CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 511:

  Joe, a user, reports to the system administrator that he is receiving an error stating his certificate has been revoked. Which of the following is the name of the database repository for these certificates?

  A. CSR
  B. OCSP
  C. CA
  D. CRL
  D. CRL

  ---

  A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key. Incorrect Answers: A: A CSR is a request to a CA, not a database of revoked certificates. One of the first steps in getting a certificate is to submit a certificate-signing request (CSR). This is a request formatted for the CA. This request will have the public key you wish to use and your fully distinguished name (often a domain name). The CA will then use this to process your request for a digital certificate. B: OCSP is a protocol, not a database. The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. C: A CA is not a database for revoked certificates, though the CRL is stored on the CA. A certificate authority (CA) is an organization that is responsible for issuing, revoking, and distributing certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-280, 285

• Question 512:

  Which of the following are examples of detective controls?

  A. Biometrics, motion sensors and mantraps.
  B. Audit, firewall, anti-virus and biometrics.
  C. Motion sensors, intruder alarm and audit.
  D. Intruder alarm, mantraps and firewall.
  C. Motion sensors, intruder alarm and audit.

• Question 513:

  A review of the company's network traffic shows that most of the malware infections are caused by users visiting gambling and gaming websites. The security manager wants to implement a solution that will block these websites, scan all web traffic for signs of malware, and block the malware before it enters the company network. Which of the following is suited for this purpose?

  A. ACL
  B. IDS
  C. UTM
  D. Firewall
  C. UTM

  ---

  An all-in-one appliance, also known as Unified Threat Management (UTM) and Next Generation Firewall (NGFW), is one that provides a good foundation for security. A variety is available; those that you should be familiar with for the exam fall under the categories of providing URL filtering, content inspection, or malware inspection. Malware inspection is the use of a malware scanner to detect unwanted software content in network traffic. If malware is detected, it can be blocked or logged and/ or trigger an alert. Incorrect Answers: A: Access control lists (ACLs) are used to define who is allowed to or denied permission to perform a specified activity or action. B: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations. D: The basic purpose of a firewall is to isolate one network from another. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 119. Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 19, 21, 24.

• Question 514:

  Which of the following allows a network administrator to implement an access control policy based on individual user characteristics and NOT on job function?

  A. Attributes based
  B. Implicit deny
  C. Role based
  D. Rule based
  A. Attributes based

  ---

  Attribute-based access control allows access rights to be granted to users via policies, which combine attributes together. The policies can make use of any type of attributes, which includes user attributes, resource attributes and environment attributes. Incorrect Answers: B: Implicit deny says that if you aren't explicitly granted access or privileges for a resource, you're denied access by default. An access control policy is not required for Implicit deny. C: Role-based Access Control is basically based on a user's job description. When a user is assigned a specific role in an environment, that user's access to objects is granted based on the required tasks of that role. The question states that the access control policy should not be based on job function. D: Rule-based access control is used for network devices, such as firewalls and routers, which filter traffic based on filtering rules. The question states that the access control policy should based on individual user characteristics, not devices. References: http://en.wikipedia.org/wiki/Attribute-based_access_control Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 280, 284.

• Question 515:

  Which of the following concepts allows an organization to group large numbers of servers together in order to deliver a common service?

  A. Clustering
  B. RAID
  C. Backup Redundancy
  D. Cold site
  A. Clustering

  ---

  Anytime you connect multiple computers to work/act together as a single server, it is known as clustering. Clustered systems utilize parallel processing (improving performance and availability) and add redundancy (but also add costs). Clustering is done whenever you connect multiple computers to work and act together as a single server. It is meant to utilize parallel processing and can also add to redundancy. Incorrect Answers: B: RAID, or redundant array of independent disks (RAID). RAID allows your existing servers to have more than one hard drive so that if the main hard drive fails, the system keeps functioning. C: Backup redundancy is a disaster recovery measure. D: A cold site is a facility that isn't immediately ready to use. The organization using it must bring along its equipment and network. A cold site may provide network capability, but this isn't usually the case; the site provides a place for operations to resume, but it doesn't provide the infrastructure to support those operations. It is one of the disaster recovery measures. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 234-235, 444

• Question 516:

  The method to provide end users of IT systems and applications with requirements related to acceptable use, privacy, new threats and trends, and use of social networking is:

  A. Security awareness training.
  B. BYOD security training.
  C. Role-based security training.
  D. Legal compliance training.
  A. Security awareness training.

