CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 641:

  Pete, a security engineer, is trying to inventory all servers in a rack. The engineer launches RDP sessions to five different PCs and notices that the hardware properties are similar. Additionally, the MAC addresses of all five servers appear on the same switch port. Which of the following is MOST likely the cause?

  A. The system is running 802.1x.
  B. The system is using NAC.
  C. The system is in active-standby mode.
  D. The system is virtualized.
  D. The system is virtualized.

  ---

  Virtualization allows a single set of hardware to host multiple virtual machines. Incorrect Answers: A: The IEEE standard 802.1X defines port-based security for wireless network access control. B: Network Access Control (NAC) is as a set of standards defined by the network for clients attempting to access it. C: This allows you to use a standby adaptive security appliance to take over the functionality of a failed unit. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 19, 95, 158.

• Question 642:

  Which of the following is the default port for TFTP?

  A. 20
  B. 69
  C. 21
  D. 68
  B. 69

  ---

  TFTP makes use of UDP port 69. Incorrect Answers: A, C: FTP (File Transfer Protocol) uses ports 20 and 21 D: Port 68 TCP/UDP is used by Bootstrap Protocol (BOOTP) Client; as well Dynamic Host Configuration Protocol (DHCP). References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 51. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 643:

  A company has 5 users. Users 1, 2 and 3 need access to payroll and users 3, 4 and 5 need access to sales. Which of the following should be implemented to give the appropriate access while enforcing least privilege?

  A. Assign individual permissions to users 1 and 2 for payroll. Assign individual permissions to users 4 and 5 for sales. Make user 3 an administrator.
  B. Make all users administrators and then restrict users 1 and 2 from sales. Then restrict users 4 and 5 from payroll.
  C. Create two additional generic accounts, one for payroll and one for sales that users utilize.
  D. Create a sales group with users 3, 4 and 5. Create a payroll group with users 1, 2 and 3.
  D. Create a sales group with users 3, 4 and 5. Create a payroll group with users 1, 2 and 3.

• Question 644:

  Full disk encryption is MOST effective against which of the following threats?

  A. Denial of service by data destruction
  B. Eavesdropping emanations
  C. Malicious code
  D. Theft of hardware
  D. Theft of hardware

  ---

  Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. However, it does not prevent the theft of hardware it only protects data should the device be stolen. Incorrect Answers: A: Denial of Service (DoS) attacks web-based attacks that exploit flaws in the operating system, applications, services, or protocols. These attacks can be mitigated by means of firewalls, routers, and intrusion detection systems (IDSs) that detect DoS traffic, disabling echo replies on external systems, disabling broadcast features on border systems, blocking spoofed packets on the network, and proper patch management. B: Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. It does not prevent eavesdropping. C: Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. IT does not mitigate against malicious code. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 170- 172, 252

• Question 645:

  Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites?

  A. Spam filter
  B. URL filter
  C. Content inspection
  D. Malware inspection
  B. URL filter

• Question 646:

  Which of the following ports should be used by a system administrator to securely manage a remote server?

  A. 22
  B. 69
  C. 137
  D. 445
  A. 22

  ---

  Secure Shell (SSH) is a more secure replacement for Telnet, rlogon, rsh, and rcp. SSH can be called a remote access or remote terminal solution. SSH offers a means by which a command- line, text-only interface connection with a server, router, switch, or similar device can be established over any distance. SSH makes use of TCP port 22. Incorrect Answers: B: Port 69 is used by TFTP. C: NetBIOS uses port 137. D: Port 445 is used by Microsoft-DS. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 51. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 647:

  A security technician is attempting to access a wireless network protected with WEP. The technician does not know any information about the network. Which of the following should the technician do to gather information about the configuration of the wireless network?

