CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 581:

  Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

  A. Kerberos
  B. TACACS+
  C. RADIUS
  D. LDAP
  D. LDAP

  ---

  The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number. A common usage of LDAP is to provide a "single sign on" where one password for a user is shared between many services, such as applying a company login code to web pages (so that staff log in only once to company computers, and then are automatically logged into the company intranet). LDAP is based on a simpler subset of the standards contained within the X.500 standard. Because of this relationship, LDAP is sometimes called X.500-lite. A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS. Global Catalog is available by default on ports 3268, and 3269 for LDAPS. The client then sends an operation request to the server, and the server sends responses in return. The client may request the following operations: StartTLS -- use the LDAPv3 Transport Layer Security (TLS) extension for a secure connection Incorrect Answers: A: Kerberos is a computer network authentication protocol which works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed it primarily at a clientserver model and it provides mutual authentication--both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks. Kerberos builds on symmetric key cryptography and requires a trusted third party, and optionally may use public- key cryptography during certain phases of authentication. Kerberos uses UDP port 88 by default. Kerberos is not based on a previous X.500 specification as is LDAP. B: Terminal Access Controller Access-Control System (TACACS) refers to a family of related protocols handling remote authentication and related services for networked access control through a centralized server. The original TACACS protocol, which dates back to 1984, was used for communicating with an authentication server, common in older UNIX networks. TACACS+ and RADIUS have generally replaced TACACS and XTACACS in more recently built or updated networks. TACACS+ is an entirely new protocol and is not compatible with its predecessors, TACACS and XTACACS. TACACS+ uses TCP (while RADIUS operates over UDP). Since TACACS+ uses the authentication, authorization, and accounting (AAA) architecture, these separate components of the protocol can be segregated and handled on separate servers. TACACS+ is not based on a previous X.500 specification as is LDAP. C: Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service. Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. RADIUS is not based on a previous X.500 specification as is LDAP. References: http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 http://en.wikipedia.org/wiki/TACACS http://en.wikipedia.org/wiki/RADIUS

• Question 582:

  A large bank has moved back office operations offshore to another country with lower wage costs in an attempt to improve profit and productivity. Which of the following would be a customer concern if the offshore staff had direct access to

  their data?

  A. Service level agreements
  B. Interoperability agreements
  C. Privacy considerations
  D. Data ownership
  C. Privacy considerations

• Question 583:

  Which of the following provides the BEST explanation regarding why an organization needs to implement IT security policies?

  A. To ensure that false positives are identified
  B. To ensure that staff conform to the policy
  C. To reduce the organizational risk
  D. To require acceptable usage of IT systems
  C. To reduce the organizational risk

  ---

  Once risks has been identified and assessed then there are five possible actions that should be taken. These are: Risk avoidance, Risk transference, Risk mitigation, Risk deterrence and Risk acceptance. Anytime you engage in steps to reduce risk, you are busy with risk mitigation and implementing IT security policy is a risk mitigation strategy. Incorrect Answers: A: False positives are events that are not really incidents. Thus to ensure that false positives are identified is not the main concern of implementing IT security policy. B: Conforming to policy is only possible if policy is in place. D: Acceptable use policy I concerned mainly with how a company allows their computers to b eused within the company. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 9-10, 28

• Question 584:

  Which of the following can Joe, a security administrator, implement on his network to capture attack details that are occurring while also protecting his production network?

  A. Security logs
  B. Protocol analyzer
  C. Audit logs
  D. Honeypot
  D. Honeypot

  ---

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies. According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes: The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers. There are two main types of honeypots: Production - A production honeypot is one used within an organization's environment to help mitigate risk. Research A research honeypot add value to research in computer security by providing a platform to study the threat. Incorrect Answers: A: Security logs record security events such as logon and logoff events. Security logs can be used to monitor failed logon events which could indicate an attack. However, logon attempts are just one form of attack. A honeypot can be used to monitor all sorts of attack. Therefore, a honeypot is a better answer so this answer is incorrect. B: A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It would be difficult to monitor attacks by analyzing network communications. Therefore, a honeypot is a better answer so this answer is incorrect. C: Audit logs record events such as file access (successful or unsuccessful) or Active Directory modifications. Audit logs could be used monitor failed attempts to access files which could indicate an attack. However, file access attempts are just one form of attack. A honeypot can be used to monitor all sorts of attack. Therefore, a honeypot is a better answer so this answer is incorrect. References: https://ethics.csc.ncsu.edu/abuse/hacking/honeypots/study.php

• Question 585:

  A security administrator would like to ensure that system administrators are not using the same password for both their privileged and non-privileged accounts. Which of the following security controls BEST accomplishes this goal?

