CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 571:

  A security technician wishes to gather and analyze all Web traffic during a particular time period. Which of the following represents the BEST approach to gathering the required data?

  A. Configure a VPN concentrator to log all traffic destined for ports 80 and 443.
  B. Configure a proxy server to log all traffic destined for ports 80 and 443.
  C. Configure a switch to log all traffic destined for ports 80 and 443.
  D. Configure a NIDS to log all traffic destined for ports 80 and 443.
  B. Configure a proxy server to log all traffic destined for ports 80 and 443.

  ---

  A proxy server is in essence a device that acts on behalf of others and in security terms all internal user interaction with the Internet should be controlled through a proxy server. This makes a proxy server the best tool to gather the required data. Incorrect Answers: A: The VPN concentrator creates an encrypted tunnel session between hosts, and many use two- factor authentication for additional security. A proxy server would still be the best tool to gather the required information. C: A switch can provide a monitoring port for troubleshooting and diagnostic purposes in addition to the virtual circuit that they can create between systems in a network. This helps to reduce network trafffic, but a proxy server would be a better tool to gather the required data. D: A network-based IDS (NIDS) approach to IDS attaches the system to a point in the network where it can monitor and report on all network traffic. However a proxy server would be the best tool to gather the required data. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 105, 111

• Question 572:

  Company XYZ has encountered an increased amount of buffer overflow attacks. The programmer has been tasked to identify the issue and report any findings. Which of the following is the FIRST step of action recommended in this scenario?

  A. Baseline Reporting
  B. Capability Maturity Model
  C. Code Review
  D. Quality Assurance and Testing
  C. Code Review

• Question 573:

  Layer 7 devices used to prevent specific types of html tags are called:

  A. Firewalls
  B. Content filters
  C. Routers
  D. NIDS
  B. Content filters

  ---

  A content filter is a is a type of software designed to restrict or control the content a reader is authorised to access, particularly when used to limit material delivered over the Internet via the Web, e-mail, or other means. Because the user and the OSI layer interact directly with the content filter, it operates at Layer 7 of the OSI model. Incorrect Answers: A, C, D: These devices deal with controlling how devices in a network gain access to data and permission to transmit it, as well as controlling error checking and packet synchronization. It, therefore, operates at Layer 2 of the OSI model. References: http://en.wikipedia.org/wiki/Content-control_software#Types_of_filtering http://en.wikipedia.org/wiki/OSI_model

• Question 574:

  A security administrator wants to perform routine tests on the network during working hours when certain applications are being accessed by the most people. Which of the following would allow the security administrator to test the lack of security controls for those applications with the least impact to the system?

  A. Penetration test
  B. Vulnerability scan
  C. Load testing
  D. Port scanner
  B. Vulnerability scan

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Incorrect Answers: A: Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. A vulnerability scan has less impact on the system than a penetration test. Therefore, this answer is incorrect. C: Load testing is the process of adding `load' to a system to test or measure how much load the system can take and continue to function. An example of a load test would be using software to simulate many users (possibly thousands) simultaneously accessing the corporate website to ensure that the web server can continue to function under the load. Load testing is not used to test the lack of security controls for applications. Therefore, this answer is incorrect. D: A port scanner is typically a software application used to scan a system such as a computer or firewall for open ports. A malicious user would attempt to access a system through an open port. A security administrator would compare the list of open ports against a list of ports that need to be open so that unnecessary ports can be closed thus reducing the vulnerability of the system. A port scanner is not used to test the lack of security controls for applications. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/V/vulnerability_scanning.html

• Question 575:

  An administrator configures all wireless access points to make use of a new network certificate authority. Which of the following is being used?

  A. WEP
  B. LEAP
  C. EAP-TLS
  D. TKIP
  C. EAP-TLS

  ---

  The majority of the EAP-TLS implementations require client-side X.509 certificates without giving the option to disable the requirement. Incorrect Answers: A: WEP does not require the use of X.509 certificates. B: LEAP does not require the use of X.509 certificates. D: TKIP does not require the use of X.509 certificates. References: http://en.wikipedia.org/wiki/Extensible_Authentication_Protocol Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 60, 61.

• Question 576:

  The public key is used to perform which of the following? (Select THREE).

