CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 521:

  Pete, the security administrator, has been notified by the IDS that the company website is under attack. Analysis of the web logs show the following string, indicating a user is trying to post a comment on the public bulletin board.

  INSERT INTO message `

  This is an example of which of the following?

  A. XSS attack
  B. XML injection attack
  C. Buffer overflow attack
  D. SQL injection attack
  A. XSS attack

  ---

  The tags indicate that script is being inserted. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Incorrect Answers: B: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. The code in this question is not XML code. Therefore, this answer is incorrect. C: A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability. This is not what is described in the question. Therefore, this answer is incorrect. D: SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. SQL Injection is not used to attempt to post a comment on the public bulletin board. Therefore this answer is incorrect. References: http://en.wikipedia.org/wiki/Cross-site_scripting Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337 http://searchsecurity.techtarget.com/definition/buffer-overflow http://en.wikipedia.org/wiki/SQL_injection

• Question 522:

  A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which of the following would BEST prevent the disclosure of customer data in the event that a tablet is lost or stolen?

  A. Application control
  B. Remote wiping
  C. GPS
  D. Screen-locks
  B. Remote wiping

  ---

  Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. Incorrect Answers: A: Application control is the process of controlling what applications are installed on a device. This may reduce exposure to malicious software by limiting the user's ability to install applications that come from unknown sources or have no work-related features. C: Global Positioning System (GPS) tracking can be used to identify its location of a stolen device and can allow authorities to recover the device. However, for GPS tracking to work, the device must have an Internet connection or a wireless phone service over which to send its location information. D: Screen lock is a security feature that requires the user to enter a PIN or a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it will be difficult for anyone else to access your data or applications. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236, http:// searchconsumerization.techtarget.com/definition/remote- wipe

• Question 523:

  Which of the following means of wireless authentication is easily vulnerable to spoofing?

  A. MAC Filtering
  B. WPA - LEAP
  C. WPA - PEAP
  D. Enabled SSID
  A. MAC Filtering

  ---

  Each network interface on your computer or any other networked device has a unique MAC address. These MAC addresses are assigned in the factory, but you can easily change, or "spoof," MAC addresses in software. Networks can use MAC address filtering, only allowing devices with specific MAC addresses to connect to a network. This isn't a great security tool because people can spoof their MAC addresses. Incorrect Answers: B: WPA LEAP (Wifi Protected Access Lightweight Extensible Authentication Protocol) combine to ensure a secure wireless authentication method. WPA LEAP is not easily vulnerable to spoofing. C: WPA PEAP (Wifi Protected Access Protected Extensible Authentication Protocol) combine to ensure a secure wireless authentication method. WPA PEAP is not easily vulnerable to spoofing. D: Enabling SSID broadcasting makes the wireless network visible to clients. It is not a means of wireless authentication. References: http://www.howtogeek.com/192173/how-and-why-to-change-your-mac-address-on-windows- linux-and-mac/ http://www.tech-faq.com/eap-leap-peap-and-eap-tls-and-eap-ttls.html

• Question 524:

  A network administrator uses an RFID card to enter the datacenter, a key to open the server rack, and a username and password to logon to a server. These are examples of which of the following?

  A. Multifactor authentication
  B. Single factor authentication
  C. Separation of duties
  D. Identification
  B. Single factor authentication

  ---

  Single-factor authentication (SFA) is a process for securing access to a given system by identifying the party requesting access via a single category of credentials. In this case, the network administrator makes use of an RFID card to access the datacenter, a key to access the server rack, and a username and password to access a server. Incorrect Answers: A: Multifactor authentication requires a user to provide two or more authentication factors in order to access a given system. C: Separation of duties divides administrator or privileged tasks into separate groupings, which in turn, is individually assigned to unique administrators. D: Identification only proves who the user is, it will not give access. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 275, 276, 282. http://searchsecurity.techtarget.com/definition/single-factor-authentication-SFA

• Question 525:

  A security administrator has deployed all laptops with Self Encrypting Drives (SED) and enforces key encryption. Which of the following represents the greatest threat to maintaining data confidentiality with these devices?

  A. Full data access can be obtained by connecting the drive to a SATA or USB adapter bypassing the SED hardware.
  B. A malicious employee can gain the SED encryption keys through software extraction allowing access to other laptops.
  C. If the laptop does not use a Secure Boot BIOS, the SED hardware is not enabled allowing full data access.
  D. Laptops that are placed in a sleep mode allow full data access when powered back on.
  D. Laptops that are placed in a sleep mode allow full data access when powered back on.

