JK0-022 Exam Questions & Answers

Correct Answer: A

Anytime you connect multiple computers to work/act together as a single server, it is known as clustering. Clustered systems utilize parallel processing (improving performance and availability) and add redundancy (but also add costs). Clustering is done whenever you connect multiple computers to work and act together as a single server. It is meant to utilize parallel processing and can also add to redundancy.

Incorrect Answers:

B: RAID, or redundant array of independent disks (RAID). RAID allows your existing servers to have more than one hard drive so that if the main hard drive fails, the system keeps functioning.

C: Backup redundancy is a disaster recovery measure.

D: A cold site is a facility that isn't immediately ready to use. The organization using it must bring along its equipment and network. A cold site may provide network capability, but this isn't usually the case; the site provides a place for

operations to resume, but it doesn't provide the infrastructure to support those operations. It is one of the disaster recovery measures.

References:

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 234-235, 444

Correct Answer: D

A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:

The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the

system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.

There are two main types of honeypots:

Production - A production honeypot is one used within an organization's environment to help mitigate risk. Research A research honeypot add value to research in computer security by providing a platform to study the threat.

Incorrect Answers:

A: Security logs record security events such as logon and logoff events. Security logs can be used to monitor failed logon events which could indicate an attack. However, logon attempts are just one form of attack. A honeypot can be used to

monitor all sorts of attack. Therefore, a honeypot is a better answer so this answer is incorrect.

B: A Protocol Analyzer is a hardware device or more commonly a software program used to capture network data communications sent between devices on a network. It would be difficult to monitor attacks by analyzing network

communications. Therefore, a honeypot is a better answer so this answer is incorrect.

C: Audit logs record events such as file access (successful or unsuccessful) or Active Directory modifications. Audit logs could be used monitor failed attempts to access files which could indicate an attack. However, file access attempts are

just one form of attack. A honeypot can be used to monitor all sorts of attack.

Therefore, a honeypot is a better answer so this answer is incorrect.

References: https://ethics.csc.ncsu.edu/abuse/hacking/honeypots/study.php

Correct Answer: A

A false positive is an error in some evaluation process in which a condition tested for is mistakenly found to have been detected. In spam filters, for example, a false positive is a legitimate message mistakenly marked as UBE --unsolicited bulk email, as junk email is more formally known. Messages that are determined to be spam -- whether correctly or incorrectly -- may be rejected by a server or client-side spam filter and returned to the sender as bounce e-mail. One problem with many spam filtering tools is that if they are configured stringently enough to be effective, there is a fairly high chance of getting false positives. The risk of accidentally blocking an important message has been enough to deter many companies from implementing any anti-spam measures at all. False positives are also common in security systems. A host intrusion prevention system (HIPS), for example, looks for anomalies, such as deviations in bandwidth, protocols and ports. When activity varies outside of an acceptable range for example, a remote application attempting to open a normally closed port -- an intrusion may be in progress. However, an anomaly, such as a sudden spike in bandwidth use, does not guarantee an actual attack, so this approach amounts to an educated guess and the chance for false positives can be high. False positives contrast with false negatives, which are results indicating mistakenly that some condition tested for is absent.

Incorrect Answers:

B: If an authorized user is wearing a new contact lens, the biometric iris scanner would not recognize it and would correctly deny access. This is not a false positive. Therefore, this answer is incorrect.

C: If a user mistypes their password too many times and an account lockout policy is configured, the account would correctly be locked if the policy condition (number of failed login attempts) is met. This is not a false positive. Therefore, this answer is incorrect.

D: If an IDS (intrusion detection system) does not identify a buffer overflow, this is not a false positive. A `positive' result would be the IDS recognizing the buffer overflow. A false positive would be the IDS identifying something as a buffer overflow when a buffer overflow doesn't exist. Therefore, this answer is incorrect.

References: http://whatis.techtarget.com/definition/false-positive