CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 731:

  An organization processes credit card transactions and is concerned that an employee may intentionally email credit card numbers to external email addresses. This company should consider which of the following technologies?

  A. IDS
  B. Firewalls
  C. DLP
  D. IPS
  C. DLP

• Question 732:

  Which of the following is the MOST likely cause of users being unable to verify a single user's email signature and that user being unable to decrypt sent messages?

  A. Unmatched key pairs
  B. Corrupt key escrow
  C. Weak public key
  D. Weak private key
  A. Unmatched key pairs

  ---

  In a PKI the sender encrypts the data using the receiver's public key. The receiver decrypts the data using his own private key. The sender and receiver must have a matching key in order for the receiver to decrypt the data. Incorrect Answers: B: Key escrow is not used for verifying signatures or for decrypting data. C: Public keys are public and known to all parties. They are weak by nature. D: A weak private(secret) key could allow third parties to compromise the security, but would not cause problems verifying signatures or decrypting data. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285

• Question 733:

  A network engineer is designing a secure tunneled VPN. Which of the following protocols would be the MOST secure?

  A. IPsec
  B. SFTP
  C. BGP
  D. PPTP
  A. IPsec

  ---

  Layer 2 Tunneling Protocol (L2TP) came about through a partnership between Cisco and Microsoft with the intention of providing a more secure VPN protocol. L2TP is considered to be a more secure option than PPTP, as the IPSec protocol which holds more secure encryption algorithms, is utilized in conjunction with it. It also requires a pre-shared certificate or key. L2TP's strongest level of encryption makes use of 168 bit keys, 3 DES encryption algorithm and requires two levels of authentication. L2TP has a number of advantages in comparison to PPTP in terms of providing data integrity and authentication of origin verification designed to keep hackers from compromising the system. However, the increased overhead required to manage this elevated security means that it performs at a slower pace than PPTP. Incorrect Answers: B: SFTP (Secure FTP) is not a VPN tunneling protocol. It is used for transferring files using the File Transfer Protocol over a secure connection. The connection is secured by using SSH (Secure Shell). C: BGP (Border Gateway Protocol) is a routing protocol, not a VPN protocol. D: Point-To-Point-Tunneling Protocol (PPTP) is the most popularly VPN protocol and is supported by the most devices. PPTP stands for point to point protocol, is by far the easiest to configure and has low overhead that makes it faster than other VPN protocols. Firewalls such as ISA Server, Cisco PIX and Sonic Wall recognize the protocol. PPTP encrypts data using a 128- bit key which puts it in the "weakest" category of VPN protocols. References: http://www.maketecheasier.com/understanding-various-vpn-connections/

• Question 734:

  Which of the following security devices can be replicated on a Linux based computer using IP tables to inspect and properly handle network based traffic?

  A. Sniffer
  B. Router
  C. Firewall
  D. Switch
  C. Firewall

  ---

  Ip tables are a user-space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall and the chains and rules it stores. Incorrect Answers: A: A sniffer is a tool used in the process of monitoring the data that is transmitted across a network. B, D: A router is connected to two or more data lines from different networks, whereas a network switch is connected to data lines from one single network. These may include a firewall, but not by default. References: http://en.wikipedia.org/wiki/Iptables Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 342. http://en.wikipedia.org/wiki/Router_(computing)

• Question 735:

  Which of the following is a step in deploying a WPA2-Enterprise wireless network?

  A. Install a token on the authentication server
  B. Install a DHCP server on the authentication server
  C. Install an encryption key on the authentication server
  D. Install a digital certificate on the authentication server
  D. Install a digital certificate on the authentication server

  ---

  When setting up a wireless network, you'll find two very different modes of Wi-Fi Protected Access (WPA) security, which apply to both the WPA and WPA2 versions. The easiest to setup is the Personal mode, technically called the Pre-Shared Key (PSK) mode. It doesn't require anything beyond the wireless router or access points (APs) and uses a single passphrase or password for all users/devices. The other is the Enterprise mode --which should be used by businesses and organizations--and is also known as the RADIUS, 802.1X, 802.11i, or EAP mode. It provides better security and key management, and supports other enterprise-type functionality, such as VLANs and NAP. However, it requires an external authentication server, called a Remote Authentication Dial In User Service (RADIUS) server to handle the 802.1X authentication of users. To help you better understand the process of setting up WPA/WPA2-Enterprise and 802.1X, here's the basic overall steps: Choose, install, and configure a RADIUS server, or use a hosted service. Create a certificate authority (CA), so you can issue and install a digital certificate onto the RADIUS server, which may be done as a part of the RADIUS server installation and configuration. Alternatively, you could purchase a digital certificate from a public CA, such as GoDaddy or Verisign, so you don't have to install the server certificate on all the clients. If using EAP-TLS, you'd also create digital certificates for each end-user. On the server, populate the RADIUS client database with the IP address and shared secret for each AP. On the server, populate user data with usernames and passwords for each end-user. On each AP, configure the security for WPA/WPA2-Enterprise and input the RADIUS server IP address and the shared secret you created for that particular AP. On each Wi-Fi computer and device, configure the security for WPA/WPA2- Enterprise and set the 802.1X authentication settings. Incorrect Answers: A: A token is not required on the authentication server when configuring WPA-Enterprise. B: DHCP (Dynamic Host Configuration Protocol) does not have to be installed on the authentication server. You don't have to use DHCP at all although it is easier if you do. However, DHCP is usually configured on a dedicated device, not on the authentication server. C: You don't install an encryption key on the authentication server when configuring WPA- Enterprise. You install a digital certificate. The private key of the certificate is then used to create secure connections. References: http://www.windowsnetworking.com/articles-tutorials/wireless-networking/Deploying-WPA2- Enterprise-Wi-Fi-Security-Small-Businesses.html

