CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 721:

  A firewall technician has been instructed to disable all non-secure ports on a corporate firewall. The technician has blocked traffic on port 21, 69, 80, and 137-139. The technician has allowed traffic on ports 22 and 443. Which of the following correctly lists the protocols blocked and allowed?

  A. Blocked: TFTP, HTTP, NetBIOS; Allowed: HTTPS, FTP
  B. Blocked: FTP, TFTP, HTTP, NetBIOS; Allowed: SFTP, SSH, SCP, HTTPS
  C. Blocked: SFTP, TFTP, HTTP, NetBIOS; Allowed: SSH, SCP, HTTPS
  D. Blocked: FTP, HTTP, HTTPS; Allowed: SFTP, SSH, SCP, NetBIOS
  B. Blocked: FTP, TFTP, HTTP, NetBIOS; Allowed: SFTP, SSH, SCP, HTTPS

  ---

  The question states that traffic on port 21, 69, 80, and 137-139 is blocked, while ports 22 and 443 are allowed. Port 21 is used for FTP by default. Port 69 is used for TFTP. Port 80 is used for HTTP. Ports 137-139 are used for NetBIOS. VMM uses SFTP over default port 22. Port 22 is used for SSH by default. SCP runs over TCP port 22 by default. Port 443 is used for HTTPS. Incorrect Answers: A: FTP uses port 21, which is blocked. C: SFTP uses port 22, which is allowed. D: HTTPS uses port 443, which is allowed. NetBIOS uses ports 137-139, which is blocked. References: https://technet.microsoft.com/en-us/library/dd548299.aspx https://technet.microsoft.com/en-us/library/hh545212(v=sc.20).aspx https://technet.microsoft.com/en-us/ library/dd425238(v=office.13).aspx https://technet.microsoft.com/en-us/library/ hh427328.aspx

• Question 722:

  Encryption of data at rest is important for sensitive information because of which of the following?

  A. Facilitates tier 2 support, by preventing users from changing the OS
  B. Renders the recovery of data harder in the event of user password loss
  C. Allows the remote removal of data following eDiscovery requests
  D. Prevents data from being accessed following theft of physical equipment
  D. Prevents data from being accessed following theft of physical equipment

  ---

  Data encryption allows data that has been stolen to remain out of the eyes of the intruders who took it as long as they do not have the proper passwords. Incorrect Answers: A: Data at rest means just that that user cannot use it at the moment, let alone change the OS. B: Data Recovery capabilities are taken into account when backup plans are made/ part of disaster recovery plan. C: Remote removal of data would not be a concern; rather the main concern should be the risk of theft. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 290

• Question 723:

  While securing a network it is decided to allow active FTP connections into the network. Which of the following ports MUST be configured to allow active FTP connections? (Select TWO).

  A. 20
  B. 21
  C. 22
  D. 68
  E. 69
  A. 20
  B. 21

• Question 724:

  Which of the following should be done before resetting a user's password due to expiration?

  A. Verify the user's domain membership.
  B. Verify the user's identity.
  C. Advise the user of new policies.
  D. Verify the proper group membership.
  B. Verify the user's identity.

  ---

  When resetting a password, users have to establish their identity by answering a series of personal questions, using a hardware authentication token, or responding to a password notification e-mail. Users can then either specify a new, unlocked password, or ask that a randomly generated one be provided. This can be done from their workstation login prompt, or through a telephone call. Incorrect Answers: A, D: Domain membership and group membership depend on the user's identity. Therefore, there identity has to be verified. C: Advising the user of new policies will not help reset their password. Their identity will though. References: http://en.wikipedia.org/wiki/Self-service_password_reset

• Question 725:

  An organization does not have adequate resources to administer its large infrastructure. A security administrator wishes to integrate the security controls of some of the network devices in the organization. Which of the following methods would BEST accomplish this goal?

  A. Unified Threat Management
  B. Virtual Private Network
  C. Single sign on
  D. Role-based management
  A. Unified Threat Management

  ---

  Unified Threat Management (UTM) is, basically, the combination of a firewall with other abilities. These abilities include intrusion prevention, antivirus, content filtering, etc. Advantages of combining everything into one: You only have one product to learn. You only have to deal with a single vendor. IT provides reduced complexity. Incorrect Answers: B: Virtual Private Networks are for connecting LANs together across the Internet or other public networks. C: Single sign on allows users to access all of the resources on the network and browse multiple directories once they have been authenticated. D: Role-based management governs access based on a user' References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 103, 119, 149, 152.

• Question 726:

  Which of the following protocols is vulnerable to man-in-the-middle attacks by NOT using end to end TLS encryption?

