CompTIA CompTIA Security+ JK0-022 Questions & Answers

• Question 1:

  An administrator wants to ensure that the reclaimed space of a hard drive has been sanitized while the computer is in use. Which of the following can be implemented?

  A. Cluster tip wiping

  B. Individual file encryption

  C. Full disk encryption

  D. Storage retention

  Correct Answer: A

  A computer hard disk is divided into small segments called clusters. A file usually spans several clusters but rarely fills the last cluster, which is called cluster tip. This cluster tip area may contain file data because the size of the file you are working with may grow or shrink and needs to be securely deleted.

  Incorrect Answers:

  B: File encryption encrypts the content of a specified file to protect it from access by unauthorised users. It does not sanitise the reclaimed space on a hard drive.

  C:

  Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. It does not sanitise the reclaimed space on a hard drive.

  D.

  Storage retention, or data retention, is a policy for handling data, particularly sensitive data, within an organization. It is not related to sanitizing the reclaimed space on a hard drive.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236, 237, 252 https://

  uwnthesis.wordpress.com/2013/07/10/ccleaner-how-to-configure-ccleaner-to-wipe- cluster-tips-on-drive/

• Question 2:

  A security administrator wants to ensure that the message the administrator sends out to their Chief Financial Officer (CFO) does not get changed in route. Which of the following is the administrator MOST concerned with?

  A. Data confidentiality

  B. High availability

  C. Data integrity

  D. Business continuity

  Correct Answer: C

  Integrity is the process of ensuring that the information has not been altered during transmission. This can be accomplished by means of hashing.

  Incorrect Answers:

  A: Confidentiality is the process of ensuring that unauthorized users are not able to read the information.

  B:

  Availability is the process of ensuring that authorized users have access to the data and systems that they require. Data backups, redundant systems, and disaster recovery plans can be used to support availability.

  D.

  Business continuity is concerned with the processes and policies that are designed to minimize the impact of a system failure, network failure, or the failure of any key component needed for business operation.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 259, 413-414, 431

• Question 3:

  A large corporation has data centers geographically distributed across multiple continents. The company needs to securely transfer large amounts of data between the data center. The data transfer can be accomplished physically or electronically, but must prevent eavesdropping while the data is on transit. Which of the following represents the BEST cryptographic solution?

  A. Driving a van full of Micro SD cards from data center to data center to transfer data

  B. Exchanging VPN keys between each data center via an SSL connection and transferring the data in the VPN

  C. Using a courier to deliver symmetric VPN keys to each data center and transferring data in the VPN

  D. Using PKI to encrypt each file and transferring them via an Internet based FTP or cloud server

  Correct Answer: B

  A virtual private network (VPN) is an encrypted communication tunnel that connects two systems over an untrusted network, such as the Internet. They provide security for both authentication and data transmission through a process called encapsulation. Secure Sockets Layer (SSL) can be used to exchange the VPN keys securely. SSL is used to establish secure TCP communication between two machines by encrypting the communication.

  Incorrect Answers:

  A: The data centers are geographically distributed across multiple continents. This makes it difficult to transport the data by driving a van.

  C: Symmetrical keys are rendered useless when the key is stolen as the same key is used for encryption and decryption. D. PKI can be used to encrypt the data but transferring the data via FTP or a cloud server is not advisable. FTP is inherently insecure while cloud servers are used for storage.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 45, 304-305, 310-311 http://www.networkworld.com/article/2263539/compliance/vpn-security----do-you-know-where- your-keys-are-.html

• Question 4:

  Which of the following data security techniques will allow Matt, an IT security technician, to encrypt a system with speed as its primary consideration?

  A. Hard drive encryption

  B. Infrastructure as a service

  C. Software based encryption

  D. Data loss prevention

  Correct Answer: A

  Disk and device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. It should be implemented using a hardware-based solution for greater speed.

  Incorrect Answers:

  B: The Infrastructure as a Service (IaaS) model is a cloud computing business model uses virtualization, with the clients paying for resources used. It is not a data security technique.

  C: Software based encryption is usually slower than hardware based encryption. D. Data loss prevention is the purpose of encryption; it is not a data security technique.

  References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 418-419 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 236,

• Question 5:

  A security administrator has implemented a policy to prevent data loss. Which of the following is the BEST method of enforcement?

  A. Internet networks can be accessed via personally-owned computers.

  B. Data can only be stored on local workstations.

  C. Wi-Fi networks should use WEP encryption by default.

  D. Only USB devices supporting encryption are to be used.

  Correct Answer: D

  The concern for preventing data loss is the concern for maintaining data confidentiality. This can be accomplished through encryption, access controls, and steganography. USB encryption is usually provided by the vendor of the USB device. It is not included on all USB devices.

  Incorrect Answers:

  A: Allowing personally-owned computers to access the intranet or internet would not prevent data loss. Allowing them to access the intranet would increase the risk of data loss while allowing them to access the internet would be of no

  consequence.

