CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 681:

  Ann, the security administrator, received a report from the security technician, that an unauthorized new user account was added to the server over two weeks ago. Which of the following could have mitigated this event?

  A. Routine log audits
  B. Job rotation
  C. Risk likelihood assessment
  D. Separation of duties
  A. Routine log audits

  ---

  When a new user account is created, an entry is added to the Event Logs. By routinely auditing the event logs, you would know that an account has been created. Incorrect Answers: B: Job rotation is a concept that has employees rotating through different jobs to learn the procedures and processes in each. From a security perspective, job rotation helps to prevent or expose dangerous shortcuts or even fraudulent activity. Knowledge is shared with multiple people, and no one person can retain explicit control of any process or data. Job rotation would not mitigate against an unauthorized new user account being created. Therefore, this answer is incorrect. C: Assessing the likelihood of risk may determine the likelihood of an unauthorized new user account being created. However, it would not tell you that an unauthorized account had been created. Therefore, this answer is incorrect. D: Separation of duties is the process of ensuring that functions of a role are carried out by multiple users. This is to prevent fraud and restricts the amount of power held by any one individual. Separation of duties would not mitigate against an unauthorized new user account being created. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Job_rotation

• Question 682:

  Pete, the system administrator, is reviewing his disaster recovery plans. He wishes to limit the downtime in the event of a disaster, but does not have the budget approval to implement or maintain an offsite location that ensures 99.99% availability. Which of the following would be Pete's BEST option?

  A. Use hardware already at an offsite location and configure it to be quickly utilized.
  B. Move the servers and data to another part of the company's main campus from the server room.
  C. Retain data back-ups on the main campus and establish redundant servers in a virtual environment.
  D. Move the data back-ups to the offsite location, but retain the hardware on the main campus for redundancy.
  A. Use hardware already at an offsite location and configure it to be quickly utilized.

  ---

  A warm site provides some of the capabilities of a hot site, but it requires the customer to do more work to become operational. Warm sites provide computer systems and compatible media capabilities. If a warm site is used, administrators and other staff will need to install and configure systems to resume operations. For most organizations, a warm site could be a remote office, a leased facility, or another organization with which yours has a reciprocal agreement. Warm sites may be for your exclusive use, but they don't have to be. A warm site requires more advanced planning, testing, and access to media for system recovery. Warm sites represent a compromise between a hot site, which is very expensive, and a cold site, which isn't preconfigured. Incorrect Answers: B: Moving the servers from the server room is not a viable option. C: The data backups should also be available away from the main campus. D: This will result in just having the data backups and no hardware on which to work not 99.9% availability. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 36

• Question 683:

  A group policy requires users in an organization to use strong passwords that must be changed every 15 days. Joe and Ann were hired 16 days ago. When Joe logs into the network, he is prompted to change his password; when Ann logs into the network, she is not prompted to change her password. Which of the following BEST explains why Ann is not required to change her password?

  A. Ann's user account has administrator privileges.
  B. Joe's user account was not added to the group policy.
  C. Ann's user account was not added to the group policy.
  D. Joe's user account was inadvertently disabled and must be re-created.
  C. Ann's user account was not added to the group policy.

  ---

  Group policy is used to manage Windows systems in a Windows network domain environment by means of a Group Policy Object (GPO). GPO's include a number of settings related to credentials, which includes password expiration. Because Anne was not prompted to change her password, it could only mean that her user account was not added to the group policy. Incorrect Answers: A: Even if Ann's user account has administrator privileges, if it was added to the group policy it would meet the requirements of the group policy. B: If Joe's user account was not added to the group policy, his account would not be required to meet the requirements of the group policy. D: If Joe's user account was inadvertently disabled and must be re-created, he would not be prompted to change his password at logon. References: https://technet.microsoft.com/en-us/library/dn579255.aspx

• Question 684:

  Which of the following mitigation strategies is established to reduce risk when performing updates to business critical systems?

  A. Incident management
  B. Server clustering
  C. Change management
  D. Forensic analysis
  C. Change management

  ---

  Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company's assets. In this case `performing updates to business critical systems. Incorrect Answers: A: Incident management is the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). B: Server clustering is used to provide failover capabilities / redundancy in addition to scalability as demand increases. D: Forensics refers to the process of identifying past events using a data trail and the analysis of evidence found in computers and on digital storage media. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 10

• Question 685:

  Which of the following can be performed when an element of the company policy cannot be enforced by technical means?

  A. Develop a set of standards
  B. Separation of duties
  C. Develop a privacy policy
  D. User training
  D. User training

  ---

  User training is an important aspect of maintaining safety and security. It helps improve users' security awareness in terms of prevention, enforcement, and threats. It is of critical importance when element of the company policy cannot be enforced by technical means. Incorrect Answers: A: Standards are derived from policies and should provide the detail required to audit a system and ensure that the standard is being met. It does no help enforce a policy. B: Separation of duties is the division of administrative tasks and their assignment to different administrators. This ensures that no one user has complete access or power over an entire network, server, or system. The separation of duties can be enforced by technical means. C: Privacy policy describes the controls required to maintain data privacy within a system. This is an example of a policy, it does not help enforce a policy. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 21, 24, 153, 399-402 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 82,

• Question 686:

  A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs:

  10.10.3.16

  10.10.3.23

  212.178.24.26

  217.24.94.83

  These attempts are overloading the server to the point that it cannot respond to traffic. Which of the following attacks is occurring?

