CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 551:

  Company A sends a PGP encrypted file to company B. If company A used company B's public key to encrypt the file, which of the following should be used to decrypt data at company B?

  A. Registration
  B. Public key
  C. CRLs
  D. Private key
  D. Private key

  ---

  In a PKI the sender encrypts the data using the receiver's public key. The receiver decrypts the data using his own private key. PKI is a two-key, asymmetric system with four main components: certificate authority (CA), registration authority (RA), RSA (the encryption algorithm), and digital certificates. Messages are encrypted with a public key and decrypted with a private key. A PKI example: 1. You want to send an encrypted message to Jordan, so you request his public key. 2. Jordan responds by sending you that key. 3. You use the public key he sends you to encrypt the message. 4. You send the message to him. 5. Jordan uses his private key to decrypt the message. Incorrect Answers: A: Registration is not used to decrypt files. Key registration is the process of providing certificates to users B: If the public key is used to encrypt the file, then we cannot use this public key to decrypt the file. We need the private key. The private and the public key are mathematically linked and make a key pair. You cannot use two public keys to encrypt and decrypt the data. C: CRLs are not used to decrypt files. A CRL is a database of revoked keys and certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285, 280-281, 285

• Question 552:

  Which of the following is the LEAST volatile when performing incident response procedures?

  A. Registers
  B. RAID cache
  C. RAM
  D. Hard drive
  D. Hard drive

  ---

  An example of OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts. Of the options stated in the question the hard drive would be the least volatile. Incorrect Answers: A: The registers are part of the CPU cache and ranks quite high in OOV incident response procedure. B: The RAID cache is more volatile than the RAM in an OOV incident response procedure. C: A hard drive ranks lower than RAM in an OOV incident response procedure. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 453

• Question 553:

  A small company has recently purchased cell phones for managers to use while working outside if the office.

  The company does not currently have a budget for mobile device management and is primarily concerned with deterring leaks if sensitive information obtained by unauthorized access to unattended phones. Which of the following would provide the solution BEST meets the company's requirements?

  A. Screen-lock
  B. Disable removable storage
  C. Full device encryption
  D. Remote wiping
  A. Screen-lock

  ---

  Screen-lock is a security feature that requires the user to enter a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it will be difficult for anyone else to access your data or applications. Incorrect Answers: B: Merely disabling removable storage will not prevent sensitive information from being accessed by unauthorized people when the phone is left unattended. C: Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. D: Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 554:

  Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and operating systems are running on the corporate network. Which of the following should be used to complete this task?

  A. Fingerprinting and password crackers
  B. Fuzzing and a port scan
  C. Vulnerability scan and fuzzing
  D. Port scan and fingerprinting
  D. Port scan and fingerprinting

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it. A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine. Fingerprinting is a means of ascertaining the operating system of a remote computer on a network. Fingerprinting is more generally used to detect specific versions of applications or protocols that are run on network servers. Fingerprinting can be accomplished "passively" by sniffing network packets passing between hosts, or it can be accomplished "actively" by transmitting specially created packets to the target machine and analyzing the response Incorrect Answers: A: Fingerprinting is a means of ascertaining the operating system of a remote computer on a network. However, a password cracker is not used to determine which services are running on network computers. Therefore, this answer is incorrect. B: A port scan can be used to determine which services are running on network computers. However fuzzing is not used to determine which operating system the computers are running. Fuzzing is a security assessment technique that allows testers to analyze the behavior of software applications by entering unexpected input. Therefore, this answer is incorrect. C: A vulnerability scanner is software designed to assess computers, computer systems, networks or applications for weaknesses. A vulnerability scan will scan for weaknesses (vulnerabilities) in a system. It could provide information about which services are running but it is not specifically designed for this purpose. Fuzzing is not used to determine which operating system the computers are running or which services are running on the computers. Fuzzing is a security assessment technique that allows testers to analyze the behavior of software applications by entering unexpected input. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Port_scanner http://www.yourdictionary.com/fingerprinting

• Question 555:

  The information security team does a presentation on social media and advises the participants not to provide too much personal information on social media web sites. This advice would BEST protect people from which of the following?

