CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 911:

  Which of the following practices reduces the management burden of access management?

  A. Password complexity policies
  B. User account audit
  C. Log analysis and review
  D. Group based privileges
  D. Group based privileges

  ---

  Granting permissions to all members of a group is quicker than individually assigning them to each user. This means an administrator will spend less time on assigning permissions to users who require the same access privileges. Incorrect Answers: A: Password complexity determines what a password should include. It will not reduce the management burden of access management. B: User account auditing can be used to establish whether users have been suitably carrying out their work tasks or if there have been failed and/or successful attempts at violating company policies or the law. This helps to detect unauthorized access after it has occurred. C: Log analysis is used for reviewing audit trails and log files for evidence of policy violations, malicious events, downtimes, bottlenecks, or other issues of concern. This helps to detect unauthorized access after it has occurred. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 291- 294.

• Question 912:

  Users need to exchange a shared secret to begin communicating securely. Which of the following is another name for this symmetric key?

  A. Session Key
  B. Public Key
  C. Private Key
  D. Digital Signature
  C. Private Key

  ---

  Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. A symmetric key, sometimes referred to as a secret key or private key, is a key that isn't disclosed to people who aren't authorized to use the encryption system. Incorrect Answers: A: Session keys are encryption keys used for a communications session. Typically, session keys are randomly selected (or generated) and then used only for one session. Session keys are often symmetric keys, but asymmetric session keys can be used as well. B: The shared secret key is not public. D: A digital signature is use to protect transmitted data, not for exchange a secret key. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 251, 261

• Question 913:

  When performing the daily review of the system vulnerability scans of the network Joe, the administrator, noticed several security related vulnerabilities with an assigned vulnerability identification number. Joe researches the assigned vulnerability identification number from the vendor website. Joe proceeds with applying the recommended solution for identified vulnerability.

  Which of the following is the type of vulnerability described?

  A. Network based
  B. IDS
  C. Signature based
  D. Host based
  C. Signature based

  ---

  A signature-based monitoring or detection method relies on a database of signatures or patterns of known malicious or unwanted activity. The strength of a signature-based system is that it can quickly and accurately detect any event from its database of signatures. Incorrect Answers: A: A network-based IDS (NIDS) watches network traffic in real time. It's reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks. B: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations. C: A host-based IDS (HIDS) watches the audit trails and log fi les of a host system. It's reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 21.

• Question 914:

  A security administrator has concerns about new types of media which allow for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on which of the following?

  A. Peer to Peer
  B. Mobile devices
  C. Social networking
  D. Personally owned devices
  C. Social networking

  ---

  There many companies that allow full use of social media in the workplace, believing that the marketing opportunities it holds outweigh any loss in productivity. What they are unknowingly minimizing are the threats that exist. Rather than being all new threats, the social networking/media threats tend to fall in the categories of the same old tricks used elsewhere but in a new format. A tweet can be sent with a shortened URL so that it does not exceed the 140- character limit set by Twitter; unfortunately, the user has no idea what the shortened URL leads to. This makes training your employees regarding the risks social networking entails essential. Incorrect Answers: A: Peer-to-peer training is not going to mitigate security risks that are meant for mass distribution as social networking is designed to do. B: Mobile devices are used to produce and send personal messages on a mass distribution basis as is facilitated by twitter, etc. these are social networking and to mitigate risks with this media your employees must be trained in the dangers that social networking poses. You cannot expect of your employees to leave their cell phones, etc. some other place when they are at work. D: Personally owned devices can lead to company information getting intermingled with personal information that employees can put at risk not media that allows for mass distribution of personal comments. References: Dul Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 404, 406 http://whatis.techtarget.com/definition/social-media

• Question 915:

  After an assessment, auditors recommended that an application hosting company should contract with additional data providers for redundant high speed Internet connections. Which of the following is MOST likely the reason for this recommendation? (Select TWO).

  A. To allow load balancing for cloud support
  B. To allow for business continuity if one provider goes out of business
  C. To eliminate a single point of failure
  D. To allow for a hot site in case of disaster
  E. To improve intranet communication speeds
  B. To allow for business continuity if one provider goes out of business
  C. To eliminate a single point of failure

  ---

  A high-speed internet connection to a second data provider could be used to keep an up-to-date replicate of the main site. In case of problem on the first site, operation can quickly switch to the second site. This eliminates the single point of failure and allows the business to continue uninterrupted on the second site. Note: Recovery Time Objective The recovery time objective (RTO) is the maximum amount of time that a process or service is allowed to be down and the consequences still be considered acceptable. Beyond this time, the break in business continuity is considered to affect the business negatively. The RTO is agreed on during BIA creation. Incorrect Answers: A: Load balancing is done on the local intranet, not over the internet. D: An alternate data site could be used as a hot site. But a high-speed internet connection is not needed for a hot site. A hot site is a location that can provide operations within hours of a failure. This type of site would have servers, networks, and telecommunications equipment in place to reestablish service in a short time. E: An additional internet site would not improve local communication speed on the intranet. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 32-33, 33

• Question 916:

  In regards to secure coding practices, why is input validation important?

  A. It mitigates buffer overflow attacks.
  B. It makes the code more readable.
  C. It provides an application configuration baseline.
  D. It meets gray box testing standards.
  A. It mitigates buffer overflow attacks.