  A. XSS
  B. DDoS
  C. DoS
  D. Xmas
  B. DDoS

  ---

  A Distributed Denial of Service (DDoS) attack is an attack from several different computers targeting a single computer. One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such attacks usually lead to a server overload. A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This after all will end up completely crashing a website for periods of time. Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack. Incorrect Answers: A: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. This is not what is described in the question. Therefore, this answer is incorrect. C: The question states that the source of the traffic is multiple IP addresses. Therefore, this is a DDoS (Distributed Denial of Service) attack. A DoS (Denial of Service) attack comes from a single IP address. Therefore, this answer is incorrect. D: Some stateless firewalls only check against security policy those packets which have the SYN flag set (that is, packets that initiate connection according to the standards). Since Christmas tree scan packets do not have the SYN flag turned on, they can pass through these simple systems and reach the target host. A large number of Christmas tree packets can also be used to conduct a DoS attack by exploiting the fact that Christmas tree packets require much more processing by routers and end-hosts than the 'usual' packets do. This is not what is described in the question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Denial-of-service_attack http://www.answers.com/Q/What_is_an_XMAS_attack_on_a_computer http://en.wikipedia.org/wiki/Cross-site_scripting

• Question 687:

  A systems engineer has been presented with storage performance and redundancy requirements for a new system to be built for the company. The storage solution must be designed to support the highest performance and must also be able to support more than one drive failure. Which of the following should the engineer choose to meet these requirements?

  A. A mirrored striped array with parity
  B. A mirrored mirror array
  C. A striped array
  D. A striped array with parity
  B. A mirrored mirror array

• Question 688:

  Which of the following wireless protocols could be vulnerable to a brute-force password attack? (Select TWO).

  A. WPA2-PSK
  B. WPA - EAP - TLS
  C. WPA2-CCMP
  D. WPA -CCMP
  E. WPA - LEAP
  F. WEP
  A. WPA2-PSK
  E. WPA - LEAP

  ---

  A brute force attack is an attack that attempts to guess a password. WPA2-PSK and WEP both use a "Pre-Shared Key". The pre-shared key is a password and therefore is susceptible to a brute force attack. Incorrect Answers: B: EAP-TLS uses the handshake protocol in TLS, not its encryption method. Client and server authenticate each other using digital certificates. Client generates a pre-master secret key by encrypting a random number with the server's public key and sends it to the server. Both client and server use the pre-master to generate the same secret key. WPA using EAP-TLS does not use a password or pre-shared key so it is not susceptible to a brute force attack. Therefore, this answer is incorrect. C: Counter Mode Cipher Block Chaining Message Authentication Code Protocol, Counter Mode CBC-MAC Protocol or simply CCMP (CCM mode Protocol) is an encryption protocol. CCMP is an enhanced data cryptographic encapsulation mechanism designed for data confidentiality and based upon the Counter Mode with CBC-MAC (CCM) of the AES standard. The advanced encryption of CCMP ensures that WPA2 with CCMP is not susceptible to a brute force attack. Therefore, this answer is incorrect. D: Counter Mode Cipher Block Chaining Message Authentication Code Protocol, Counter Mode CBC-MAC Protocol or simply CCMP (CCM mode Protocol) is an encryption protocol. CCMP is an enhanced data cryptographic encapsulation mechanism designed for data confidentiality and based upon the Counter Mode with CBC-MAC (CCM) of the AES standard. The advanced encryption of CCMP ensures that WPA2 with CCMP is not susceptible to a brute force attack. Therefore, this answer is incorrect. E: LEAP (Lightweight Extensible Authentication Protocol) requires frequent re-authentication using different keys. The frequent changing of the key makes WPA with LEAP less susceptible to a brute force attack. Therefore, this answer is incorrect References: http://encyclopedia2.thefreedictionary.com/EAP-TLS

• Question 689:

  Which of the following is an authentication service that uses UDP as a transport medium?

  A. TACACS+
  B. LDAP
  C. Kerberos
  D. RADIUS
  D. RADIUS

  ---

  RADIUS runs in the application layer and makes use of UDP as transport. Incorrect Answers: A: TACACS+ makes use of TCP. B: LDAP makes use of TCP. C: Kerberos Makes use of both UDP and TCP. References: http://en.wikipedia.org/wiki/RADIUS http://en.wikipedia.org/wiki/TACACS Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 273. https://tools.ietf.org/html/rfc6251

• Question 690:

  Which of the following application attacks is used to gain access to SEH?

  A. Cookie stealing
  B. Buffer overflow
  C. Directory traversal
  D. XML injection
  B. Buffer overflow

  ---

  Buffer overflow protection is used to detect the most common buffer overflows by checking that the stack has not been altered when a function returns. If it has been altered, the program exits with a segmentation fault. Microsoft's implementation of Data Execution Prevention (DEP) mode explicitly protects the pointer to the Structured Exception Handler (SEH) from being overwritten. A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability. Incorrect Answers: A: In computer science, session hijacking, sometimes also known as cookie hijacking or cookie stealing is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. This type of attack is not used to gain access to the Structured Exception Handler (SEH). Therefore, this answer is incorrect. C: Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server. Although some educated guesswork is involved in finding paths to restricted files on a Web server, a skilled hacker can easily carry out this type of attack on an inadequately protected server by searching through the directory tree. The risk of such attacks can be minimized by careful Web server programming, the installation of software updates and patches, filtering of input from browsers, and the use of vulnerability scanners. This type of attack is not used to gain access to the Structured Exception Handler (SEH). Therefore, this answer is incorrect. D: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. This type of attack is not used to gain access to the Structured Exception Handler (SEH). Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/buffer-overflow http://en.wikipedia.org/wiki/Session_hijacking http://searchsecurity.techtarget.com/definition/directory-traversal Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337