CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 951:

  A user commuting to work via public transport received an offensive image on their smart phone from another commuter. Which of the following attacks MOST likely took place?

  A. War chalking
  B. Bluejacking
  C. War driving
  D. Bluesnarfing
  B. Bluejacking

  ---

  The question states that the `attack' took place on public transport and was received on a smartphone. Therefore, it is most likely that the image was sent using Bluetooth. Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth-enabled device via the OBEX protocol. Bluetooth has a very limited range, usually around 10 metres (32.8 ft) on mobile phones, but laptops can reach up to 100 metres (328 ft) with powerful (Class 1) transmitters. Bluejacking is usually harmless, but because bluejacked people generally don't know what has happened, they may think that their phone is malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it's possible to send images or sounds as well. Bluejacking has been used in guerrilla marketing campaigns to promote advergames. Incorrect Answers: A: War chalking is the act of making chalk marks on outdoor surfaces (walls, sidewalks, buildings, sign posts, trees) to indicate the existence of an open wireless network connection, usually offering an Internet connection so that others can benefit from the free wireless access. The open connections typically come from the access points of wireless networks located within buildings to serve enterprises. The chalk symbols indicate the type of access point that is available at that specific spot. War chalking is not used to send unsolicited files over Bluetooth. Therefore, this answer is incorrect. C: War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, you need a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car. Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources. War driving is not used to send offensive images over Bluetooth. Therefore, this answer is incorrect. D: Bluesnarfing is the theft of information from a wireless device through a Bluetooth connection. Bluetooth is a high-speed but very short-range wireless technology for exchanging data between desktop and mobile computers, personal digital assistants (PDAs), and other devices. By exploiting a vulnerability in the way Bluetooth is implemented on a mobile phone, an attacker can access information -- such as the user's calendar, contact list and e-mail and text messages -without leaving any evidence of the attack. Other devices that use Bluetooth, such as laptop computers, may also be vulnerable, although to a lesser extent, by virtue of their more complex systems. Operating in invisible mode protects some devices, but others are vulnerable as long as Bluetooth is enabled. Bluesnarfing is stealing information over Bluetooth; it is not used to send offensive images to a mobile device. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/Bluejacking http://www.webopedia.com/TERM/W/warchalking.html http://searchmobilecomputing.techtarget.com/definition/war-driving http://searchmobilecomputing.techtarget.com/definition/bluesnarfing

• Question 952:

  Which of the following will help prevent smurf attacks?

  A. Allowing necessary UDP packets in and out of the network
  B. Disabling directed broadcast on border routers
  C. Disabling unused services on the gateway firewall
  D. Flash the BIOS with the latest firmware
  B. Disabling directed broadcast on border routers

  ---

  A smurf attack involves sending PING requests to a broadcast address. Therefore, we can prevent smurf attacks by blocking broadcast packets on our external routers. A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network. Incorrect Answers: A: Allowing necessary UDP packets in and out of the network would not block the broadcast packets used in a smurf attack. This answer is therefore incorrect. C: Disabling unused services on any device is a recommended security measure. However, a smurf attack doesn't use a service that you would disable. A smurf attack uses TCP/IP networking. This answer is therefore incorrect. D: Flashing the BIOS with the latest firmware is a good idea. Smurf attacks do not attack a firmware vulnerability though, so updating the firmware would not prevent a smurf attack. This answer is therefore incorrect. References: http://www.webopedia.com/TERM/S/smurf.html

• Question 953:

  Pete, the system administrator, wishes to monitor and limit users' access to external websites. Which of the following would BEST address this?

  A. Block all traffic on port 80.
  B. Implement NIDS.
  C. Use server load balancers.
  D. Install a proxy server.
  D. Install a proxy server.

  ---

  A proxy is a device that acts on behalf of other(s). In the interest of security, all internal user interaction with the Internet should be controlled through a proxy server. The proxy server should automatically block known malicious sites. The proxy server should cache often-accessed sites to improve performance. Incorrect Answers: A: A network-based IDS (NIDS) approach to IDS attaches the system to a point in the network where it can monitor and report on all network traffic. B: This would block all web traffic, as port 80 is used for World Wide Web. C: In its most common implementation, a load balancer splits the traffic intended for a website into individual requests that are then rotated to redundant servers as they become available. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 98, 103, 111.

• Question 954:

  The security manager wants to unify the storage of credential, phone numbers, office numbers, and address information into one system. Which of the following is a system that will support the requirement on its own?

  A. LDAP
  B. SAML
  C. TACACS
  D. RADIUS
  A. LDAP

• Question 955:

  Which of the following types of authentication solutions use tickets to provide access to various resources from a central location?

  A. Biometrics
  B. PKI
  C. ACLs
  D. Kerberos
  D. Kerberos

  ---

  The basic process of Kerberos authentication is as follows: The subject provides logon credentials. The Kerberos client system encrypts the password and transmits the protected credentials to the KDC. The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client. The client receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm. The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC. The KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime. The client receives the ST. The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved. Incorrect Answers: A: Biometrics provides authentication based on physical characteristics or traits. B: Public Key Infrastructure (PKI) solutions are based on certificates and the use of a CA. C: ACLs provide authentication based on rules. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 24, 130, 271, 350.

• Question 956:

  By default, which of the following uses TCP port 22? (Select THREE).

