CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 591:

  Several employee accounts appear to have been cracked by an attacker. Which of the following should the security administrator implement to mitigate password cracking attacks? (Select TWO).

  A. Increase password complexity
  B. Deploy an IDS to capture suspicious logins
  C. Implement password history
  D. Implement monitoring of logins
  E. Implement password expiration
  F. Increase password length
  A. Increase password complexity
  F. Increase password length

  ---

  The more difficult a password is the more difficult it is to be cracked by an attacker. By increasing the password complexity you make it more difficult. Passwords that are too short can easily be cracked. The more characters used in a password, combined with the increased complexity will mitigate password cracking attacks. Incorrect Answers: B: IDS (intrusion detection systems) can be implemented to capture suspicious logins, but that assumes that the passwords are already cracked. C: Password history implementation is used to prevent users changing their password to the same value as the old one, or to one that they used the last time around, this might also be used by some crackers to hack passwords and thus is not mitigating password attacks. D: Monitoring the logins is part of auditing and does not mitigate the password cracking attacks. E: Password expiration refers to the period of validity of passwords. Some crackers will even make use of these expiry periods to crack passwords. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139-140

• Question 592:

  According to company policy an administrator must logically keep the Human Resources department separated from the Accounting department. Which of the following would be the simplest way to accomplish this?

  A. NIDS
  B. DMZ
  C. NAT
  D. VLAN
  D. VLAN

  ---

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. Incorrect Answers: A: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, not separating networks. B: A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. It does not separate networks. C: NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request. It does not separate networks. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 21, 23, 39.

• Question 593:

  An Information Systems Security Officer (ISSO) has been placed in charge of a classified peer- to-peer network that cannot connect to the Internet. The ISSO can update the antivirus definitions manually, but which of the following steps is MOST important?

  A. A full scan must be run on the network after the DAT file is installed.
  B. The signatures must have a hash value equal to what is displayed on the vendor site.
  C. The definition file must be updated within seven days.
  D. All users must be logged off of the network prior to the installation of the definition file.
  B. The signatures must have a hash value equal to what is displayed on the vendor site.

  ---

  A hash value can be used to uniquely identify secret information. This requires that the hash function is collision resistant, which means that it is very hard to find data that generate the same hash value and thus it means that in hashing two different inputs will not yield the same output. Thus the hash value must be equal to that displayed on the vendor site. Incorrect Answers: A: To run a full scan is just important to check the status of your computer insofar as virus infections may be concerned, not the updating of the antivirus definitions when you cannot connect the P2P to the internet. C: This not a time constraint issue. D: Logging off of the network is not a requirement to install updates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 255

• Question 594:

  A Chief Information Security Officer (CISO) is tasked with outsourcing the analysis of security logs. These will need to still be reviewed on a regular basis to ensure the security of the company has not been breached. Which of the following cloud service options would support this requirement?

  A. SaaS
  B. MaaS
  C. IaaS
  D. PaaS
  B. MaaS

  ---

  Monitoring-as-a-service (MaaS) is a cloud delivery model that falls under anything as a service (XaaS). MaaS allows for the deployment of monitoring functionalities for several other services and applications within the cloud. Incorrect Answers: A: SaaS is a software delivery method that offers remote access to software as a Web-based service. C: IaaS is when computer infrastructure, such as virtualization, is outsourced and clients pay for resources used. D: It is when a computing platform is outsourced rather than a company or data center purchasing and managing their own hardware and software layers. References: http://www.techopedia.com/definition/29430/monitoring-as-a-service-maas http://www.webopedia.com/TERM/S/SaaS.html http://www.webopedia.com/TERM/I/IaaS.html Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 17.

• Question 595:

  Which of the following would a security administrator use to verify the integrity of a file?

  A. Time stamp
  B. MAC times
  C. File descriptor
  D. Hash
  D. Hash

  ---

  Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables and it is a one-way transformation in order to validate the integrity of data. Incorrect Answers: A: Time stamp is used to check whether a certificate has expired or not. B: MAC times are pieces of file system metadata which record when certain events pertaining to a computer file occurred most recently. The events are usually described as "modification" (the data in the file was modified), "access" (some part of the file was read), and "metadata change" (the file's permissions or ownership were modified) also commonly used in forensics. C: File descriptor describing a file is not the same as verifying the integrity of the file. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 255, 260

• Question 596:

  Sara, an attacker, is recording a person typing in their ID number into a keypad to gain access to the building. Sara then calls the helpdesk and informs them that their PIN no longer works and would like to change it. Which of the following attacks occurred LAST?

