CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 691:

  In the case of a major outage or business interruption, the security office has documented the expected loss of earnings, potential fines and potential consequence to customer service. Which of the following would include the MOST detail on these objectives?

  A. Business Impact Analysis
  B. IT Contingency Plan
  C. Disaster Recovery Plan
  D. Continuity of Operations
  A. Business Impact Analysis

  ---

  Business impact analysis (BIA) is the process of evaluating all of the critical systems in an organization to define impact and recovery plans. BIA isn't concerned with external threats or vulnerabilities; the analysis focuses on the impact a loss would have on the organization. A BIA comprises the following: identifying critical functions, prioritizing critical business functions, calculating a timeframe for critical systems loss, and estimating the tangible impact on the organization. Incorrect Answers: B: IT Contingency plan is usually part of the disaster recovery plan. C: Disaster recovery plan usually deals with site relocation in the event of an emergency, natural disaster, or service outage. D: Continuity of operation plan refers to policies, processes and methods that an organization has to follow to minimize the impact of failure of the key components needed for operations. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 29, 432

• Question 692:

  Jane, the security administrator, sets up a new AP but realizes too many outsiders are able to connect to that AP and gain unauthorized access. Which of the following would be the BEST way to mitigate this issue and still provide coverage where needed? (Select TWO).

  A. Disable the wired ports
  B. Use channels 1, 4 and 7 only
  C. Enable MAC filtering
  D. Disable SSID broadcast
  E. Switch from 802.11a to 802.11b
  C. Enable MAC filtering
  D. Disable SSID broadcast

  ---

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn't for public use. A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a WAP to block access to all unauthorized devices. Incorrect Answers: A: Disabling the wired ports will not prevent outsiders from connecting to the AP and gaining unauthorized access. B: Selecting the correct channels will prevent interference, not unauthorized access. E: Doing this will decrease the bandwidth and increase the risk of interference. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 61. https://technet.microsoft.com/en-us/library/cc783011(v=ws.10).aspx

• Question 693:

  A security administrator implements access controls based on the security classification of the data and need-to-know information. Which of the following BEST describes this level of access control?

  A. Implicit deny
  B. Role-based Access Control
  C. Mandatory Access Controls
  D. Least privilege
  C. Mandatory Access Controls

  ---

  Mandatory Access Control allows access to be granted or restricted based on the rules of classification. MAC also includes the use of need to know. Need to know is a security restriction where some objects are restricted unless the subject has a need to know them. Incorrect Answers: A: Implicit deny says that if you aren't explicitly granted access or privileges for a resource, you're denied access by default. B: Basically, Role-based Access Control is based on a user's job description. It does not include the use of need to know. D: Least privilege states that users should only be granted the minimum necessary access, permissions, and privileges that are required for them to accomplish their work tasks. It does not include the use of need to know. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 278- 284.

• Question 694:

  Used in conjunction, which of the following are PII? (Select TWO).

  A. Marital status
  B. Favorite movie
  C. Pet's name
  D. Birthday
  E. Full name
  D. Birthday
  E. Full name

  ---

  Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. A birthday together with a full name makes it personally identifiable information. Incorrect Answers: A: Marital status can be shared and thus is not personally identifiable information. B: Many people can share a like for the same movie. C: Pet's name is not personally identifiable information. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 404

• Question 695:

  Which of the following devices would be MOST useful to ensure availability when there are a large number of requests to a certain website?

  A. Protocol analyzer
  B. Load balancer
  C. VPN concentrator
  D. Web security gateway
  B. Load balancer

  ---

  Load balancing refers to shifting a load from one device to another. A load balancer can be implemented as a software or hardware solution, and it is usually associated with a device--a router, a firewall, NAT appliance, and so on. In its most common implementation, a load balancer splits the traffic intended for a website into individual requests that are then rotated to redundant servers as they become available. Incorrect Answers: A: The terms protocol analyzing and packet sniffing are interchangeable. They refer to the process of monitoring the data that is transmitted across a network. C: A VPN concentrator is a hardware device used to create remote access VPNs. The concentrator creates encrypted tunnel sessions between hosts, and many use two-factor authentication for additional security. D: One of the newest buzzwords is web security gateway, which can be thought of as a proxy server (performing proxy and caching functions) with web protection software built in. Depending on the vendor, the "web protection" can range from a standard virus scanner on incoming packets to monitoring outgoing user traffic for red flags as well. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 103, 104, 118.

• Question 696:

  Which of the following is a security benefit of providing additional HVAC capacity or increased tonnage in a datacenter?

  A. Increased availability of network services due to higher throughput
  B. Longer MTBF of hardware due to lower operating temperatures
  C. Higher data integrity due to more efficient SSD cooling
  D. Longer UPS run time due to increased airflow
  B. Longer MTBF of hardware due to lower operating temperatures

  ---

  The mean time between failures (MTBF) is the measure of the anticipated incidence of failure for a system or component. This measurement determines the component's anticipated lifetime. If the MTBF of a cooling system is one year, you can anticipate that the system will last for a one-year period; this means that you should be prepared to replace or rebuild the system once a year. If the system lasts longer than the MTBF, your organization receives a bonus. MTBF is helpful in evaluating a system's reliability and life expectancy. Thus longer MTBF due to lower operating temperatures is a definite advantage Incorrect Answers: A: Availability means simply to make sure that the data and systems are available for authorized users. Data backups, redundant systems, and disaster recovery plans all support availability. C: Data integrity refers to keeping data unaltered. D: Longer UPS will allow you to continue to function in the absence of power and provide time to shut down gracefully in the event of power failures. It is thus a business continuity benefit. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 378, 456

• Question 697:

  A company's employees were victims of a spear phishing campaign impersonating the CEO. The company would now like to implement a solution to improve the overall security posture by assuring their employees that email originated from the CEO. Which of the following controls could they implement to BEST meet this goal?

