CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 841:

  Which of the following must a user implement if they want to send a secret message to a coworker by embedding it within an image?

  A. Transport encryption
  B. Steganography
  C. Hashing
  D. Digital signature
  B. Steganography

  ---

  Steganography is the process of concealing a file, message, image, or video within another file, message, image, or video. Note: The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable will arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message. Incorrect Answers: A: Transport encryption encrypt the payload data C: A hash function is used to map digital data of variable size to digital data of fixed length. D: A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 249, 155, 261, 323 http://en.wikipedia.org/wiki/Steganography

• Question 842:

  Verifying the integrity of data submitted to a computer program at or during run-time, with the intent of preventing the malicious exploitation of unintentional effects in the structure of the code, is BEST described as which of the following?

  A. Output sanitization
  B. Input validation
  C. Application hardening
  D. Fuzzing
  B. Input validation

• Question 843:

  Which of the following is an authentication and accounting service that uses TCP for connecting to routers and switches?

  A. DIAMETER
  B. RADIUS
  C. TACACS+
  D. Kerberos
  C. TACACS+

  ---

  TACACS+ is an authentication, authorization, and accounting (AAA) service that makes us of TCP only. Incorrect Answers: A: DIAMETER makes use of TCP, as well as SCTP. B: RADIUS makes use of UDP. D: Kerberos is not an authentication and accounting service, but an authentication protocol. References: http://en.wikipedia.org/wiki/TACACS http://en.wikipedia.org/wiki/Diameter_(protocol) http://en.wikipedia.org/wiki/RADIUS http://en.wikipedia.org/wiki/Kerberos_(protocol)

• Question 844:

  An online store wants to protect user credentials and credit card information so that customers can store their credit card information and use their card for multiple separate transactions.

  Which of the following database designs provides the BEST security for the online store?

  A. Use encryption for the credential fields and hash the credit card field
  B. Encrypt the username and hash the password
  C. Hash the credential fields and use encryption for the credit card field
  D. Hash both the credential fields and the credit card field
  C. Hash the credential fields and use encryption for the credit card field

  ---

  Hashing refers to the hash algorithms used in cryptography. It is used to store data, such as hash tables. One main characteristic of hashing is that the algorithm must have few or no collisions in hashing two different inputs does not give the same output. Thus the credential fields should be hashed because anyone customer will have a unique credit card number/identity and since they will use their credit cards for many different transactions, the credit card field should be encrypted only, not hashed. Incorrect Answers: A: Encryption should be used on the credit card field because the customers could be making many separate transactions using the same credit card. The credential field should be hashed and not encrypted because anyone customer would most likely use a credit card to make purchases and not many credit cards to make purchases at the same online store. B: Credit card customers would not be using usernames and passwords to make purchases from an online store. D: Hashing the credit card field will limit the customers to one transaction only and not multiple separate transactions. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 255, 291

• Question 845:

  Which of the following allows a company to maintain access to encrypted resources when employee turnover is high?

  A. Recovery agent
  B. Certificate authority
  C. Trust model
  D. Key escrow
  A. Recovery agent

  ---

  If an employee leaves and we need access to data he has encrypted, we can use the key recovery agent to retrieve his decryption key. We can use this recovered key to access the data. A key recovery agent is an entity that has the ability to recover a key, key components, or plaintext messages as needed. As opposed to escrow, recovery agents are typically used to access information that is encrypted with older keys. Incorrect Answers: B: A certificate authority (CA) is an organization. A CA is responsible for issuing, revoking, and distributing certificates. A CA cannot recovery keys. C: A trust Model is collection of rules that informs application on how to decide the legitimacy of a Digital Certificate. A trust model cannot recover keys. D: Key escrow is not used to recover old keys. Key escrow addresses the possibility that a third party may need to access keys. Under the conditions of key escrow, the keys needed to encrypt/decrypt data are held in an escrow account (think of the term as it relates to home mortgages) and made available if that third party requests them. The third party in question is generally the government, but it could also be an employer if an employee's private messages have been called into question. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-280, 285-289

• Question 846:

  Developers currently have access to update production servers without going through an approval process. Which of the following strategies would BEST mitigate this risk?

