CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 621:

  Which of the following is described as an attack against an application using a malicious file?

  A. Client side attack
  B. Spam
  C. Impersonation attack
  D. Phishing attack
  A. Client side attack

  ---

  In this question, a malicious file is used to attack an application. If the application is running on a client computer, this would be a client side attack. Attacking a service or application on a server would be a server side attack. Client-side attacks target vulnerabilities in client applications interacting with a malicious data. The difference is the client is the one initiating the bad connection. Client-side attacks are becoming more popular. This is because server side attacks are not as easy as they once were according to apache.org. Attackers are finding success going after weaknesses in desktop applications such as browsers, media players, common office applications and e-mail clients. To defend against client-side attacks keep-up the most current application patch levels, keep antivirus software updated and keep authorized software to a minimum. Incorrect Answers: B: Spam is most often considered to be electronic junk mail or junk newsgroup postings. Some people define spam even more generally as any unsolicited email. However, if a long-lost brother finds your email address and sends you a message, this could hardly be called spam, even though it is unsolicited. Real spam is generally email advertising for some product sent to a mailing list or newsgroup. In addition to wasting people's time with unwanted e-mail, spam also eats up a lot of network bandwidth. Consequently, there are many organizations, as well as individuals, who have taken it upon themselves to fight spam with a variety of techniques. But because the Internet is public, there is really little that can be done to prevent spam, just as it is impossible to prevent junk mail. However, some online services have instituted policies to prevent spammers from spamming their subscribers. The attack described in this question is not an example of spam. Therefore, this answer is incorrect. C: Impersonation is where a person, computer, software application or service pretends to be someone it's not. Impersonation is commonly non-maliciously used in client/server applications. However, it can also be used as a security threat. However, the attack described in this question is not an example of impersonation. Therefore, this answer is incorrect. D: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page. Phishing emails are blindly sent to thousands, if not millions of recipients. By spamming large groups of people, the "phisher" counts on the email being read by a percentage of people who actually have an account with the legitimate company being spoofed in the email and corresponding webpage. Phishing, also referred to as brand spoofing or carding, is a variation on "fishing," the idea being that bait is thrown out with the hopes that while most will ignore the bait, some will be tempted into biting. The attack described in this question is not an example of spam. Therefore, this answer is incorrect. References: http://blog.botrevolt.com/what-are-client-side-attacks/ http://www.webopedia.com/TERM/S/spam.html http://www.webopedia.com/TERM/P/phishing.html

• Question 622:

  A cafe provides laptops for Internet access to their customers. The cafe is located in the center corridor of a busy shopping mall. The company has experienced several laptop thefts from the cafe during peak shopping hours of the day.

  Corporate has asked that the IT department provide a solution to eliminate laptop theft.

  Which of the following would provide the IT department with the BEST solution?

  A. Attach cable locks to each laptop
  B. Require each customer to sign an AUP
  C. Install a GPS tracking device onto each laptop
  D. Install security cameras within the perimeter of the caf
  A. Attach cable locks to each laptop

  ---

  All laptop cases include a built-in security slot in which a cable lock can be inserted to prevent it from easily being removed from the premises. Incorrect Answers: B: Acceptable use policies (AUPs) describe how the employees in an organization can use company systems and resources, both software and hardware. This policy should also outline the consequences for misuse. However it does not prevent hardware loss as it does only address issues regarding the use of company resources. C: GPS-Tracking is used for tracking the laptop in the event of it being stolen which means it does not prevent loss. D: All a security camera can do is record what occurs, it cannot react to any incident such as theft. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 24, 113, 369, 419

• Question 623:

  A security manager must remain aware of the security posture of each system. Which of the following supports this requirement?

  A. Training staff on security policies
  B. Establishing baseline reporting
  C. Installing anti-malware software
  D. Disabling unnecessary accounts/services
  B. Establishing baseline reporting

  ---

  The IT baseline protection approach is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. This is known as a baseline. A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline). Incorrect Answers: A: Training staff on security policies is always a good idea. However, this will not provide a mechanism for making the security manager aware of the security posture of each system. C: Anti-malware is required to remove any existing malware and prevent malware being installed in the future. However, anti-malware does not provide a mechanism for making the security manager aware of the security posture of each system. D: Disabling unnecessary accounts/services is a good practice for reducing the attack surface of a computer system. However, it does not provide a mechanism for making the security manager aware of the security posture of each system. References: http://en.wikipedia.org/wiki/IT_baseline_protection

• Question 624:

  Which of the following application attacks is used against a corporate directory service where there are unknown servers on the network?

