CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 561:

  Which of the following malware types typically allows an attacker to monitor a user's computer, is characterized by a drive-by download, and requires no user interaction?

  A. Virus
  B. Logic bomb
  C. Spyware
  D. Adware
  C. Spyware

  ---

  Spyware is software that is used to gather information about a person or organization without their knowledge and sends that information to another entity. Incorrect Answers: A: A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man-made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems. Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs. A virus is not what is described in this question. Therefore, this answer is incorrect. B: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. A logic bomb is not what is described in this question. Therefore, this answer is incorrect. D: Adware is free software that is supported by advertisements. Common adware programs are toolbars that sit on your desktop or work in conjunction with your Web browser. They include features like advanced searching of the Web or your hard drive and better organization of your bookmarks and shortcuts. Adware can also be more advanced programs such as games or utilities. They are free to use, but require you to watch advertisements as long as the programs are open. Since the ads often allow you to click to a Web site, adware typically requires an active Internet connection to run. Most adware is safe to use, but some can serve as spyware, gathering information about you from your hard drive, the Web sites you visit, or your keystrokes. Spyware programs can then send the information over the Internet to another computer. So be careful what adware you install on your computer. Make sure it is from a reputable company and read the privacy agreement that comes with it. Adware is not what is described in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Spyware http://www.webopedia.com/TERM/V/virus.html http://techterms.com/definition/adware

• Question 562:

  A new application needs to be deployed on a virtual server. The virtual server hosts a SQL server that is used by several employees. Which of the following is the BEST approach for implementation of the new application on the virtual server?

  A. Take a snapshot of the virtual server after installing the new application and store the snapshot in a secure location.
  B. Generate a baseline report detailing all installed applications on the virtualized server after installing the new application.
  C. Take a snapshot of the virtual server before installing the new application and store the snapshot in a secure location.
  D. Create an exact copy of the virtual server and store the copy on an external hard drive after installing the new application.
  C. Take a snapshot of the virtual server before installing the new application and store the snapshot in a secure location.

• Question 563:

  An auditing team has found that passwords do not meet best business practices. Which of the following will MOST increase the security of the passwords? (Select TWO).

  A. Password Complexity
  B. Password Expiration
  C. Password Age
  D. Password Length
  E. Password History
  A. Password Complexity
  D. Password Length

  ---

  Passwords should have the strength to avoid discovery through attack, but it should also be easy enough for the user to remember. The length and complexity of a password combined are vital factors in defining a password's strength. Incorrect Answers: B, C: It is common practice for passwords to automatically expire after a specified period so as to compel users to change passwords. However, if it is a strong password, it can remain static. E: Password History tracks previous passwords so as to prevent password reuse. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 292, 293.

• Question 564:

  Human Resources suspect an employee is accessing the employee salary database. The administrator is asked to find out who it is. In order to complete this task, which of the following is a security control that should be in place?

  A. Shared accounts should be prohibited.
  B. Account lockout should be enabled
  C. Privileges should be assigned to groups rather than individuals
  D. Time of day restrictions should be in use
  A. Shared accounts should be prohibited.

  ---

  Since distinguishing between the actions of one person and another isn't possible if they both use a shared account, shared accounts should not be allowed. If shared accounts are being used, the administrator will find the account, but have more than one suspect. To nullify this occurrence, Shared accounts should be prohibited. Incorrect Answers: B: When a user repeatedly enters an incorrect password at logon, Account lockout automatically disables their account someone attempts. Repeated incorrect logon attempts are not the issue in this instance. C: Group-based privileges assign all members of a group a privilege or access to a resource as a collective. Assigning privileges to groups won't help the administrator find the suspect. D: Time of day restrictions limits when a specific user account can log on to the network according to the time of day. Time of day restrictions won't help the administrator find the suspect. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 280, 293, 294.

• Question 565:

  Which of the following technologies can store multi-tenant data with different security requirements?

  A. Data loss prevention
  B. Trusted platform module
  C. Hard drive encryption
  D. Cloud computing
  D. Cloud computing

  ---

  One of the ways cloud computing is able to obtain cost efficiencies is by putting data from various clients on the same machines. This "multitenant" nature means that workloads from different clients can be on the same system, and a flaw in implementation could compromise security. Incorrect Answers: A, B, C: None of these options offer multitenancy. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 37. http://en.wikipedia.org/wiki/Multitenancy

• Question 566:

  The process of making certain that an entity (operating system, application, etc.) is as secure as it can be is known as:

  A. Stabilizing
  B. Reinforcing
  C. Hardening
  D. Toughening
  C. Hardening

  ---

  Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing unnecessary functions and features, removing unnecessary usernames or logins and disabling unnecessary services. Incorrect Answers: A, B, D: The correct term for making a system as secure as possible is hardening, not stabilizing, reinforcing, or toughening. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 215-217

• Question 567:

  A network administrator wants to block both DNS requests and zone transfers coming from outside IP addresses. The company uses a firewall which implements an implicit allow and is currently configured with the following ACL applied to its external interface.

