CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 811:

  Which of the following BEST describes using a smart card and typing in a PIN to gain access to a system?

  A. Biometrics
  B. PKI
  C. Single factor authentication
  D. Multifactor authentication
  D. Multifactor authentication

  ---

  Multifactor authentication requires a user to provide two or more authentication factors for authentication purposes. In this case, a smart card (something they have) is one and a PIN (something they know) is the second. Incorrect Answers: A: Biometrics refers to a collection of physical attributes of the human body that can be used for authentication. It is an authentication factor type. Something they are. B: Public Key Infrastructure (PKI) centers on proving the identity of communication partners. PKI makes use of asymmetric cryptographic solutions to securely exchange session-based symmetric encryption keys. PKI also makes use of hashing to protect message integrity. C: Single factor authentication only requires one authentication factor for authentication purposes. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 282, 285, 350.

• Question 812:

  Which of the following could a security administrator implement to mitigate the risk of tailgating for a large organization?

  A. Train employees on correct data disposal techniques and enforce policies.
  B. Only allow employees to enter or leave through one door at specified times of the day.
  C. Only allow employees to go on break one at a time and post security guards 24/7 at each entrance.
  D. Train employees on risks associated with social engineering attacks and enforce policies.
  D. Train employees on risks associated with social engineering attacks and enforce policies.

  ---

  Tailgating is the term used for someone being so close to you when you enter a building that they are able to come in right behind you without needing to use a key, a card, or any other security device. Many social engineering intruders needing physical access to a site will use this method of gaining entry. Educate users to beware of this and other social engineering ploys and prevent them from happening. Incorrect Answers: A: Data disposal methods refers to how data is disposed off, especial by destroying the media on which it was stored, this will not safeguard the company from the risks involved with tailgating. B: Leaving or entering a building at specified times do not prevent tailgating in fact it could facilitate tailgating in that culprits will know what times they can try to gain unlawful entry. C: It is hugely impractical for a large corporation to only allow employees to go on a break one at a time. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 353, 405, 408

• Question 813:

  An email client says a digital signature is invalid and the sender cannot be verified. The recipient is concerned with which of the following concepts?

  A. Integrity
  B. Availability
  C. Confidentiality
  D. Remediation
  A. Integrity

  ---

  A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. The message is encrypted using the encryption system, and a second piece of information, the digital signature, is added to the message. Digital Signatures is used to validate the integrity of the message and the sender. Integrity means the message can't be altered without detection. Incorrect Answers: B: Availability refers to the measures that are used to keep services and systems operational C: Confidentiality means that the message/data retains its privacy. D: Remediation is concerned with security posturing. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 261, 291, 414

• Question 814:

  The network administrator is responsible for promoting code to applications on a DMZ web server. Which of the following processes is being followed to ensure application integrity?

  A. Application hardening
  B. Application firewall review
  C. Application change management
  D. Application patch management
  C. Application change management

  ---

  Change management is the structured approach that is followed to secure a company's assets. Promoting code to application on a SMZ web server would be change management. Incorrect Answers: A: Application Hardening is a strategy to make servers and workstations less vulnerable to exploitation and attack. B: Application firewall review is a strategy used to look for risk, threat, and vulnerability. D: Application patch management is used to support ownership in that it will keep your software up to date. In most cases the software would be the operating system rather than applications. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 215-218, 345

• Question 815:

  Which of the following can be utilized in order to provide temporary IT support during a disaster, where the organization sets aside funds for contingencies, but does not necessarily have a dedicated site to restore those services?

  A. Hot site
  B. Warm site
  C. Cold site
  D. Mobile site
  D. Mobile site

  ---

  Not having a dedicated site means that the mobile site can fill the role of either being a hot, warm or cold site as a disaster recovery measure. Incorrect Answers: A: A hot site is a location that can provide operations within hours of a failure. This type of site would have servers, networks, and telecommunications equipment in place to reestablish service in a short time. Hot sites provide network connectivity, systems, and preconfi gured software to meet the needs of an organization. Databases can be kept up-to-date using network connections. These types of facilities are expensive, and they're primarily suitable for short-term situations. B: A warm site provides some of the capabilities of a hot site, but it requires the customer to do more work to become operational. Warm sites provide computer systems and compatible media capabilities. C: A cold site is a facility that isn't immediately ready to use. The organization using it must bring along its equipment and network. A cold site may provide network capability, but this isn't usually the case; the site provides a place for operations to resume, but it doesn't provide the infrastructure to support those operations. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 443-444

• Question 816:

  A company is concerned that a compromised certificate may result in a man-in-the-middle attack against backend financial servers. In order to minimize the amount of time a compromised certificate would be accepted by other servers, the

  company decides to add another validation step to SSL/TLS connections.

  Which of the following technologies provides the FASTEST revocation capability?

  A. Online Certificate Status Protocol (OCSP)
  B. Public Key Cryptography (PKI)
  C. Certificate Revocation Lists (CRL)
  D. Intermediate Certificate Authority (CA)
  A. Online Certificate Status Protocol (OCSP)

• Question 817:

  A security administrator must implement a secure key exchange protocol that will allow company clients to autonomously exchange symmetric encryption keys over an unencrypted channel. Which of the following MUST be implemented?

  A. SHA-256
  B. AES
  C. Diffie-Hellman
  D. 3DES
  C. Diffie-Hellman

• Question 818:

  During a penetration test from the Internet, Jane, the system administrator, was able to establish a connection to an internal router, but not successfully log in to it. Which ports and protocols are MOST likely to be open on the firewall? (Select FOUR).

