Practice Test 1-1

During an IT meeting, your colleague Anne-Marie suggests that there is a single point of failure in the single load balancer in place for the company website ordering system. She suggests having two load balancers configured, with only one in service at a given time. What type of load balancing configuration is Anne-Marie recommending?

You are a business networking consultant and have a large retail outlet as a client. Your project for them consists of configuring a wireless router at their coffee shop area. The wireless connection will be used by waiting customers to connect to the Internet. You want to ensure that wireless clients can connect to the Internet but cannot connect to internal computers owned by the retail outlet’s offices. Where will you plug in the wireless router?

The Microsoft Group Policy setting for password complexity is “Password must meet complexity requirements.” The policy states that when the setting is enabled, the user password must contain:

English uppercase characters (A through Z),

English lowercase characters (a through z),

Digits (0 through 9), and

Non-alphabetic characters (!, $, #, %).

According to the policy, passwords must contain characters from how many of these different groups?

You are an IT consultant for a business located in a coastal area that is susceptible to storms and occasional flooding. Because of your company’s location, there is an emphasis on continued business operation. Which of the following plans focus on ensuring that personnel, customers, and IT systems are minimally affected after a disaster?

You are a computer security consultant, and your latest client is a military contractor who requires the utmost in security for transmitting messages during wartime. Which of the following provides the best security?

Which of the following types of malware delivery, usually through a Trojan, includes demands for payment?

Review the malware related compromises listed. Which type of malware can make its presence and that of its accompanying payload invisible to the system?

The act of pretending to be the proper owner of an address or the provider of a service, when another system is actually the true provider, is referred to as ___________.

Which type of network penetration attack model requires an attacker to have the highest skill level?

Which one of the listed tools scans for known security threats on groups of computers?

The IPsec protocol suite uses all but one of the choices listed below. Which of these is NOT relevant to IPsec?

You have a multilayer switch. Which layers does it operate at?

Which choice listed below describes the deployment of a network device in order to conduct academic research or detect attackers inside the organization’s network perimeter?

A service on a local server cannot communicate with its database server running on another machine. The database server is functioning correctly and all network connections are working properly. What is most likely causing this issue?

The host-based intrusion detection system can be referred to as which of the following?

A simple way to keep virus, spyware and other malware from attacking your network while allowing BYOD is to use which of the following?

Which of the following methods would generally speaking be the most basic method to mitigate security risks on a network?

Which of the following BYOD security measures would allow separation between work and personal data?

UEFI is a new technology that is starting to replace the system BIOS and has several additional features. Which of these best identifies the security standard used along with UEFI to confirm that only trusted software and firmware is used to access a trusted operating system?

Deploying least functionality along with disabling unnecessary ports and services are two methods of ________________. (Choose the best answer.)

The three step process of authentication, authorization, and accounting, is usually referred to as which of the following choices below?

Which term describes the automatic creation of a two-way relationship between child and parent domains in a Microsoft AD forest?

Multifactor authentication uses at least two of three possible authentication methods to identify a user. Which of the following is not one of the generally accepted methods?

Also known as LDAPS, which protocol enabled connection allows authentication to the Microsoft DC and provides additional services?

Choose the biometric authentication method that uses nodal points to identify the user.

Your company’s standard operating procedure for onboarding includes an agreement targeted at minimizing the security risks involving transmitted data. What is the name of this agreement?

Which personnel management policy involves securing all sensitive data regardless of format (paper or digital) when an employee’s workspace will be unattended?

Which risk strategy is in use if a company is NOT implementing a countermeasure to a risk while realizing the potential risk?

What is considered an acceptable level of risk?

Which of the following is an internal threat?

In a corporation where computer utilization spikes several times a year, the Chief Information Officer (CIO) has requested a cost-effective architecture to handle the variable capacity demand. Which of the following characteristics BEST describes what the CIO has requested?

An analyst wants to implement a more secure wireless authentication for office access points. Which of the following technologies allows for encrypted authentication of wireless clients over TLS?