  A. HTTPS
  B. WEP
  C. WPA
  D. WPA 2
  B. WEP

  ---

  WEP offers no end-to-end TLS encryption. The WEP process consists of a series of steps as follows: The wireless client sends an authentication request. The Access Point (AP) sends an authentication response containing clear-text (uh-oh!) challenge text. The client takes the challenge text received and encrypts it using a static WEP key. The client sends the encrypted authentication packet to the AP. The AP encrypts the challenge text using its own static WEP key and compares the result to the authentication packet sent by the client. If the results match, the AP begins the association process for the wireless client. The big issue with WEP is the fact that it is very susceptible to a Man in the Middle attack. The attacker captures the clear-text challenge and then the authentication packet reply. The attacker then reverses the RC4 encryption in order to derive the static WEP key. Yikes! As you might guess, the designers attempted to strengthen WEP using the approach of key lengths. The native Windows client supported a 104-bit key as opposed to the initial 40-bit key. The fundamental weaknesses in the WEP process still remained however. Incorrect Answers: A: HTTPS (HTTP over SSL or HTTP Secure) is the use of Secure Socket Layer (SSL) or Transport Layer Security (TLS) as a sublayer under regular HTTP application layering. HTTPS encrypts and decrypts user page requests as well as the pages that are returned by the Web server. The use of HTTPS protects against eavesdropping and man-in-the-middle attacks. Therefore, this answer is incorrect. C: WPA (WiFi Protected Access) is the new security standard adopted by the WiFi Alliance consortium. WiFi compliance ensures interoperability between different manufacturer's wireless equipment. WPA is a much improved encryption standard that delivers a level of security beyond anything that WEP can offer. It bridges the gap between WEP and 802.11i (WPA2) networks. WPA uses Temporal Key Integrity Protocol (TKIP), which is designed to allow WEP to be upgraded through corrective measures that address the existing security problems. WPA is able to achieve over 500 trillion possible key combinations and re-keying of global encryption keys is required. The encryption key is changed after every frame using TKIP. This allows key changes to occur on a frame by frame basis and to be automatically synchronized between the access point and the wireless client. The TKIP encryption algorithm is stronger than the one used by WEP. WPA is compatible with many older access points and network cards. WPA uses TKIP to provide TLS encryption. Therefore, this answer is incorrect. D: WPA2 is the latest implementation of WPA and provides stronger data protection and network access control. It provides WiFi users with a higher level of assurance that only authorized users can access their wireless networks. WPA2 is based on the IEEE 802.11i standard and provides government grade security. 802.11i describes the encrypted transmission of data between systems of 802.11a and 802.11b wireless LANs. It defines new encryption key protocols including the Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES). WPA2 uses TKIP or AES to provide TLS encryption. Therefore, this answer is incorrect. References: http://blog.ine.com/2010/10/16/wlan-security-wep/ http://searchsoftwarequality.techtarget.com/definition/HTTPS http://www.onlinecomputertips.com/networking/wep_wpa.html

• Question 727:

  Which of the following is the primary security concern when deploying a mobile device on a network?

  A. Strong authentication
  B. Interoperability
  C. Data security
  D. Cloud storage technique
  C. Data security

  ---

  Mobile devices, such as laptops, tablet computers, and smartphones, provide security challenges above those of desktop workstations, servers, and such in that they leave the office and this increases the odds of their theft which makes data security a real concern. At a bare minimum, the following security measures should be in place on mobile devices: Screen lock, Strong password, Device encryption, Remote Wipe or Sanitation, voice encryption, GPS tracking, Application control, storage segmentation, asses tracking and device access control. Incorrect Answers: A: Strong authentication is a risk avoidance technique and as such is not a security concern with mobile devices. B: Mobile devices are designed to be interoperable with networks, etc. D: Cloud storage is not a primary security concern regarding mobile devices. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 419 http://searchmobilecomputing.techtarget.com/guides/Mobile-device-protection-and-security- threat-measures

• Question 728:

  Matt, a systems security engineer, is determining which credential-type authentication to use within a planned 802.1x deployment. He is looking for a method that does not require a client certificate, has a server side certificate, and uses TLS tunnels for encryption. Which credential type authentication method BEST fits these requirements?

  A. EAP-TLS
  B. EAP-FAST
  C. PEAP-CHAP
  D. PEAP-MSCHAPv2
  D. PEAP-MSCHAPv2

  ---

  PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS or PEAP-TLS because user authentication is accomplished via password-base credentials (user name and password) rather than digital certificates or smart cards. Only servers running Network Policy Server (NPS) or PEAP-MS-CHAP v2 are required to have a certificate. Incorrect Answers: A: Authenticated wireless access design based on Extensible Authentication Protocol Transport Level Security (EAP-TLS) can use either smart cards or user and computer certificates to authenticate wireless access clients. EAP-TLS does not use usernames and passwords for authentication. B: EAP-FAST does not make use of TLS, but PAC (Protected Access Credentials). C: CHAP intermittently authenticates the identity of the client via a three-way handshake. References: https://technet.microsoft.com/en-us/library/dd348500(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd348478(v=ws.10).aspx http:// www.techrepublic.com/article/ultimate-wireless-security-guide-a-primer-on-cisco-eap- fast-authentication/ http://en.wikipedia.org/wiki/Challenge-Handshake_Authentication_Protocol

• Question 729:

  Which of the following would be MOST appropriate if an organization's requirements mandate complete control over the data and applications stored in the cloud?

  A. Hybrid cloud
  B. Community cloud
  C. Private cloud
  D. Public cloud
  C. Private cloud

• Question 730:

  A company's Chief Information Officer realizes the company cannot continue to operate after a disaster. Which of the following describes the disaster?

  A. Risk
  B. Asset
  C. Threat
  D. Vulnerability
  C. Threat