CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 771:

  Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that these were false indicators. Which of the following security devices needs to be configured to disable future false alarms?

  A. Signature based IPS
  B. Signature based IDS
  C. Application based IPS
  D. Anomaly based IDS
  D. Anomaly based IDS

  ---

  Most intrusion detection systems (IDS) are what is known as signature-based. This means that they operate in much the same way as a virus scanner, by searching for a known identity - or signature - for each specific intrusion event. And, while signature-based IDS is very efficient at sniffing out known s of attack, it does, like anti-virus software, depend on receiving regular signature updates, to keep in touch with variations in hacker technique. In other words, signature-based IDS is only as good as its database of stored signatures. Any organization wanting to implement a more thorough - and hence safer - solution, should consider what we call anomaly-based IDS. By its nature, anomaly-based IDS is a rather more complex creature. In network traffic terms, it captures all the headers of the IP packets running towards the network. From this, it filters out all known and legal traffic, including web traffic to the organization's web server, mail traffic to and from its mail server, outgoing web traffic from company employees and DNS traffic to and from its DNS server. There are other equally obvious advantages to using anomaly-based IDS. For example, because it detects any traffic that is new or unusual, the anomaly method is particularly good at identifying sweeps and probes towards network hardware. It can, therefore, give early warnings of potential intrusions, because probes and scans are the predecessors of all attacks. And this applies equally to any new service installed on any item of hardware - for example, Telnet deployed on a network router for maintenance purposes and forgotten about when the maintenance was finished. This makes anomaly-based IDS perfect for detecting anything from port anomalies and web anomalies to mis-formed attacks, where the URL is deliberately mis- typed. Incorrect Answers: A: The question states that suspicious traffic without a specific signature was detected. Therefore, a signature based IDS would not detect the suspicious traffic. The traffic must have been detected by an anomaly based device. The fact that the traffic was `detected' rather than `prevented' suggest the anomaly based device was an IDS rather than an IPS. Therefore, this answer is incorrect. B: The question states that suspicious traffic without a specific signature was detected. Therefore, a signature based IPS would not detect the suspicious traffic. The traffic must have been detected by an anomaly based device. The fact that the traffic was `detected' rather than `prevented' suggest the anomaly based device was an IDS rather than an IPS. Therefore, this answer is incorrect. C: The question states that suspicious traffic without a specific signature was detected. The fact that the traffic was `detected' rather than `prevented' suggest the anomaly based device was an IDS rather than an IPS. Therefore, this answer is incorrect. References: http://www.scmagazine.com/signature-based-or-anomaly-based-intrusion-detection-the-practice- and-pitfalls/article/30471/

• Question 772:

  Speaking a passphrase into a voice print analyzer is an example of which of the following security concepts?

  A. Two factor authentication
  B. Identification and authorization
  C. Single sign-on
  D. Single factor authentication
  A. Two factor authentication

  ---

  Two-factor authentication is when two different authentication factors are provided for authentication purposes. Speaking (Voice) something they are. Passphrase something they know. Incorrect Answers: B: Identification is the act of claiming an identity using a single authentication factor, and authorization controls what a subject can and can't do, access, use, or view. C: Single sign-on (SSO) is to give users access to all the applications and systems they need when they log on. D: Single factor authentication only requires one authentication factor for authentication purposes. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 278- 284.

• Question 773:

  During an anonymous penetration test, Jane, a system administrator, was able to identify a shared print spool directory, and was able to download a document from the spool. Which statement BEST describes her privileges?

  A. All users have write access to the directory.
  B. Jane has read access to the file.
  C. All users have read access to the file.
  D. Jane has read access to the directory.
  C. All users have read access to the file.

  ---

  The question states that Jane was able to download a document from the spool directory. To view and download the document, Jane must have at least Read access to the file. The fact that the document belonged to someone else suggests that all users have read access to the file. Incorrect Answers: A: You need Read access to read and download a document from a spool directory. Write access would enable you to create documents in the spool directory but doesn't mean you can download documents from the directory. Therefore, this answer is incorrect. B: Jane was able to view and download the document so she does have Read access to it. However, the fact that the document belonged to someone else suggests that other users have read access to the file rather than only Jane having read access to the file. Therefore, this answer is incorrect. D: Read access to the directory would allow Jane to view the directory and view the contents of the directory. However, to view and download a file from the directory, Jane would need read access to the file itself, not just the directory. Therefore, this answer is incorrect.

• Question 774:

  Results from a vulnerability analysis indicate that all enabled virtual terminals on a router can be accessed using the same password. The company's network device security policy mandates that at least one virtual terminal have a different password than the other virtual terminals. Which of the following sets of commands would meet this requirement?

  A. line vty 0 6 P@s5W0Rd password line vty 7 Qwer++!Y password
  B. line console 0 password password line vty 0 4 password P@s5W0Rd
  C. line vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd
  D. line vty 0 3 password Qwer++!Y line console 0 password P@s5W0Rd
  C. line vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd

  ---

  The VTY lines are the Virtual Terminal lines of the router, used solely to control inbound Telnet connections. They are virtual, in the sense that they are a function of software - there is no hardware associated with them. Two numbers follow the keyword VTY because there is more than one VTY line for router access. The default number of lines is five on many Cisco routers. Here, I'm configuring one password for all terminal (VTY) lines. I can specify the actual terminal or VTY line numbers as a range. The syntax that you'll see most often, vty 0 4, covers all five terminal access lines. Incorrect Answers: A: The number 6 is highly unlikely to be used since the default number of lines is 5 on most Cisco routers. B: Using a 0 vty means that there are no passwords. D: The command will not yield a different password for the virtual terminal. References: http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-110/45843- configpasswords.html http://www.techrepublic.com/article/basic-access-security-for-cisco-network-devices/

• Question 775:

  Matt, the IT Manager, wants to create a new network available to virtual servers on the same hypervisor, and does not want this network to be routable to the firewall. How could this BEST be accomplished?

