a difference between TFTP and FTP?

  A. TFTP is slower than FTP.
  B. TFTP is more secure than FTP.
  C. TFTP utilizes TCP and FTP uses UDP.
  D. TFTP utilizes UDP and FTP uses TCP.
  D. TFTP utilizes UDP and FTP uses TCP.

  ---

  FTP employs TCP ports 20 and 21 to establish and maintain client-to-server communications, whereas TFTP makes use of UDP port 69. Incorrect Answers: A: UDP is faster than TCP is because there is no form of flow control or error correction. B: TFTP requires no authentication, whereas FTP allows authenticated connections. C: As stated above, FTP employs TCP ports 20 and 21 and TFTP makes use of UDP port 69. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 49, 50. http://www.skullbox.net/tcpudp.php

• Question 500:

  Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the temporary credentials being passed to Joe's browser. The attacker later uses the credentials to impersonate Joe and creates SPAM messages. Which of the following attacks allows for this impersonation?

  A. XML injection
  B. Directory traversal
  C. Header manipulation
  D. Session hijacking
  D. Session hijacking

  ---

  In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. Incorrect Answers: A: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. This is not what is described in this question. This answer is therefore incorrect. B: Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server. Although some educated guesswork is involved in finding paths to restricted files on a Web server, a skilled hacker can easily carry out this type of attack on an inadequately protected server by searching through the directory tree. The risk of such attacks can be minimized by careful Web server programming, the installation of software updates and patches, filtering of input from browsers, and the use of vulnerability scanners. This is not what is described in this question. This answer is therefore incorrect. C: A header manipulation attack uses other methods (hijacking, cross-site forgery, and so forth) to change values in HTTP headers and falsify access. When used with XSRF, the attacker can even change a user's cookie. Internet Explorer 8 and above include InPrivate Filtering to help prevent some of this. By default, your browser sends information to sites as they need it--think of requesting a map from a site; it needs to know your location in order to give directions. With InPrivate Filtering, you can configure the browser not to share information that can be captured and manipulated. This is not what is described in this question. This answer is therefore incorrect. References: http://en.wikipedia.org/wiki/Session_hijacking Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337, 340 http://searchsecurity.techtarget.com/definition/directory-traversal