CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 541:

  A certificate used on an ecommerce web server is about to expire. Which of the following will occur if the certificate is allowed to expire?

  A. The certificate will be added to the Certificate Revocation List (CRL).
  B. Clients will be notified that the certificate is invalid.
  C. The ecommerce site will not function until the certificate is renewed.
  D. The ecommerce site will no longer use encryption.
  B. Clients will be notified that the certificate is invalid.

  ---

  A similar process to certificate revocation will occur when a certificate is allowed to expire. Notification will be sent out to clients of the invalid certificate. The process of revoking a certificate begins when the CA is notified that a particular certificate needs to be revoked. This must be done whenever the private key becomes known. The owner of a certificate can request that it be revoked at any time, or the administrator can make the request. Incorrect Answers: A: Revocation occurs prior to expiration and not vice versa. C: Expired certificates are not the same as a site ceasing to function; it is access that is the issue. D: No longer using encryption would be impractical for an ecommerce webserver. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 285

• Question 542:

  A company's legacy server requires administration using Telnet. Which of the following protocols could be used to secure communication by offering encryption at a lower OSI layer? (Select TWO).

  A. IPv6
  B. SFTP
  C. IPSec
  D. SSH
  E. IPv4
  A. IPv6
  C. IPSec

  ---

  Telnet supports IPv6 connections. IPv6 is the communications protocol that provides an identification and location system for computers on networks and routes traffic across the Internet. IPsec is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec is a compulsory component for IPv6. IPsec operates at Layer 3 of the OSI model, whereas Telnet operates at Layer 7. Incorrect Answers: B, D: SFTP is a protocol encrypted by SSH, which is a more secure replacement for Telnet. E: Telnet supports IPv6 connections. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 40, 41, 42, 48. http://en.wikipedia.org/wiki/OSI_model http://en.wikipedia.org/wiki/Telnet

• Question 543:

  In order to prevent and detect fraud, which of the following should be implemented?

  A. Job rotation
  B. Risk analysis
  C. Incident management
  D. Employee evaluations
  A. Job rotation

  ---

  A job rotation policy defines intervals at which employees must rotate through positions. Similar in purpose to mandatory vacations, it helps to ensure that the company does not become too dependent on one person and it does afford the company with the opportunity to place another person in that same job and in this way the company can potentially uncover any fraud perhaps committed by the incumbent. Incorrect Answers: B: Risk assessment is also known as risk analysis or risk calculation and it deals with the threats, vulnerabilities, and impacts of a loss of information-processing capabilities or a loss of information itself. C: Incident management refers to the steps that are followed when events occur. D: The Evaluation process is called an audit. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 4, 10, 26

• Question 544:

  A security administrator is tackling issues related to authenticating users at a remote site. There have been a large number of security incidents that resulted from either tailgating or impersonation of authorized users with valid credentials. The security administrator has been told to implement multifactor authentication in order to control facility access. To secure access to the remote facility, which of the following could be implemented without increasing the amount of space required at the entrance?

  A. MOTD challenge and PIN pad
  B. Retina scanner and fingerprint reader
  C. Voice recognition and one-time PIN token
  D. One-time PIN token and proximity reader
  C. Voice recognition and one-time PIN token

• Question 545:

  Which of the following firewall rules only denies DNS zone transfers?

  A. deny udp any any port 53
  B. deny ip any any
  C. deny tcp any any port 53
  D. deny all dns packets
  C. deny tcp any any port 53

  ---

  DNS operates over TCP and UDP port 53. TCP port 53 is used for zone transfers. Incorrect Answers: A: UDP port 53 is used for most typical DNS queries. B: An access-list has a deny ip any any implicitly at the end of any access-list. If traffic is related to a DHCP request and if it is not explicitly permitted, the traffic is dropped. D: The question requires DNS zone transfers to be blocked only, not all DNS. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 44. http://www.cisco.com/c/en/us/support/docs/security/ios- firewall/23602-confaccesslists.html

• Question 546:

  It is important to staff who use email messaging to provide PII to others on a regular basis to have confidence that their messages are not intercepted or altered during transmission. They are concerned about which of the following types of security control?