A security technician would like to obscure sensitive data within a file so that it can be transferred without causing suspicion. Which of the following technologies would BEST be suited to accomplish this?

Which of the following attack types is being carried out where a target is being sent unsolicited messages via Bluetooth?

Joe is exchanging an encrypted email with another party. Joe encrypts the initial email with a key. When Joe receives a response, he is unable to decrypt the response with the same key he initially used. Which of the following would explain this situation?

Which of the following would verify that a threat does exist and security controls can be easily bypassed without actively testing an application?

Which of the following technologies would be MOST appropriate to utilize when testing a new software patch before a company-wide deployment?

A company wants to host a publicly available server that perfoms the following functions:

-Evaluates maintenance record lookup
-Performs authenticated requests for A and AAA records
-Uses RRSIG

Which of the following should the company use to fulfill the above requirements?

The chief security officer (CSO) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites without incurring additional costs. Which of the following is the best solution for the network administrator to secure each internal website?

A vice president at a manufacturing organization is concerned about desktops being connected to the network. Employees need to log onto the desktops' local account to verify that a product is being created within specifications; otherwise, the desktops should be as isolated as possible. Which of the following is the BEST way to accomplish this?

After attempting to harden a web server, a security analyst needs to determine if an application remains vulnerable to SQL injection attacks. Which of the following would BEST assist the analyst in making this determination?

A technician receives a device with the following anomalies:

-Frequent pop-up ads
-Show response-time switching between active programs
-Unresponsive peripherals

The technician reviews the following log file entries:

File Name Source MD5
Target MD5
Status
antivirus.exe F794F21CD33E4F57890DDEA5CF267ED2
F794F21CD33E4F57890DDEA5CF267ED2
Automatic
iexplore.exe 7FAAF21CD33E4F57890DDEA5CF29CCEA
AA87F21CD33E4F57890DDEAEE2197333
Automatic
service.exe 77FF390CD33E4F57890DDEA5CF28881F
77FF390CD33E4F57890DDEA5CF28881F
Manual
USB.exe E289F21CD33E4F57890DDEA5CF28EDC0
E289F21CD33E4F57890DDEA5CF28EDC0
Stopped

Based on the above output, which of the following should be reviewed?

An active/passive configuration has an impact on:

Company A has acquired Company B. Company A has different domains spread globally, and typically migrates its acquisitions infrastructure under its own domain infrastructure. Company B, however, cannot be merged into Company A's domain infrastructure. Which of the following methods would allow the two companies to access one another's resources?

A procedure differs from a policy in that it:

A security auditor is testing perimeter security in a building that is protected by badge readers. Which of the following types of attacks would MOST likely gain access?

Which of the following encryption methods does PKI typically use to securely protect keys?

A department head at a university resigned on the first day of spring semester. It was subsequently determined that the department head deleted numerous files and directories from the server-based home directory while the campus was closed. Which of the following policies or procedures could have prevented this from occurring?

An organization wants to upgrade its enterprise-wide desktop computer solution. The organization currently has 500 PCs active on the network. the Chief Information Security Officer (CISO) suggests that the organization employ desktop imaging technology for such a large scale upgrade. Which of the following is a security benefit of implementing an imaging solution?

A senior incident response manager receives a call about some external IPs communicating with internal computers during off hours. Which of the following types of malware is MOST likely causing this issue?

An organization has implemented an IPSec VPN access for remote users. Which of the following IPSec modes would be the MOST secure for this organization to implement?

A security engineer is configuring a wireless network with EAP-TLS (Extensible Authentication Protocol-Transport Layer Security). Which of the following activities is a requirement for this configuration?

Several workstations on a network are found to be on OS versions that are vulnerable to a specific attack. Which of the following is considered to be a corrective action to combat this vulnerability?