  ---

  Security awareness and training are critical to the success of a security effort. They include explaining policies, procedures, and current threats to both users and management. Incorrect Answers: B: BYOD security training is just part of security awareness training and involves the possibility of a personal device that is infected with malware introducing that malware to the network. C: Role-based security training is more geared towards specific roles. D: Legal compliance training would refer to keeping users up to date with new regulations and laws, not threats, trends and use of social engineering. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 399-404

• Question 517:

  One of the system administrators at a company is assigned to maintain a secure computer lab. The administrator has rights to configure machines, install software, and perform user account maintenance. However, the administrator cannot add new computers to the domain, because that requires authorization from the Information Assurance Officer. This is an example of which of the following?

  A. Mandatory access
  B. Rule-based access control
  C. Least privilege
  D. Job rotation
  C. Least privilege

  ---

  A least privilege policy should be used when assigning permissions. Give users only the permissions that they need to do their work and no more. Incorrect Answers: A: Mandatory access control is used to control how information access is permitted. In a MAC environment, all access capabilities are predefined. Users can't share information unless their rights to share it are established by administrators. Consequently, administrators must make any changes that need to be made to such rights. B: Rule-based access control is when the settings used are in the pre-configured security policies. D: Job rotation is when one person fills in for another and vice versa so that there is redundancy in this regard. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 151, 152

• Question 518:

  A network administrator is looking for a way to automatically update company browsers so they import a list of root certificates from an online source. This online source will then be responsible for tracking which certificates are to be trusted or not trusted. Which of the following BEST describes the service that should be implemented to meet these requirements?

  A. Trust model
  B. Key escrow
  C. OCSP
  D. PKI
  A. Trust model

  ---

  In this scenario we can put a CA in the local network and use an online CA as root CA in a hierarchical trust model. A trust Model is collection of rules that informs application on how to decide the legitimacy of a Digital Certificate. In a hierarchical trust model, also known as a tree, a root CA at the top provides all of the information. The intermediate CAs are next in the hierarchy, and they trust only information provided by the root CA. The root CA also trusts intermediate CAs that are in their level in the hierarchy and none that aren't. This arrangement allows a high level of control at all levels of the hierarchical tree. Incorrect Answers: B: Key escrow is a database of stored keys that later can be retrieved. Key escrow cannot be used to set up a trust to a CA. C: The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. OCSP cannot be used to set up a trust to a CA. D: PKI is a high level concept. In itself you cannot use a PKI to set up a trust to a CA. Within a PKI you use a trust model for this purpose. A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285, 285, 285-289

• Question 519:

  Which of the following controls can be used to prevent the disclosure of sensitive information stored on a mobile device's removable media in the event that the device is lost or stolen?

  A. Hashing
  B. Screen locks
  C. Device password
  D. Encryption
  D. Encryption

  ---

  Encryption is used to ensure the confidentiality of information. Incorrect Answers: A: Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables. B: You can secure your phone or tablet by setting a screen lock. Each time you turn on your device or wake up the screen, you'll be asked to unlock your device. But this does not mean that your sensitive data is safe. You should still encrypt your sensitive data. C: Device passwords are only meant to unlock screen lock on your mobile device. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 255, 291

• Question 520:

  Which of the following components MUST be trusted by all parties in PKI?

  A. Key escrow
  B. CA
  C. Private key
  D. Recovery key
  B. CA

  ---

  A certificate authority (CA) is an organization that is responsible for issuing, revoking, and distributing certificates. In a simple trust model all parties must trust the CA. In a more complicated trust model all parties must trust the Root CA. Incorrect Answers: A: Key escrow is nothing that needs to be trusted. Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question. C: A private or secret key is an encryption/decryption key known only to the party or parties that exchange secret messages. D: A recovery key has no specific function within a PKI. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 278-290