CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 801:

  While configuring a new access layer switch, the administrator, Joe, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?

  A. Log Analysis
  B. VLAN Management
  C. Network separation D. 802.1x
  D

  ---

  802.1x is a port-based authentication mechanism. It's based on Extensible Authentication Protocol (EAP) and is commonly used in closed-environment wireless networks. 802.1x was initially used to compensate for the weaknesses of Wired Equivalent Privacy (WEP), but today it's often used as a component in more complex authentication and connection-management systems, including Remote Authentication Dial-In User Service (RADIUS), Diameter, Cisco System's Terminal Access Controller Access-Control System Plus (TACACS+), and Network Access Control (NAC). Incorrect Answers: A: Log analysis is the art and science of reviewing audit trails, log fi les, or other forms of computer-generated records for evidence of policy violations, malicious events, downtimes, bottlenecks, or other issues of concern. B: VLAN management is the use of VLANs to control traffic for security or performance reasons. C: Bridging between networks can be a desired feature of network design. Network bridging is self-configuring, is inexpensive, maintains collision-domain isolation, is transparent to Layer 3+ protocols, and avoids the 5-4-3 rule's Layer 1 limitations. However, network bridging isn't always desirable. It doesn't limit or divide broadcast domains, doesn't scale well, can cause latency, and can result in loops. In order to eliminate these problems, you can implement network separation or segmentation. There are two means to accomplish this. First, if communication is necessary between network segments, you can implement IP subnets and use routers. Second, you can create physically separate networks that don't need to communicate. This can also be accomplished later using firewalls instead of routers to implement secured filtering and traffic management. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 23, 25, 26.

• Question 802:

  Which of the following wireless security technologies continuously supplies new keys for WEP?

  A. TKIP
  B. Mac filtering
  C. WPA2
  D. WPA
  A. TKIP

  ---

  TKIP is a suite of algorithms that works as a "wrapper" to WEP, which allows users of legacy WLAN equipment to upgrade to TKIP without replacing hardware. TKIP uses the original WEP programming but "wraps" additional code at the beginning and end to encapsulate and modify it. Incorrect Answers: B: Networks can use MAC address filtering, only allowing devices with specific MAC addresses to connect to a network. It does not continuously supply new keys for WEP. C: WPA2 makes use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) and is a more secure standard that WEP or WPA. D: WPA replaces WEP, and also uses TKIP. References: http://www.howtogeek.com/192173/how-and-why-to-change-your-mac-address-on-windows- linux-and-mac/ Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 172, 173.

• Question 803:

  A user reports being unable to access a file on a network share. The security administrator determines that the file is marked as confidential and that the user does not have the appropriate access level for that file. Which of the following is being implemented?

  A. Mandatory access control
  B. Discretionary access control
  C. Rule based access control
  D. Role based access control
  A. Mandatory access control

  ---

  Mandatory Access Control (MAC) allows access to be granted or restricted based on the rules of classification. MAC in corporate business environments involve the following four sensitivity levels Public Sensitive Private Confidential MAC assigns subjects a clearance level and assigns objects a sensitivity label. The name of the clearance level must be the same as the name of the sensitivity label assigned to objects or resources. In this case the file is marked confidential, and the user does not have that clearance level and cannot access the file. Incorrect Answers: B: Discretionary access control (DAC) allows access to be granted or restricted by an object's owner based on user identity and on the discretion of the object owner, not on its clearance level. C: Rule-based access control is used for network devices that filter traffic based on filtering rules. D: Role-based Access Control is basically based on a user's job description.

• Question 804:

  Pete needs to open ports on the firewall to allow for secure transmission of files. Which of the following ports should be opened on the firewall?

  A. TCP 23
  B. UDP 69
  C. TCP 22
  D. TCP 21
  C. TCP 22

  ---

  SSH uses TCP port 22. All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22. Secure Copy Protocol (SCP) is a secure file-transfer facility based on SSH and Remote Copy Protocol (RCP). Secure FTP (SFTP) is a secured alternative to standard File Transfer Protocol (FTP). Incorrect Answers: A: Telnet uses port 23. B: Port 69 is used by TFTP. D: Port 21 is used by FTP. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 51. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 805:

  Account lockout is a mitigation strategy used by Jane, the administrator, to combat which of the following attacks? (Select TWO).

  A. Spoofing
  B. Man-in-the-middle
  C. Dictionary
  D. Brute force
  E. Privilege escalation
  C. Dictionary
  D. Brute force

  ---

  Account lockout is a useful method for slowing down online password-guessing attacks. A dictionary attack performs password guessing by making use of a pre- existing list of likely passwords. A brute-force attack is intended to try every possible valid combination of characters to create possible passwords in the attempt to discover the specific passwords used by user accounts. Incorrect Answers: A: Spoofing is the act of falsifying data by changing the source addresses of network packets. B: A man-in-the-middle attack is a type of communications eavesdropping attack. E: Privilege escalation is a breach of authorization restrictions and may be a breach of authentication. References: https://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Account-Lockout- Policy Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 168, 173, 176, 319.

• Question 806:

  Users at a company report that a popular news website keeps taking them to a web page with derogatory content. This is an example of which of the following?