A user suspects someone has been accessing a home network without permission by spoofing the MAC
address of an authorized system. While attempting to determine if an unauthorized user is logging into the home network, the user reviews the wireless router, which shows the following table for systems that are currently on the home network:

Hostname IP Address MAC MAC Filter
DadPC 192.168.1.15 00:1D:1A:44:17:B5 On
MomPC 192.168.1.15 21:13:D6:C5:42:A2 Off
JuniorPC 192.168.2.16 42:A7:D1:25:11:52 On
Unknown 192.168.1.18 10:B3:22:1A:FF:21 Off

Which of the following should be the NEXT step to determine if there is an unauthorized user on the network?

The POODLE attack is an MITM exploit that affects:

TLS - Transport Layer Security
SSL - Secure Sockers Layer

Which of the following allows an auditor to test proprietary-software compiled code for security flaws?

Which of the following is the BEST reason to run an untested application is a sandbox?

A company is performing an analysis of the corporate enterprise network with the intent of identifying what will cause losses in revenue, referrals, and/or reputation when out of commission. Which of the following is an element of a Business Impact Analysis (BIA) that is being addressed?

Ann, a user, states that her machine has been behaving erratically over the past week. She has experienced slowness and input lag and found text files that appear to contain pieces of her emails or online conversations with coworkers. The technician runs a standard virus scan but detects nothing. Which of the following types of malware has infected the machine?

A security analyst is attempting to identify vulnerabilities in a customer's web application without impacting the system or its data. Which of the following BEST describes the vulnerability scanning concept performed?

A systems administrator wants to implement a wireless protocol that will allow the organization to authenticate mobile devices prior to providing the user with a captive portal login. Which of the following should the systems administrator configure?

A user receives an email from ISP indicating malicious traffic coming from the user's home network is detected. The traffic appears to be Linux-based, and it is targeting a website that was recently featured on the news as being taken offline by an Internet attack. The only Linux device on the network is a home surveillance camera system. Which of the following BEST describes what is happening?

A company has developed a business critical system for its core automation process with a software vendor. Which of the following can provide access to the source code if the licencor declares bankruptcy?

An administrator is configuring a wireless network. Security policy states that deprecated cryptography should not be used when there is an alternative choice. Which of the following should the administrator use for the wireless network's cryptographic protocol?

A security analyst is securing a Proxy Auto Configuration (PACS). One of the requirements is network isolation with no access to the Internet or networked computers. Given this scenario, which of the following should the analyst implement to BEST address this requirement?

When developing an application, executing a preconfigured set of instructions is known as:

A group of developers is collaborating to write software for a company. The developers need to work in subgroups and restrict access to their modules. Which of the following access control methods is considered user-centric?

Which of the following BEST implements control diversity to reduce the risks associated with the authentication of employees into company resources?

A security analyst is conducting a web application vulnerability scan against the company website. Which of the following is considered an intrusive scan?

A company wishes to deploy a wireless network. Management insists that each individual user should have to authenticate with a unique username and password before being able to associate with the wireless access points. Which of the following wireless features would be the MOST appropriate to achieve this objective?

Joe, a senior systems administrator, must leave for a family emergency. While Joe is absent, another systems administrator discovers Joe stole confidential company information. Which of the following organizational procedures would have detected this breach sooner?

Some of the legacy systems in an organization are running old versions of the Windows OS and others are running Linux OSs, while new systems are running the latest release of the Windows OS. The systems are not running any legacy custom applications. The organization's Chief Information Officer (CIO) wishes to unify all systems to reduce cost and enhance the security posture of the organization, without losing data or causing data leakage. Which of the following would be the BEST course of action to take?

Finance department employees are reporting slow network connectivity and SSL/TLS certificate errors when they access secure websites. A security administrator suspects a computer in the finance VLAN may have been compromised and is impersonating the router's IP address using an MITM attack. Which of the following commands should the security administrator use to verify this finding?

The Chief Information Security Officer (CISO) of an organization has tasked the security analysis team with researching and developing a multifactor authentication alternative to the existing single-factor version. The team decides that multifactor, for this organization, will mean three separate and distinct authentication methods. Which of the following options BEST meets this requirement?

