CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 671:

  A Chief Information Security Officer (CISO) wants to implement two-factor authentication within the company. Which of the following would fulfill the CISO's requirements?

  A. Username and password
  B. Retina scan and fingerprint scan
  C. USB token and PIN
  D. Proximity badge and token
  C. USB token and PIN

  ---

  Multi-factor authentication (MFA) is a method of computer access control which a user can pass by successfully presenting authentication factors from at least two of the three categories: knowledge factors ("things only the user knows"), such as passwords possession factors ("things only the user has"), such as ATM cards inherence factors ("things only the user is"), such as biometrics In this question, a USB token is a possession factor (something the user has) and a PIN is a knowledge factor (something the user knows). Incorrect Answers: A: A username and password are both knowledge factors (something the user knows). Therefore, this answer only provides single-factor authentication. B: A retina scan and fingerprint scan are both inherence factors (something only that user has). Therefore, this answer only provides single-factor authentication. D: A proximity badge and token are both possession factors (something the user has). Therefore, this answer only provides single-factor authentication. References: http://en.wikipedia.org/wiki/Multi-factor_authentication

• Question 672:

  The security administrator is currently unaware of an incident that occurred a week ago. Which of the following will ensure the administrator is notified in a timely manner in the future?

  A. User permissions reviews
  B. Incident response team
  C. Change management
  D. Routine auditing
  D. Routine auditing

  ---

  Routine audits are carried out after you have implemented security controls based on risk. These audits include aspects such as user rights and permissions and specific events. Incorrect Answers: A: User permissions reviews should form part of routine auditing and refers to specific type of incident. In this case the security administrator wants to be notified of any type of incident in a timeous manner in future. B: AN incident response team that can be tossed together to respond to an incident and this happens after the incident happened to that they may deal with the situation. In this case the administrator wants to be notified in a timeous manner in future. C: Change management is the structured approach that should be in place to secure the company's assets. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 28, 446

• Question 673:

  Which of the following is true about the CRL?

  A. It should be kept public
  B. It signs other keys
  C. It must be kept secret
  D. It must be encrypted
  A. It should be kept public

  ---

  The CRL must be public so that it can be known which keys and certificates have been revoked. In the operation of some cryptosystems, usually public key infrastructures (PKIs), a certificate revocation list (CRL) is a list of certificates (or more specifically, a list of serial numbers for certificates) that have been revoked, and therefore, entities presenting those (revoked) certificates should no longer be trusted. Incorrect Answers: B: A CRL is a database of revoked keys and signatures. It does not sign other keys. C: Keeping the CRL secret would be against the purpose of the CRL, which is to provide information regarding revoked keys and certificates. D: The CRL must be readily available so it should not be encrypted. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285, 285

• Question 674:

  An organization recently switched from a cloud-based email solution to an in-house email server. The firewall needs to be modified to allow for sending and receiving email. Which of the following ports should be open on the firewall to allow for email traffic? (Select THREE).

  A. TCP 22
  B. TCP 23
  C. TCP 25
  D. TCP 53
  E. TCP 110
  F. TCP 143
  G. TCP 445
  C. TCP 25
  E. TCP 110
  F. TCP 143

• Question 675:

  The security administrator at ABC company received the following log information from an external party:

  10:45:01 EST, SRC 10.4.3.7:3056, DST 8.4.2.1:80, ALERT, Directory traversal

  10:45:02 EST, SRC 10.4.3.7:3057, DST 8.4.2.1:80, ALERT, Account brute force

  10:45:03 EST, SRC 10.4.3.7:3058, DST 8.4.2.1:80, ALERT, Port scan

  The external party is reporting attacks coming from abc-company.com. Which of the following is the reason the ABC company's security administrator is unable to determine the origin of the attack?

  A. A NIDS was used in place of a NIPS.
  B. The log is not in UTC.
  C. The external party uses a firewall.
  D. ABC company uses PAT.
  D. ABC company uses PAT.

  ---

  PAT would ensure that computers on ABC's LAN translate to the same IP address, but with a different port number assignment. The log information shows the IP address, not the port number, making it impossible to pin point the exact source. Incorrect Answers: A: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks. This will not have any bearing on the security administrator at ABC Company finding the root of the attack. B: UTC is the abbreviation for Coordinated Universal Time, which is the primary time standard by which the world regulates clocks and time. The time in the log is not the issue in this case. C: Whether the external party uses a firewall or not will not have any bearing on the security administrator at ABC Company finding the root of the attack. References: http://www.webopedia.com/TERM/P/PAT.html http://en.wikipedia.org/wiki/Intrusion_prevention_system http://en.wikipedia.org/wiki/Coordinated_Universal_Time

• Question 676:

  A software development company wants to implement a digital rights management solution to protect its intellectual property. Which of the following should the company implement to enforce software digital rights?

