CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 891:

  Which of the following should an administrator implement to research current attack methodologies?

  A. Design reviews
  B. Honeypot
  C. Vulnerability scanner
  D. Code reviews
  B. Honeypot

  ---

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies. According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes: The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers. There are two main types of honeypots: Production - A production honeypot is one used within an organization's environment to help mitigate risk. Research A research honeypot add value to research in computer security by providing a platform to study the threat. Incorrect Answers: A: Reviewing the design of a system would not help to determine current attack methodologies. You would use a honeypot to determine current attack methodologies. You might then have a design review to counteract the threats. C: A vulnerability scanner scans a system or network for known vulnerabilities. It is not used to determine new attack methodologies. D: Reviewing the code of an application would not help to determine current attack methodologies. You would use a honeypot to determine current attack methodologies. You might then have a code review to counteract the threats. References: https://ethics.csc.ncsu.edu/abuse/hacking/honeypots/study.php

• Question 892:

  On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages.

  Which of the following is the MOST likely cause for this issue?

  A. Too many incorrect authentication attempts have caused users to be temporarily disabled.
  B. The DNS server is overwhelmed with connections and is unable to respond to queries.
  C. The company IDS detected a wireless attack and disabled the wireless network.
  D. The Remote Authentication Dial-In User Service server certificate has expired.
  D. The Remote Authentication Dial-In User Service server certificate has expired.

  ---

  The question states that the network uses 802.1x with PEAP. The 802.1x authentication server is typically an EAP-compliant Remote Access Dial-In User Service (RADIUS). A RADIUS server will be configured with a digital certificate. When a digital certificate is created, an expiration period is configured by the Certificate Authority (CA). The expiration period is commonly one or two years. The question states that no configuration changes have been made so it's likely that the certificate has expired. Incorrect Answers: A: The question asks for the most likely cause of the issue. It's very unlikely that all the users have forgotten their passwords on the same day to cause too many incorrect authentication attempts and caused users to be temporarily disabled. B: The question asks for the most likely cause of the issue. A DNS server can usually handle thousands of DNS requests. Even if a DNS server was overwhelmed, the users would still be able to connect to the wireless network. C: The question asks for the most likely cause of the issue. The company IDS detected a wireless attack and disabled the wireless network is very unlikely. References: https://technet.microsoft.com/en-us/library/cc759077%28v=ws.10%29.aspx

• Question 893:

  A security administrator has configured FTP in passive mode. Which of the following ports should the security administrator allow on the firewall by default?

  A. 20
  B. 21
  C. 22
  D. 23
  B. 21

  ---

  When establishing an FTP session, clients start a connection to an FTP server that listens on TCP port 21 by default. Incorrect Answers: A: FTP uses port 20, but it is not the default port. C: SSH uses TCP port 22. D: Telnet uses port 23. References: http://compnetworking.about.com/od/tcpip/p/port-numbers-21-ftp.htm http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 894:

  A recent intrusion has resulted in the need to perform incident response procedures. The incident response team has identified audit logs throughout the network and organizational systems which hold details of the security breach. Prior to this incident, a security consultant informed the company that they needed to implement an NTP server on the network. Which of the following is a problem that the incident response team will likely encounter during their assessment?

  A. Chain of custody
  B. Tracking man hours
  C. Record time offset
  D. Capture video traffic
  C. Record time offset

  ---

  It is quite common for workstation as well as server times to be off slightly from actual time. Since a forensic investigation is usually dependent on a step-by-step account of what has happened, being able to follow events in the correct time sequence is critical. Because of this, it is imperative to record the time offset on each affected machine during the investigation. One method of assisting with this is to add an entry to a log file and note the time that this was done and the time associated with it on the system. There is no mention that this was done by the incident response team. Incorrect Answers: A: Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. The evidence must always be within your custody, or you're open to dispute about possible evidence tampering. In this case there is no mention that the chain of evidence is in question. B: Tracking man hours and Expenses go hand-in-hand. In this case the incident response team already has the evidence. D: The incident response already has the audit logs pertaining to the incident identified and there is thus no problem regarding capturing video traffic that might be encountered. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 453, 448, 454

• Question 895:

  HOTSPOT

  For each of the given items, select the appropriate authentication category from the dropdown choices.

  Instructions: When you have completed the simulation, please select the Done button to submit.

  Hot Area:

  

  

• Question 896:

  In which of the following scenarios is PKI LEAST hardened?

  A. The CRL is posted to a publicly accessible location.
  B. The recorded time offsets are developed with symmetric keys.
  C. A malicious CA certificate is loaded on all the clients.
  D. All public keys are accessed by an unauthorized user.
  C. A malicious CA certificate is loaded on all the clients.

  ---

  A rogue Certification Authority (CA) certificate allows malicious users to impersonate any Web site on the Internet, including banking and e-commerce sites secured using the HTTPS protocol. A rogue CA certificate would be seen as trusted by Web browsers, and it is harmful because it can appear to be signed by one of the root CAs that browsers trust by default. A rogue Certification Authority (CA) certificate can be created using a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure Web sites. Incorrect Answers: A: The CRL should be readily accessible. It should be posted on a publically accessible location. A CRL is a database of revoked keys and signatures. B: Incorrect time offsets is much less of a security threat compared to a rogue Certification Authority certificate. D: Public keys are public and can be accessed by anyone. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 279-285 http://www.webopedia.com/TERM/R/rogue_certification_authority_certificate.html

• Question 897:

  Two programmers write a new secure application for the human resources department to store personal identifiable information. The programmers make the application available to themselves using an uncommon port along with an ID and password only they know. This is an example of which of the following?