A security consultant is gathering information about the frequency of a security threat's impact to an organization. Which of the following should the consultant use to label the number of times an attack can be expected to impact the organization in a 365-day period?

A security specialist must confirm file backups match the original copy. Which of the following should the security specialist use to accomplish the objective?

Which of the following BEST describes the impact of an unremediated session timeout vulnerability?

The Chief Information Security Officer (CISO) of a university is concerned about potential transmission of usernames and passwords in cleartext when authenticating to a directory server. Which of the following would BEST mitigate the CISO's concerns?

After an employee reported slow network speeds and application responsiveness, the help desk asked the company's security administrator to review the following firewall logs from the employee's computer:

2017-05-30 12:12:31 ALLOW TCP 192.168.1.236 192.168.1.1 30295 21
2017-05-30 12:12:32 ALLOW TCP 192.168.1.236 192.168.1.1 30296 22
2017-05-30 12:12:33 ALLOW TCP 192.168.1.236 192.168.1.1 30296 25
2017-05-30 12:12:33 ALLOW TCP 192.168.1.236 192.168.1.1 30297 80
2017-05-30 12:12:33 DROP TCP 84.176.55.103 192.168.1.236 10434 445

Which of the following can the security administrator infer and report to the help desk based on the above logs?

A penetration tester uses an exploited network printer as a base of operations to expand access to various workstations. Which of the following BEST describes the tester's actions?

A security engineer is making changes to a corporate network to facilitate the expansion of corporate connectivity to guest users. The security engineer is concerned with unauthorized users accessing sensitive systems that also require network connectivity. Given the engineer's requirements, which of the following is the BEST method of securing the sensitive systems?

A network technician must update the company's wireless configuration settings to comply with new requirements, which means the use of AES encryption. Which of the following settings would BEST ensure the requirements are met?

After a significant amount of hiring, an organization would like to simplify the connection process to its wireless network for employees while ensuring maximum security. The Chief Information Officer (CIO) wants to get rid of any shared network passwords and require employees to use their company credentials when connecting. Which of the following should be implemented to BEST meet this requirement?

An auditor confirms the risk associated with a Windows-specific vulnerability, which was discovered by the company's security tool, does not apply due to the server running a LInux OS. Which of the following does this BEST describe?

An employee has been writing a secure shell around software used to secure executable files. The employee has conducted the appropriate self-test and is ready to move the software into the next environment. Within which of the following environments is the employee currently working?

A security administrator wants to prevent standard users from running software they downloaded or copied to the computer. The security administrator find the following permissions on the computer:

Folder Location Administrator Permissions Standard User Permissions
C:\ RW RW
C:\OperatingSystem\ RW R
C:\Programs\ RW R
C:\TEMP\ RW RW
C:\ShippingDATA RW RW
C:\Users\User1 R RW
C:\Users\Admin RW .

The administrator needs to create a policy that specifies from which folders a low-privilege user can run applications. Which of the following application whitelist configurations would BEST accomplish this task?

A network administrator is downloading the latest software for the organization's core switch. The downloads page allows users to view the checksum values for the available files. The network administrator is shows the following when viewing the checksum values for the TB_16.swi.file:

Checksum values for the downloaded file:

MD5 d50b2b04cfb168eec8
SHA1 6a49065705a43de83dfa9e94
SHA256 7123fb644fbabdda6a73f6e6bc833e2cf12

After downloading the file, the network administrator runs a command to show the following output:

Algorithm Hash Patch
SHA256 5fdbbfb644fbabdda000006e6bc833e2c968 C:\Users\bsmith\YB_16.swi
SHA256 64ccbfbaf4fb96dda6a7373e9bcf62e3c244 C:\Users\bsmith\AA_15.swi
SHA1 12fec6aabc9ce87fee654abc C:\Users\bsmith\KB_09.swi
MD5 5fdbbfb644fbadda6 C:\Users\bsmith\KA_01.swi

Which of the following can be determined from the above output?

A security engineer at a manufacturing company is implementing a third-party cloud application. Rather than create users manually in the application, the engineer decides to use the SAML protocol. Which of the following is being used for this implementation?

