CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 501:

  Which of the following MUST be updated immediately when an employee is terminated to prevent unauthorized access?

  A. Registration
  B. CA
  C. CRL
  D. Recovery agent
  C. CRL

  ---

  Certificates or keys for the terminated employee should be put in the CRL. A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key. By checking the CRL you can check if a particular certificate has been revoked. Incorrect Answers: A: The registration of any certificates or keys for the terminated employee should be revoked. These keys and certificates should be put in the CRL. B: More specifically, it is not the CA that need to be updated, just the CRL. D: A recovery agent is an entity that has the ability to recover a key, key components, or plaintext messages as needed. A recovery is not affected when a user is terminated. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-280, 280-281, 285

• Question 502:

  Which of the following BEST represents the goal of a vulnerability assessment?

  A. To test how a system reacts to known threats
  B. To reduce the likelihood of exploitation
  C. To determine the system's security posture
  D. To analyze risk mitigation strategies
  C. To determine the system's security posture

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Incorrect Answers: A: A vulnerability scan is used to determine whether a system is vulnerable to known threats. It is not used to test how a system reacts to the known threats. Therefore, this answer is incorrect. B: A vulnerability scan is used to determine whether a system is vulnerable to known threats. By determining the existence of vulnerabilities, we can reduce the likelihood of the system being exploited. However, we first need to determine the existence of the vulnerabilities. Therefore, this answer is incorrect. D: A vulnerability scan is used to determine whether a system is at risk from known threats. After determining the risk, we can develop a risk mitigation strategy. However it is not the purpose of the vulnerability scan to analyze the risk mitigation strategies. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/V/vulnerability_scanning.html

• Question 503:

  Which of the following protocols operates at the HIGHEST level of the OSI model?

  A. ICMP
  B. IPSec
  C. SCP
  D. TCP
  C. SCP

  ---

  SCP (Secure Copy) uses SSH (Secure Shell). SSH runs in the application layer (layer 7) of the OSI model. Incorrect Answers: A: ICMP (Internet Control Message Protocol) works in the network layer (Layer 3) of the OSI model. B: IPSec (Internet Protocol Security) works in the network layer (Layer 3) of the OSI model. D: TCP (Transmission Control Protocol) works in the transport layer (Layer 4) of the OSI model. References: http://www.rhyshaden.com/osi.htm http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29 http://en.wikipedia.org/wiki/OSI_model

• Question 504:

  The call center supervisor has reported that many employees have been playing preinstalled games on company computers and this is reducing productivity. Which of the following would be MOST effective for preventing this behavior?

  A. Acceptable use policies
  B. Host-based firewalls
  C. Content inspection
  D. Application whitelisting
  D. Application whitelisting

• Question 505:

  Computer evidence at a crime is preserved by making an exact copy of the hard disk. Which of the following does this illustrate?

  A. Taking screenshots
  B. System image capture
  C. Chain of custody
  D. Order of volatility
  B. System image capture

  ---

  A system image would be a snapshot of what exists at the moment. Thus capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it. Incorrect Answers: A: Taking screenshots is akin to video and screenshots would be to capture all relevant screenshots for later analysis. C: Chain of custody is observed to ensure that each step taken with evidence is documented and accounted for from the point of collection. D: Order of volatility helps when dealing with multiple issues and volatility refers to the time that you have to collect certain data before that window of opportunity is closed because some data will exist longer than others. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 453

• Question 506:

  A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by camouflaging data inside of other files?

  A. Integrity
  B. Confidentiality
  C. Steganography
  D. Availability
  C. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message. Incorrect Answers: A: Integrity it computing terms proves that a person, file, computer or data is who it says it is. Hashing is used to prove the integrity of data to prove that it hasn't been modified. Integrity is not the process of camouflaging data inside of other files. B: Confidentiality defines who should be able to view information. Confidentiality is not the process of camouflaging data inside of other files. D: Availability in computing terms is used to ensure that a system remains online and accessible (available) in the event of a failure of a component. Availability is not the process of camouflaging data inside of other files. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 323, 259, 414 http://en.wikipedia.org/wiki/Steganography

• Question 507:

  A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability.

