CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 741:

  While previously recommended as a security measure, disabling SSID broadcast is not effective against most attackers because network SSIDs are:

  A. no longer used to authenticate to most wireless networks.
  B. contained in certain wireless packets in plaintext.
  C. contained in all wireless broadcast packets by default.
  D. no longer supported in 802.11 protocols.
  B. contained in certain wireless packets in plaintext.

  ---

  The SSID is still required for directing packets to and from the base station, so it can be discovered using a wireless packet sniffer. Incorrect Answers: A, D: The SSID is still used as a unique identifier for a wireless LAN. It is therefore still valid for authentication, and also still supported in 802.11 protocols. C: Devices which are configured to connect to a network which does not broadcast its SSID may try to connect to the network by broadcasting for the network. This results in the SSID being revealed to wireless snoopers in the vicinity of the device. It is not included by default. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 61. http://en.wikipedia.org/wiki/Service_set_(802.11_network)

• Question 742:

  A user in the company is in charge of various financial roles but needs to prepare for an upcoming audit. They use the same account to access each financial system. Which of the following security controls will MOST likely be implemented within the company?

  A. Account lockout policy
  B. Account password enforcement
  C. Password complexity enabled
  D. Separation of duties
  D. Separation of duties

  ---

  Separation of duties means that users are granted only the permissions they need to do their work and no more. More so it means that there is differentiation between users, employees and duties per se which form part of best practices. Incorrect Answers: A: An account lockout policy only needs to be implemented when you need to deny a user access. The user in this case does not have to be locked out. B: The account policy determines the security parameters regarding who can and cannot access the system. In this scenario the user must have access. C: Password complexity only means to make it more difficult for a miscreant to break in and use someone else's account. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 141, 153

• Question 743:

  A forensic analyst is reviewing electronic evidence after a robbery. Security cameras installed at the site were facing the wrong direction to capture the incident. The analyst ensures the cameras are turned to face the proper direction. Which of the following types of controls is being used?

  A. Detective
  B. Deterrent
  C. Corrective
  D. Preventive
  C. Corrective

  ---

  A corrective control would be any corrective action taken to correct any existing control that were faulty or wrongly installed as in this case the cameras were already there, it just had to be adjusted to perform its function as intended. Incorrect Answers: A: A detective control is used to uncover a violation and only becomes relevant when preventive control has failed. B: A deterrent control would be anything that is intended to warn a would be attacker that they should not attack, like a warning that they may be prosecuted in the shape of a banner. D: A preventive control would be to stop something from happening like a locked door or user training on potential harm. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 384

• Question 744:

  A security technician at a small business is worried about the Layer 2 switches in the network suffering from a DoS style attack caused by staff incorrectly cabling network connections between switches.

  Which of the following will BEST mitigate the risk if implemented on the switches?

  A. Spanning tree
  B. Flood guards
  C. Access control lists
  D. Syn flood
  A. Spanning tree

  ---

  Spanning Tree is designed to eliminate network `loops' from incorrect cabling between switches. Imagine two switches named switch 1 and switch 2 with two network cables connecting the switches. This would cause a network loop. A network loop between two switches can cause a `broadcast storm' where a broadcast packet is sent out of all ports on switch 1 which includes two links to switch 2. The broadcast packet is then sent out of all ports on switch 2 which includes links back to switch 1. The broadcast packet will be sent out of all ports on switch 1 again which includes two links to switch 2 and so on thus flooding the network with broadcast traffic. The Spanning-Tree Protocol (STP) was created to overcome the problems of transparent bridging in redundant networks. The purpose of STP is to avoid and eliminate loops in the network by negotiating a loop-free path through a root bridge. This is done by determining where there are loops in the network and blocking links that are redundant. Spanning-Tree Protocol executes an algorithm called the Spanning-Tree Algorithm (STA). In order to find redundant links, STA will choose a reference point called a Root Bridge, and then determines all the available paths to that reference point. If it finds a redundant path, it chooses for the best path to forward and for all other redundant paths to block. This effectively severs the redundant links within the network. All switches participating in STP gather information on other switches in the network through an exchange of data messages. These messages are referred to as Bridge Protocol Data Units (BPDUs). The exchange of BPDUs in a switched environment will result in the election of a root switch for the stable spanning-tree network topology, election of designated switch for every switched segment, and the removal of loops in the switched network by placing redundant switch ports in a backup state. Incorrect Answers: B: Flood guards are used to prevent network flooding attacks such as DoS, SYN floods, ping floods etc. However, this question states that a security technician at a small business is worried about the Layer 2 switches in the network suffering from a DoS style attack caused by staff incorrectly cabling network connections between switches. Spanning tree is a more appropriate answer is this scenario. Therefore, this answer is incorrect. C: Access control lists would not prevent a DoS style attack caused by staff incorrectly cabling network connections between switches. Switch traffic is not allowed or disallowed using Access control lists. Therefore, this answer is incorrect. D: A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. It is not used to prevent a DoS style attack caused by staff incorrectly cabling network connections between switches. Therefore, this answer is incorrect. References: http://www.symantec.com/business/support/index?page=contentandid=HOWTO6019 https://www.google.co.uk/webhp?sourceid=chrome- instantandion=1andespv=2andie=UTF-8#q=syn %20flood