An energy company is in the final phase of testing its new billing service. The testing team wants to use production data in the test system for stress testing. Which of the following is the BEST way to use production data without sending false notification to the customers?

A company is looking for an authentication protocol that uses tickets and time stamps to ensure the validity of requests and prevent against replay attacks. Which of the following would be BEST suited to meet this requirement?

A network administrator is reviewing the following IDS logs:

ALERT: 192.168.1.20:1027 -> 192.168.1.21:445 malicious payload detected
ALERT: 192.168.1.20:1034 -> 192.168.1.21:445 malicious payload detected
ALERT: 192.168.1.20:2041 -> 192.168.1.21:445 malicious payload detected
ALERT: 192.168.1.20:1165 -> 192.168.1.21:445 malicious payload detected

Based on the above information, which of the following types of malware is triggering the IDS?

Which of the following security controls provides an alternative solution to a control that would be considered unpractical or excessively expensive?

An organization has an account management policy that defines parameters around each type of account. The policy specifies different security attributes, such as longevity, usage auditing, password complexity, and identity proofing. The goal of the account management policy is to ensure the highest level of security while providing the greatest availability without compromising data integrity for users. Which of the following account types should the policy specify for service technicians from corporate partners?

The network team has detected a large amount of traffic between workstations on the network. The traffic was initially very light, but it is increasing exponentially as the day progresses. Which of the following types of malware might be suspected?

A security analyst has been dealing with a large number of malware infections on workstations with legacy operating systems. The infections are not being detected by the current AV suite. Further analysis shows that the signatures are up-to-date and the AV engines are functioning correctly. The company is unable to afford next-generation AV that prevents these types of attacks. Which of the following methods should the security analyst employ to prevent future outbreaks?

An organization wants to ensure servers and applications can be deployed rapidly, in a consistent manner, and allow for flexible configuration changes. Which of the following should the organization use to make this process repeatable across multiple locations?

Which of the following staging environments is MOST likely to be a one-to-one mapping with the production environment and used for testing and validation prior to "go live"?

Which of the following would be MOST effective in reducing tailgating incidents?

The human resources department is outsourcing much of its operations to a third party. As part of the process, the local human resources data needs to be transmitted to the third party over the Internet. Which of the following is the BEST way to transmit the data?

Management wishes to add another authentication factor in addition to fingerprints and passwords in order to have three-factor authentication. Which of the following would BEST satisfy this request?

Vendor diversity is considered an architectural best practice because:

A security analyst wants to limit the use of USB and external drives to protect against malware, as well as protect files leaving a user's computer. Which of the following is the BEST method to use?

An organization would like to grant access to its wireless network to users who are visiting from another trusted organization by authenticating the visiting users at their home organization. Which of the following is the organization's BEST option?

A network technician is trying to set up a secure method for managing users and groups across the enterprise. Which of the following protocols is MOST likely to be used?

A Chief Executive Officer (CEO) of an organization receives an email stating the CEO's account may have been compromised. The email further directs the CEO to click on a link to update the account credentials. Which of the following types of attacks has MOST likely occurred?

A security analyst identified an SQL injection attack. Which of the following is the FIRST step in remediating the vulnerability?

To get the most accurate results on the security posture of a system, which of the following actions should the security analyst do prior to scanning?

When using a cryptographic function to store a password, which of the following should be used to avoid similar output from similar passwords?

A security administrator is performing a test to determine if a server is vulnerable to compromise through unnecessary ports. Which of the following tools would assist the security administrator in gathering the required information?

A security consultant wants to see what information can be obtained by banner grabbing the company's web servers. There are more than 100 web servers, and the consultant would like to perform and aggregate the information quickly. Which of the following is the MOST time-efficient way to accomplish this task?

A third-party penetration testing company was able to successfully use an ARP cache poison technique to gain root access on a server. The tester successfully moved to another server that was not in the original network. Which of the following is the MOST likely method used to gain access to the other host?