  A. Transport encryption
  B. IPsec
  C. Non-repudiation
  D. Public key infrastructure
  D. Public key infrastructure

  ---

  The Public-Key Infrastructure (PKI) is intended to offer a means of providing security to messages and transactions on a grand scale. The need for universal systems to support e- commerce, secure transactions, and information privacy is one aspect of the issues being addressed with PKI. A PKI can be used to protect software. Incorrect Answers: A: Transport encryption would protect data that is sent between two entities. It would not be able to protect use of software. B: IPSec protect data that is sent between two entities through encryption. It would not be able to protect use of software. C: Nonrepudiation is a means of ensuring that transferred data is valid. Nonrepudiation is not a way to protect software. Nonrepudiation means to ensure that a transferred message has been sent and received by the parties claiming to have sent and received the message. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 249, 262, 274-275, 279-285

• Question 677:

  After a number of highly publicized and embarrassing customer data leaks as a result of social engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will reduce the risk of another data leak. Which of the following would be MOST effective in reducing data leaks in this situation?

  A. Information Security Awareness
  B. Social Media and BYOD
  C. Data Handling and Disposal
  D. Acceptable Use of IT Systems
  A. Information Security Awareness

  ---

  Education and training with regard to Information Security Awareness will reduce the risk of data leaks and as such forms an integral part of Security Awareness. By employing social engineering data can be leaked by employees and only when company users are made aware of the methods of social engineering via Information Security Awareness Training, you can reduce the risk of data leaks. Incorrect Answers: B: Attackers can solicit information/data from the company over instant messaging (IM) which is social media as easily as they can over email, and this can occur in Facebook, MySpace, or anywhere else that IM is possible. As far as employees bringing their own devices is concerned: it can connect to the company's Wi Fi network. C: Data handling and disposal refers to the access of data to those users that need to access it and not more and how YOU as the CIO handle the disposal of that data, it does not involve training users. D: Acceptable use of IT systems refers to the usage of computers within the organization, not the leaking of data prevention. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 364-369, 399-404, 408, 420, 422 http://en.wikipedia.org/wiki/Security_awareness

• Question 678:

  Which of the following secure file transfer methods uses port 22 by default?

  A. FTPS
  B. SFTP
  C. SSL
  D. S/MIME
  B. SFTP

  ---

  SSH uses TCP port 22. All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22. Incorrect Answers: A: FTPS uses ports 989 and 990. C: SSL operates over TCP port 443. D: S/MIME is an Internet standard for encrypting and digitally signing e-mail. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 45, 51, 313.

• Question 679:

  An internal auditing team would like to strengthen the password policy to support special characters. Which of the following types of password controls would achieve this goal?

  A. Add reverse encryption
  B. Password complexity
  C. Increase password length
  D. Allow single sign on
  B. Password complexity

  ---

  Generally, the minimum password length is considered to be 8 upper and lowercase characters. The use of at least one non-alpha character like punctuation, special characters, or numbers, combined with the password length produces strong passwords. Strong passwords are produced by the combination of a password's length and complexity. Incorrect Answers: A: Typical protocol components, like encryption and hash functions, can be reverse-engineered automatically by tracing the execution of protocol implementations and trying to identify buffers in memory holding unencrypted packets. It will not strengthen the password policy to support special characters. C: Increasing the password length will not necessarily support special characters. D: Single sign-on means that once a user (or other subject) is authenticated into a realm, they need not re-authenticate to access resources on any realm entity. It will not strengthen the password policy to support special characters. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 284, 292, 293. http://en.wikipedia.org/wiki/Reverse_engineering

• Question 680:

  A security analyst performs the following activities: monitors security logs, installs surveillance cameras and analyzes trend reports. Which of the following job responsibilities is the analyst performing? (Select TWO).

  A. Detect security incidents
  B. Reduce attack surface of systems
  C. Implement monitoring controls
  D. Hardening network devices
  E. Prevent unauthorized access
  A. Detect security incidents
  C. Implement monitoring controls