CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 821:

  A computer is found to be infected with malware and a technician re-installs the operating system. The computer remains infected with malware. This is an example of:

  A. a rootkit.
  B. a MBR infection.
  C. an exploit kit.
  D. Spyware.
  B. a MBR infection.

• Question 822:

  The Chief Executive Officer (CEO) receives a suspicious voice mail warning of credit card fraud. No one else received the voice mail. Which of the following BEST describes this attack?

  A. Whaling
  B. Vishing
  C. Spear phishing
  D. Impersonation
  A. Whaling

• Question 823:

  Which of the following is characterized by an attacker attempting to map out an organization's staff hierarchy in order to send targeted emails?

  A. Whaling
  B. Impersonation
  C. Privilege escalation
  D. Spear phishing
  A. Whaling

  ---

  A whaling attack is targeted at company executives. Mapping out an organization's staff hierarchy to determine who the people at the top are is also part of a whaling attack. Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats. Incorrect Answers: B: Impersonation is where a person, computer, software application or service pretends to be someone it's not. Impersonation is commonly non-maliciously used in client/server applications. However, it can also be used as a security threat. No examples of impersonation occurred in this question. Therefore, this answer is incorrect. C: Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The attack described in the question is not an example of privilege escalation. Therefore, this answer is incorrect. D: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority. Mapping out an organization's staff hierarchy could be used for a spear phishing attack. However, the emails in a spear phishing attack would be sent to everyone in the company (not targeted to specific people) with the sender ID spoofed to appear to be from someone in authority. In this question, it's likely that the emails would be targeted to the executives and that would be an example of whaling. Therefore, this answer is incorrect. References: http://www.techopedia.com/definition/28643/whaling http://searchsecurity.techtarget.com/definition/spear-phishing

• Question 824:

  In order to maintain oversight of a third party service provider, the company is going to implement a Governance, Risk, and Compliance (GRC) system. This system is promising to provide overall security posture coverage. Which of the following is the MOST important activity that should be considered?

  A. Continuous security monitoring
  B. Baseline configuration and host hardening
  C. Service Level Agreement (SLA) monitoring
  D. Security alerting and trending
  A. Continuous security monitoring

  ---

  The company is investing in a Governance, Risk, and Compliance (GRC) system to provide overall security posture coverage. This is great for testing the security posture. However, to be effective and ensure the company always has a good security posture, you need to monitor the security continuously. Once a baseline security configuration is documented, it is critical to monitor it to see that this baseline is maintained or exceeded. A popular phrase among personal trainers is "that which gets measured gets improved." Well, in network security, "that which gets monitored gets secure." Continuous monitoring means exactly that: ongoing monitoring. This may involve regular measurements of network traffic levels, routine evaluations for regulatory compliance, and checks of network security device configurations. Incorrect Answers: B: Baseline configuration and host hardening should be performed initially or when new computer systems are implemented. However, after that has been done, you should continue to monitor the security of the system. Therefore, this answer is incorrect. C: Service Level Agreement (SLA) monitoring is performed to ensure that the availability of the system meets SLA's agreed with your customers. It does not affect or ensure the security of the system. Therefore, this answer is incorrect. D: Security alerting and trending is important. However, this can only happen with continuous security monitoring. Therefore, this answer is incorrect. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 61

• Question 825:

  Which of the following security awareness training is BEST suited for data owners who are concerned with protecting the confidentiality of their data?

  A. Social networking use training
  B. Personally owned device policy training
  C. Tailgating awareness policy training
  D. Information classification training
  D. Information classification training

  ---

  Information classification is done by confidentiality and comprises of three categories, namely: public use, internal use and restricted use. Knowing these categories and how to handle data according to its category is essential in protecting the confidentiality of the data. Incorrect Answers: A: Social networking can sometimes be a useful marketing tool, however most companies would rather choose to avoid social networking since the exposure of your data would be too great. Risk avoidance would be better. B: It is best policy for companies not to allow users to bring their own devises why would they provide training for own devices other than informing users that they are not allowed to bring their own devices. C: Tailgating refers to the act of following someone through a door they just unlocked. This is a physical security issue. References: Dul Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 404

• Question 826:

  Purchasing receives a phone call from a vendor asking for a payment over the phone. The phone number displayed on the caller ID matches the vendor's number. When the purchasing agent asks to call the vendor back, they are given a different phone number with a different area code.