  A. Validate the CRL
  B. Validate the identity of an email sender
  C. Encrypt messages
  D. Perform key recovery
  E. Decrypt messages
  F. Perform key escrow
  B. Validate the identity of an email sender
  C. Encrypt messages
  E. Decrypt messages

  ---

  B: The sender uses the private key to create a digital signature. The message is, in effect, signed with the private key. The sender then sends the message to the receiver. The receiver uses the public key attached to the message to validate the digital signature. If the values match, the receiver knows the message is authentic. C: The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message. E: You encrypt data with the private key and decrypt with the public key, though the opposite is much more frequent. Public-key cryptography, also known as asymmetric cryptography, is a class of cryptographic protocols based on algorithms that require two separate keys, one of which is secret (or private) and one of which is public. Although different, the two parts of this key pair are mathematically linked. Incorrect Answers: A: The CRL does not need to be validated. A CRL is a locally stored record containing revoked certificates and revoked keys. D: Key recovery is done through the key recovery agent. The key recovery agent does not use the public key. F: The key escrow process does not use the public key. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285, 285

• Question 577:

  Acme Corp has selectively outsourced proprietary business processes to ABC Services. Due to some technical issues, ABC services wants to send some of Acme Corp's debug data to a third party vendor for problem resolution. Which of the following MUST be considered prior to sending data to a third party?

  A. The data should be encrypted prior to transport
  B. This would not constitute unauthorized data sharing
  C. This may violate data ownership and non-disclosure agreements
  D. Acme Corp should send the data to ABC Services' vendor instead
  C. This may violate data ownership and non-disclosure agreements

  ---

  With sending your data to a third party is already a risk since the third party may have a different policy than yours. Data ownership and non-disclosure is already a risk that you will have to accept since the data will be sent for debugging / troubleshooting purposes which will result in definite disclosure of the data. Incorrect Answers: A: Encrypting the data prior to transport will not negate the fact that the third party needs to send debug data to a third party for troubleshooting purposes. B: The question mentions that the company has outsources proprietary business processes which means it is authorized data sharing in this case since the data is being sent to the third party for troubleshooting purposes. D: ABC's vendor does not have the agreement with Acme Corp since it is an Acme Corp proprietary business process. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 419-420

• Question 578:

  Which of the following is a way to implement a technical control to mitigate data loss in case of a mobile device theft?

  A. Disk encryption
  B. Encryption policy
  C. Solid state drive
  D. Mobile device policy
  A. Disk encryption

  ---

  Disk and device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. Incorrect Answers: B: An encryption policy provides guidelines that limit the use of encryption to algorithms that have been proven to work effectively. The policy still needs to be applied and enforced. C: Solid state drives are hard drives that have memory chips to store data rather than magnetic disks. These are much faster than traditional hard disks but have no effect on data loss due to device theft. D: A mobile device policy provides guidelines the acceptable use of mobile devices within an organization, and means of securing the devices and the data on those devices. However, the policy still needs to be applied and enforced. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236, http:// www.sans.org/security-resources/policies/general/pdf/ acceptable-encryption-policy

• Question 579:

  A large multinational corporation with networks in 30 countries wants to establish an understanding of their overall public-facing network attack surface. Which of the following security techniques would be BEST suited for this?

  A. External penetration test
  B. Internal vulnerability scan
  C. External vulnerability scan
  D. Internal penetration test
  C. External vulnerability scan

• Question 580:

  Ann, a security administrator, has concerns regarding her company's wireless network. The network is open and available for visiting prospective clients in the conference room, but she notices that many more devices are connecting to the network than should be.

  Which of the following would BEST alleviate Ann's concerns with minimum disturbance of current functionality for clients?

  A. Enable MAC filtering on the wireless access point.
  B. Configure WPA2 encryption on the wireless access point.
  C. Lower the antenna's broadcasting power.
  D. Disable SSID broadcasting.
  C. Lower the antenna's broadcasting power.

  ---

  Some access points include power level controls that allow you to reduce the amount of output provided if the signal is traveling too far. Incorrect Answers: A: This would require clients to furnish the security administrator with their device's MAC address. B: This would require clients to ask for Wi-Fi access. D: Clients would not be able to detect the Wi-Fi network. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172, 177, 178, 183.