CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 861:

  Which of the following would a security administrator implement in order to identify a problem between two systems that are not communicating properly?

  A. Protocol analyzer
  B. Baseline report
  C. Risk assessment
  D. Vulnerability scan
  A. Protocol analyzer

  ---

  A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. Capturing and analyzing the packets sent from two systems that are not communicating properly could help determine the cause of the issue. Well known software protocol analyzers include Message Analyzer (formerly Network Monitor) from Microsoft and Wireshark (formerly Ethereal). Incorrect Answers: B: A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline). It is not used to troubleshoot communication issues between two systems. C: A risk assessment (in this context) is the process of evaluating threats and vulnerabilities to the network and/or I.T. infrastructure. It is not used to troubleshoot communication issues between two systems. D: A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment. It is not used to troubleshoot communication issues between two systems. References: http://en.wikipedia.org/wiki/Wireshark

• Question 862:

  While rarely enforced, mandatory vacation policies are effective at uncovering:

  A. Help desk technicians with oversight by multiple supervisors and detailed quality control systems.
  B. Collusion between two employees who perform the same business function.
  C. Acts of incompetence by a systems engineer designing complex architectures as a member of a team.
  D. Acts of gross negligence on the part of system administrators with unfettered access to system and no oversight.
  D. Acts of gross negligence on the part of system administrators with unfettered access to system and no oversight.

  ---

  Least privilege (privilege reviews) and job rotation is done when mandatory vacations are implemented. Then it will uncover areas where the system administrators neglected to check all users' privileges since the other users must fill in their positions when they are on their mandatory vacation. Incorrect Answers: A: Help desk technicians are not the main concern for having mandatory vacations. B: Collusion implies two unlikely users fulfilling very different functions committing fraud, not two users performing the same business function. C: Incompetency of the systems engineer regarding the architecture is not the focus of companies implementing mandatory vacations. References: D Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 25

• Question 863:

  Which of the following is synonymous with a server's certificate?

  A. Public key
  B. CRL
  C. Private key
  D. Recovery agent
  A. Public key

  ---

  A public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove ownership of a public key. Incorrect Answers: B: A CRL is not a certificate. It is a database consisting of revoked keys and signatures. C: A private key is not a certificate. A public key is a certificate. D: A recovery agent is not a certificate. A recovery agent is used to recover keys. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 279-285, 285

• Question 864:

  Ann, a security administrator at a call center, has been experiencing problems with users intentionally installing unapproved and occasionally malicious software on their computers. Due to the nature of their jobs, Ann cannot change their permissions. Which of the following would BEST alleviate her concerns?

  A. Deploy a HIDS suite on the users' computers to prevent application installation.
  B. Maintain the baseline posture at the highest OS patch level.
  C. Enable the pop-up blockers on the users' browsers to prevent malware.
  D. Create an approved application list and block anything not on it.
  D. Create an approved application list and block anything not on it.

• Question 865:

  Identifying a list of all approved software on a system is a step in which of the following practices?

  A. Passively testing security controls
  B. Application hardening
  C. Host software baselining
  D. Client-side targeting
  C. Host software baselining

  ---

  Application baseline defines the level or standard of security that will be implemented and maintained for the application. It may include requirements of hardware components, operating system versions, patch levels, installed applications and their configurations, and available ports and services. Systems can be compared to the baseline to ensure that the required level of security is being maintained. Incorrect Answers: A: Passive testing of security controls is performed by automated vulnerability scanners. The scanners detect the security control as it attempts a test. These tests are performed against targets but not specifically directed toward the security measures themselves. B: Hardening is the process of securing a system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing or disabling unnecessary functions and features, removing or disabling unnecessary user accounts, disabling unnecessary protocols and ports, and disabling unnecessary services. D: Client-side targeting is an aspect Windows Group Policy that allows security configurations to be applied to specific types of devices or device groups. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 215-217, 219 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 208, https:// technet.microsoft.com/en-us/library/dd252762.aspx

• Question 866:

  After a production outage, which of the following documents contains detailed information on the order in which the system should be restored to service?

  A. Succession planning
  B. Disaster recovery plan
  C. Information security plan
  D. Business impact analysis
  B. Disaster recovery plan

  ---

  A disaster-recovery plan, or scheme, helps an organization respond effectively when a disaster occurs. Disasters may include system failure, network failure, infrastructure failure, and natural disaster. The primary emphasis of such a plan is reestablishing services and minimizing losses. Incorrect Answers: A: Succession planning outlines those internal to the organization that has the ability to step into positions when they open. By identifying key roles that cannot be left unfilled and associating internal employees who can step into these roles, you can groom those employees to make sure that they are up to speed when it comes time for them to fill those positions. C: Information security plan focusses on the integrity and confidentiality of documents. D: A business impact analysis is part of the business continuity planning and focuses on evaluating the processes. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 29, 433-434, 454

• Question 867:

  In which of the following categories would creating a corporate privacy policy, drafting acceptable use policies, and group based access control be classified?

