CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 761:

  Which of the following is true about the recovery agent?

  A. It can decrypt messages of users who lost their private key.
  B. It can recover both the private and public key of federated users.
  C. It can recover and provide users with their lost or private key.
  D. It can recover and provide users with their lost public key.
  A. It can decrypt messages of users who lost their private key.

  ---

  A key recovery agent is an entity that has the ability to recover a private key, key components, or plaintext messages as needed. Using the recovered key the recovery agent can decrypt encrypted data. Incorrect Answers: B: The key recovery agent does not recover the public key. The key recovery agent recovers the private key which then is used to decrypt the data. C: The key recovery agent does indeed recovery the private key. D: The key recovery agent does not recover the public key. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285

• Question 762:

  Which of the following is an indication of an ongoing current problem?

  A. Alert
  B. Trend
  C. Alarm
  D. Trap
  C. Alarm

  ---

  An alarm indicates that something is wrong and needs to be resolved as soon as possible. Alarms usually continue to sound until the problem is resolved or the alarm is manually silenced. Incorrect Answers: A: An alert does indicate that something is wrong. However this question asks about an ONGOING problem. An alert will usually just trigger at the beginning of a problem whereas an alarm will sound for the duration of the problem. Therefore, this answer is incorrect. B: A trend signifies the ongoing status of something. That status may change during an ongoing problem so the trend will indicate that the current status is different than normal. However, an alarm is specifically design to indicate that there is currently a problem and is a better answer. Therefore, this answer is incorrect. C: A trap is something that is triggered by an event. The `problem' may cause the trap to trigger. However this question asks about an ONGOING problem. A trap will usually just trigger at the beginning of a problem whereas an alarm will sound for the duration of the problem. Therefore, this answer is incorrect. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 69, 470

• Question 763:

  Which of the following is used by the recipient of a digitally signed email to verify the identity of the sender?

  A. Recipient's private key
  B. Sender's public key
  C. Recipient's public key
  D. Sender's private key
  B. Sender's public key

  ---

  When the sender wants to send a message to the receiver. It's important that this message not be altered. The sender uses the private key to create a digital signature. The message is, in effect, signed with the private key. The sender then sends the message to the receiver. The recipient uses the public key attached to the message to validate the digital signature. If the values match, the receiver knows the message is authentic. Thus the recipient uses the sender's public key to verify the sender's identity. Incorrect Answers: A: The recipient's private key is not required to check the identity of the sender. C: The public key must be sent to the recipient by the sender, the recipient cannot use their own public key. D: The sender must use the private key to create the digital signature. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 261

• Question 764:

  Which of the following attacks could be used to initiate a subsequent man-in-the-middle attack?

  A. ARP poisoning
  B. DoS
  C. Replay
  D. Brute force
  C. Replay

  ---

  A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack). For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice's password (or hash) read from the last session, which Bob accepts thus granting access to Eve. Countermeasures: A way to avoid replay attacks is by using session tokens: Bob sends a one- time token to Alice, which Alice uses to transform the password and send the result to Bob (e.g. computing a hash function of the session token appended to the password). On his side Bob performs the same computation; if and only if both values match, the login is successful. Now suppose Eve has captured this value and tries to use it on another session; Bob sends a different session token, and when Eve replies with the captured value it will be different from Bob's computation. Session tokens should be chosen by a (pseudo-) random process. Otherwise Eve may be able to pose as Bob, presenting some predicted future token, and convince Alice to use that token in her transformation. Eve can then replay her reply at a later time (when the previously predicted token is actually presented by Bob), and Bob will accept the authentication. Onetime passwords are similar to session tokens in that the password expires after it has been used or after a very short amount of time. They can be used to authenticate individual transactions in addition to sessions. The technique has been widely implemented in personal online banking systems. Bob can also send nonces but should then include a message authentication code (MAC), which Alice should check. Timestamping is another way of preventing a replay attack. Synchronization should be achieved using a secure protocol. For example Bob periodically broadcasts the time on his clock together with a MAC. When Alice wants to send Bob a message, she includes her best estimate of the time on his clock in her message, which is also authenticated. Bob only accepts messages for which the timestamp is within a reasonable tolerance. The advantage of this scheme is that Bob does not need to generate (pseudo-) random numbers, with the trade-off being that replay attacks, if they are performed quickly enough i.e. within that 'reasonable' limit, could succeed. Incorrect Answers: A: Address Resolution Protocol poisoning (ARP poisoning) is a form of attack in which an attacker changes the Media Access Control (MAC) address and attacks an Ethernet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets. This modifies the layer -Ethernet MAC address into the hacker's known MAC address to monitor it. Because the ARP replies are forged, the target computer unintentionally sends the frames to the hacker's computer first instead of sending it to the original destination. As a result, both the user's data and privacy are compromised. An effective ARP poisoning attempt is undetectable to the user. ARP poisoning is also known as ARP cache poisoning or ARP poison routing (APR). ARP poisoning would not be used to initiate a subsequent man-in-the-middle attack. Therefore, this answer is incorrect. B: DoS, short for denial-of-service attack, a type of attack on a network that is designed to bring the network to its knees by flooding it with useless traffic. Many DoS attacks, such as the Ping of Death and Teardrop attacks, exploit limitations in the TCP/IP protocols. For all known DoS attacks, there are software fixes that system administrators can install to limit the damage caused by the attacks. But, like viruses, new DoS attacks are constantly being dreamed up by hackers. DoS would not be used to initiate a subsequent man-in-the-middle attack. Therefore, this answer is incorrect. D: A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data. Brute force attacks may be used by criminals to crack encrypted data, or by security analysts to test an organization's network security. A brute force attack may also be referred to as brute force cracking. For example, a form of brute force attack known as a dictionary attack might try all the words in a dictionary. Other forms of brute force attack might try commonly-used passwords or combinations of letters and numbers. An attack of this nature can be time- and resource-consuming. Hence the name "brute force attack;" success is usually based on computing power and the number of combinations tried rather than an ingenious algorithm. A brute force attack would not be used to initiate a subsequent man-in-the-middle attack. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Replay_attack http://www.techopedia.com/definition/27471/address-resolution-protocol-poisoning-arp- poisoning http://www.webopedia.com/TERM/D/DoS_attack.html http://www.techopedia.com/definition/18091/brute-force-attack