  A. Require different account passwords through a policy
  B. Require shorter password expiration for non-privileged accounts
  C. Require shorter password expiration for privileged accounts
  D. Require a greater password length for privileged accounts
  A. Require different account passwords through a policy

• Question 586:

  Which of the following is a hardware based encryption device?

  A. EFS
  B. TrueCrypt
  C. TPM
  D. SLE
  C. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: A: Encrypting File System (EFS) is a software-based encryptions solution that is used to encrypt files or entire volumes in a Windows computer. It is not a hardware-based encryption solution. B: TrueCrypt is an open source software-based encryption solution. D: SLE (Single Loss Expectancy) is a risk management concept that measures the potential dollar value loss from a single risk-realization incident. It is not related to cryptography. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 5-7, 237, 290

• Question 587:

  Which of the following devices is BEST suited for servers that need to store private keys?

  A. Hardware security module
  B. Hardened network firewall
  C. Solid state disk drive
  D. Hardened host firewall
  A. Hardware security module

  ---

  A hardware security module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. By adding a HSM to the server and storing the private keys on HSM, the security of the keys would be improved. Incorrect Answers: B: A firewall protects from threats in the incoming traffic. A firewall would not be of much help in securing keys stored on a server. C: A solid state drive does not provide any extra security, it is just faster than most regular hard drives. D: A firewall protects from threats in the incoming traffic. A firewall would not be of much help in securing keys stored on a server. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96-97, 222, 238, 290, 386

• Question 588:

  A network administrator, Joe, arrives at his new job to find that none of the users have changed their network passwords since they were initially hired. Joe wants to have everyone change their passwords immediately. Which of the following policies should be enforced to initiate a password change?

  A. Password expiration
  B. Password reuse
  C. Password recovery
  D. Password disablement
  A. Password expiration

• Question 589:

  Which of the following assessment techniques would a security administrator implement to ensure that systems and software are developed properly?

  A. Baseline reporting
  B. Input validation
  C. Determine attack surface
  D. Design reviews
  D. Design reviews

  ---

  When implementing systems and software, an important step is the design of the systems and software. The systems and software should be designed to ensure that the system works as intended and is secure. The design review assessment examines the ports and protocols used, the rules, segmentation, and access control in the system or application. A design review is basically a check to ensure that the design of the system meets the security requirements. Incorrect Answers: A: A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline). Baseline reporting should take place after the systems and software have been designed, the design reviewed and the systems and software have been implemented. Therefore, this answer is incorrect. B: Input validation can improve application performance by catching malformed input in the application that could cause problems with the output. For example, if a user is expected to enter a number into a field in the application, input validation can be used to ensure that the input is numeric and not text. Input validation is a part of application design. It can also be used to prevent attacks such as cross-site scripting and SQL injection. However, it is not part of general system design. Therefore, this answer is incorrect. C: Determining attack surface is a security practice that is performed after a system or software application has been implemented. However, this question is asking about the development of systems and software. The `development' is performed before the systems are implemented. Therefore, this answer is incorrect.

• Question 590:

  The call center supervisor has reported that many employees have been playing preinstalled games on company computers and this is reducing productivity.

  Which of the following would be MOST effective for preventing this behavior?

  A. Acceptable use policies
  B. Host-based firewalls
  C. Content inspection
  D. Application whitelisting
  D. Application whitelisting

  ---

  Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list. Incorrect Answers: A: An acceptable use policy is a document that defines the acceptable activity, practice, or use for equipment and resources. However, the policy must still be enforced. B: Firewalls are used to control inbound and outbound network communications between systems. It does not prevent the installation of applications. C: Content inspection is a filtering function where the contents of the application protocol payload are inspected against a blacklist of unwanted terms, addresses, or URLs. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 24, 340 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 19,