  Which of the following attack types is this?

  A. Hoax
  B. Impersonation
  C. Spear phishing
  D. Whaling
  B. Impersonation

  ---

  In this question, the impersonator is impersonating a vendor and asking for payment. They have managed to `spoof' their calling number so that their caller ID matches the vendor's number. Impersonation is where a person, computer, software application or service pretends to be someone or something it's not. Impersonation is commonly non-maliciously used in client/server applications. However, it can also be used as a security threat. Incorrect Answers: A: A hoax is something that makes a person believe that something is real when it is not. A hoax is usually not malicious or theft. Therefore, this answer is incorrect. C: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority. Spear phishing involves email spoofing rather than telephone spoofing. Therefore this answer is incorrect. D: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats. This is not what is described in this question. Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/spear-phishing http://www.techopedia.com/definition/28643/whaling

• Question 827:

  Which of the following would BEST be used to calculate the expected loss of an event, if the likelihood of an event occurring is known? (Select TWO).

  A. DAC
  B. ALE
  C. SLE
  D. ARO
  E. ROI
  B. ALE
  C. SLE

  ---

  ALE (Annual Loss Expectancy) is equal to the SLE (Single Loss Expectancy) times the annualized rate of occurrence. SLE (Single Loss Expectancy) is equal to asset value (AV) times exposure factor (EF). Incorrect Answers: A: DAC is short for Discretionary Access Control which allows some information sharing flexibility capabilities within the network. D: ARO (annualized rate of occurrence) is the frequency (in number of years) that an event can be expected to happen. E: ROI (Rate Of Investment) is the benefit (return) of an investment is divided by the cost of the investment; the result is expressed as a percentage or a ratio. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 5-6

• Question 828:

  A set of standardized system images with a pre-defined set of applications is used to build end-user workstations. The security administrator has scanned every workstation to create a current inventory of all applications that are installed on active workstations and is documenting which applications are out- of-date and could be exploited. The security administrator is determining the:

  A. attack surface.
  B. application hardening effectiveness.
  C. application baseline.
  D. OS hardening effectiveness.
  A. attack surface.

• Question 829:

  During a disaster recovery planning session, a security administrator has been tasked with determining which threats and vulnerabilities pose a risk to the organization. Which of the following should the administrator rate as having the HIGHEST frequency of risk to the organization?

  A. Hostile takeovers
  B. Large scale natural disasters
  C. Malware and viruses
  D. Corporate espionage
  C. Malware and viruses

• Question 830:

  Ann, a security analyst, is preparing for an upcoming security audit. To ensure that she identifies unapplied security controls and patches without attacking or compromising the system, Ann would use which of the following?

  A. Vulnerability scanning
  B. SQL injection
  C. Penetration testing
  D. Antivirus update
  A. Vulnerability scanning

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Incorrect Answers: B: SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. SQL injection is not a method used to test for unapplied security controls and patches. Therefore, this answer is incorrect. C: Penetration testing evaluates an organization's ability to protect its networks, applications, computers and users from attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets. The difference between a vulnerability scan and a penetration test is that by performing a penetration test, you are actually trying to access a system by exploiting a weakness in the system. This question states that you need to test for unapplied security controls and patches without attacking or compromising the system. Therefore, this answer is incorrect. D: An antivirus update is the process of updating the virus definition files used by antivirus software. It is not used to test for unapplied security controls and patches. Therefore, this answer is incorrect. References: http://www.webopedia.com/TERM/V/vulnerability_scanning.html http://en.wikipedia.org/wiki/SQL_injection