  A. Rainbow tables attacks
  B. Brute force attacks
  C. Birthday attacks
  D. Cognitive passwords attacks
  D. Cognitive passwords attacks

  ---

  Social Networking Dangers are `amplified' in that social media networks are designed to mass distribute personal messages. If an employee reveals too much personal information it would be easy for miscreants to use the messages containing the personal information to work out possible passwords. Incorrect Answers: A: A rainbow table attack focuses on identifying a stored value. By using values in an existing table of hashed phrases or words (think of taking a word and hashing it every way you can imagine) and comparing them to values found. B: A brute-force attack is an attempt to guess passwords until a successful guess occurs. C: Birthday Attack is built on a simple premise. If 25 people are in a room, there is some probability that two of those people will have the same birthday. The probability increases as additional people enter the room. It's important to remember that probability doesn't mean that something will occur, only that it's more likely to occur. To put it another way, if you ask if anyone has a birthday of March 9th, the odds are 1 in 365 (or 25/365 given the number of people in the room), but if you ask if anyone has the same birthday as any other individual, the odds of there being a match increase significantly. This makes guessing the possible password easily. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 328

• Question 556:

  An advantage of virtualizing servers, databases, and office applications is:

  A. Centralized management.
  B. Providing greater resources to users.
  C. Stronger access control.
  D. Decentralized management.
  A. Centralized management.

  ---

  Virtualization consists of allowing one set of hardware to host multiple virtual Machines and in the case of software and applications; one host is all that is required. This makes centralized management a better prospect. Incorrect Answers: B: Virtualization does not necessarily mean providing greater resources to users, rather it makes it possible for the company to use fewer resources and spread it over more users. C: Stronger access control is one aspect of the centralized management dilemma as virtualization may result in privilege escalation. D: Decentralized management is the exact opposite of what virtualization accomplishes. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 19

• Question 557:

  Joe, the security administrator, has determined that one of his web servers is under attack. Which of the following can help determine where the attack originated from?

  A. Capture system image
  B. Record time offset
  C. Screenshots
  D. Network sniffing
  D. Network sniffing

  ---

  Network sniffing is the process of capturing and analyzing the packets sent between systems on the network. A network sniffer is also known as a Protocol Analyzer. A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing and analyzing the packets sent to the web server will help determine the source IP address of the system sending the packets. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal). Incorrect Answers: A: Capturing an image of the system is the process of making an exact copy of the contents of the hard drive in the system. This would not help in determining the source of an attack on the system. Therefore, this answer is incorrect. B: Recording the time offset of the system will determine the difference between the time on the system compared to the actual current time. This would not help in determining the source of an attack on the system. Therefore, this answer is incorrect. C: Taking screenshots of the system will not help in determining the source of an attack on the system. A screenshot is a copy of what is displayed on the computer screen at the time of the screenshot. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Wireshark

• Question 558:

  A technician is unable to manage a remote server. Which of the following ports should be opened on the firewall for remote server management? (Select TWO).

  A. 22
  B. 135
  C. 137
  D. 143
  E. 443
  F. 3389
  A. 22
  F. 3389

  ---

  A secure remote administration solution and Remote Desktop protocol is required. Secure Shell (SSH) is a secure remote administration solution and makes use of TCP port 22. Remote Desktop Protocol (RDP) uses TCP port 3389. Incorrect Answers: B: Port 135 is used by Microsoft EPMAP (End Point Mapper), also known as DCE/RPC Locator service, which is used to remotely manage services including DHCP server, DNS server and WINS. C: NetBIOS Name Service uses TCP port 137. D: Internet Message Access Protocol v4 (IMAP4) uses TCP port 143. E: HTTPS uses TCP port 443 References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 51, 52. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 559:

  Which device monitors network traffic in a passive manner?

  A. Sniffer
  B. IDS
  C. Firewall
  D. Web browser
  A. Sniffer

  ---

  A sniffer is another name for a protocol analyzer. A protocol analyzer performs its function in a passive manner. In other words, computers on the network do not know that their data packets have been captured. A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing packets sent from a computer system is known as packet sniffing. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal). A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn't generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. The NIC is put into promiscuous mode, and it reads communications between computers within a particular segment. This allows the sniffer to seize everything that is flowing in the network, which can lead to the unauthorized access of sensitive data. A packet sniffer can take the form of either a hardware or software solution. A sniffer is also known as a packet analyzer. Incorrect Answers: B: An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. An IDS does not passively monitor network traffic. Therefore, this answer is incorrect. C: A firewall is used to block or allow network traffic according to rules specifying source address, destination address, protocol or port number. It does not passively monitor network traffic. Therefore, this answer is incorrect. D: A Web browser is used to view web sites. It does not monitor network traffic. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/4113/sniffer http://en.wikipedia.org/wiki/Intrusion_detection_system

• Question 560:

  Visible security cameras are considered to be which of the following types of security controls?

  A. Technical
  B. Compensating
  C. Deterrent
  D. Administrative
  C. Deterrent