A security controls assessor intends to perform a holistic configuration compliance test of networked
assets. The assessor has been handed a package of definitions provided in XML format, and many of the
files have two common tags within them: "<object object_ref=... />"and "<state state_ref=...
/>".Which of the following tools BEST supports the use of these definitions?

• A.XML fuzzer
• B.SCAP scanner
• C.Static code analyzer
• D.HTTP interceptor

Comment: *

Name: *

Email: *

Verification: *

A company wants to extend its help desk availability beyond business hours. The Chief Information Officer (CIO) decides to augment the help desk with a third-party service that will answer calls and provide Tier 1 problem resolution, such as password resets and remote assistance. The security administrator implements the following firewall change:

The administrator provides the appropriate path and credentials to the third-party company. Which of the following technologies is MOST likely being used to provide access to the third company?

• A.LDAP
• B.WAYF
• C.OpenID
• D.SAML
• E.RADIUS

Comment: *

Name: *

Email: *

Verification: *

A technician receives the following security alert from the firewall's automated system:

After reviewing the alert, which of the following is the BEST analysis?

• A.This alert indicates an endpoint may be infected and is potentially contacting a suspect host.
• B.This alert was generated by the SIEM because the user attempted too many invalid login attempts.
• C.This alert indicates a user was attempting to bypass security measures using dynamic DNS.
• D.This alert is false positive because DNS is a normalnetwork function.

Comment: *

Name: *

Email: *

Verification: *

A security administrator must configure the database server shown below to comply with the four requirements listed. Drag and drop the appropriate ACL that should be configured on the database server to its corresponding requirement. Answer options may be used once or not at all.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

A security administrator is updating a company's SCADA authentication system with a new application. To ensure interoperability between the legacy system and the new application, which of the following stakeholders should be involved in the configuration process before deployment? (Choose two.)

• A.Networkengineer
• B.Compliancemanager
• C.Humanresourcesadministrator
• D.Facilitiesmanager
• E.Incidentresponsecoordinator
• F.Servicedeskpersonnel

Comment: *

Name: *

Email: *

Verification: *