  Which of the following BEST describes this exploit?

  A. Malicious insider threat
  B. Zero-day
  C. Client-side attack
  D. Malicious add-on
  B. Zero-day

  ---

  A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. In this question, there are no patches are available to mitigate the vulnerability. This is therefore a zero-day vulnerability. Incorrect Answers: A: An insider threat is a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization's security practices, data and computer systems. This is not what is described in this question. Therefore, this answer is incorrect. C: Attackers are finding success going after weaknesses in desktop applications such as browsers, media players, common office applications and e-mail clients rather than attacking servers. This is known as a client-side attack. A client-side attack is not what is described in this question. Therefore, this answer is incorrect. D: A malicious add-on is a software `add-on' that modifies the functionality of an existing application. An example of this would be an Internet browser add-on. This is not what is described in this question. Therefore, this answer is incorrect. References: http://www.pctools.com/security-news/zero-day-vulnerability/ http://en.wikipedia.org/wiki/Insider_threat

• Question 508:

  Various network outages have occurred recently due to unapproved changes to network and security devices. All changes were made using various system credentials. The security analyst has been tasked to update the security policy. Which of the following risk mitigation strategies would also need to be implemented to reduce the number of network outages due to unauthorized changes?

  A. User rights and permissions review
  B. Configuration management
  C. Incident management
  D. Implement security controls on Layer 3 devices
  A. User rights and permissions review

  ---

  Reviewing user rights and permissions can be used to determine that all groups, users, and other accounts have the appropriate privileges assigned according to the policies of the corporation and their job descriptions. Also reviewing user rights and permissions will afford the security analyst the opportunity to put the principle of least privilege in practice as well as update the security policy Incorrect Answers: B: Configuration management is an operational control type that is put into action after a risk assessment has been done. C: Incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). D: IPSec can be implemented on Layer 3 devices, but this will not prevent unauthorized changes to the network. It is a case of the permissions and user rights that has to be addressed. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 17

• Question 509:

  A security specialist has been asked to evaluate a corporate network by performing a vulnerability assessment. Which of the following will MOST likely be performed?

  A. Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls.
  B. Verify vulnerabilities exist, bypass security controls and exploit the vulnerabilities.
  C. Exploit security controls to determine vulnerabilities and misconfigurations.
  D. Bypass security controls and identify applicability of vulnerabilities by passively testing security controls.
  A. Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls.

  ---

  We need to determine if vulnerabilities exist by passively testing security controls. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise. Incorrect Answers: B: Verifying vulnerabilities exist, bypassing security controls and exploiting the vulnerabilities describes an attack on the system or a penetration test. Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. A penetration test can test one method at a time of accessing one system at a time. A vulnerability scan can scan for all vulnerabilities on multiple systems and is therefore a better answer. Therefore, this answer is incorrect. C: Exploiting security controls to determine vulnerabilities and misconfigurations would be a slow and manual way of performing a vulnerability assessment. A vulnerability scan is an automated process of scanning for all vulnerabilities on multiple systems and is therefore a better answer. Therefore, this answer is incorrect. D: We need to first identify any vulnerabilities before we can check the applicability of the vulnerabilities. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/V/vulnerability_scanning.html

• Question 510:

  Privilege creep among long-term employees can be mitigated by which of the following procedures?

  A. User permission reviews
  B. Mandatory vacations
  C. Separation of duties
  D. Job function rotation
  A. User permission reviews

  ---

  Privilege creep is the steady build-up of access rights beyond what a user requires to perform his/her task. Privilege creep can be decreased by conducting sporadic access rights reviews, which will confirm each user's need to access specific roles and rights in an effort to find and rescind excess privileges. Incorrect Answers: B: Mandatory vacations require each employee to be on vacation for a minimal amount of time each year. During this time a different employee sits at their desk and performs their work tasks. C: Separation of duties divides administrator or privileged tasks into separate groupings. D: Job function rotation allows for employees to be knowledgeable about another employee's job function in the event that an employee is sick or on vacation. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 81, 82, 294.