• Question 745:

  A security analyst informs the Chief Executive Officer (CEO) that a security breach has just occurred. This results in the Risk Manager and Chief Information Officer (CIO) being caught unaware when the CEO asks for further information. Which of the following strategies should be implemented to ensure the Risk Manager and CIO are not caught unaware in the future?

  A. Procedure and policy management
  B. Chain of custody management
  C. Change management
  D. Incident management
  D. Incident management

  ---

  incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). The events that could occur include security breaches. Incorrect Answers: A: Procedure and Policy management is in essence methods that need to be followed to ensure business continuity. B: When working with incident then chain of custody management , i.e. how evidence is secured, where it is stored and who has access to it, is observed, but this is but a step in incident management. C: Change management refers to the structured approach that is followed to secure a company's assets. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 448

• Question 746:

  If Organization A trusts Organization B and Organization B trusts Organization C, then Organization A trusts Organization C. Which of the following PKI concepts is this describing?

  A. Transitive trust
  B. Public key trust
  C. Certificate authority trust
  D. Domain level trust
  A. Transitive trust

  ---

  In transitive trusts, trust between a first party and a third party flows through a second party that is trusted by both the first party and the third party. Incorrect Answers: B: Public keys are part of Public Key Infrastructure (PKI) and are used together with private keys in an asymmetrical cryptography system. C: A Certificate Authority (CA) is responsible for issuing, managing and maintaining certificates in a Public Key Infrastructure (PKI). The certificates are used as a means of authentication. This, however, is not a trust model. D: Domains exist within a single organization and represent the trust of entities within the domain. This trust is not extended to third parties. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251- 252, 332-333 https://technet.microsoft.com/en-us/library/cc731335.aspx

• Question 747:

  Which of the following common access control models is commonly used on systems to ensure a "need to know" based on classification levels?

  A. Role Based Access Controls
  B. Mandatory Access Controls
  C. Discretionary Access Controls
  D. Access Control List
  B. Mandatory Access Controls

  ---

  Mandatory Access Control allows access to be granted or restricted based on the rules of classification. MAC also includes the use of need to know. Need to know is a security restriction where some objects are restricted unless the subject has a need to know them. Incorrect Answers: A: Basically, Role-based Access Control is based on a user's job description. It does not include the use of need to know. C: Discretionary access control (DAC) is identity based, not based on classification levels. D: Access Control List (ACL) specifies which users are allowed or refused the different types of available access based on the object type. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 278- 284.

• Question 748:

  After working on his doctoral dissertation for two years, Joe, a user, is unable to open his dissertation file. The screen shows a warning that the dissertation file is corrupted because it is infected with a backdoor, and can only be recovered by

  upgrading the antivirus software from the free version to the commercial version.

  Which of the following types of malware is the laptop MOST likely infected with?

  A. Ransomware
  B. Trojan
  C. Backdoor
  D. Armored virus
  A. Ransomware

• Question 749:

  Sara, a security architect, has developed a framework in which several authentication servers work together to increase processing power for an application. Which of the following does this represent?

  A. Warm site
  B. Load balancing
  C. Clustering
  D. RAID
  C. Clustering

  ---

  Anytime you connect multiple computers to work/act together as a single server, it is known as clustering. Clustered systems utilize parallel processing (improving performance and availability) and add redundancy. Server clustering is used to provide failover capabilities / redundancy in addition to scalability as demand increases. Incorrect Answers: A: A warm site is part of disaster recovery and involves he provision of some of the capabilities of a hot site, but it requires the customer to do more work to become operational. Warm sites provide computer systems and compatible media capabilities. B: Load balancing is a way of providing high availability by splitting the workload across multiple computers. D: RAID, or redundant array of independent disks (RAID). RAID allows your existing servers to have more than one hard drive so that if the main hard drive fails, the system keeps functioning. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 234-235, 444

• Question 750:

  The security administrator notices a user logging into a corporate Unix server remotely as root. Which of the following actions should the administrator take?

  A. Create a firewall rule to block SSH
  B. Delete the root account
  C. Disable remote root logins
  D. Ensure the root account has a strong password
  C. Disable remote root logins