  A. Root Kit
  B. Spyware
  C. Logic Bomb
  D. Backdoor
  D. Backdoor

  ---

  A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice) or may subvert the system through a rootkit. A backdoor in a login system might take the form of a hard coded user and password combination which gives access to the system. Although the number of backdoors in systems using proprietary software (software whose source code is not publicly available) is not widely credited, they are nevertheless frequently exposed. Programmers have even succeeded in secretly installing large amounts of benign code as Easter eggs in programs, although such cases may involve official forbearance, if not actual permission. Many computer worms, such as Sobig and Mydoom, install a backdoor on the affected computer (generally a PC on broadband running Microsoft Windows and Microsoft Outlook). Such backdoors appear to be installed so that spammers can send junk e-mail from the infected machines. Others, such as the Sony/BMG rootkit distributed silently on millions of music CDs through late 2005, are intended as DRM measures--and, in that case, as data gathering agents, since both surreptitious programs they installed routinely contacted central servers. Incorrect Answers: A: A rootkit is a collection of tools (programs) that enable administrator-level access to a computer or computer network. Typically, a cracker installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. Once the rootkit is installed, it allows the attacker to mask intrusion and gain root or privileged access to the computer and, possibly, other machines on the network. A rootkit may consist of spyware and other programs that: monitor traffic and keystrokes; create a "backdoor" into the system for the hacker's use; alter log files; attack other machines on the network; and alter existing system tools to escape detection. The presence of a rootkit on a network was first documented in the early 1990s. At that time, Sun and Linux operating systems were the primary targets for a hacker looking to install a rootkit. Today, rootkits are available for a number of operating systems, including Windows, and are increasingly difficult to detect on any network. While a rootkit does allow an attacker administrator-level access to a computer, a backdoor is a specific term used to describe a security breach that allows unauthorized access to the computer. Therefore, this answer is incorrect. B: Spyware is software that aids in gathering information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge. "Spyware" is mostly classified into four types: system monitors, trojans, adware, and tracking cookies. Spyware is mostly used for the purposes of tracking and storing Internet users' movements on the Web and serving up pop-up ads to Internet users. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users. While the term spyware suggests software that monitors a user's computing, the functions of spyware can extend beyond simple monitoring. Spyware can collect almost any type of data, including personal information like Internet surfing habits, user logins, and bank or credit account information. Spyware can also interfere with user control of a computer by installing additional software or redirecting Web browsers. Some spyware can change computer settings, which can result in slow Internet connection speeds, un-authorized changes in browser settings, or changes to software settings. Sometimes, spyware is included along with genuine software, and may come from a malicious website. In response to the emergence of spyware, a small industry has sprung up dealing in anti- spyware software. Running anti-spyware software has become a widely recognized element of computer security practices, especially for computers running Microsoft Windows. Spyware is not what is described in this question. Therefore, this answer is incorrect. C: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs". To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs. A logic bomb is not what is described in this question. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Backdoor_%28computing%29 http://en.wikipedia.org/wiki/Logic_bomb http://searchmidmarketsecurity.techtarget.com/definition/rootkit http://en.wikipedia.org/wiki/Spyware

• Question 898:

  Which of the following best practices makes a wireless network more difficult to find?

  A. Implement MAC filtering
  B. UseWPA2-PSK
  C. Disable SSID broadcast
  D. Power down unused WAPs
  C. Disable SSID broadcast

  ---

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn't for public use. Incorrect Answers: A: A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a WAP to block access to all unauthorized devices. It does not, however, increase the difficulty of finding a wireless network. B: WPA-Personal, also referred to as WPA-PSK (Pre-shared key) mode, is designed for home and small office networks and doesn't require an authentication server. Each wireless network device authenticates with the access point using the same 256-bit key generated from a password or passphrase. Using this option will not decrease the chances of discovering the wireless network. D: Using this option will not decrease the chances of discovering the wireless network in use. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 61. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access

• Question 899:

  Which of the following does full disk encryption prevent?

  A. Client side attacks
  B. Clear text access
  C. Database theft
  D. Network-based attacks
  B. Clear text access

  ---

  Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. Incorrect Answers: A, D: Full-disk encryption encrypts the data on the device itself and ensures that the data on the device cannot be accessed in a useable form should the device be stolen. It does not prevent client-side or network-based attacks. C: Full-disk encryption encrypts the data on the device itself. It may help prevent access to database data but database encryption would be the preferred method of protecting database data. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 251

• Question 900:

  Which of the following presents the STRONGEST access control?

  A. MAC
  B. TACACS
  C. DAC
  D. RBAC
  A. MAC

  ---

  A: With Mandatory Access Control (MAC) all access is predefined. This makes it the strongest access control of the options presented in the question. Incorrect Answers: B: TACACS refers to a client-server-oriented environment similar to that of RADIUS and is in essence an authentication service. It is an older authentication protocol common to UNIX networks that allows a remote access server to forward a user's logon password to an authentication server to determine whether access can be allowed to a given system. C: With Discretionary Access Control (DAC) access control incorporates some flexibility. D: With Role-Based Access Control (RBAC) access control allows the user's role to dictate access capabilities. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 146, 150