  A. Create a VLAN without a default gateway.
  B. Remove the network from the routing table.
  C. Create a virtual switch.
  D. Commission a stand-alone switch.
  C. Create a virtual switch.

  ---

  A Hyper-V Virtual Switch implements policy enforcement for security, isolation, and service levels. Incorrect Answers: A: The default gateway usually connects the internal networks and the Internet. This could result in the gateway node acting as a proxy server and a firewall. The gateway is also associated with both a router, and a switch. A router makes use of headers and forwarding tables to determine where packets are sent, and a switch supplies the actual path for the packet in and out of the gateway. Therefore, a gateway is necessary. B: A routing table contains information about the topology of the network immediately around it. Removing the network from it would prevent the virtual servers from connecting to the network. D: A standalone switch is able to function independently of other hardware. This would involve cost and effort. Using a virtual switch is the best option. References: https://technet.microsoft.com/en-us/library/hh831823.aspx

• Question 776:

  The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems. Which of the following phases of incident response is MOST appropriate as a FIRST response?

  A. Recovery
  B. Follow-up
  C. Validation
  D. Identification
  E. Eradication
  F. Containment
  D. Identification

  ---

  To be able to respond to the incident of malware infection you need to know what type of malware was used since there are many types of malware around. This makes identification critical in this case. Incorrect Answers: A: Recovering from the malware incident can only happen after you identified the type of malware involved. B: Follow-up is exactly that following the incident and not a first response. C: Validation is not an appropriate first response when dealing with a malware infection. Validation only comes into effect as a prevention measure to LDAP Injection attacks. E: Eradication of malware infections can only be done successfully after the malware involved has been identified. Thus the best first response would be identification and not eradication. F: Containment if akin to quarantine and is usually a last resort when one cannot eradicate the malware from the systems. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 301-309, 338, 429 http://www.certiguide.com/secplus/cg_sp_SixStepIncidentResponseProcess.htm

• Question 777:

  A system administrator attempts to ping a hostname and the response is 2001:4860:0:2001::68. Which of the following replies has the administrator received?

  A. The loopback address
  B. The local MAC address
  C. IPv4 address
  D. IPv6 address
  D. IPv6 address

  ---

  IPv6 addresses are 128-bits in length. An IPv6 address is represented as eight groups of four hexadecimal digits, each group representing 16 bits (two octets). The groups are separated by colons (:). The hexadecimal digits are case-insensitive, but IETF recommendations suggest the use of lower case letters. The full representation of eight 4-digit groups may be simplified by several techniques, eliminating parts of the representation. Incorrect Answers: A: The name localhost is reserved for loopback purposes. An IPv4 or IPv6 address query for the name localhost must always resolve to the respective loopback address, which is specified in a separate standard. B: MAC addresses are 48-bits in length. C: IPv4 uses 32-bit addresses. References: http://en.wikipedia.org/wiki/IPv6_address http://en.wikipedia.org/wiki/Localhost http://en.wikipedia.org/wiki/MAC_address http://en.wikipedia.org/wiki/IPv4#Addressing

• Question 778:

  A security analyst is reviewing firewall logs while investigating a compromised web server. The following ports appear in the log: 22, 25, 445, 1433, 3128, 3389, 6667

  Which of the following protocols was used to access the server remotely?

  A. LDAP
  B. HTTP
  C. RDP
  D. HTTPS
  C. RDP

  ---

  RDP uses TCP port 3389. Incorrect Answers: A: LDAP operates over TCP ports 636 and 389. B: HTTP uses TCP port 80 or TCP port 8080. D: HTTPS uses TCP port 443 (or TCP port 80 in some configurations of TLS). References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 23, 55, 56.

• Question 779:

  Which of the following should a company implement to BEST mitigate from zero-day malicious code executing on employees' computers?

  A. Least privilege accounts
  B. Host-based firewalls
  C. Intrusion Detection Systems
  D. Application white listing
  D. Application white listing

• Question 780:

  A computer is suspected of being compromised by malware. The security analyst examines the computer and finds that a service called Telnet is running and connecting to an external website over port 443. This Telnet service was found by comparing the system's services to the list of standard services on the company's system image. This review process depends on:

  A. MAC filtering.
  B. System hardening.
  C. Rogue machine detection.
  D. Baselining.
  D. Baselining.

  ---

  Application baseline defines the level or standard of security that will be implemented and maintained for the application. It may include requirements of hardware components, operating system versions, patch levels, installed applications and their configurations, and available ports and services. Systems can be compared to the baseline to ensure that the required level of security is being maintained. Incorrect Answers: A: MAC Filtering is used to secure access to wireless network access points. It is used to explicitly allow MAC addresses on a whitelist, blocking all other MAC addresses. B: Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing or disabling unnecessary functions and features, removing or disabling unnecessary user accounts, disabling unnecessary protocols and ports, and disabling unnecessary services. C: Rogue machine detection attempt to identify the presence of unauthorized systems on a network. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 178, 215-217, 219 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 206, 207, 208