CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 751:

  Which of the following is a notification that an unusual condition exists and should be investigated?

  A. Alert
  B. Trend
  C. Alarm
  D. Trap
  A. Alert

  ---

  We need to look carefully at the wording of the question to determine the answer. This question is asking about an "unusual condition" that should be investigated. There are different levels of alerts from Critical to Warning to Information only. An Alarm would be triggered by a serious definite problem that needs resolving urgently. An "unusual condition" probably wouldn't trigger an alarm; it is more likely to trigger an Alert. Incorrect Answers: B: A trend signifies the ongoing status of something. An "unusual condition" may or may not change the trend whereas an alert is likely to be triggered. Therefore, this answer is incorrect. C: An Alarm would be triggered by a serious definite problem that needs resolving urgently. An "unusual condition" probably wouldn't trigger an alarm; it is more likely to trigger an Alert. Therefore, this answer is incorrect. D: A trap is something that is triggered by an event that meets the conditions to trigger to trap. An "unusual condition" is unlikely to trigger a trap whereas an alert is likely to be triggered. Therefore, this answer is incorrect. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 69, 470

• Question 752:

  Which of the following describes the process of removing unnecessary accounts and services from an application to reduce risk exposure?

  A. Error and exception handling
  B. Application hardening
  C. Application patch management
  D. Cross-site script prevention
  B. Application hardening

  ---

  Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing unnecessary functions and features, removing unnecessary usernames or logins and disabling unnecessary services. Incorrect Answers: A: Error handling is an aspect of secure coding. When errors occur, the system should revert back to a secure state. This must be coded into the system, and should include error and exception handling. C: Patch management is the process of maintaining the latest source code for applications and operating systems. This helps protect a systems from newly discovered attacks and vulnerabilities. D: Cross-site scripting (XSS) is a form of malicious code-injection attack on a web server in which an attacker injects code into the content sent to website visitors. XSS can be mitigated by implementing patch management on the web server, using firewalls, and auditing for suspicious activity. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 215-217, 220 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 231

• Question 753:

  Pete, the system administrator, has concerns regarding users losing their company provided smartphones. Pete's focus is on equipment recovery. Which of the following BEST addresses his concerns?

  A. Enforce device passwords.
  B. Use remote sanitation.
  C. Enable GPS tracking.
  D. Encrypt stored data.
  C. Enable GPS tracking.

  ---

  Global Positioning System (GPS) tracking can be used to identify its location of a stolen device and can allow authorities to recover the device. However, for GPS tracking to work, the device must have an Internet connection or a wireless phone service over which to send its location information. Incorrect Answers: A: Enforcing device passwords may make it difficult for a thief to access the applications and data on the device but it does not assist in recovering the stolen device. B: Remote wipe or remote sanitation is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. D: Encrypting the stored data may make it difficult for a thief to access the data on the device but it does not assist in recovering the stolen device. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 754:

  After a recent breach, the security administrator performs a wireless survey of the corporate network. The security administrator notices a problem with the following output: MAC SSID ENCRYPTION POWER BEACONS 00:10:A1:36:12:CC MYCORP WPA2 CCMP 60 1202 00:10:A1:49:FC:37 MYCORP WPA2 CCMP 70 9102 FB:90:11:42:FA:99 MYCORP WPA2 CCMP 40 3031 00:10:A1:AA:BB:CC MYCORP WPA2 CCMP 55 2021 00:10:A1:FA:B1:07 MYCORP WPA2 CCMP 30 6044

  Given that the corporate wireless network has been standardized, which of the following attacks is underway?

  A. Evil twin
  B. IV attack
  C. Rogue AP
  D. DDoS
  A. Evil twin

  ---

  The question states that the corporate wireless network has been standardized. By `standardized' it means the wireless network access points are running on hardware from the same vendor. We can see this from the MAC addresses used. The first half of a MAC address is vendor specific. The second half is network adapter specific. We have four devices with MAC addresses that start with 00:10:A1. The "odd one out" is the device with a MAC address starting FB:90:11. This device is from a different vendor. The SSID of the wireless network on this access point is the same as the other legitimate access points. Therefore, the access point with a MAC address starting FB:90:11 is impersonating the corporate access points. This is known as an Evil Twin. An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits. Incorrect Answers: B: An initialization vector is a random number used in combination with a secret key as a means to encrypt data. This number is sometimes referred to as a nonce, or "number occurring once," as an encryption program uses it only once per session. An initialization vector is used to avoid repetition during the data encryption process, making it impossible for hackers who use dictionary attack to decrypt the exchanged encrypted message by discovering a pattern. This is known as an IV attack. This is not what is described in this question. Therefore, this answer is incorrect. C: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. The Evil Twin in this question is a type of rogue access point. However, as the access point is impersonating the corporate network, it is classed as an Evil Twin. Therefore, this answer is incorrect. D: A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This after all will end up completely crashing a website for periods of time. This is not what is described in this question. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/5057/evil-twin http://www.techopedia.com/definition/26858/initialization-vector http://en.wikipedia.org/wiki/Denial-of-service_attack

• Question 755:

  Which of the following policies is implemented in order to minimize data loss or theft?