  A. Security control frameworks
  B. Best practice
  C. Access control methodologies
  D. Compliance activity
  B. Best practice

  ---

  Best practices are based on what is known in the industry and those methods that have consistently shown superior results over those achieved by other means. Furthermore best practices are applied to all aspects in the work environment. Incorrect Answers: A: Security control frameworks refer to the backbone of SAFE (architecture) and unification is the underlying key to security which incorporates all ptrs of the network, including the WAN, the extranet, the Internet, and the intranet. C: Access control methodologies refer to Mandatory- Discretionary- and Rule-based access control types that can be implemented. D: Compliance activity usually comes into focus when a third party involvement is being considered. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 29

• Question 868:

  A new virtual server was created for the marketing department. The server was installed on an existing host machine. Users in the marketing department report that they are unable to connect to the server. Technicians verify that the server has an IP address in the same VLAN as the marketing department users. Which of the following is the MOST likely reason the users are unable to connect to the server?

  A. The new virtual server's MAC address was not added to the ACL on the switch
  B. The new virtual server's MAC address triggered a port security violation on the switch
  C. The new virtual server's MAC address triggered an implicit deny in the switch
  D. The new virtual server's MAC address was not added to the firewall rules on the switch
  A. The new virtual server's MAC address was not added to the ACL on the switch

  ---

  Configuring the switch to allow only traffic from computers based upon their physical address is known as MAC filtering. The physical address is known as the MAC address. Every network adapter has a unique MAC address hardcoded into the adapter. You can configure the ports of a switch to allow connections from computers with specific MAC addresses only and block all other MAC addresses. In computer networking, MAC Filtering (or GUI filtering, or layer 2 address filtering) refers to a security access control method whereby the 48-bit address assigned to each network card is used to determine access to the network. MAC addresses are uniquely assigned to each card, so using MAC filtering on a network permits and denies network access to specific devices through the use of blacklists and whitelists. While the restriction of network access through the use of lists is straightforward, an individual person is not identified by a MAC address, rather a device only, so an authorized person will need to have a whitelist entry for each device that he or she would use to access the network. Incorrect Answers: B: The new virtual server's MAC address triggering a port security violation on the switch may happen if the MAC address was not added to the ACL on the switch. However, the port security violation is not the actual cause of the users being unable to connect to the server. The MAC address not being added to the ACL on the switch is what would prevent the users connecting to the server. Therefore this answer is incorrect. C: The new virtual server's MAC address triggering an implicit deny in the switch would happen if the MAC address met a condition that caused the deny. This is unlikely. The MAC address not being added to the ACL on the switch to allow access if more likely. Therefore this answer is incorrect. D: Dedicated network switches don't tend to have firewalls. A typical home wireless router may function as a switch and a firewall. However, even in this case, the firewall typically wouldn't prevent communications between devices connected to the switch. This answer is very unlikely and is therefore incorrect. References: http://en.wikipedia.org/wiki/MAC_filtering

• Question 869:

  When reviewing security logs, an administrator sees requests for the AAAA record of www.comptia.com. Which of the following BEST describes this type of record?

  A. DNSSEC record
  B. IPv4 DNS record
  C. IPSEC DNS record
  D. IPv6 DNS record
  D. IPv6 DNS record

  ---

  The AAAA Address record links a FQDN to an IPv6 address. Incorrect Answers: A, C: There is no specific DNSSEC or IPSEC DNS record B: The A Address record links a FQDN to an IPv4 address. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 44. http://en.wikipedia.org/wiki/List_of_DNS_record_types

• Question 870:

  Which of the following types of application attacks would be used to identify malware causing security breaches that have NOT yet been identified by any trusted sources?

  A. Zero-day
  B. LDAP injection
  C. XML injection
  D. Directory traversal
  A. Zero-day

  ---

  The security breaches have NOT yet been identified. This is zero day vulnerability. A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. Incorrect Answers: B: LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree. The same advanced exploitation techniques available in SQL Injection can be similarly applied in LDAP Injection. LDAP injection is not a term used for an unknown security breach. This answer is therefore incorrect. C: When a web user takes advantage of a weakness with SQL by entering values that they should not, it is known as a SQL injection attack. Similarly, when the user enters values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user's input and sanitize it to make certain that it does not cause XPath to return more data than it should. XML injection is not a term used for an unknown security breach. This answer is therefore incorrect. D: Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server. Although some educated guesswork is involved in finding paths to restricted files on a Web server, a skilled hacker can easily carry out this type of attack on an inadequately protected server by searching through the directory tree. The risk of such attacks can be minimized by careful Web server programming, the installation of software updates and patches, filtering of input from browsers, and the use of vulnerability scanners. Directory traversal is not a term used for an unknown security breach. This answer is therefore incorrect. References: http://www.pctools.com/security-news/zero-day-vulnerability/ https://www.owasp.org/index.php/LDAP_injection Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 337 http:// searchsecurity.techtarget.com/definition/directory-traversal