• Question 736:

  The system administrator notices that their application is no longer able to keep up with the large amounts of traffic their server is receiving daily. Several packets are dropped and sometimes the server is taken offline. Which of the following would be a possible solution to look into to ensure their application remains secure and available?

  A. Cloud computing
  B. Full disk encryption
  C. Data Loss Prevention
  D. HSM
  A. Cloud computing

  ---

  Cloud computing means hosting services and data on the Internet instead of hosting it locally. There is thus no issue when the company's server is taken offline. Incorrect Answers: B: Full disk encryption allows data that has been stolen to remain out of the eyes of intruders. This does not address availability issues. C: Data Loss prevention systems are used to monitor the contents of workstations, servers and networks. Essentially it makes sure that key content is not deleted or removed by legitimate users. D: Hierarchical storage management (HSM) provides continuous online backup by using optical or tape jukeboxes. It appears as an infinite disk to the system, and you can configure it to provide the closest version of an available real-time backup. This does not address the issues of the application to remain secure and available. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 17, 290 https://technet.microsoft.com/en-us/library/hh831630.aspx

• Question 737:

  The administrator receives a call from an employee named Joe. Joe says the Internet is down and he is receiving a blank page when typing to connect to a popular sports website. The administrator asks Joe to try visiting a popular search engine site, which Joe reports as successful. Joe then says that he can get to the sports site on this phone. Which of the following might the administrator need to configure?

  A. The access rules on the IDS
  B. The pop up blocker in the employee's browser
  C. The sensitivity level of the spam filter
  D. The default block page on the URL filter
  D. The default block page on the URL filter

  ---

  A URL filter is used to block access to a site based on all or part of a URL. There are a number of URL-filtering tools that can acquire updated master URL block lists from vendors, as well as allow administrators to add or remove URLs from a custom list. Incorrect Answers: A: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations. B: Pop-up blockers prevent websites from opening further web browser windows without your approval. C: A spam filter deals with identifying and blocking/filtering/removing unsolicited messages. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 18, 19, 21, 246.

• Question 738:

  Which of the following should be deployed to prevent the transmission of malicious traffic between virtual machines hosted on a singular physical device on a network?

  A. HIPS on each virtual machine
  B. NIPS on the network
  C. NIDS on the network
  D. HIDS on each virtual machine
  A. HIPS on each virtual machine

  ---

  Host-based intrusion prevention system (HIPS) is an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host. Incorrect Answers: B: Network-based intrusion prevention system (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. C: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks. D: A host-based IDS (HIDS) watches the audit trails and log files of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. References: http://en.wikipedia.org/wiki/Intrusion_prevention_system Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 21.

• Question 739:

  Which of the following provides dedicated hardware-based cryptographic functions to an operating system and its applications running on laptops and desktops?

  A. TPM
  B. HSM
  C. CPU
  D. FPU
  A. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: B: Hardware Security Module (HSM) hardware-based encryption solution that is usually used in conjunction with PKI to enhance security with certification authorities (CAs). It is available as an expansion card and can cryptographic keys, passwords, or certificates. However, the HSM secures communication between devices rather than the data on the device. C: A Central Processing Unit (CPU) does not provide cryptographic functions. D: A Floating-point Unit (FPU) is a math coprocessor designed to carry out operations on floating point numbers. IT does not provide cryptographic functions. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 237, 238

• Question 740:

  After running into the data center with a vehicle, attackers were able to enter through the hole in the building and steal several key servers in the ensuing chaos. Which of the following security measures can be put in place to mitigate the issue from occurring in the future?

  A. Fencing
  B. Proximity readers
  C. Video surveillance
  D. Bollards
  D. Bollards

  ---

  To stop someone from entering a facility, barricades or gauntlets can be used. These are often used in conjunction with guards, fencing, and other physical security measures. Bollards are physical barriers that are strong enough to withstand impact with a vehicle. Incorrect Answers: A: Fencing, although also a physical barrier is not as strong as bollards and will not keep a vehicle out on impact. B: Proximity readers are not designed to withstand impact from vehicles. C: Video surveillance will not stop a vehicle impact. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 372, 375