A company was recently audited by a third party. The audit revealed the company's network devices were transferring files in the clear. Which of the following protocols should the company use to transfer files?

A security engineer is working with the CSIRT to investigate a recent breach of client data to the improper use of cloud-based tools. The engineer finds that an employee was able to access cloud-based storage platform from the office and upload data for the purposes of doing work from home after hours. Such activity is prohibited by policy, but no preventive control is in place to block such activities. Which of the following controls would have prevented this breach?

A security analyst reviews the following log entry:

2017-01-13 1622CST 10.11.24.18 93242 148 TCP_HIT 200.200.0.223 _
OBSERVED POST HTTP/1.1.0. "Mozilla 1." www.dropbox.com
Financial_Report_2016_CONFID.pdf, 13MB, MS-RTC LM8; .NET
CLR 3.0.4509.1392, Jane.Doe

Which of the following security issues can the analyst identify?

A network administrator receives a support ticket from the security operations team to implement secure access to the domain. The support ticket contains the following information:

Source: 192.168.1.137
Destination: 10.113.10.8
Protocol: TCP
Ports: 636
Time-of-day restriction: None
Proxy bypass required: Yes

Which of the following is being requested to be implemented?

A consumer purchases an exploit from the dark web. The exploit targets the online shopping cart of popular website, allowing the shopper to modify the price of an item at checkout. Which of the following BEST describes this type of user?

A user needs to transmit confidential information to a third party. Which of the following should be used to encrypt the message?

Which of the following BEST describes the process of altering the bits of a media file to embed a hidden message?

An incident response analyst at a large corporation is reviewing proxy log data. The analyst believes a malware infection may have occurred. Upon further review, the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the best NEXT step for the analyst to take?

An organization is providing employees on the shop floor with computers that will log their time based on when they sign on and off the network. Which of the following account types should the employee receive?

While troubleshooting a client application connecting to the network, the security administrator notices the following error: Certificate is not valid. Which of the following is the BEST way to check if the digital certificate is valid?

Which of the following types of embedded systems is required in manufacturing environments with life safety requirements?

Which of the following access management concepts is MOST closely associated with the use of a password or PIN?

A security administrator wants to determine if a company's web servers have the latest operating system and application patches installed. Which of the following types of vulnerability scan should be conducted?

A security analyst, who is analyzing the security of the company's web server, receives the following output:

POST http://www.acme.com/AuthenticationServlet HTTP/1.1
HOST: www.acme.com
accept: text/xml, application/xml, application/xhtml + xml
Keep-Alive: 300
Connection: keep-alive
Referer: http//acme.com/index.jsp
Cookie: JSESSIONID+LvzZRJJXgwyWPWEQMhS49vtW1yJdvn78CG1Kp5jTvvChDyPknm4t !
Content-type: application/x-www-form-urlencoded
Content-length: 64
delegate_service=131&user=acme1&pass=test&submit=SUBMIT

Which of the following is the issue:

Which of the following is a compensating control that will BEST reduce the risk of weak passwords?

A DFIR analyst is collecting log data from multiple global locations. Which of the following must the DFIR analyst do to properly utilize the logs for forensic analysis?

Which of the following access management concepts is associated with file permissions?

Which of the following differentiates ARP poisoning from a MAC spoofing attack?

A technician is evaluating malware that was found on the enterprise network. After reviewing samples of the malware binaries, the technician finds each has a different hash associated with it. Which of the following types of malware is MOST likely present in the environment?

An employee is having issues when attempting to access files on a laptop. The machine was previously running slow, and many files were not accessible. The employee is not able to access the hard drive the next day, and all file names were changed to some random names. Which of the following BEST represents what compromised the machine?

A website form is used to register new students at a university. The form passed the unsanitized values entered by the user and uses them to directly add the student's information to several core systems. Which of the following attacks can be used to gain further access due to this practice?

A penetration testing team deploys a specifically crafted payload to a web server, which results in opening a new session as the web server daemon. This session has full read/write access to the file system and the admin console. Which of the following BEST describes the attack?

