CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 851:

  Separation of duties is often implemented between developers and administrators in order to separate which of the following?

  A. More experienced employees from less experienced employees
  B. Changes to program code and the ability to deploy to production
  C. Upper level management users from standard development employees
  D. The network access layer from the application access layer
  B. Changes to program code and the ability to deploy to production

  ---

  Separation of duties means that there is differentiation between users, employees and duties per se which form part of best practices. Incorrect Answers: A: It is not an issue regarding experience of employees, but rather the difference in duties of employees. C: Developers and administrators are not necessarily upper level management and standard development employees. D: This is a network distinction and not a job description distinction. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 153

• Question 852:

  Ann, a software developer, has installed some code to reactivate her account one week after her account has been disabled. Which of the following is this an example of? (Select TWO).

  A. Rootkit
  B. Logic Bomb
  C. Botnet
  D. Backdoor
  E. Spyware
  B. Logic Bomb
  D. Backdoor

  ---

  This is an example of both a logic bomb and a backdoor. The logic bomb is configured to `go off' or activate one week after her account has been disabled. The reactivated account will provide a backdoor into the system. A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs". To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs. A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit. A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system. Incorrect Answers: A: A rootkit is a collection of tools (programs) that enable administrator-level access to a computer or computer network. Typically, a cracker installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. Once the rootkit is installed, it allows the attacker to mask intrusion and gain root or privileged access to the computer and, possibly, other machines on the network. In this question, a program hasn't been installed. Therefore, a rootkit is not what is described in the question so this answer is incorrect. C: A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network. The term is usually used with a negative or malicious connotation. Computers can be co-opted into a botnet when they execute malicious software. This can be accomplished by luring users into making a drive-by download, exploiting web browser vulnerabilities, or by tricking the user into running a Trojan horse program, which may come from an email attachment. This malware will typically install modules that allow the computer to be commanded and controlled by the botnet's operator. Many computer users are unaware that their computer is infected with bots. Depending on how it is written, a Trojan may then delete itself, or may remain present to update and maintain the modules. In this question, no software has been installed. Therefore, a botnet is not what is described in the question so this answer is incorrect. E: Spyware is software that aids in gathering information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge. "Spyware" is mostly classified into four types: system monitors, trojans, adware, and tracking cookies. Spyware is mostly used for the purposes of tracking and storing Internet users' movements on the Web and serving up pop-up ads to Internet users. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users. In this question, no software has been installed. Therefore, spyware is not what is described in the question so this answer is incorrect. References: http://en.wikipedia.org/wiki/Logic_bomb http://en.wikipedia.org/wiki/Botnet http://www.webopedia.com/TERM/V/virus.html http://en.wikipedia.org/wiki/Backdoor_%28computing%29 http://searchmidmarketsecurity.techtarget.com/definition/rootkit

• Question 853:

  A database administrator contacts a security administrator to request firewall changes for a connection to a new internal application. The security administrator notices that the new application uses a port typically monopolized by a virus. The security administrator denies the request and suggests a new port or service be used to complete the application's task. Which of the following is the security administrator practicing in this example?

  A. Explicit deny
  B. Port security
  C. Access control lists
  D. Implicit deny
  C. Access control lists

  ---

  Traffic that comes into the router is compared to ACL entries based on the order that the entries occur in the router. New statements are added to the end of the list. The router continues to look until it has a match. If no matches are found when the router reaches the end of the list, the traffic is denied. For this reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic that is not permitted. Incorrect Answers: A: An explicit deny would block the application until it is added to the ACL. B: Port security in IT can mean several things: The physical control of all connection points, such as RJ-45 wall jacks or device ports, so that no unauthorized users or unauthorized devices can attempt to connect into an open port. The management of TCP and User Datagram Protocol (UDP) ports. If a service is active and assigned to a port, then that port is open. All the other 65,535 ports (of TCP or UDP) are closed if a service isn't actively using them. Port knocking is a security system in which all ports on a system appear closed. However, if the client sends packets to a specific set of ports in a certain order, a bit like a secret knock, then the desired service port becomes open and allows the client software to connect to the service. C: Implicit deny is the default security stance that says if you aren't specifically granted access or privileges for a resource, you're denied access by default. References: http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 24, 26.

• Question 854:

  Which of the following file systems is from Microsoft and was included with their earliest operating systems?

  A. NTFS
  B. UFS
  C. MTFS
  D. FAT
  D. FAT

  ---

  File Allocation Table (FAT) is a file system created by Microsoft and used for its earliest DOS operating systems. Incorrect Answers: A: NTFS is a file system created by Microsoft but it was first used on its Windows NT Server operating systems. NTFS has file and folder level access permissions and auditing capabilities. It was not used with Microsoft's earliest operating systems. B: Unix File System (UFS) is a file system created for the Unix operating system. C: Multi-Threaded File System (MTFS) is a file system created for the Linux based operating systems. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 58-59 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 203 http://en.wikipedia.org/ wiki/File_Allocation_Table http://en.wikipedia.org/wiki/Unix_File_System

• Question 855:

  An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network security, the administrator desires to provide network access for this group only. Which of the following would BEST address this desire?