  A. Spoof the MAC address of an observed wireless network client
  B. Ping the access point to discover the SSID of the network
  C. Perform a dictionary attack on the access point to enumerate the WEP key
  D. Capture client to access point disassociation packets to replay on the local PC's loopback
  A. Spoof the MAC address of an observed wireless network client

  ---

  With ARP spoofing (also known as ARP poisoning), the MAC (Media Access Control) address of the data is faked. By faking this value, it is possible to make it look as if the data came from a network that it did not. This can be used to gain access to the network, to fool the router into sending data here that was intended for another host, or to launch a DoS attack. In all cases, the address being faked is an address of a legitimate user, and that makes it possible to get around such measures as allow/deny lists. Note: As an example, the initialization vector (IV) that WEP uses for encryption is 24-bit, which is quite weak and means that IVs are reused with the same key. By examining the repeating result, it was easy for attackers to crack the WEP secret key. This is known as an IV attack. Incorrect Answers: B: An SSID would not provide much information about the network. C: A dictionary attack uses a dictionary of common words to attempt to find the user's password. It is not of particular use to gain access to WEP networks. D: In order to do a forged dissociation attack the attacker sends a spoofed Disassociation frame where the source MAC address is set to that of the AP. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 258, 321-322

• Question 648:

  An administrator is looking to implement a security device which will be able to not only detect network intrusions at the organization level, but help defend against them as well. Which of the following is being described here?

  A. NIDS
  B. NIPS
  C. HIPS
  D. HIDS
  B. NIPS

  ---

  Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it Incorrect Answers: A: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks. C: Host-based intrusion prevention system (HIPS) is an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host. D: A host-based IDS (HIDS) watches the audit trails and log files of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. References: http://en.wikipedia.org/wiki/Intrusion_prevention_system Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 21.

• Question 649:

  Pete, the system administrator, wants to restrict access to advertisements, games, and gambling web sites. Which of the following devices would BEST achieve this goal?

  A. Firewall
  B. Switch
  C. URL content filter
  D. Spam filter
  C. URL content filter

  ---

  URL filtering, also known as web filtering, is the act of blocking access to a site based on all or part of the URL used to request access. URL filtering can focus on all or part of a fully qualified domain name (FQDN), specific path names, specific filenames, specific fi le extensions, or entire specific URLs. Many URL-filtering tools can obtain updated master URL block lists from vendors as well as allow administrators to add or remove URLs from a custom list. Incorrect Answers: A: The basic purpose of a firewall is to isolate one network from another. Firewalls are available as appliances, meaning they're installed as the primary device separating two networks. B: Switches are multiport devices that improve network efficiency. D: A spam filter is a software or hardware tool whose primary purpose is to identify and block/filter/remove unwanted messages (that is, spam). References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 18, 19. Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 96, 102.

• Question 650:

  A security researcher wants to reverse engineer an executable file to determine if it is malicious. The file was found on an underused server and appears to contain a zero-day exploit. Which of the following can the researcher do to determine if the file is malicious in nature?

  A. TCP/IP socket design review
  B. Executable code review
  C. OS Baseline comparison
  D. Software architecture review
  C. OS Baseline comparison

  ---

  Zero-Day Exploits begin exploiting holes in any software the very day it is discovered. It is very difficult to respond to a zero-day exploit. Often, the only thing that you as a security administrator can do is to turn off the service. Although this can be a costly undertaking in terms of productivity, it is the only way to keep the network safe. In this case you want to check if the executable file is malicious. Since a baseline represents a secure state is would be possible to check the nature of the executable file in an isolated environment against the OS baseline. Incorrect Answers: A: A socket is a combination of IP address and port number. A TCP/IP socket design review is useful since sockets are the primary method used to communicate with services and applications such as the Web and Telnet. It is not used to check if an underused server may have a zero-day exploitable file. B: Executable code review. Executable scripts often run at elevated permission levels and infect more components in your network. This is best done with the underused server in isolation. The purpose of code review is to look at all custom written code for holes that may exist. The review needs also to examine changes that the code--most likely in the form of a finished application-- may make: configuration files, libraries, and the like. This could be unwise to run if you suspect a zero-day exploit. D: Software architecture review is not the way to check if an existing file on a server is malicious nor not. Comparing the existing files to a baseline would be a better option. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 338, 345-346 http://www.techrepublic.com/blog/software-engineer/reverse-engineering-your-net-applications/