CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 791:

  Environmental control measures include which of the following?

  A. Access list
  B. Lighting
  C. Motion detection
  D. EMI shielding
  D. EMI shielding

  ---

  Environmental controls include HVAC, Fire Suppression, EMI Shielding, Hot and Cold Aisles, Environmental monitoring as well as Temperature and Humidity controls. Incorrect Answers: A: Access lists are used in implementing physical security. B: Lighting, and in particular proper lighting is used in implementing physical security. C: Motion Detections forms part of physical security implementation. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp.373, 376, 377

• Question 792:

  End-user awareness training for handling sensitive personally identifiable information would include secure storage and transmission of customer:

  A. Date of birth.
  B. First and last name.
  C. Phone number.
  D. Employer name.
  A. Date of birth.

  ---

  Personally identifiable information (PII) is a catchall for any data that can be used to uniquely identify an individual. This data can be anything from the person's name to a fingerprint (think biometrics), credit card number, or patient record. Date of birth is personally identifiable information. Incorrect Answers: B, C, D: First and last names, phone numbers and employer name is shared information. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 404

• Question 793:

  Which of the following tools would allow Ann, the security administrator, to be able to BEST quantify all traffic on her network?

  A. Honeypot
  B. Port scanner
  C. Protocol analyzer
  D. Vulnerability scanner
  C. Protocol analyzer

  ---

  A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. By capturing and analyzing the packets sent between the systems on the network, Ann would be able to quantify the amount of traffic on the network. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal). Incorrect Answers: A: A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies. A honeypot is not used to monitor device security. It is not used to calculate the volume of traffic on a network. Therefore, this answer is incorrect. B: A port scanner is typically a software application used to scan a system such as a computer or firewall for open ports. A malicious user would attempt to access a system through an open port. A security administrator would compare the list of open ports against a list of ports that need to be open so that unnecessary ports can be closed thus reducing the vulnerability of the system. A port scanner is not used to calculate the volume of traffic on a network. Therefore, this answer is incorrect. D: A vulnerability scanner is software designed to assess computers, computer systems, networks or applications for weaknesses. This includes applications or default configurations posing a security risk. A vulnerability scanner is not used to calculate the volume of traffic on a network. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Wireshark

• Question 794:

  The fundamental information security principals include confidentiality, availability and which of the following?

  A. The ability to secure data against unauthorized disclosure to external sources
  B. The capacity of a system to resist unauthorized changes to stored information
  C. The confidence with which a system can attest to the identity of a user
  D. The characteristic of a system to provide uninterrupted service to authorized users
  B. The capacity of a system to resist unauthorized changes to stored information

  ---

  Confidentiality, integrity, and availability, which make up the CIA triad, are the three most important concepts in security. In this instance, the answer describes the Integrity part of the CIA triad. Incorrect Answers: A: This describes confidentiality. C: This describes identification. D: This describes redundancy. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 148- 152.

• Question 795:

  Joe, a security analyst, asks each employee of an organization to sign a statement saying that they understand how their activities may be monitored. Which of the following BEST describes this statement? (Select TWO).

  A. Acceptable use policy
  B. Risk acceptance policy
  C. Privacy policy
  D. Email policy
  E. Security policy
  A. Acceptable use policy
  C. Privacy policy

  ---

  Privacy policies define what controls are required to implement and maintain the sanctity of data privacy in the work environment. Privacy policy is a legal document that outlines how data collected is secured. It should encompass information regarding the information the company collects, privacy choices you have based on your account, potential information sharing of your data with other parties, security measures in place, and enforcement. Acceptable use policies (AUPs) describe how the employees in an organization can use company systems and resources, both software and hardware. Incorrect Answers: B: Risk Acceptance policy refers to the choice that must be made when the cost of implementing any of the choices exceeds the value of harm that would occur if the risk actually came to happen. D: Email is not bound to any one type of policy when it comes to risk mitigation, etc. email policy and regulations can be found in acceptable use policy as well as privacy policy which best describes what Joe is doing. E: Security policies define what controls are required to implement and maintain the security of systems, users, and networks. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 24-25

• Question 796:

  Joe, an administrator, installs a web server on the Internet that performs credit card transactions for customer payments. Joe also sets up a second web server that looks like the first web server. However, the second server contains fabricated files and folders made to look like payments were processed on this server but really were not. Which of the following is the second server?