  A. Rogue access point
  B. Zero day attack
  C. Packet sniffing
  D. LDAP injection
  D. LDAP injection

  ---

  A directory service is accessed by using LDAP (Lightweight Directory Access Protocol). LDAP injection is an attack against a directory service. Just as SQL injection attacks take statements that are input by users and exploit weaknesses within, an LDAP injection attack exploits weaknesses in LDAP (Lightweight Directory Access Protocol) implementations. This can occur when the user's input is not properly filtered, and the result can be executed commands, modified content, or results returned to unauthorized queries. The best way to prevent LDAP injection attacks is to filter the user input and to use a validation scheme to make certain that queries do not contain exploits. One of the most common uses of LDAP is associated with user information. Numerous applications exist--such as employee directories--where users find other users by typing in a portion of their name. These queries are looking at the cn value or other fields (those defined for department, home directory, and so on). Someone attempting LDAP injection could feed unexpected values to the query to see what results are returned. All too often, finding employee information equates to finding usernames and values about those users that could be portions of their passwords. Incorrect Answers: A: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. Rogue access points are not used for application attacks used against a corporate directory service. Therefore this answer is incorrect. B: A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it --this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. A zero day attack is generally not used for application attacks against a corporate directory service. Therefore this answer is incorrect. C: Packet sniffing is the process of intercepting data as it is transmitted over a network. A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn't generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. Packet sniffing is not used for application attacks against a corporate directory service. Therefore this answer is incorrect. References: C Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 336-337 http://en.wikipedia.org/wiki/Rogue_access_point http://www.pctools.com/security-news/zero-day-vulnerability/ http://www.techopedia.com/definition/4113/sniffer

• Question 625:

  Joe, the systems administrator, is setting up a wireless network for his team's laptops only and needs to prevent other employees from accessing it. Which of the following would BEST address this?

  A. Disable default SSID broadcasting.
  B. Use WPA instead of WEP encryption.
  C. Lower the access point's power settings.
  D. Implement MAC filtering on the access point.
  D. Implement MAC filtering on the access point.

  ---

  If MAC filtering is turned off, any wireless client that knows the values looked for (MAC addresses) can join the network. When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so. Incorrect Answers: A: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast. B: WPA offers better protection than WEP, but is not the best solution here. C: On the chance that the signal is actually traveling too far, some access points include power level controls, which allow you to reduce the amount of output provided. However, this would help here. Employees would still be in the range of the access point. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258

• Question 626:

  A security administrator needs to image a large hard drive for forensic analysis. Which of the following will allow for faster imaging to a second hard drive?

  A. cp /dev/sda /dev/sdb bs=8k
  B. tail -f /dev/sda > /dev/sdb bs=8k
  C. dd in=/dev/sda out=/dev/sdb bs=4k
  D. locate /dev/sda /dev/sdb bs=4k
  C. dd in=/dev/sda out=/dev/sdb bs=4k

  ---

  dd is a command-line utility for Unix and Unix-like operating systems whose primary purpose is to convert and copy files. dd can duplicate data across files, devices, partitions and volumes On Unix, device drivers for hardware (such as hard disks) and special device files (such as /dev/zero and /dev/random) appear in the file system just like normal files; dd can also read and/or write from/to these files, provided that function is implemented in their respective driver. As a result, dd can be used for tasks such as backing up the boot sector of a hard drive, and obtaining a fixed amount of random data. The dd program can also perform conversions on the data as it is copied, including byte order swapping and conversion to and from the ASCII and EBCDIC text encodings. An attempt to copy the entire disk using cp may omit the final block if it is of an unexpected length; whereas dd may succeed. The source and destination disks should have the same size. Incorrect Answers: A: Using cp in the command line may omit the final block. B: You must use the dd command. D: You must the the dd command. References: http://www.linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/

• Question 627:

  During the information gathering stage of a deploying role-based access control model, which of the following information is MOST likely required?

