CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 781:

  Simulation

  

  Correct Answer.

  ---

  

  Firewall rules act like ACLs, and they are used to dictate what traffic can pass between the firewall and the internal network. Three possible actions can be taken based on the rule's criteria:

  Block the connection

  Allow the connection

  Allow the connection only if it is secured

  TCP is responsible for providing a reliable, one-to-one, connection-oriented session. TCP establishes a connection and ensures that the other end receives any packets sent. Two hosts communicate packet results with each other. TCP also

  ensures that packets are decoded and sequenced properly. This connection is persistent during the session. When the session ends, the connection is torn down.

  UDP provides an unreliable connectionless communication method between hosts. UDP is considered a best-effort protocol, but it's considerably faster than TCP.

  The sessions don't establish a synchronized session like the kind used in TCP, and UDP doesn't guarantee error-free communications. The primary purpose of UDP is to send small packets of information. The application is responsible for

  acknowledging the correct reception of the data.

  Port 22 is used by both SSH and SCP with UDP.

  Port 443 is used for secure web connections HTTPS and is a TCP port. Thus to make sure only the Accounting computer has HTTPS access to the Administrative server you should use TCP port 443 and set the rule to allow communication

  between 10.4.255.10/24 (Accounting) and 10.4.255.101

  (Administrative server1)

  Thus to make sure that only the HR computer has access to Server2 over SCP you need use of TCP port 22 and set the rule to allow communication between 10.4.255.10/23 (HR) and 10.4.255.2 (server2)

  Thus to make sure that the IT computer can access both the Administrative servers you need to use a port and accompanying port number and set the rule to allow communication between:

  10.4.255.10.25 (IT computer) and 10.4.255.101 (Administrative server1) 10.4.255.10.25 (IT computer) and 10.4.255.102 (Administrative server2)

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 77, 83, 96, 157.

• Question 782:

  Which of the following IP addresses would be hosts on the same subnet given the subnet mask 255.255.255.224? (Select TWO).

  A. 10.4.4.125
  B. 10.4.4.158
  C. 10.4.4.165
  D. 10.4.4.189
  E. 10.4.4.199
  C. 10.4.4.165
  D. 10.4.4.189

  ---

  With the given subnet mask, a maximum number of 30 hosts between IP addresses 10.4.4.161 and 10.4.4.190 are allowed. Therefore, option C and D would be hosts on the same subnet, and the other options would not. References: http://www.subnetonline.com/pages/subnet-calculators/ip-subnet-calculator.php

• Question 783:

  A company has two server administrators that work overnight to apply patches to minimize disruption to the company. With the limited working staff, a security engineer performs a risk assessment to ensure the protection controls are in place

  to monitor all assets including the administrators in case of an emergency.

  Which of the following should be in place?

  A. NIDS
  B. CCTV
  C. Firewall
  D. NIPS
  B. CCTV

• Question 784:

  A UNIX administrator would like to use native commands to provide a secure way of connecting to other devices remotely and to securely transfer files. Which of the following protocols could be utilized? (Select TWO).

  A. RDP
  B. SNMP
  C. FTP
  D. SCP
  E. SSH
  D. SCP
  E. SSH

  ---

  SSH is used to establish a command-line, text-only interface connection with a server, router, switch, or similar device over any distance. Secure Copy Protocol (SCP) is a secure file-transfer facility based on SSH and Remote Copy Protocol (RCP). SCP is commonly used on Linux and Unix platforms. Incorrect Answers: A: Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. B: You can use SNMP to interact with several network devices to acquire status information, performance data, statistics, and configuration details via a management console. C: Standard FTP is a protocol often used to move files between one system and another either over the Internet or within private networks. It is not commonly used on Linux and Unix platforms. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 47, 49. http://en.wikipedia.org/wiki/Remote_Desktop_Protocol

• Question 785:

  Which of the following devices will help prevent a laptop from being removed from a certain location?

  A. Device encryption
  B. Cable locks
  C. GPS tracking
  D. Remote data wipes
  B. Cable locks

  ---

  Cable locks are theft deterrent devices that can be used to tether a device to a fixed point keep smaller devices from being easy to steal. Incorrect Answers: A: Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. C: Global Positioning System (GPS) tracking can be used to identify its location of a stolen device and can allow authorities to recover the device. However, for GPS tracking to work, the device must have an Internet connection or a wireless phone service over which to send its location information. D: Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 369, 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 786:

  Two members of the finance department have access to sensitive information. The company is concerned they may work together to steal information. Which of the following controls could be implemented to discover if they are working together?