  A. DMZ
  B. Honeynet
  C. VLAN
  D. Honeypot
  D. Honeypot

  ---

  In this scenario, the second web server is a `fake' webserver designed to attract attacks. We can then monitor the second server to view the attacks and then ensure that the `real' web server is secure against such attacks. The second web server is a honeypot. A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies. According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes: The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers. There are two main types of honeypots: Production - A production honeypot is one used within an organization's environment to help mitigate risk. Research A research honeypot add value to research in computer security by providing a platform to study the threat. Incorrect Answers: A: A DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to a larger and untrusted network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN); an external network node only has direct access to equipment in the DMZ, rather than any other part of the network. The name is derived from the term "demilitarized zone", an area between nation states in which military operation is not permitted. The second web server described in this question is not a DMZ. Therefore, this answer is incorrect. B: A honeynet is a network set up with intentional vulnerabilities; its purpose is to invite attack, so that an attacker's activities and methods can be studied and that information used to increase network security. In this question, we have a second single server rather than a network set up to be attacked. The server is a honeypot, not a honeynet. Therefore, this answer is incorrect. C: In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers; such a domain is referred to as a virtual local area network, virtual LAN or VLAN. This is usually achieved on switch or router devices. Simpler devices only support partitioning on a port level (if at all), so sharing VLANs across devices requires running dedicated cabling for each VLAN. More sophisticated devices can mark packets through tagging, so that a single interconnect (trunk) may be used to transport data for multiple VLANs. Grouping hosts with a common set of requirements regardless of their physical location by VLAN can greatly simplify network design. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be grouped together more easily even if they are not on the same network switch. The second web server described in this question is not a VLAN. Therefore, this answer is incorrect. References: https://ethics.csc.ncsu.edu/abuse/hacking/honeypots/study.php http://en.wikipedia.org/wiki/DMZ_%28computing%29 http://searchsecurity.techtarget.com/definition/honeynet http://en.wikipedia.org/wiki/Virtual_LAN

• Question 797:

  A security administrator must implement a firewall rule to allow remote employees to VPN onto the company network. The VPN concentrator implements SSL VPN over the standard HTTPS port. Which of the following is the MOST secure ACL to implement at the company's gateway firewall?

  A. PERMIT TCP FROM ANY 443 TO 199.70.5.25 443
  B. PERMIT TCP FROM ANY ANY TO 199.70.5.23 ANY
  C. PERMIT TCP FROM 199.70.5.23 ANY TO ANY ANY
  D. PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443
  D. PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443

• Question 798:

  A CA is compromised and attacks start distributing maliciously signed software updates. Which of the following can be used to warn users about the malicious activity?

  A. Key escrow
  B. Private key verification
  C. Public key verification
  D. Certificate revocation list
  D. Certificate revocation list

  ---

  If we put the root certificate of the comprised CA in the CRL, users will know that this CA (and the certificates that it has issued) no longer can be trusted. The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release. Incorrect Answers: A: Key escrow is not related to revoked certificates. Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question. B: Within PKI there are only two methods to verify certificates or keys still are valid. One is using a CRL and the other is using the OCSP protocol. Private key verification cannot be used to check if a CA is comprised. C: Public key verification cannot be used to a comprised CA. Within PKI there are only two methods to verify certificates or keys still are valid. One is using a CRL and the other is using the OCSP protocol. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285, 285

• Question 799:

  A security team has identified that the wireless signal is broadcasting into the parking lot. To reduce the risk of an attack against the wireless network from the parking lot, which of the following controls should be used? (Select TWO).

  A. Antenna placement
  B. Interference
  C. Use WEP
  D. Single Sign on
  E. Disable the SSID
  F. Power levels
  A. Antenna placement
  F. Power levels

  ---

  Placing the antenna in the correct position is crucial. You can then adjust the power levels to exclude the parking lot. Incorrect Answers: B: Interference could disrupt the signal in the building as well. C: WEP is not a secure encryption protocol. D: This allows users access to all the applications and systems they need when they log on. E: This option would "cloak" the network, not limit its signal strength. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 149, 171, 177, 183.

• Question 800:

  Which of the following should be enabled in a laptop's BIOS prior to full disk encryption?

  A. USB
  B. HSM
  C. RAID
  D. TPM
  D. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates. Incorrect Answers: A: USB support can be enabled or disabled in a system's BIOS but it is not required for full-disk encryption. B: Hardware Security Module (HSM) hardware-based encryption solution that is usually used in conjunction with PKI to enhance security with certification authorities (CAs). It is available as an expansion card and can cryptographic keys, passwords, or certificates. As HSM is not embedded in the motherboards, it is not enabled or disable in BIOS. C: Random Array of Independent Disks (RAID) is a fault-tolerant storage solution that consists of two or more hard disks. It is not required for full-disk encryption. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 237, 238