  A. Integrity
  B. Safety
  C. Availability
  D. Confidentiality
  A. Integrity

  ---

  Integrity means that the messages/ data is not altered. PII is personally identifiable information that can be used to uniquely identify an individual. PII can be used to ensure the integrity of data/messages. Incorrect Answers: B: Safety concerns would refer to the physical safety and aspect of security, measures such fences, lighting, locks, CCTV, escape plans, etc. is the focus. C: Availability refers to the measures that are used to keep services and systems operational. D: Confidentiality would refer to preventing unauthorized users from accessing the messages. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 401, 404, 413, 414

• Question 547:

  The Chief Technical Officer (CTO) has tasked The Computer Emergency Response Team (CERT) to develop and update all Internal Operating Procedures and Standard Operating Procedures documentation in order to successfully respond to future incidents. Which of the following stages of the Incident Handling process is the team working on?

  A. Lessons Learned
  B. Eradication
  C. Recovery
  D. Preparation
  D. Preparation

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/ reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Developing and updating all internal operating and standard operating procedures documentation to handle future incidents is preparation. Incorrect Answers: A: Lessons learned presumes that the incident already occurred and developing and updating procedures for handling future incidents means that the incident has not occurred yet. B: Eradication assumes that the incident already occurred. C: Recovery is a phase that happens after the incident occurred. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 429

• Question 548:

  A program displays:

  ERROR: this program has caught an exception and will now terminate. Which of the following is MOST likely accomplished by the program's behavior?

  A. Operating system's integrity is maintained
  B. Program's availability is maintained
  C. Operating system's scalability is maintained
  D. User's confidentiality is maintained
  A. Operating system's integrity is maintained

  ---

  The purpose of error handling is to maintain the security and integrity of the system. Integrity is compromised when unauthorized modification occurs. Incorrect Answers: B: Availability is the process of ensuring that authorized users have access to the data and systems that they require. Data backups, redundant systems, and disaster recovery plans can be used to support availability, not error and exception handling. C: Scalability is the ability of a system to adapt to increased demand. Error handling does not contribute to a system's scalability. D: Confidentiality is maintained when unauthorized users do not have access to sensitive information. Error and Exception handling is not related to this. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 259, 413-414

• Question 549:

  DRAG DROP

  Determine the types of attacks below by selecting an option from the dropdown list.

  Determine the types of Attacks from right to specific action.

  Select and Place:

  

  

  ---

  A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

  Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website,

  however, is bogus and set up only to steal the information the user enters on the page.

  B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In

  whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring

  technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or

  other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber

  threats.

  C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he

  or she will profit.

  D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant

  messaging service, which can include Short Message Service (SMS).

  E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations

  today encounter. A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal

  information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem

  that requires immediate network access. Appealing to vanity, appealing to authority,appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.

  References: http://www.webopedia.com/TERM/P/phishing.html http://www.techopedia.com/definition/28643/whaling http://www.webopedia.com/TERM/V/vishing.html http://searchsecurity.techtarget.com/definition/social-engineering

• Question 550:

  Which of the following types of wireless attacks would be used specifically to impersonate another WAP in order to gain unauthorized information from mobile users?

  A. IV attack
  B. Evil twin
  C. War driving
  D. Rogue access point
  B. Evil twin

  ---

  An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits. Incorrect Answers: A: An initialization vector is a random number used in combination with a secret key as a means to encrypt data. This number is sometimes referred to as a nonce, or "number occurring once," as an encryption program uses it only once per session. An initialization vector is used to avoid repetition during the data encryption process, making it impossible for hackers who use dictionary attack to decrypt the exchanged encrypted message by discovering a pattern. This is known as an IV attack. An IV attack is not used to impersonate another WAP. Therefore this answer is incorrect. C: War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, you need a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car. Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources. War driving is not used to impersonate another WAP. Therefore this answer is incorrect. D: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. A rogue access point can be used to impersonate another WAP but it doesn't have to whereas an Evil Twin WAP always impersonates another WAP. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/5057/evil-twin http://www.techopedia.com/definition/26858/initialization-vector http://en.wikipedia.org/wiki/Rogue_access_point