CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 701:

  All executive officers have changed their monitor location so it cannot be easily viewed when passing by their offices. Which of the following attacks does this action remediate?

  A. Dumpster Diving
  B. Impersonation
  C. Shoulder Surfing
  D. Whaling
  C. Shoulder Surfing

  ---

  Viewing confidential information on someone's monitor is known as shoulder surfing. By moving their monitors so they cannot be seen, the executives are preventing users passing by `shoulder surfing'. Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand. Incorrect Answers: A: Dumpster diving is looking for treasure in someone else's trash. (A dumpster is a large trash container.) In the world of information technology, dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. Seemingly innocent information like a phone list, calendar, or organizational chart can be used to assist an attacker using social engineering techniques to gain access to the network. This is not what is described in this question. Therefore, this answer is incorrect. B: Impersonation is where a person, computer, software application or service pretends to be someone or something it's not. Impersonation is commonly non- maliciously used in client/server applications. However, it can also be used as a security threat. This is not what is described in this question. Therefore, this answer is incorrect. D: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats. This is not what is described in this question. Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/shoulder-surfing http://searchsecurity.techtarget.com/definition/dumpster-diving http://www.techopedia.com/ definition/28643/whaling

• Question 702:

  Which of the following MOST interferes with network-based detection techniques?

  A. Mime-encoding
  B. SSL
  C. FTP
  D. Anonymous email accounts
  B. SSL

  ---

  Secure Sockets Layer (SSL) is used to establish secure TCP communication between two machines by encrypting the communication. Encrypted communications cannot easily be inspected for anomalies by network-based intrusion detection systems (NIDS). Incorrect Answers: A: Multi-Purpose Internet Mail Extensions (MIME) encoding is used in email messages to allow messages to be sent in formats other than ASCII text. Email messages are handles by host based intrusion detection systems (HIDS). C: File Transfer Protocol (FTP) is an inherently insecure protocol that does not use any form of encryption making it easy to inspect for anomalies. D: Email messages are handles by host based intrusion detection systems (HIDS). References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 268 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 8, 12

• Question 703:

  A company requires that a user's credentials include providing something they know and something they are in order to gain access to the network. Which of the following types of authentication is being described?

  A. Biometrics
  B. Kerberos
  C. Token
  D. Two-factor
  D. Two-factor

  ---

  Two-factor authentication is when two different authentication factors are provided for authentication purposes. In this case, "something they know and something they are". Incorrect Answers: A: Biometrics refers to a collection of physical attributes of the human body that can be used for authentication. It is an authentication factor type. Something they are. B: Kerberos is used for the security and protection of authentication credentials. C: Tokens is an authentication factor type. Something they have. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 272, 280, 281, 282.

• Question 704:

  Ann, the software security engineer, works for a major software vendor. Which of the following practices should be implemented to help prevent race conditions, buffer overflows, and other similar vulnerabilities prior to each production release?

  A. Product baseline report
  B. Input validation
  C. Patch regression testing
  D. Code review
  D. Code review

  ---

  The problems listed in this question can be caused by problems with the application code. Reviewing the code will help to prevent the problems. The purpose of code review is to look at all custom written code for holes that may exist. The review needs also to examine changes that the code--most likely in the form of a finished application--may make: configuration files, libraries, and the like. During this examination, look for threats such as opportunities for injection to occur (SQL, LDAP, code, and so on), cross-site request forgery, and authentication. Code review is often conducted as a part of gray box testing. Looking at source code can often be one of the easiest ways to find weaknesses within the application. Simply reading the code is known as manual assessment, whereas using tools to scan the code is known as automated assessment. Incorrect Answers: A: A product baseline report is a report that compares the current state of the product to the original product specification. It is not used to prevent race conditions, buffer overflows, and other similar vulnerabilities in an application. Therefore, this answer is incorrect. B: Input validation can improve application performance by catching malformed input in the application that could cause problems with the output. For example, if a user is expected to enter a number into a field in the application, input validation can be used to ensure that the input is numeric and not text. It can also be used to prevent attacks such as cross-site scripting and SQL injection. It is not used to prevent race conditions, buffer overflows, and other similar vulnerabilities in an application. Therefore, this answer is incorrect. C: Regression testing is a type of software testing that seeks to uncover new software bugs, or regressions, in existing functional and non-functional areas of a system after changes such as enhancements, patches or configuration changes, have been made to them. The intent of regression testing is to ensure that changes such as those mentioned above have not introduced new faults. One of the main reasons for regression testing is to determine whether a change in one part of the software affects other parts of the software. Application patches may be released after the original application has been released. However, a code review should be performed before the application is released in the first place. Therefore, this answer is incorrect. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 345 http://en.wikipedia.org/wiki/Regression_testing

• Question 705:

  An administrator is concerned that a company's web server has not been patched. Which of the following would be the BEST assessment for the administrator to perform?

