CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 901:

  Which of the following should be performed to increase the availability of IP telephony by prioritizing traffic?

  A. Subnetting
  B. NAT
  C. Quality of service
  D. NAC
  C. Quality of service

  ---

  Quality of Service (QoS) facilitates the deployment of media-rich applications, such as video conferencing and Internet Protocol (IP) telephony, without adversely affecting network throughput. Incorrect Answers: A: Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections. B: NAT converts the IP addresses of internal systems found in the header of network packets into public IP addresses. D: The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control. References: https://technet.microsoft.com/en-us/library/cc959594.aspx Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 39,

• Question 902:

  A security engineer, Joe, has been asked to create a secure connection between his mail server and the mail server of a business partner. Which of the following protocol would be MOST appropriate?

  A. HTTPS
  B. SSH
  C. FTP
  D. TLS
  D. TLS

  ---

  Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. It uses X.509 certificates and hence asymmetric cryptography to authenticate the counterparty with whom it is communicating, and to exchange a symmetric key. The TLS protocol allows client-server applications to communicate across a network in a way designed to prevent eavesdropping and tampering. Incorrect Answers: A: HTTPS provides the secure means for web-based transactions by utilizing various other protocols such as SSL and TLS. B: SSH is used to establish a command-line, text-only interface connection with a server, router, switch, or similar device over any distance. C: Standard FTP is a protocol often used to move files between one system and another either over the Internet or within private networks. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 42, 46, 49.

• Question 903:

  Pete, the Chief Executive Officer (CEO) of a company, has increased his travel plans for the next two years to improve business relations. Which of the following would need to be in place in case something happens to Pete?

  A. Succession planning
  B. Disaster recovery
  C. Separation of duty
  D. Removing single loss expectancy
  A. Succession planning

  ---

  Succession planning outlines those internal to the organization who have the ability to step into positions when they open. By identifying key roles that cannot be left unfilled and associating internal employees who can step into these roles, you can groom those employees to make sure that they are up to speed when it comes time for them to fill those positions. Incorrect Answers: B: Disaster recovery refers to the actions taken after an event resulting in a loss/disaster occurred. C: Separation of duties are used to reduce the risk of fraud and to prevent other types of losses. It is also designed to prevent accidents from occurring; e.g. someone other than the user responsible for writing code to check and run tests on the code. D: Single loss expectance refers to asset value times the exposure factor and is used to calculate risk. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 23, 454

• Question 904:

  Fuzzing is a security assessment technique that allows testers to analyze the behavior of software applications under which of the following conditions?

  A. Unexpected input
  B. Invalid output
  C. Parameterized input
  D. Valid output
  A. Unexpected input

  ---

  Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. Incorrect Answers: B, D: Fuzzing uses invalid input and not output to test the application's response, such as crashes, or failed validation, or memory leaks, to such input. C: Parameterized input may be one of the invalid, unexpected, or random data that would be used in fuzz testing. Other forms of invalid data should also be tested. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 218 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 229

• Question 905:

  Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time.

  Which of the following does this illustrate?

  A. System image capture
  B. Record time offset
  C. Order of volatility
  D. Chain of custody
  D. Chain of custody

  ---

  Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. Incorrect Answers: A: A system image is a snapshot of what exists. Capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it. B: Record Time Offset - It is quite common for workstation times to be off slightly from actual time, and that can happen with servers as well. Since a forensic investigation is usually dependent on a step-by-step account of what has happened, being able to follow events in the correct time sequence is critical. Because of this, it is imperative to record the time offset on each affected machine during the investigation. C: Act in Order of Volatility is of importance when dealing with multiple issues. Then you should address them in order of volatility (OOV); always deal with the most volatile first. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 448, 453 http://en.wikipedia.org/wiki/Chain_of_custody

• Question 906:

  The IT department noticed that there was a significant decrease in network performance during the afternoon hours. The IT department performed analysis of the network and discovered this was due to users accessing and downloading music and video streaming from social sites. The IT department notified corporate of their findings and a memo was sent to all employees addressing the misuse of company resources and requesting adherence to company policy. Which of the following policies is being enforced?