  A. Evil twin
  B. DNS poisoning
  C. Vishing
  D. Session hijacking
  B. DNS poisoning

  ---

  DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) resolver's cache, causing the name server to return an incorrect IP address, diverting traffic to the attacker's computer (or any other computer). A domain name system server translates a human-readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn't know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again. When a DNS server has received a false translation and caches it for performance optimization, it is considered poisoned, and it supplies the false data to clients. If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer (in this case, the server hosting the web page with derogatory content). Incorrect Answers: A: An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique. For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits. This is not what is described in this question. Therefore, this answer is incorrect. C: Vishing (voice or VoIP phishing) is an electronic fraud tactic in which individuals are tricked into revealing critical financial or personal information to unauthorized entities. Vishing works like phishing but does not always occur over the Internet and is carried out using voice technology. A vishing attack can be conducted by voice email, VoIP (voice over IP), or landline or cellular telephone. This is not what is described in this question. Therefore, this answer is incorrect. D: In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. This is not what is described in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/DNS_spoofing http://www.techopedia.com/definition/5057/evil-twin http://searchunifiedcommunications.techtarget.com/definition/vishing http://en.wikipedia.org/wiki/Session_hijacking

• Question 807:

  After a recent security breach, the network administrator has been tasked to update and backup all router and switch configurations. The security administrator has been tasked to enforce stricter security policies. All users were forced to undergo additional user awareness training. All of these actions are due to which of the following types of risk mitigation strategies?

  A. Change management
  B. Implementing policies to prevent data loss
  C. User rights and permissions review
  D. Lessons learned
  D. Lessons learned

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/ reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Described in the question is a situation where a security breach had occurred and its response which shows that lessons have been learned and used to put in place measures that will prevent any future security breaches of the same kind. Incorrect Answers: A: Change Management refers to the structured approach that is followed to secure a company's assets. Described in the question is a case of incident response. And incident response is but a part of change management. B: Policies preventing data loss involves monitoring the contents of systems to make sure that key content is not deleted or removed. This is not the updating and backup of all router and switch configurations. C: Audits usually address user rights and permission reviews which forms part of risk mitigation. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 429

• Question 808:

  A recent spike in virus detections has been attributed to end-users visiting www.compnay.com. The business has an established relationship with an organization using the URL of www.company.com but not with the site that has been causing the infections. Which of the following would BEST describe this type of attack?

  A. Typo squatting
  B. Session hijacking
  C. Cross-site scripting
  D. Spear phishing
  A. Typo squatting

  ---

  Typosquatting, also called URL hijacking or fake url, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typographical errors made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL (including an alternative website owned by a cybersquatter). The typosquatter's URL will usually be one of four kinds, all similar to the victim site address: (In the following, the intended website is "example.com") ?A common misspelling, or foreign language spelling, of the intended site: exemple.com ?A misspelling based on typing errors: xample.com or examlpe.com ?A differently phrased domain name: examples.com ?A different top-level domain: example.org Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content. Incorrect Answers: B: In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session--sometimes also called a session key--to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. In this question, the users went to www.compnay.com instead of www.company.com. Therefore, this is not a case of hijacking a valid session; it's a case of users going to the wrong URL. Therefore, this answer is incorrect. C: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. The question is not describing an XSS attack. Therefore, this answer is incorrect. D: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority. The attack described in the question is not an example of spear phishing. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Typosquatting http://en.wikipedia.org/wiki/Session_hijacking http://searchsecurity.techtarget.com/definition/spear-phishing

• Question 809:

  The IT department has installed new wireless access points but discovers that the signal extends far into the parking lot. Which of the following actions should be taken to correct this?

  A. Disable the SSID broadcasting
  B. Configure the access points so that MAC filtering is not used
  C. Implement WEP encryption on the access points
  D. Lower the power for office coverage only
  D. Lower the power for office coverage only

  ---

  On the chance that the signal is actually traveling too far, some access points include power level controls, which allow you to reduce the amount of output provided. Incorrect Answers: A: Disabling SSID broadcasting is not the best solution. One method of protecting the network that is often recommended is to disable, or turn off, the SSID broadcast (also known as cloaking). The access point is still there, and it is still accessible by those who have been told of its existence by the administrator, but it prevents those who are just scanning from finding it. This is considered a very weak form of security, because there are still other ways, albeit a bit more complicated, to discover the presence of the access point besides the SSID broadcast. B: Disabling MAC filtering would lower the network security. If MAC filtering is turned off, any wireless client that knows the values looked for (MAC addresses) can join the network. When MAC filtering is used, the administrator compiles a list of the MAC addresses associated with users' computers and enters those addresses. When a client attempts to connect and other values have been correctly entered, an additional check of the MAC address is done. If the address appears in the list, the client is allowed to join; otherwise, it is forbidden from doing so. C: WEP encryption is weak and has many vulnerabilities. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 171, 178, 183, 258

• Question 810:

  Which of the following symmetric key algorithms are examples of block ciphers? (Select THREE).

  A. RC4
  B. 3DES
  C. AES
  D. MD5
  E. PGP
  F. Blowfish
  B. 3DES
  C. AES
  F. Blowfish

  ---

  B: Triple DES (3DES) is the common name for the Triple Data Encryption Algorithm (TDEA or Triple DEA) symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. C: Advanced Encryption Standard (AES) is a block cipher that has replaced DES as the current standard, and it uses the Rijndael algorithm. It was developed by Joan Daemen and Vincent Rijmen. AES is the current product used by U.S. governmental agencies. F: Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64-bit block cipher at very fast speeds. Incorrect Answers: A: RC4 is a stream cipher, not a block cipher. It is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS). D: MD5 is a hash function not a block cipher. It is a widely used cryptographic hash function producing a 128-bit (16-byte) hash value, typically expressed in text format as a 32 digit hexadecimal number. E: Pretty Good Privacy (PGP) is not a block cipher. It is a data encryption and decryption program that provides cryptographic privacy and authentication for data communication References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 250, 251, 255-256, 272-273