  A. FTPS
  B. STELNET
  C. TLS
  D. SCP
  E. SSL
  F. HTTPS
  G. SSH
  H. SFTP
  D. SCP
  G. SSH
  H. SFTP

  ---

  G: Secure Shell (SSH) is a cryptographic network protocol for securing data communication. It establishes a secure channel over an insecure network in a client- server architecture, connecting an SSH client application with an SSH server. Common applications include remote command- line login, remote command execution, but any network service can be secured with SSH. SSH uses port 22. D: SCP stands for Secure Copy. SCP is used to securely copy files over a network. SCP uses SSH to secure the connection and therefore uses port 22. H: SFTP stands for stands for Secure File Transfer Protocol and is used for transferring files using FTP over a secure network connection. SFTP uses SSH to secure the connection and therefore uses port 22. Incorrect Answers: A: FTPS stands for File Transfer Protocol Secure. FTPS is similar to SFTP in that it is used to securely transfer files. The difference between the two is the encryption protocol used. FTPS uses the SSL or TLS cryptographic protocols and therefore uses port 443. B: STelnet stands for secure telnet. STelnet uses SSL by default and therefore uses port 443. C: TLS (Transport Layer Security) is a successor to SSL and uses port 443. E: SSL (Secure Sockets Layer) uses port 443. F: HTTPS (Hypertext transfer protocol secure) is used by web sites to encrypt and security transmit data. HTTPS uses the SSL or TLS cryptographic protocols and therefore uses port 443. References: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• Question 957:

  When a new network drop was installed, the cable was run across several fluorescent lights. The users of the new network drop experience intermittent connectivity. Which of the following environmental controls was MOST likely overlooked during installation?

  A. Humidity sensors
  B. EMI shielding
  C. Channel interference
  D. Cable kinking
  B. EMI shielding

  ---

  Shielding refers to the process of preventing electronic emissions from your computer systems from being used to gather intelligence and preventing outside electronic emissions from disrupting your information-processing abilities. In this case you are experiencing intermittent connectivity since Electro Magnetic Interference (EMI) was not taken into account when running the cables over fluorescent lighting. Incorrect Answers: A: Humidity sensors are used to control and monitor humidity. Humidity control prevents the buildup of static electricity in the environment and can result in electronic components being vulnerable to damage from electrical shock and not intermittent connectivity issues as is the case in this scenario. C: Channel interference is not applicable here, rather it is a matter of interference from electromagnetic nature. D: Cable Kinking is not the issue here because there is connectivity, the issue is with the cables being exposed to electromagnetic interference. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 380, 383

• Question 958:

  Which of the following technical controls helps to prevent Smartphones from connecting to a corporate network?

  A. Application white listing
  B. Remote wiping
  C. Acceptable use policy
  D. Mobile device management
  D. Mobile device management

  ---

  Mobile device management (MDM) is allows for managing the mobile devices that employees use to access company resources. MDM is intended to improve security, provide monitoring, enable remote management, and support troubleshooting. It can be used to push or remove applications, manage data, and enforce configuration settings on these devices. Incorrect Answers: A: Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list. It does not prevent Smartphones from connecting to a corporate network. B: Remote wipe is the process of deleting data on a device in the event that the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people. C: An acceptable use policy is a document that defines the acceptable activity, practice, or use for equipment and resources. However, the policy must still be enforced. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 24, 340 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 79, 236, 238

• Question 959:

  The security officer is preparing a read-only USB stick with a document of important personal phone numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At which of the following points in an incident should the officer instruct employees to use this information?

  A. Business Impact Analysis
  B. First Responder
  C. Damage and Loss Control
  D. Contingency Planning
  B. First Responder

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/ reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. In this scenario the security officer is carrying out an incident response measure that will address and be of benefit to those in the vanguard, i.e. the employees and they are the first responders. Incorrect Answers: A: A business impact analysis (BIA) is concerned with evaluating the processes in the likelihood of a loss. A business impact analysis is an integral part of Business continuity planning which is a management tool that ensures that critical business functions can be performed when normal business operations are disrupted. In this case the question refers to a process within the incident response plan being carried out by an incident response team member. C: Damage and loss Control is a critical, but a security officer arming employees (those in the vanguard) with tools to mitigate risk when they encounter an incident seems more like a first responder phase in incident response procedures. D: Contingency planning is not normally part of an incidence response policy. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 429, 432

• Question 960:

  A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. Which of the following would be an appropriate mitigation technique?

  A. Disabling unnecessary accounts
  B. Rogue machine detection
  C. Encrypting sensitive files
  D. Implementing antivirus
  B. Rogue machine detection

  ---

  Rogue machine detection is the process of detecting devices on the network that should not be there. If a user brings in a laptop and plugs it into the network, the laptop is a "rogue machine". The laptop could cause problems on the network. Any device on the network that should not be there is classed as rogue. Incorrect Answers: A: The question states, "unknown internal host". This host is a hardware device (most likely a computer), not a person. Therefore disabling accounts will not prevent an unknown internal host exfiltrating files to several foreign IP addresses. B: This question is about an unknown internal host (most likely a computer) exfiltrating files to several foreign IP addresses. Encrypting files stored disk will not prevent the files being sent. D: This question is about an unknown internal host (most likely a computer) exfiltrating files to several foreign IP addresses. This question is not about a known host with a virus. Therefore implementing antivirus will not solve the problem.