  A. Least privilege access
  B. Separation of duties
  C. Mandatory access control
  D. Mandatory vacations
  D. Mandatory vacations

  ---

  A mandatory vacation policy requires all users to take time away from work to refresh. Mandatory vacation give the employee a chance to refresh, but it also gives the company a chance to make sure that others can fill in any gaps in skills and satisfies the need to have replication or duplication at all levels. Mandatory vacations also provide an opportunity to discover fraud. In this case mandatory vacations can prevent the two members from colluding to steal the information that they have access to. Incorrect Answers: A: A least privilege policy should be used when assigning permissions. Give users only the permissions that they need to do their work and no more. This is not preventing employees with legitimate access to information from colluding to steal the information. B: A separation of duties policy is designed to reduce the risk of fraud and to prevent other losses in an organization. Much like job rotation and it will not prevent two employees with legitimate access to information from working together to steal information. C: Mandatory access control means all access is pre-defined by methods for how information access is permitted. In a MAC environment, all access capabilities are pre-defi ned. Users can't share information unless their rights to share it are established by administrators. Consequently, administrators must make any changes that need to be made to such rights. But in this case the users both have legitimate access to the information. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 25

• Question 787:

  An administrator wants to minimize the amount of time needed to perform backups during the week. It is also acceptable to the administrator for restoration to take an extended time frame.

  Which of the following strategies would the administrator MOST likely implement?

  A. Full backups on the weekend and incremental during the week
  B. Full backups on the weekend and full backups every day
  C. Incremental backups on the weekend and differential backups every day
  D. Differential backups on the weekend and full backups every day
  A. Full backups on the weekend and incremental during the week

  ---

  A full backup is a complete, comprehensive backup of all fi les on a disk or server. The full backup is current only at the time it's performed. Once a full backup is made, you have a complete archive of the system at that point in time. A system shouldn't be in use while it undergoes a full backup because some fi les may not get backed up. Once the system goes back into operation, the backup is no longer current. A full backup can be a time-consuming process on a large system. An incremental backup is a partial backup that stores only the information that has been changed since the last full or the last incremental backup. If a full backup were performed on a Sunday night, an incremental backup done on Monday night would contain only the information that changed since Sunday night. Such a backup is typically considerably smaller than a full backup. Each incremental backup must be retained until a full backup can be performed. Incremental backups are usually the fastest backups to perform on most systems, and each incremental backup tape is relatively small. Incorrect Answers: B: Full backups on a daily base would be too time consuming and impractical. C: A differential backup is similar in function to an incremental backup, but it backs up any files that have been altered since the last full backup; it makes duplicate copies of fi les that haven't changed since the last differential backup. However this together with incremental backups on the weekend will not provide a complete backup since the administrator want to minimize time required to perform backups during the week. D: Full backups on a daily basis is exactly the opposite of what is required when you want to minimize the time required to make the backups during the week. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 436-437

• Question 788:

  Vendors typically ship software applications with security settings disabled by default to ensure a wide range of interoperability with other applications and devices. A security administrator should perform which of the following before deploying new software?

  A. Application white listing
  B. Network penetration testing
  C. Application hardening
  D. Input fuzzing testing
  C. Application hardening

  ---

  Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing unnecessary functions and features, removing unnecessary usernames or logins and disabling unnecessary services. Incorrect Answers: A: Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list. Including the application on the whitelist does not address the security settings that have been disabled by default. B: Network penetrating testing attempts to find weakness in a network by trying to hack into the network. This is not related to software. D: Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 215-217, 218, 340 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 229

• Question 789:

  The string:

  ` or 1=1--

  Represents which of the following?

  A. Bluejacking
  B. Rogue access point
  C. SQL Injection
  D. Client-side attacks
  C. SQL Injection

  ---

  The code in the question is an example of a SQL Injection attack. The code `1=1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table. SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. Incorrect Answers: A: Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth- enabled device via the OBEX protocol. The code in the question is not an example of bluejacking. Therefore, this answer is incorrect. B: A rogue access point is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator, or has been created to allow a hacker to conduct a man-in-themiddle attack. Rogue access points of the first kind can pose a security threat to large organizations with many employees, because anyone with access to the premises can install (maliciously or non-maliciously) an inexpensive wireless router that can potentially allow access to a secure network to unauthorized parties. Rogue access points of the second kind target networks that do not employ mutual authentication (client-server server-client) and may be used in conjunction with a rogue RADIUS server, depending on security configuration of the target network. A rogue access point would not create the code shown in the question. Therefore, this answer is incorrect. D: Client-side attacks target vulnerabilities in client applications interacting with a malicious data. The difference is the client is the one initiating the bad connection. The code in the question is much more likely to be part of a SQL statement in a SQL Injection attack. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/Bluejacking http://en.wikipedia.org/wiki/Rogue_access_point

• Question 790:

  A security administrator is notified that users attached to a particular switch are having intermittent connectivity issues. Upon further research, the administrator finds evidence of an ARP spoofing attack. Which of the following could be utilized to provide protection from this type of attack?

  A. Configure MAC filtering on the switch.
  B. Configure loop protection on the switch.
  C. Configure flood guards on the switch.
  D. Configure 802.1x authentication on the switch.
  C. Configure flood guards on the switch.