  PERMIT TCP ANY ANY 80 PERMIT TCP ANY ANY 443

  Which of the following rules would accomplish this task? (Select TWO).

  A. Change the firewall default settings so that it implements an implicit deny
  B. Apply the current ACL to all interfaces of the firewall
  C. Remove the current ACL
  D. Add the following ACL at the top of the current ACL DENY TCP ANY ANY 53
  E. Add the following ACL at the bottom of the current ACL DENY ICMP ANY ANY 53
  F. Add the following ACL at the bottom of the current ACL DENY IP ANY ANY 53
  A. Change the firewall default settings so that it implements an implicit deny
  F. Add the following ACL at the bottom of the current ACL DENY IP ANY ANY 53

  ---

  Implicit deny is the default security stance that says if you aren't specifically granted access or privileges for a resource, you're denied access by default. Implicit deny is the default response when an explicit allow or deny isn't present. DNS operates over TCP and UDP port 53. TCP port 53 is used for zone transfers. These are zone file exchanges between DNS servers, special manual queries, or used when a response exceeds 512 bytes. UDP port 53 is used for most typical DNS queries. Incorrect Answers: B: Applying the current ACL to all interfaces of the firewall, and adding a deny clause will also prevent internal users from performing the actions included in the deny clause. C: Removing the current ACL will block web traffic coming in. D: An implicit deny clause is implied at the end of each ACL. E: ICMP is a network health and link-testing protocol, and is not related to the question. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 26, 44.

• Question 568:

  Several departments within a company have a business need to send high volumes of confidential information to customers via email. Which of the following is the BEST solution to mitigate unintentional exposure of confidential information?

  A. Employ encryption on all outbound emails containing confidential information.
  B. Employ exact data matching and prevent inbound emails with Data Loss Prevention.
  C. Employ hashing on all outbound emails containing confidential information.
  D. Employ exact data matching and encrypt inbound e-mails with Data Loss Prevention.
  A. Employ encryption on all outbound emails containing confidential information.

  ---

  Encryption is used to ensure the confidentiality of information and in this case the outbound email that contains the confidential information should be encrypted. Incorrect Answers: B: DLP system should be set to monitor the outbound emails not the inbound email since the company will be sending out confidential email. C: Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables. D: Encrypting inbound email would be futile if the data protection should be carried out on outbound email. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 236, 255, 291

• Question 569:

  Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?

  A. WAF
  B. NIDS
  C. Routers
  D. Switches
  A. WAF

  ---

  A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as cross-site scripting (XSS) and SQL injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified. As the protocols used to access a web server (typically HTTP and HTTPS) run in layer 7 of the OSI model, then web application firewall (WAF) is the correct answer. Incorrect Answers: B: A NIDS (Network Intrusion Detection System) operates in layer 2 of the OSI model, not layer 7. C: Routers operate in layer 3 of the OSI model, not layer 7. D: Switches operate in layer 2 of the OSI model, not layer 7. References: https://owasp.org/index.php/Web_Application_Firewall http://en.wikipedia.org/wiki/OSI_model

• Question 570:

  Which of the following are examples of network segmentation? (Select TWO).

  A. IDS
  B. IaaS
  C. DMZ
  D. Subnet
  E. IPS
  C. DMZ
  D. Subnet

  ---

  C: A demilitarized zone (DMZ) is a part of the network that is separated of segmented from the rest of the network by means of firewalls and acts as a buffer between the untrusted public Internet and the trusted local area network (LAN). D. IP subnets can be used to separate or segment networks while allowing communication between the network segments via routers. Incorrect Answers: A: An intrusion detection system (IDS) is an automated system that detects intrusions or security policy violations on networks or host systems. It does not feature or offer network segmentation. B: The Infrastructure as a Service (IaaS) model is a cloud computing business model uses virtualization, with the clients paying for resources used. E: An intrusion prevention system (IPS) is an automated system that attempts to prevent intrusions or security policy violations on networks or host systems. It does not feature or offer network segmentation. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 21, 26, 27-28 Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 65, 110-111