  A. 21
  B. 22
  C. 23
  D. 69
  E. 3389
  F. SSH
  G. Terminal services
  H. Rlogin
  I. Rsync
  J. Telnet
  B. 22
  C. 23
  F. SSH
  J. Telnet

  ---

  The question states that Jane was able to establish a connection to an internal router. Typical ports and protocols used to connect to a router include the following: B, F: Port 22 which is used by SSH (Secure Shell). C, J: Port 23 which is used by Telnet. SSH and Telnet both provide command line interfaces for administering network devices such as routers and switches. Incorrect Answers: A: Port 21 is used by FTP (File Transfer Protocol). It is used for downloading and uploading files over a network using a TCP connection. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. D: Port 69 is used by TFTP (Trivial File Transfer Protocol). It is used for downloading and uploading files over a network using a UDP connection. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. E: Port 3389 is used by Remote Desktop Protocol (RDP). RDP is used for connecting to Windows computers. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. G: Terminal Services is an earlier name for Remote Desktop Services. Terminal Services uses Remote Desktop Protocol (RDP) on port 3389. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. H: Rlogin (Remote Login) uses port 513 and is used for connecting to Linux or Unix computers. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. I: RSync is a file synchronization protocol that uses port 873. It is used for synchronizing files between Linux or Unix computers. It is not used for connecting to network devices such as routers or switches. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 819:

  A trojan was recently discovered on a server. There are now concerns that there has been a security breach that allows unauthorized people to access data. The administrator should be looking for the presence of a/an:

  A. Logic bomb.
  B. Backdoor.
  C. Adware application.
  D. Rootkit.
  B. Backdoor.

  ---

  There has been a security breach on a computer system. The security administrator should now check for the existence of a backdoor. A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit. A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system. Although the number of backdoors in systems using proprietary software (software whose source code is not publicly available) is not widely credited, they are nevertheless frequently exposed. Programmers have even succeeded in secretly installing large amounts of benign code as Easter eggs in programs, although such cases may involve official forbearance, if not actual permission. Many computer worms, such as Sobig and Mydoom, install a backdoor on the affected computer (generally a PC on broadband running Microsoft Windows and Microsoft Outlook). Such backdoors appear to be installed so that spammers can send junk e-mail from the infected machines. Others, such as the Sony/BMG rootkit distributed silently on millions of music CDs through late 2005, are intended as DRM measures--and, in that case, as data gathering agents, since both surreptitious programs they installed routinely contacted central servers. Incorrect Answers: A: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs". To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs. A logic bomb is not a security breach that allows unauthorized people to access data. Therefore, this answer is incorrect. C: Adware is free software that is supported by advertisements. Common adware programs are toolbars that sit on your desktop or work in conjunction with your Web browser. They include features like advanced searching of the Web or your hard drive and better organization of your bookmarks and shortcuts. Adware can also be more advanced programs such as games or utilities. They are free to use, but require you to watch advertisements as long as the programs are open. Since the ads often allow you to click to a Web site, adware typically requires an active Internet connection to run. Most adware is safe to use, but some can serve as spyware, gathering information about you from your hard drive, the Web sites you visit, or your keystrokes. Spyware programs can then send the information over the Internet to another computer. So be careful what adware you install on your computer. Make sure it is from a reputable company and read the privacy agreement that comes with it. Adware is not a security breach that allows unauthorized people to access data. Therefore, this answer is incorrect. D: A rootkit is a collection of tools (programs) that enable administrator-level access to a computer or computer network. Typically, a cracker installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. Once the rootkit is installed, it allows the attacker to mask intrusion and gain root or privileged access to the computer and, possibly, other machines on the network. A rootkit may consist of spyware and other programs that: monitor traffic and keystrokes; create a "backdoor" into the system for the hacker's use; alter log files; attack other machines on the network; and alter existing system tools to escape detection. The presence of a rootkit on a network was first documented in the early 1990s. At that time, Sun and Linux operating systems were the primary targets for a hacker looking to install a rootkit. Today, rootkits are available for a number of operating systems, including Windows, and are increasingly difficult to detect on any network. While a rootkit does allow an attacker administrator-level access to a computer, a backdoor is a specific term used to describe a security breach that allows unauthorized people to access data. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Backdoor_%28computing%29 http://en.wikipedia.org/wiki/Logic_bomb http://techterms.com/definition/adware http://searchmidmarketsecurity.techtarget.com/definition/rootkit

• Question 820:

  Which of the following BEST describes the weakness in WEP encryption?

  A. The initialization vector of WEP uses a crack-able RC4 encryption algorithm. Once enough packets are captured an XOR operation can be performed and the asymmetric keys can be derived.
  B. The WEP key is stored in plain text and split in portions across 224 packets of random data. Once enough packets are sniffed the IV portion of the packets can be removed leaving the plain text key.
  C. The WEP key has a weak MD4 hashing algorithm used. A simple rainbow table can be used to generate key possibilities due to MD4 collisions.
  D. The WEP key is stored with a very small pool of random numbers to make the cipher text. As the random numbers are often reused it becomes easy to derive the remaining WEP key.
  D. The WEP key is stored with a very small pool of random numbers to make the cipher text. As the random numbers are often reused it becomes easy to derive the remaining WEP key.

  ---

  WEP is based on RC4, but due to errors in design and implementation, WEP is weak in a number of areas, two of which are the use of a static common key and poor implementation of initiation vectors (IVs). When the WEP key is discovered, the attacker can join the network and then listen in on all other wireless client communications. Incorrect Answers: A: RC4 itself is not crack-able, but the IV that is crack-able. B: The initialization vector (IV) that WEP uses for encryption is 24-bit and IVs are reused with the same key. By examining the repeating result, it is easy for intruders to crack the WEP secret key, known as an IV attack. C: WEP does not use the MD4 hashing algorithm, but RC4. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 189.