CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 531:

  Sara, a security engineer, is testing encryption ciphers for performance. Which of the following ciphers offers strong encryption with the FASTEST speed?

  A. 3DES
  B. Blowfish
  C. Serpent
  D. AES256
  B. Blowfish

  ---

  Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64- bit block cipher at very fast speeds. Blowfish is a fast, except when changing keys. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). Incorrect Answers: A: 3DES would be slower than Blowfish. Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys). C: Serpent would be slower than Blowfish. Serpent is a symmetric key block cipher that has a block size of 128 bits and supports a key size of 128, 192 or 256 bits. D: AES256 (also often written as AES-256) uses 256 bits instead of 128. This qualifies for U.S. government classification as Top Secret. AES256 would be slower than Blowfish. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256 http://en.wikipedia.org/wiki/Serpent_%28cipher%29

• Question 532:

  How must user accounts for exiting employees be handled?

  A. Disabled, regardless of the circumstances
  B. Disabled if the employee has been terminated
  C. Deleted, regardless of the circumstances
  D. Deleted if the employee has been terminated
  A. Disabled, regardless of the circumstances

  ---

  You should always disable an employee's account as soon as they leave. The employee knows the username and password of the account and could continue to log in for potentially malicious purposes. Disabling the account will ensure that no one can log in using that account. Incorrect Answers: B: You should always disable an employee's account as soon as they leave regardless of why they are leaving. A terminated employee might be more likely to log in for malicious purposes but should you also disable the accounts of employees leaving through their own choice. Disabling any unused account is always best practice. Therefore, this answer is incorrect. C: There is no need to delete the account. The employee may come back to the company or a new employee may join the company to replace the leaving employee. In this case, you could just rename the disabled account, change the password and re-enable the account. The new employee would then have the same access to resources as the ex-employee. Therefore, this answer is incorrect. D: There is no need to delete the account. A new employee may join the company to replace the leaving employee. In this case, you could just rename the disabled account, change the password and re-enable the account. The new employee would then have the same access to resources as the ex-employee. Therefore, this answer is incorrect.

• Question 533:

  Which of the following is BEST used to break a group of IP addresses into smaller network segments or blocks?

  A. NAT
  B. Virtualization
  C. NAC
  D. Subnetting
  D. Subnetting

  ---

  Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections. Incorrect Answers: A: NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request. B: Virtualization allows a single set of hardware to host multiple virtual machines. C: The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39,

• Question 534:

  Which of the following controls would prevent an employee from emailing unencrypted information to their personal email account over the corporate network?

  A. DLP
  B. CRL
  C. TPM
  D. HSM
  A. DLP

  ---

  Data loss prevention (DLP) systems monitor the contents of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access) and transmitting the data. Incorrect Answers: B: A certificate revocation list is used to revoke a certificate or key. This means that a specific CA state should no longer be used. C: TPM is used to assist with hash key generation. This will enhance security, but a DLP control would better serve the needs of the company in this instance. D: HSM is also a crypto-processor which is used with PKI systems. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 262, 290

• Question 535:

  After visiting a website, a user receives an email thanking them for a purchase which they did not request. Upon investigation the security administrator sees the following source code in a pop-up window:

  Which of the following has MOST likely occurred?

  A. SQL injection
  B. Cookie stealing
  C. XSRF
  D. XSS
  C. XSRF

  ---

  XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application's trust of a user who known or is supposed to have been authenticated. This is often accomplished without the user's knowledge. Incorrect Answers: A:; SQL injection attacks use unexpected input to a web application to gain access to the database used by web application. SQL injection attacks typically do not open pop-up browser windows. B: Cookie stealing is used in session hijacking. Cookies are one of the mechanisms used to validate a web user's session. When stolen, it can be used to establish a session with a host system that thinks it is still communicating with the original user. The original user's session has been hijacked and no longer receives communication from the host system. They will thus no receive pop-up windows. D: Cross-site scripting (XSS) is a form of malicious code-injection attack on a web server in which an attacker injects code into the content sent to website visitors. XSS can be mitigated by implementing patch management on the web server, using firewalls, and auditing for suspicious activity. References: http://en.wikipedia.org/wiki/Cross-site_request_forgery Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 335, 340 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 195

• Question 536:

  Configuring the mode, encryption methods, and security associations are part of which of the following?