  A. Phishing
  B. Shoulder surfing
  C. Impersonation
  D. Tailgating
  C. Impersonation

  ---

  Two attacks took place in this question. The first attack was shoulder surfing. This was the act of Sara recording a person typing in their ID number into a keypad to gain access to the building. The second attack was impersonation. Sara called the helpdesk and used the PIN to impersonate the person she recorded. Incorrect Answers: A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page. Phishing emails are blindly sent to thousands, if not millions of recipients. By spamming large groups of people, the "phisher" counts on the email being read by a percentage of people who actually have an account with the legitimate company being spoofed in the email and corresponding webpage. Phishing, also referred to as brand spoofing or carding, is a variation on "fishing," the idea being that bait is thrown out with the hopes that while most will ignore the bait, some will be tempted into biting. No examples of phishing occurred in this question. Therefore, this answer is incorrect. B: Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand. Shoulder surfing was the first attack in this question. This was the act of Sara recording a person typing in their ID number into a keypad to gain access to the building. Therefore, this answer is incorrect. D: Just as a driver can tailgate another driver's car by following too closely, in the security sense, tailgating means to compromise physical security by following somebody through a door meant to keep out intruders. Tailgating is actually a form of social engineering, whereby someone who is not authorized to enter a particular area does so by following closely behind someone who is authorized. No examples of tailgating occurred in this question. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/P/phishing.html http://searchsecurity.techtarget.com/definition/shoulder-surfing http://www.yourdictionary.com/tailgating

• Question 597:

  Joe, a security administrator, believes that a network breach has occurred in the datacenter as a result of a misconfigured router access list, allowing outside access to an SSH server. Which of the following should Joe search for in the log files?

  A. Failed authentication attempts
  B. Network ping sweeps
  C. Host port scans
  D. Connections to port 22
  D. Connections to port 22

  ---

  Log analysis is the art and science of reviewing audit trails, log files, or other forms of computer- generated records for evidence of policy violations, malicious events, downtimes, bottlenecks, or other issues of concern. SSH uses TCP port 22. All protocols encrypted by SSH also use TCP port 22, such as SFTP, SHTTP, SCP, SExec, and slogin. Incorrect Answers: A: This just shows you the number of attempts at authentication that were unsuccessful. B: Ping sweeps are can establish a range of IP addresses which map to live hosts. C: This is often carried out by administrators to validate security policies of their networks and by attackers to identify running services on a host with the view to compromise it. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 26. http://en.wikipedia.org/wiki/Ping_sweep http://en.wikipedia.org/wiki/Port_scanner

• Question 598:

  Which of the following access controls enforces permissions based on data labeling at specific levels?

  A. Mandatory access control
  B. Separation of duties access control
  C. Discretionary access control
  D. Role based access control
  A. Mandatory access control

  ---

  In a MAC environment everything is assigned a classification marker. Subjects are assigned a clearance level and objects are assigned a sensitivity label. Incorrect Answers: B: Separation of duties divides administrator or privileged tasks into separate groupings, which in turn, is individually assigned to unique administrators. It does not involve labelling at specific levels. C: Discretionary access control (DAC) allows access to be granted or restricted by an object's owner based on user identity and on the discretion of the object owner. It does not involve labelling at specific levels. D: Basically, Role-based Access Control is based on a user's job description. It does not involve labelling at specific levels. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 278- 284.

• Question 599:

  A security administrator has installed a new KDC for the corporate environment. Which of the following authentication protocols is the security administrator planning to implement across the organization?

  A. LDAP
  B. RADIUS
  C. Kerberos
  D. XTACACS
  C. Kerberos

  ---

  The fundamental component of a Kerberos solution is the key distribution centre (KDC), which is responsible for verifying the identity of principles and granting and controlling access within a network environment through the use of secure cryptographic keys and tickets. Incorrect Answers: A: The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. B, D: RADIUS and XTACACS do not require a KDC to function. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 270- 274.

• Question 600:

  Which of the following encompasses application patch management?

  A. Configuration management
  B. Policy management
  C. Cross-site request forgery
  D. Fuzzing
  A. Configuration management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities. A part of patch management is testing the effects of vendor updates on a test system first to ensure that the updates do not have detrimental effects on the system and its configuration, and, should the updates have no detrimental effects on the test systems, backing up the production systems before applying the updates on a production system. Incorrect Answers: B: Policy management is the use of policies to form guidelines for the management of entities within an organization. These policies need to be enforced. C: XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application's trust of a user who known or is supposed to have been authenticated. This is often accomplished without the user's knowledge. XSRF is not related to patch management. D: Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 218, 220 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 229, 231-232