  A. Incident management
  B. Clean desk policy
  C. Routine audits
  D. Change management
  D. Change management

  ---

  Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company's assets. This structured approach involves policies that should be in place and technological controls that should be enforced. Incorrect Answers: A: Incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). These are usually set in a policy that has been approved. B: Clean Desk Policy refers to information on a desk--in terms of printouts, pads of note paper, sticky notes, and the like that can be easily seen by prying eyes and taken by thieving hands. The strategy should be to encourage employees to maintain clean desks and to leave out only those papers that are relevant to the project they are working on at that moment. All sensitive information should be put away when the employee is away from their desk. C: Routine audits are carried out after you have implemented security controls based on risk. These audits include aspects such as user rights and permissions and specific events. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 10, 402

• Question 847:

  After a new firewall has been installed, devices cannot obtain a new IP address. Which of the following ports should Matt, the security administrator, open on the firewall?

  A. 25
  B. 68
  C. 80
  D. 443
  B. 68

  ---

  The Dynamic Host Configuration Protocol (DHCP) is a standardized network protocol used on Internet Protocol (IP) networks for distributing IP addresses for interfaces and services. DHCP makes use of port 68. Incorrect Answers: A: SMTP makes use of port 25. C: HTTP makes use of port 80. D: HTTPS makes use of port 443 References: http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 848:

  Which of the following would satisfy wireless network implementation requirements to use mutual authentication and usernames and passwords?

  A. EAP-MD5
  B. WEP
  C. PEAP-MSCHAPv2
  D. EAP-TLS
  C. PEAP-MSCHAPv2

  ---

  PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS or PEAP-TLS because user authentication is accomplished via password-base credentials (user name and password) rather than digital certificates or smart cards. Incorrect Answers: A: MD5 has been employed in a wide selection of cryptographic applications, and is also commonly used to verify data integrity. B: Usernames and passwords are not required for WEP authentication. D: Authenticated wireless access design based on Extensible Authentication Protocol Transport Level Security (EAP-TLS) can use either smart cards or user and computer certificates to authenticate wireless access clients. EAP-TLS does not use usernames and passwords for authentication. References: https://technet.microsoft.com/en-us/library/dd348500(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd348478(v=ws.10).aspx http://en.wikipedia.org/ wiki/MD5

• Question 849:

  A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. Which of the following is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of transactional data?

  A. AES
  B. 3DES
  C. RC4
  D. WPA2
  B. 3DES

  ---

  3DES (Triple DES) is based on DES. In cryptography, Triple DES (3DES) is the common name for the Triple Data Encryption Algorithm symmetric-key block cipher, which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. The electronic payment industry uses Triple DES and continues to develop and promulgate standards based upon it (e.g. EMV). Microsoft OneNote, Microsoft Outlook 2007, and Microsoft System Center Configuration Manager 2012, use Triple DES to password protect user content and system data. Incorrect Answers: A: AES (Advanced Encryption Standard) has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES) which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. DES and AES are completely different whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler. C: RC4 is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS). DES and AES are different protocols used for different purposes whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler. D: WPA2 (Wireless Protected Access 2) is used for securing wireless network connections. DES and WPA2 are different protocols used for different purposes whereas 3DES is based on DES. Therefore, upgrading the terminals to 3DES would be simpler. References: http://en.wikipedia.org/wiki/Triple_DES http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 172-173, 250, 251, 255-256

• Question 850:

  Which of the following is a penetration testing method?

  A. Searching the WHOIS database for administrator contact information
  B. Running a port scanner against the target's network
  C. War driving from a target's parking lot to footprint the wireless network
  D. Calling the target's helpdesk, requesting a password reset
  D. Calling the target's helpdesk, requesting a password reset