  A. IPSec
  B. Full disk encryption
  C. 802.1x
  D. PKI
  A. IPSec

  ---

  IPSec can operate in tunnel mode or transport mode. It uses symmetric cryptography to provide encryption security. Furthermore, it makes use of Internet Security Association and Key Management Protocol (ISAKMP). Incorrect Answers: B: Full disk encryption is used to provide protection for an OS, its installed applications, and all locally stored data. It does not require you to configure the mode, encryption methods, and security associations. C: 802.1x is a port-based authentication mechanism. It does not require you to configure the mode, encryption methods, and security associations. D: A PKI is the definition of the mechanisms involved in implementing certificates. It does not require you to configure the mode, encryption methods, and security associations. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 25, 40, 41, 251, 346.

• Question 537:

  The information security technician wants to ensure security controls are deployed and functioning as intended to be able to maintain an appropriate security posture. Which of the following security techniques is MOST appropriate to do this?

  A. Log audits
  B. System hardening
  C. Use IPS/IDS
  D. Continuous security monitoring
  D. Continuous security monitoring

  ---

  A security baseline is the security setting of a system that is known to be secure. This is the initial security setting of a system. Once the baseline has been applied, it must be maintained or improved. Maintaining the security baseline requires continuous monitoring. Incorrect Answers: A: Auditing logs is good practice. However, it is only one aspect of maintaining security posture. This question asks for the MOST appropriate answer. Continuous security monitoring covers all aspects of maintaining security posture so it is a more appropriate answer. B: Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing or disabling unnecessary functions and features, removing or disabling unnecessary user accounts, disabling unnecessary protocols and ports, and disabling unnecessary services. C: An IPS/IDS (intrusion prevention system/intrusion detection system) is used to detect and prevent malicious activity on a network or a host. However, there is more to maintaining security posture that this one aspect and should be a part of continuous security monitoring. References: Stewart, James Michael, Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, Sybex, Indianapolis, 2014, p 12, 61, 130 Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 208, 215-217, 222

• Question 538:

  The system administrator has deployed updated security controls for the network to limit risk of attack. The security manager is concerned that controls continue to function as intended to maintain appropriate security posture.

  Which of the following risk mitigation strategies is MOST important to the security manager?

  A. User permissions
  B. Policy enforcement
  C. Routine audits
  D. Change management
  C. Routine audits

  ---

  After you have implemented security controls based on risk, you must perform routine audits. These audits should include reviews of user rights and permissions as well as specific events. You should pay particular attention to false positives and negatives. Incorrect Answers: A: User permissions are part of the routine checks that should be followed. B: Policy enforcement usually refers to account policies and these determine the security parameters regarding who may and may not access the system. These are already in place and should be routine checked in this scenario. D: Change management is the structured approach that is followed to secure a company's assets. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 28

• Question 539:

  Users report that they are unable to access network printing services. The security technician checks the router access list and sees that web, email, and secure shell are allowed. Which of the following is blocking network printing?

  A. Port security
  B. Flood guards
  C. Loop protection
  D. Implicit deny
  D. Implicit deny

  ---

  Implicit deny says that if you aren't explicitly granted access or privileges for a resource, you're denied access by default. The scenario does not state that network printing is allowed in the router access list, therefore, it must be denied by default. Incorrect Answers: A: Port security in IT can mean the physical control of all connection points, the management of TCP and User Datagram Protocol (UDP) ports, or Port knocking. The issue in this case, however, is that network printing is not explicitly allowed in the ACL. B: A flood guard protects a private network against flooding or massive-traffic DoS attacks. The issue in this case, however, is that network printing is not explicitly allowed in the ACL. C: Loop protection is the resolving of a transmission pathway that repeats itself. It includes the use of Spanning Tree Protocol (STP) for Ethernet and the IP header TTL value. The issue in this case, however, is that network printing is not explicitly allowed in the ACL. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 24, 25, 284.

• Question 540:

  HOTSPOT

  Select the appropriate attack from each drop down list to label the corresponding illustrated attack Instructions: Attacks may only be used once, and will disappear from drop down list if selected.

  When you have completed the simulation, please select the Done button to submit.

  Hot Area:

  

  

  ---

  References: http://searchsecurity.techtarget.com/definition/spear-phishing http://www.webopedia.com/TERM/V/vishing.html http://www.webopedia.com/TERM/P/phishing.html http://www.webopedia.com/TERM/P/pharming.html