  A. Acceptable use policy
  B. Telecommuting policy
  C. Data ownership policy
  D. Non disclosure policy
  A. Acceptable use policy

• Question 907:

  A company that has a mandatory vacation policy has implemented which of the following controls?

  A. Risk control
  B. Privacy control
  C. Technical control
  D. Physical control
  A. Risk control

  ---

  Risk mitigation is done anytime you take steps to reduce risks. Thus mandatory vacation implementation is done as a risk control measure because it is a step that is taken as risk mitigation. Incorrect Answers: B: Privacy control is carried out to protect the sanctity of data privacy. C: Technical controls involves aspects such as Identification and Authentication; Access Control, Audit and Accountability as well as System and Communication Protection, not mandatory vacation implementation. D: Physical control is a part of operational control type. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 25

• Question 908:

  A security administrator has been tasked to ensure access to all network equipment is controlled by a central server such as TACACS+. This type of implementation supports which of the following risk mitigation strategies?

  A. User rights and permissions review
  B. Change management
  C. Data loss prevention
  D. Implement procedures to prevent data theft
  A. User rights and permissions review

  ---

  Terminal Access Controller Access-Control System (TACACS, and variations like XTACACS and TACACS+) is a client/server-oriented environment, and it operates in a manner similar to RADIUS. Furthermore TACACS+ allows for credential to be accepted from multiple methods. Thus you can perform user rights and permission reviews with TACACS+. Incorrect Answers: B: Change management is the structured approach that is followed to secure a company's assets and not a risk mitigation strategy. C: Data loss prevention systems are used mainly to monitor the contents of systems and to make sure that key content is not deleted or removed. D: Data theft prevention is similar to data loss prevention systems. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 9-10, 146

• Question 909:

  Joe, an employee, was escorted from the company premises due to suspicion of revealing trade secrets to a competitor. Joe had already been working for two hours before leaving the premises.

  A security technician was asked to prepare a report of files that had changed since last night's integrity scan. Which of the following could the technician use to prepare the report? (Select TWO).

  A. PGP
  B. MD5
  C. ECC
  D. AES
  E. Blowfish
  F. HMAC
  B. MD5
  F. HMAC

  ---

  B: MD5 can be used to locate the data which has changed. The Message Digest Algorithm (MD) creates a hash value and uses a one-way hash. The hash value is used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2. F: A common method of verifying integrity involves adding a message authentication code (MAC) to the message. HMAC (Hash-Based Message Authentication Code) uses a hashing algorithm along with a symmetric key. Incorrect Answers: A: Pretty Good Privacy (PGP) is a freeware email encryption system. It would not be of any use to locate files that have been changed. C: ECC is an encryption algorithm. It is not used to locate files that have changed. D: AES is an encryption algorithm. It is not used to locate files that have changed. E: Blowfish is an encryption system. It is not used to locate files that have changed. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 139, 251, 253-254, 255, 260, 272

• Question 910:

  Which of the following malware types may require user interaction, does not hide itself, and is commonly identified by marketing pop-ups based on browsing habits?

  A. Botnet
  B. Rootkit
  C. Adware
  D. Virus
  C. Adware

  ---

  Adware is free software that is supported by advertisements. Common adware programs are toolbars, games and utilities. They are free to use, but require you to watch advertisements as long as the programs are open. Adware typically requires an active Internet connection to run. Incorrect Answers: A: A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. A botnet does hide itself, but is not commonly identified by marketing popups. Therefore, this answer is incorrect. B: A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer. A rootkit does hide itself, but is not commonly identified by marketing popups. Therefore, this answer is incorrect. D: A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man-made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems. A virus does hide itself, but is not commonly identified by marketing popups. Therefore, this answer is incorrect. References: http://techterms.com/definition/adware http://en.wikipedia.org/wiki/Botnet http://www.webopedia.com/TERM/V/virus.html