  A. PII handling
  B. Password policy
  C. Chain of custody
  D. Zero day exploits
  A. PII handling

  ---

  Although the concept of PII is old, it has become much more important as information technology and the Internet have made it easier to collect PII through breaches of internet security, network security and web browser security, leading to a profitable market in collecting and reselling PII. PII can also be exploited by criminals to stalk or steal the identity of a person, or to aid in the planning of criminal acts. Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. Thus a PII handling policy can be used to protect data. Incorrect Answers: B: Password policy is usually implemented to control access to resources. C: Chain of custody refers to a basic forensic procedure that is taken into account after an event occurred. D: When a hole is found in a web browser or other software and attackers begin exploiting it the very day it is discovered by the developer (bypassing the one-to- two-day response time that many software providers need to put out a patch once the hole has been found), it is known as a zero-day exploit. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 338, 404

• Question 756:

  Use of a smart card to authenticate remote servers remains MOST susceptible to which of the following attacks?

  A. Malicious code on the local system
  B. Shoulder surfing
  C. Brute force certificate cracking
  D. Distributed dictionary attacks
  A. Malicious code on the local system

  ---

  Once a user authenticates to a remote server, malicious code on the user's workstation could then infect the server. Incorrect Answers: B: Shoulder surfing is when a malicious user can watch your keyboard or view your display to figure out your password. This would not work as you are using a smart card. C: Brute force attacks are designed to try every possible valid combination of characters to construct possible passwords in the attempt to discover the specific passwords used by user accounts. This would not work as you are using a smart card. D: Dictionary attacks create hashes to compare via prebuilt lists of potential passwords. This would not work as you are using a smart card. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 278- 282.

• Question 757:

  A company hosts its public websites internally. The administrator would like to make some changes to the architecture.

  The three goals are:

  (1)

  reduce the number of public IP addresses in use by the web servers (2) drive all the web traffic through a central point of control

  (3)

  mitigate automated attacks that are based on IP address scanning

  Which of the following would meet all three goals?

  A. Firewall
  B. Load balancer
  C. URL filter
  D. Reverse proxy
  D. Reverse proxy

• Question 758:

  Public key certificates and keys that are compromised or were issued fraudulently are listed on which of the following?

  A. PKI
  B. ACL
  C. CA
  D. CRL
  D. CRL

  ---

  A CRL is a locally stored record containing revoked certificates and revoked keys. Incorrect Answers: A: A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. Within a PKI you can use CRL to meet the requirements in this question. B: Access control lists (ACLs) enable devices in your network to ignore requests from specified users or systems or to grant them access to certain network capabilities. ACLs cannot be used for certificates or keys. C: In cryptography, a certificate authority or certification authority (CA) is an entity that issues digital certificates. You don't use a CA to store revoked certificates. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 156-157, 279-280, 279-285, 285

• Question 759:

  Sara, an employee, tethers her smartphone to her work PC to bypass the corporate web security gateway while connected to the LAN. While Sara is out at lunch her PC is compromised via the tethered connection and corporate data is stolen. Which of the following would BEST prevent this from occurring again?

  A. Disable the wireless access and implement strict router ACLs.
  B. Reduce restrictions on the corporate web security gateway.
  C. Security policy and threat awareness training.
  D. Perform user rights and permissions reviews.
  C. Security policy and threat awareness training.

  ---

  BYOD (In this case Sara's smart phone) involves the possibility of a personal device that is infected with malware introducing that malware to the network and security awareness training will address the issue of the company's security policy with regard to BYOD. Incorrect Answers: A: Disabling wireless access and implementing strict router ACL's will hamper the day-to-day operations of the company and disabling these `punishes all users' and not just Sara who was responsible for the data theft that occurred. It would be best to provide training to all users regarding BYOD. B: Reducing restrictions on the corporate web security gateway will leave the company data more vulnerable. D: User rights and permissions reviews will not prevent data theft since Sara still requires permissions to perform her duties. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 399-404, 401

• Question 760:

  Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment?

  A. Protocol analyzer
  B. Router
  C. Firewall
  D. HIPS
  A. Protocol analyzer