• Question 526:

  Prior to leaving for an extended vacation, Joe uses his mobile phone to take a picture of his family in the house living room. Joe posts the picture on a popular social media site together with the message: "Heading to our two weeks vacation to Italy." Upon returning home, Joe discovers that the house was burglarized. Which of the following is the MOST likely reason the house was burglarized if nobody knew Joe's home address?

  A. Joe has enabled the device access control feature on his mobile phone.
  B. Joe's home address can be easily found using the TRACEROUTE command.
  C. The picture uploaded to the social media site was geo-tagged by the mobile phone.
  D. The message posted on the social media site informs everyone the house will be empty.
  C. The picture uploaded to the social media site was geo-tagged by the mobile phone.

  ---

  Geo-tagging is the process of embedding the GPS coordinates in image files and images taken using a smartphone or a digital camera. The geotagged information accompanying the image allows anyone to discover the precise location where the image was taken. Incorrect Answers: A: Device access control is the process of controlling which users have access to a device. This is accomplished through the use of screen locks that require the user to enter a password or pin after a period of inactivity. B: TRACEROUTE is a network diagnostic tool used to trace the path from a client to a host machine. It cannot be used to determine the physical location of a house. D: The message posted on the social media site does inform everyone the house will be empty but it does not disclose the location of the hose. An attacker would still need to determine the location of the house. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 236, 419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 238

• Question 527:

  Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? Host 192.168.1.123

  [00:00:01]Successful Login: 015 192.168.1.123 : local

  [00:00:03]Unsuccessful Login: 022 214.34.56.006 :RDP 192.168.1.124

  [00:00:04]UnSuccessful Login: 010 214.34.56.006 :RDP 192.168.1.124

  [00:00:07]UnSuccessful Login: 007 214.34.56.006 :RDP 192.168.1.124

  [00:00:08]UnSuccessful

  Login: 003 214.34.56.006 :RDP 192.168.1.124

  A. Reporting
  B. IDS
  C. Monitor system logs
  D. Hardening
  D. Hardening

• Question 528:

  Which of the following helps to establish an accurate timeline for a network intrusion?

  A. Hashing images of compromised systems
  B. Reviewing the date of the antivirus definition files
  C. Analyzing network traffic and device logs
  D. Enforcing DLP controls at the perimeter
  C. Analyzing network traffic and device logs

• Question 529:

  Which of the following types of trust models is used by a PKI?

  A. Transitive
  B. Open source
  C. Decentralized
  D. Centralized
  D. Centralized

  ---

  PKI uses a centralized trust model. In a simple PKI a single centralized certification authority (CA). In a hierarchical trust model the root CA is the center of the model, with subordinate CAs lower in the hierarchy. Note: A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. A trust Model is collection of rules that informs application on how to decide the legitimacy of a Digital Certificate. Incorrect Answers: A: Some of the trust in a PKI trust model are transitive, but the trust model itself is centralized not transitive. B: Open Source refers to software and is not a concept that is within a PKI. Open source software is software whose source code is available for modification or enhancement by anyone. C: PKI is not use a decentralized trust model. Web of trust, an alternative to PKI, use a decentralized trust model. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 285-289

• Question 530:

  Which of the following can be used by a security administrator to successfully recover a user's forgotten password on a password protected file?

  A. Cognitive password
  B. Password sniffing
  C. Brute force
  D. Social engineering
  C. Brute force

  ---

  One way to recover a user's forgotten password on a password protected file is to guess it. A brute force attack is an automated attempt to open the file by using many different passwords. A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data. Brute force attacks may be used by criminals to crack encrypted data, or by security analysts to test an organization's network security. A brute force attack may also be referred to as brute force cracking. For example, a form of brute force attack known as a dictionary attack might try all the words in a dictionary. Other forms of brute force attack might try commonly-used passwords or combinations of letters and numbers. An attack of this nature can be time- and resource-consuming. Hence the name "brute force attack;" success is usually based on computing power and the number of combinations tried rather than an ingenious algorithm. Incorrect Answers: A: A cognitive password is a form of knowledge-based authentication that requires a user to answer a question to verify their identity. To open the password protected file, we need the password that was used to protect the file. Therefore, this answer is incorrect. B: Password sniffing is the process of capturing a password as it is transmitted over a network. As no one knows what the password for the protected file is, it won't be transmitted over a network. Therefore, this answer is incorrect. D: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques. As no one knows what the password for the protected file is, we can't use social engineering to reveal the password. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/18091/brute-force-attack http://searchsecurity.techtarget.com/definition/social-engineering