  ---

  Buffer overflow is an exploit at programming error, bugs and flaws. It occurs when an application is fed more input data than it is programmed to handle. This may cause the application to terminate or to write data beyond the end of the allocated space in memory. The termination of the application may cause the system to send the data with temporary access to privileged levels in the system, while overwriting can cause important data to be lost. Proper error and exception handling and input validation will help prevent Buffer overflow exploits. Incorrect Answers: B: Code readability is a function of the integrated development environment (IDE) and the use of indentation and formatting. It is not a function of input validation. C: Application configuration baselining is the process of tuning the settings of an application to ensure it operates at its optimal value while providing security and vulnerability protection. D: Gray box testing is a form of penetration testing for software where the tester approaches the software from a user perspective, analyzing inputs and outputs. They do have access to the source code which they use to design their tests but they do not analyze the inner workings of the application during their testing. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 219, 338 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 197,

• Question 917:

  Digital signatures are used for ensuring which of the following items? (Select TWO).

  A. Confidentiality
  B. Integrity
  C. Non-Repudiation
  D. Availability
  E. Algorithm strength
  B. Integrity
  C. Non-Repudiation

  ---

  A digital signature is similar in function to a standard signature on a document. It validates the integrity of the message and the sender. The message is encrypted using the encryption system, and a second piece of information, the digital signature, is added to the message. Nonrepudiation prevents one party from denying actions that they carried out and in the electronic world nonrepudiation measures can be a two-key cryptographic system and the involvement of a third party to verify the validity. This respected third party `vouches' for the individuals in the two-key system. Thus non-repudiation also impacts on integrity. Incorrect Answers: A: Confidentiality means that the message/data retains its privacy. D: Availability refers to the measures that are used to keep services and systems operational. E: Digital signatures are not used to ensure algorithm strength. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 248, 255, 262 261, 414

• Question 918:

  Several bins are located throughout a building for secure disposal of sensitive information. Which of the following does this prevent?

  A. Dumpster diving
  B. War driving
  C. Tailgating
  D. War chalking
  A. Dumpster diving

  ---

  The bins in this question will be secure bins designed to prevent someone accessing the `rubbish' to learn sensitive information. Dumpster diving is looking for treasure in someone else's trash. (A dumpster is a large trash container.) In the world of information technology, dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. Seemingly innocent information like a phone list, calendar, or organizational chart can be used to assist an attacker using social engineering techniques to gain access to the network. To prevent dumpster divers from learning anything valuable from your trash, experts recommend that your company establish a disposal policy where all paper, including print-outs, is shredded in a cross- cut shredder before being recycled, all storage media is erased, and all staff is educated about the danger of untracked trash. Incorrect Answers: B: War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, you need a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car. Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources. Secure bins are not used to prevent war driving. Therefore, this answer is incorrect. C: Tailgating in IT security would be an unauthorized person following and authorized person into a building or room such as a datacenter. If a building has a card reader where an authorized person can hold up a card to the reader to unlock the door, someone tailgating could follow the authorized person into the building by walking through the door before it closes and locks. Secure bins are not used to prevent tailgating. Therefore, this answer is incorrect. D: War chalking is the act of making chalk marks on outdoor surfaces (walls, sidewalks, buildings, sign posts, trees) to indicate the existence of an open wireless network connection, usually offering an Internet connection so that others can benefit from the free wireless access. The open connections typically come from the access points of wireless networks located within buildings to serve enterprises. The chalk symbols indicate the type of access point that is available at that specific spot. Secure bins are not used to prevent war chalking. Therefore, this answer is incorrect. References: http://searchsecurity.techtarget.com/definition/dumpster-diving http://searchmobilecomputing.techtarget.com/definition/war-driving http://www.webopedia.com/ TERM/W/warchalking.html

• Question 919:

  During a recent investigation, an auditor discovered that an engineer's compromised workstation was being used to connect to SCADA systems while the engineer was not logged in. The engineer is responsible for administering the SCADA systems and cannot be blocked from connecting to them. The SCADA systems cannot be modified without vendor approval which requires months of testing.

  Which of the following is MOST likely to protect the SCADA systems from misuse?

  A. Update anti-virus definitions on SCADA systems
  B. Audit accounts on the SCADA systems
  C. Install a firewall on the SCADA network
  D. Deploy NIPS at the edge of the SCADA network
  D. Deploy NIPS at the edge of the SCADA network

  ---

  A supervisory control and data acquisition (SCADA) system is an industrial control system (ICS) that is used to control infrastructure processes, facility-based processes, or industrial processes. A network-based IPS (NIPS) is an intrusion detection and prevention system that scans network traffic in real time against a database of attack signatures. It is useful for detecting and responding to network-based attacks originating from outside the organization. Incorrect Answers: A: Antivirus software is used to protect systems against viruses, which are a form of malicious code designed to spread from one system to another, consuming network resources. B: Auditing accounts on the SCADA system will not likely to protect the SCADA systems as the compromised workstation is being used to connect to the SCADA systems while the engineer is not logged in. C: A firewall protects a system from attack by filtering network traffic to and from the system. It can be used to block ports and protocols but this would prevent the administrator from access the SCADA system. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 117, 157

• Question 920:

  In order for network monitoring to work properly, you need a PC and a network card running in what mode?

  A. Launch
  B. Exposed
  C. Promiscuous
  D. Sweep
  C. Promiscuous

  ---

  Promiscuous mode allows the network card to look at any packet that it sees on the network. This even includes packets that are not addressed to that network card. Incorrect Answers: A, B, D: These options are not valid modes for network cards. For network monitoring to work properly you require a PC that includes a NIC running in promiscuous mode and monitoring software. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 46.