  A. Spam filter
  B. Digital signatures
  C. Antivirus software
  D. Digital certificates
  B. Digital signatures

  ---

  A digital signature is a mathematical technique used to validate the authenticity and integrity of a message, software, or digital document. The digital equivalent of a handwritten signature or stamped seal, but offering far more inherent security, a digital signature is intended to solve the problem of tampering and impersonation in digital communications. Digital signatures can provide the added assurances of evidence to origin, identity and status of an electronic document, transaction or message, as well as acknowledging informed consent by the signer. Digital signatures are based on public key cryptography, also known as asymmetric cryptography. Using a public key algorithm such as RSA, one can generate two keys that are mathematically linked: one private and one public. To create a digital signature, signing software (such as an email program) creates a one-way hash of the electronic data to be signed. The private key is then used to encrypt the hash. The encrypted hash -- along with other information, such as the hashing algorithm -- is the digital signature. The reason for encrypting the hash instead of the entire message or document is that a hash function can convert an arbitrary input into a fixed length value, which is usually much shorter. This saves time since hashing is much faster than signing. Incorrect Answers: A: A spam filter is used to detect and block spam email. All inbound (and sometimes outbound) email is passed through the spam filter to detect spam emails. The spam emails are then discarded or tagged as potential spam according to the spam filter configuration. A spam filter is not used to guarantee the integrity of an email. C: Anti-virus software is software installed on a computer to protect against viruses. An anti- virus program will scan files on the hard drive and scan files as they are accessed to see if the files contain a potential threat. Anti-virus software is not used to guarantee the integrity of an email. D: In cryptography, a digital certificate is an electronic document that uses a digital signature to bind together a public key with an identity for example, the name of an organization, etc. The certificate is used to confirm that a public key belongs to a specific organization. Digital certificates are used to verify the trustworthiness of a website, while digital signatures are used to verify the trustworthiness of information. In the case of digital certificates, an organization may only trust a site if the digital certificates are issued by the organization itself or by a trusted certification source, like Verisign Inc. But, this doesn't necessarily mean that the content of the site can be trusted; a trusted site may be infiltrated by a hacker who modifies the site's content. References: http://searchsecurity.techtarget.com/definition/digital-signature http://searchsecurity.techtarget.com/answer/The-difference-between-a-digital-signature-and- digital- certificate

• Question 698:

  Which of the following should Jane, a security administrator, perform before a hard drive is analyzed with forensics tools?

  A. Identify user habits
  B. Disconnect system from network
  C. Capture system image
  D. Interview witnesses
  C. Capture system image

  ---

  Capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it. Very much as helpful in same way that a virus sample is kept in laboratories to study later after a breakout. Also you should act in the order of volatility which states that the system image capture is first on the list of a forensic analysis. Incorrect Answers: A: User habits involves password behavior, data handling, clean desk issues, tail gating and personally owned devices that they bring to the workplace. Not useful to analyze a hard drive with forensic tools. B: Disconnecting the system from the network will change the state that the hard drive is in at present and as such disconnecting will defeat the purpose of the analysis with forensic tools. D: Interviewing witnesses would be the users and not the hard drive which is to be forensically analyzed. Though important, it just refers to the fact that the sooner you learn about what happened from witnesses the better since over time, details and reflections can change and you would want to collect their thoughts before such changes occur. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 453-454

• Question 699:

  Pete, an employee, attempts to visit a popular social networking site but is blocked. Instead, a page is displayed notifying him that this site cannot be visited. Which of the following is MOST likely blocking Pete's access to this site?

  A. Internet content filter
  B. Firewall
  C. Proxy server
  D. Protocol analyzer
  A. Internet content filter

  ---

  Web filtering software is designed to restrict or control the content a reader is authorised to access, especially when utilised to restrict material delivered over the Internet via the Web, e- mail, or other means. Incorrect Answers: B: The basic purpose of a firewall is to isolate one network from another. C: A proxy server is a variation of an application firewall or circuit-level firewall, and used as a middleman between clients and servers. Often a proxy serves as a barrier against external threats to internal clients. D: The terms protocol analyzer and packet sniffer are interchangeable. They refer to the tools used in the process of monitoring the data that is transmitted across a network. References: http://en.wikipedia.org/wiki/Content-control_software Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 11, 96, 342.

• Question 700:

  A company wants to ensure that all aspects if data are protected when sending to other sites within the enterprise. Which of the following would ensure some type of encryption is performed while data is in transit?

  A. SSH
  B. SHA1
  C. TPM
  D. MD5
  C. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: A: Secure Shell (SSH) is a tunneling protocol that uses encryption to establish a secure shell connection to a remote system. This allows a user to run commands on the remote machine without being physically present at the machine. B: SHA-1 is a version of Secure Hash Algorithm (SHA) and is a 160-bit (20-byte) hash algorithm that can be used for hashing. Hashing is not an encryption algorithm but the hash can be used to verify that the data has not been altered. Cryptographic weaknesses were discovered in SHA-1 in 2005. D: Message Digest 5 (MD5) is a 128-bit hash algorithm that can be used for hashing. Hashing is not an encryption algorithm but the hash can be used to verify that the data has not been altered. This, however, is only one aspect of data protection. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 237, 271, 315-316 http://en.wikipedia.org/wiki/SHA-1