  A. Install a proxy server between the users' computers and the switch to filter inbound network traffic.
  B. Block commonly used ports and forward them to higher and unused port numbers.
  C. Configure the switch to allow only traffic from computers based upon their physical address.
  D. Install host-based intrusion detection software to monitor incoming DHCP Discover requests.
  C. Configure the switch to allow only traffic from computers based upon their physical address.

  ---

  Configuring the switch to allow only traffic from computers based upon their physical address is known as MAC filtering. The physical address is known as the MAC address. Every network adapter has a unique MAC address hardcoded into the adapter. You can configure the ports of a switch to allow connections from computers with specific MAC addresses only and block all other MAC addresses. MAC filtering is commonly used in wireless networks but is considered insecure because a MAC address can be spoofed. However, in a wired network, it is more secure because it would be more difficult for a rogue computer to sniff a MAC address. Incorrect Answers: A: A proxy server is often used to filter web traffic. It is not used in port security or to restrict which computers can connect to a network. B: You should not block commonly used ports. This would just stop common applications and protocols working. It would not restrict which computers can connect to a network. D: DHCP Discover requests are part of the DHCP process. A DHCP client will send out a DHCP Discover request to locate a DHCP server. All computers on the network receive the DHCP Discover request because it is a broadcast packet but all computers (except the DHCP server) will just drop the packet. Blocking DHCP Discover requests will not restrict which computers can connect to a network. References: http://alliedtelesis.com/manuals/awplusv212weba/mac_address_Port_security.html

• Question 856:

  Which of the following attacks involves the use of previously captured network traffic?

  A. Replay
  B. Smurf
  C. Vishing
  D. DDoS
  A. Replay

• Question 857:

  A new client application developer wants to ensure that the encrypted passwords that are stored in their database are secure from cracking attempts. To implement this, the developer implements a function on the client application that hashes passwords thousands of times prior to being sent to the database. Which of the following did the developer MOST likely implement?

  A. RIPEMD
  B. PBKDF2
  C. HMAC
  D. ECDHE
  B. PBKDF2

• Question 858:

  Which of the following helps to apply the proper security controls to information?

  A. Data classification
  B. Deduplication
  C. Clean desk policy
  D. Encryption
  A. Data classification

  ---

  Information classification is done by confidentiality and comprises of three categories, namely: public use, internal use and restricted use. These categories make applying the appropriate policies and security controls practical. Incorrect Answers: B: Deduplication is a specialized data compression technique for eliminating duplicate copies of repeating data. Related and somewhat synonymous terms are intelligent (data) compression and single-instance (data) storage. C: Clean Desk Policy Information on a desk--in terms of printouts, pads of note paper, sticky notes, and the like--can be easily seen by prying eyes and taken by thieving hands. To protect data and your business, encourage employees to maintain clean desks and to leave out only those papers that are relevant to the project they are working on at that moment. All sensitive information should be put away when the employee is away from their desk. This however applies only to a certain category of information. D: Encryption of data/information is but one type of security control and the question is more concerned about the proper security controls that needs to be applied and when data is classified it makes the type of security control to be employed more appropriate. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 404, 409

• Question 859:

  Which of the following must be kept secret for a public key infrastructure to remain secure?

  A. Certificate Authority
  B. Certificate revocation list
  C. Public key ring
  D. Private key
  D. Private key

  ---

  The private key, which is also called the secret key, must be kept secret. Incorrect Answers: A: The CA must be accessible. It should not be kept secret. A certificate authority (CA) is an organization. A CA is responsible for issuing, revoking, and distributing certificates. B: The CRL should be readily accessible. It should be posted on a publically accessible location. A CRL is a database of revoked keys and signatures. C: A public key ring must be available for all. A public key ring is often implemented as a file with public keys in it. The traditional PGP Key Ring is a sequential file with a sequential list of keys in it. Slightly more advanced key rings, such as those used in Key Servers actually use a database. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-280, 279-285, 285

• Question 860:

  Allowing unauthorized removable devices to connect to computers increases the risk of which of the following?

  A. Data leakage prevention
  B. Data exfiltration
  C. Data classification
  D. Data deduplication
  B. Data exfiltration

  ---

  Data exfiltration is the unauthorized copying, transfer or retrieval of data from a system. Incorrect Answers: A: Data leak prevention is designed to detect potential data breach or data exfiltration and prevent them by monitoring, detecting and blocking sensitive data. C: Data classification is the categorizing of data based on its sensitivity or desired level of confidentiality. This can be high, medium, low. D: Data deduplication is a specialized data compression technique for identifying and eliminating duplicate copies of data. References: http://en.wikipedia.org/wiki/Data_loss_prevention_software http://www.techopedia.com/definition/14682/data-exfiltration http://en.wikipedia.org/wiki/ Data_deduplication Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 409