• Question 765:

  An administrator is building a development environment and requests that three virtual servers are cloned and placed in a new virtual network isolated from the production network. Which of the following describes the environment the administrator is building?

  A. Cloud
  B. Trusted
  C. Sandbox
  D. Snapshot
  C. Sandbox

  ---

  Sandboxing is the process of isolating a system before installing new applications on it so as to restrict any potential malware that may be embedded in the new application from being able to cause harm to production systems. Incorrect Answers: A: In a cloud environment, data or applications are stored on the internet rather than on the local network. B: In a trusted environment communications between systems are permitted and systems are not isolated. D: Snapshots are backups of virtual machines that can be used to quickly recover from poor updates, and errors arising from newly installed applications. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 203, 204-205 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 208,

• Question 766:

  Which of the following devices is used for the transparent security inspection of network traffic by redirecting user packets prior to sending the packets to the intended destination?

  A. Proxies
  B. Load balancers
  C. Protocol analyzer
  D. VPN concentrator
  A. Proxies

• Question 767:

  Which of the following MOST specifically defines the procedures to follow when scheduled system patching fails resulting in system outages?

  A. Risk transference
  B. Change management
  C. Configuration management
  D. Access control revalidation
  B. Change management

  ---

  Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company's assets. In this case `scheduled system patching'. Incorrect Answers: A: Risk transference is when you offload risk to another party akin to risk sharing. C: Configuration management is an operational control type that is put into action after a risk assessment has been done. D: Access control revalidation referrers to server-side and client-side validation that has to be repeated. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 14-17

• Question 768:

  Sara, a company's security officer, often receives reports of unauthorized personnel having access codes to the cipher locks of secure areas in the building. Sara should immediately implement which of the following?

  A. Acceptable Use Policy
  B. Physical security controls
  C. Technical controls
  D. Security awareness training
  D. Security awareness training

  ---

  Security awareness and training include explaining policies, procedures, and current threats to both users and management. A security awareness and training program can do much to assist in your efforts to improve and maintain security. A good security awareness training program for the entire organization should cover the following areas: Importance of security; Responsibilities of people in the organization; Policies and procedures; Usage policies; Account and password-selection criteria as well as Social engineering prevention. Incorrect Answers: A: Companies generally have acceptable use policies regarding how computers can be used within the organization. B: Physical security controls refers to actual physical barriers such as an external entrance to a building (perimeter), locked doors and entrance to the secure/ computer room itself. In this scenario the unauthorized personnel already have access codes to the cipher locks of secure areas. C: Technical Controls are usually implements using technology such as firewalls, IDS, IPS, etc. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p p 399-404, 420

• Question 769:

  Which of the following BEST describes a protective countermeasure for SQL injection?

  A. Eliminating cross-site scripting vulnerabilities
  B. Installing an IDS to monitor network traffic
  C. Validating user input in web applications
  D. Placing a firewall between the Internet and database servers
  C. Validating user input in web applications

  ---

  By validating user input and preventing special characters, we can prevent the injection of client- side scripting code. SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. Incorrect Answers: A: Eliminating cross-site scripting vulnerabilities is always a good idea. However, that will not prevent SQL Injection attacks. Therefore this answer is incorrect. B: An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. IDS come in a variety of "flavors" and approach the goal of detecting suspicious traffic in different ways. There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. An IDS is not used to prevent SQL Injection attacks. Therefore this answer is incorrect. D: A firewall is used to restrict the flow of traffic between subnets based on rules that specify what source/destination IP addresses, ports and protocols are allowed. A firewall is not used to prevent SQL Injection attacks. Therefore this answer is incorrect. References: http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/Intrusion_detection_system

• Question 770:

  Which of the following types of encryption will help in protecting files on a PED?

  A. Mobile device encryption
  B. Transport layer encryption
  C. Encrypted hidden container
  D. Database encryption
  A. Mobile device encryption

  ---

  Device encryption encrypts the data on a Personal Electronic Device (PED). This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. Incorrect Answers: B: The transport layer provides network communication. It does not involve files on a Personal Electronic Device (PED). C: Encrypting hidden containers would protect the files in those containers. It will not protect the rest of the files on the Personal Electronic Device (PED). D: Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the data base. This often offers granular encryption options which allows for the encryptions of the entire database, specific database tables, or specific database fields, such as a credit card number field. However, a database would typically be stored on a server and not a Personal Electronic Device (PED). References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236, 237, 252