  A. Vulnerability scan
  B. Risk assessment
  C. Virus scan
  D. Network sniffer
  A. Vulnerability scan

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. Vulnerabilities include computer systems that do not have the latest security patches installed. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise. Incorrect Answers: B: A risk assessment is the process of determining risk. A risk assessment alone would not determine if a web server has been patched. A vulnerability scan should be performed first. The results of the vulnerability scan can then be used in a risk assessment. Therefore, this answer is incorrect. C: A virus scan will scan a computer for known viruses. It is not used to determine if a system has been patched. Therefore, this answer is incorrect. D: A network sniffer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It is not used to determine if a system has been patched. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/V/vulnerability_scanning.html

• Question 706:

  DRAG DROP

  Drag the items on the left to show the different types of security for the shown devices. Not all fields need to be filled. Not all items need to be used.

  Select and Place:

  

  

  ---

  For mobile devices, at bare minimum you should have the following security measures in place:

  Screen lock, Strong password, Device encryption, Remote wipe/Sanitation, voice encryption, GPS tracking, Application control, Storage segmentation, Asset tracking as well as Device Access control.

  For servers in a data center your security should include: Fire extinguishers such as FM200 as part of fire suppression; Biometric, proximity badges, mantraps, HVAC, cable locks; these can all be physical security measures to control access

  to the server.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 418

• Question 707:

  A security architect wishes to implement a wireless network with connectivity to the company's internal network. Before they inform all employees that this network is being put in place, the architect wants to roll it out to a small test segment. Which of the following allows for greater secrecy about this network during this initial phase of implementation?

  A. Disabling SSID broadcasting
  B. Implementing WPA2 - TKIP
  C. Implementing WPA2 - CCMP
  D. Filtering test workstations by MAC address
  A. Disabling SSID broadcasting

  ---

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn't for public use. Incorrect Answers: B: WPA2 makes use of CCMP, not TKIP. C: WPA2 is an encryption scheme, but it will not make discovering the network difficult. D: This will block devices not included in the MAC address list from accessing the network, but it will not make discovering the network difficult. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 60, 61.

• Question 708:

  Which of the following would prevent a user from installing a program on a company-owned mobile device?

  A. White-listing
  B. Access control lists
  C. Geotagging
  D. Remote wipe
  A. White-listing

  ---

  Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list. Incorrect Answers: B: Access Control Lists (ACLs) define the level of access logged on users have to resources. It does not prevent users from installing applications on a device. C: Geo-tagging is the process of embedding the GPS coordinates in image files and images taken using a smartphone or a digital camera. The geotagged information accompanying the image allows anyone to discover the precise location where the image was taken. D: Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 236, 340 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236

• Question 709:

  Sara, the security administrator, must configure the corporate firewall to allow all public IP addresses on the internal interface of the firewall to be translated to one public IP address on the external interface of the same firewall. Which of the following should Sara configure?

  A. PAT
  B. NAP
  C. DNAT
  D. NAC
  A. PAT

  ---

  Port Address Translation (PAT), is an extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be mapped to a single public IP address. The goal of PAT is to conserve IP addresses. Most home networks use PAT. In such a scenario, the Internet Service Provider (ISP) assigns a single IP address to the home network's router. When Computer X logs on the Internet, the router assigns the client a port number, which is appended to the internal IP address. This, in effect, gives Computer X a unique address. If Computer Z logs on the Internet at the same time, the router assigns it the same local IP address with a different port number. Although both computers are sharing the same public IP address and accessing the Internet at the same time, the router knows exactly which computer to send specific packets to because each computer has a unique internal address. Incorrect Answers: B: NAP is a Microsoft technology for controlling network access of a computer host based on system health of the host. C: Destination network address translation (DNAT) is a technique for transparently changing the destination IP address of an end route packet and performing the inverse function for any replies. Any router situated between two endpoints can perform this transformation of the packet. DNAT is commonly used to publish a service located in a private network on a publicly accessible IP address. This use of DNAT is also called port forwarding. DNAT does not allow for many internal devices to share one public IP address. D: NAC is an approach to computer network security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), user or system authentication and network security enforcement. References: http://searchnetworking.techtarget.com/definition/Port-Address-Translation-PAT http://en.wikipedia.org/wiki/Network_Access_Protection http://en.wikipedia.org/wiki/Network_address_translation#DNAT http://en.wikipedia.org/wiki/ Network_Access_Control

• Question 710:

  Which of the following is an example of a false negative?

  A. The IDS does not identify a buffer overflow.
  B. Anti-virus identifies a benign application as malware.
  C. Anti-virus protection interferes with the normal operation of an application.
  D. A user account is locked out after the user mistypes the password too many times.
  A. The IDS does not identify a buffer overflow.

  ---

  With a false negative, you are not alerted to a situation when you should be alerted. Incorrect Answers: B, C, D: This would be an example of a false positive. False positives are essentially events that are mistakenly flagged and are not really events to be concerned about. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 28