  B: Storing data on local workstations does not reduce the risk of data loss as the data can still be accessed if it is not encrypted.

  C: Wired Equivalent Privacy (WEP) is the original wireless encryption standard that has inherent weakness and has been replaced by WiFi Protected Access (WPA). The current version of WPA is WPA2.

  References:

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 148,

• Question 6:

  Access mechanisms to data on encrypted USB hard drives must be implemented correctly otherwise:

  A. user accounts may be inadvertently locked out.

  B. data on the USB drive could be corrupted.

  C. data on the hard drive will be vulnerable to log analysis.

  D. the security controls on the USB drive can be bypassed.

  Correct Answer: D

  A common access mechanism to data on encrypted USB hard drives is a password. If a weak password is used, someone could guess the password and bypass the security controls on the USB drive to access the data.

  Incorrect Answers:

  A: Not configuring a password (or other access mechanism) on an encrypted USB hard drive would not lock out a user account. It would just enable someone to access the data on the hard drive.

  B: Not configuring a password (or other access mechanism) on an encrypted USB hard drive would not corrupt the data. It would just enable someone to access the data on the hard drive.

  C: Not configuring a password (or other access mechanism) on an encrypted USB hard drive would not cause the data on the hard drive will be vulnerable to log analysis. It would just enable someone to access the data on the hard drive.

  References:

  http://www.pcadvisor.co.uk/test-centre/pc-peripheral/114492/group-test-top-7-encrypted-hard- drives/?pn=2

• Question 7:

  Which of the following BEST explains the use of an HSM within the company servers?

  A. Thumb drives present a significant threat which is mitigated by HSM.

  B. Software encryption can perform multiple functions required by HSM.

  C. Data loss by removable media can be prevented with DLP.

  D. Hardware encryption is faster than software encryption.

  Correct Answer: D

  Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. It provides a fast solution for the for large asymmetrical encryption calculations and is much faster than software-based cryptographic solutions.

  Incorrect Answers:

  A: Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. HSM is usually used in conjunction with PKI to enhance security with certification authorities (CAs). PKI secures communication. It does not secure thumb drives.

  B: Hardware Security Module (HSM) is a cryptoprocessor that can be used to enhance security. HSM is usually used in conjunction with PKI to enhance security with certification authorities (CAs). It provides encryption functions rather than requiring it.

  C: Data loss prevention (DLP) is designed detect and prevent unauthorized access to sensitive information. It may involve content inspection, storage and transmission encryption, contextual assessment, monitoring authorizations, and centralized management. It can make use of software-based cryptographic solutions, of hardware-based cryptographic solutions such as HSM.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 238, 278 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 254

• Question 8:

  The systems administrator wishes to implement a hardware-based encryption method that could also be used to sign code. They can achieve this by:

  A. Utilizing the already present TPM.

  B. Configuring secure application sandboxes.

  C. Enforcing whole disk encryption.

  D. Moving data and applications into the cloud.

  Correct Answer: A

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

  Incorrect Answers:

  B: Sandboxing is the process of isolating a system before installing new applications on it so as to restrict any potential harm it may cause to production systems.

  C:

  Whole disk encryption can be implemented by either a software-based cryptography solutions or by a hardware based solution such as a Trusted Platform Module (TPM) or a Hardware Security Module (HSM).

  D.

  Moving data and applications to the cloud does not ensure that the data or applications are encrypted in its new location.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 204-205, 237 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 250

• Question 9:

  Which of the following hardware based encryption devices is used as a part of multi-factor authentication to access a secured computing system?

  A. Database encryption

  B. USB encryption

  C. Whole disk encryption

  D. TPM

  Correct Answer: D

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

  Incorrect Answers:

  A: Database encryption makes use of cryptography functions that are built into the database software to encrypt the data stored in the data base. Encryption protects data on storage devices it is not an authentication mechanism.

  B: USB encryption is provided by the vendor of the USB device or by a tool from a third party. Encrypting the data on a USB protects the data on the USB; it is not an authentication mechanism.

  C: Whole disk encryption protects the data on hard drives of devices it is not an authentication mechanism.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 237 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 252,

• Question 10:

  A hospital IT department wanted to secure its doctor's tablets. The IT department wants operating system level security and the ability to secure the data from alteration. Which of the following methods would MOST likely work?

  A. Cloud storage

  B. Removal Media

  C. TPM

  D. Wiping

  Correct Answer: C

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

  Incorrect Answers:

  A: Cloud storage involves using an online storage provider to host data. The operating system would most likely not be installed on cloud storage. Therefore securing removable media would not provide operating system level security.

  B: Removable media includes tape drives, recordable compact disks (CD-Rs), diskettes, memory cards, etc. The operating system would most likely not be installed on removable media. Therefore securing removable media would not provide operating system level security. D. Wiping is the process of removing data from a device so that it is no longer recoverable. This is usually done when the device is to be decommissioned or discarded. It does not provide data security while the device is in use.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 206, 237 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 252