  A. Conditional rules under which certain systems may be accessed
  B. Matrix of job titles with required access privileges
  C. Clearance levels of all company personnel
  D. Normal hours of business operation
  B. Matrix of job titles with required access privileges

  ---

  Role-based access control is a model where access to resources is determines by job role rather than by user account. Within an organization, roles are created for various job functions. The permissions to perform certain operations are assigned to specific roles. Members or staff (or other system users) are assigned particular roles, and through those role assignments acquire the computer permissions to perform particular computer- system functions. Since users are not assigned permissions directly, but only acquire them through their role (or roles), management of individual user rights becomes a matter of simply assigning appropriate roles to the user's account; this simplifies common operations, such as adding a user, or changing a user's department. To configure role-based access control, you need a list (or matrix) of job titles (roles) and the access privileges that should be assigned to each role. Incorrect Answers: A: For role-based access control, you don't need conditional rules under which certain systems may be accessed; you just need a list of roles and their associated privileges. C: Clearance levels of all company personnel. Privileges are assigned based on job role rather than directly to individuals. D: The hours of business operation are not required. Business hours are not related to assigning access privileges. References: http://en.wikipedia.org/wiki/Role-based_access_control

• Question 628:

  A security technician is attempting to improve the overall security posture of an internal mail server. Which of the following actions would BEST accomplish this goal?

  A. Monitoring event logs daily
  B. Disabling unnecessary services
  C. Deploying a content filter on the network
  D. Deploy an IDS on the network
  B. Disabling unnecessary services

  ---

  One of the most basic practices for reducing the attack surface of a specific host is to disable unnecessary services. Services running on a host, especially network services provide an avenue through which the system can be attacked. If a service is not being used, disable it. Incorrect Answers: A: Monitoring event logs daily is good practice to view events that have happened. However, it does not improve the security posture of the system. The event logs record things that have happened. They don't prevent things such as an attack from happening. C: Content filtering is the process of inspecting the content of a web page as it is downloaded. The content can then be blocked if it doesn't comply with the company's web policy. Content- control software determines what content will be available or perhaps more often what content will be blocked. Content filtering will not improve the overall security posture of a server. D: An IDS (Intrusion Detection System) is used to detect attempts to access a computer systems on a network. An IDS is a good idea to improve the security posture of the network. However, this question is asking about improving the security posture of a specific computer (the email server). Therefore disabling unnecessary services is a better answer.

• Question 629:

  A system administrator is setting up a file transfer server. The goal is to encrypt the user authentication and the files the user is sending using only a user ID and a key pair. Which of the following methods would achieve this goal?

  A. AES
  B. IPSec
  C. PGP
  D. SSH
  D. SSH

• Question 630:

  An attacker attempted to compromise a web form by inserting the following input into the username field: admin)(|(password=*)) Which of the following types of attacks was attempted?

  A. SQL injection
  B. Cross-site scripting
  C. Command injection
  D. LDAP injection
  D. LDAP injection

  ---

  LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree. The same advanced exploitation techniques available in SQL Injection can be similarly applied in LDAP Injection. In a page with a user search form, the following code is responsible to catch input value and generate a LDAP query that will be used in LDAP database. Insert the username The LDAP query is narrowed down for performance and the underlying code for this function might be the following: String ldapSearchQuery = "(cn=" + $userName + ")"; System.out.println(ldapSearchQuery); If the variable $userName is not validated, it could be possible accomplish LDAP injection, as follows: If a user puts "*" on box search, the system may return all the usernames on the LDAP base If a user puts "jonys) (| (password = * ) )", it will generate the code bellow revealing jonys' password ( cn = jonys ) ( | (password = * ) ) Incorrect Answers: A: SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. The code in this question is not SQL code. Therefore this answer is incorrect. B: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. The code in this question is not an example of cross-site scripting code. Therefore, this answer is incorrect. C: Command injection is an attack method in which a hacker alters dynamically generated content on a Web page by entering HTML code into an input mechanism, such as a form field that lacks effective validation constraints. The code in this question is not HTML code. Therefore this answer is incorrect. References: https://www.owasp.org/index.php/LDAP_injection http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/Cross-site_scripting http://searchsoftwarequality.techtarget.com/definition/command-injection