An organization wants to move its operations to the cloud. The organization's systems administrator will still maintain control of the servers, firewalls and load balancers in the cloud environment. Which of the following models is the organization considering?

After a recent security breach at a hospital, it was discovered that nursing staff members, who were working the overnight shift, searched for and accessed private health information for local celebrities who were patients at the hospital. Which of the following would have enabled the hospital to discover this behavior BEFORE a breach occurred?

To help prevent against a SQL injection, which of the following functions should the application developer implement?

The Chief Executive Officer (CEO) has asked a junior technician to create a folder in which the CEO can place sensitive files. The technician later finds the information within these files is the topic of conversation around the company. When this information gets back to the CEO, the technician is called in to explain. Which of the following MOST likely occurred?

A Chief Information Security Officer (CISO) is concerned about insider threats compromising credentials related to service accounts on internal servers. A security analyst is tasked with developing a solution that will allow for the collection and analysis of log data in a simulated environment, which represents the production environment. Which of the following solutions would BEST satisfy the CISO's requirements?

Users are able to reach the login page of their company website from home using HTTP. A network administrator disables HTTP and implements SSL. However, after the implementation, home users cannot access the login page of the company website. Which of the following is the MOST likely reason the site is unavailable?

During a routine review of firewall log reports, a security technician notices multiple successful logins for the admin user during unusual hours. The technician contacts the network administrator, who confirms the logins were not related to the administrator's activities. Which of the following is the MOST likely reason for these logins?

An organization is deploying a new system to the production environment. A security analyst discovers the system is not properly hardened or patched. Which of the following BEST describes the scenario?

Which of the following computer recovery sites is the least expensive and the most difficult to test at the same time?

A security specialist is notified about a certificate warning that users receive when using a new internal website. After being given the URL from one of the users and seeing the warning, the security specialist inspects the certificate and realizes it has been issued to the IP address, which is how the developers reach the site. Which of the following would BEST resolve the issue?

Compared to a non-credentialed scan, which of the following is a unique result of a credentialed scan?

A company is implementing an internal PKI. The design will include a CA and a subordinate CA. Which of the following CA design choices should be considered prior to implementation?

A member of the IR team has identified an infected computer. Which of the following IR phases should the team member conduct NEXT?

A retail store recently deployed tablets for sales employees to use while assisting customers. Two of the tablets have already been lost or stolen. Which of the following would be the BEST way for the store to secure the tablets against future loss or theft?

A security engineer at a manufacturing company is implementing a third-party cloud application. Rather than create users manually in the application, the engineer decides to use the SAML protocol. Which of the following is being used for this implementation?

A security engineer is configuring a wireless network. The security requirements for the network are:

- Mutual authentication of wireless clients and the authentication server
- Client authentication must be username and password
- Cannot use a certificate on the authentication server

Which of the following protocols BEST meets these requirements?

A security administrator wants to implement least privilege access for a network share that stores sensitive company data. The organization is particularly concerned with the integrity of data and implementing discretionary access control. The following controls are available:

Read = A user can read the content of an existing file.
Write = A user can modify the content of an existing file and delete an existing file.
Create = A user can create a new file and place data with the file.

A missing control means the users does not have that access. Which of the following configurations provides the appropriate control to support the organization's requirements?

A security team has deployed a new UTM to connect different segments of the corporate network. In addition to the UTM, each host has its own firewall and HIPS. The new UTM implements many of the same protections as the host-based firewall and HIPS, but the security team plans to leave both of these protections in place. Which of the following BEST describes the reason for this redundancy?

A security consultant is gathering information about the frequency of a security threat's impact to an organization. Which of the following should the consultant use to label the number of times an attack can be expected to impact the organization in a 365-day period?

When sending messages using symmetric encryption, which of the following must happen FIRST?

While troubleshooting a client application connecting to the network, the security administrator notices the following error: Certificate is not valid. Which of the following is the BEST way to check if the digital certificate is valid?