Engineers at a company believe a certain type of data should be protected from competitors, but the data owner insists the information is not sensitive. An information security engineer is implementing controls to secure the corporate SAN. The controls require dividing data into four groups: non-sensitive, sensitive but accessible, sensitive but export-controlled, and extremely sensitive.
Which of the following actions should the engineer take regarding the data?

• A.Label the data as sensitive but export-controlled.
• B.Label the data as sensitive but accessible.
• C.Label the data as extremely sensitive.
• D.Label the data as non-sensitive.

Comment: *

Name: *

Email: *

Verification: *

A managed service provider is designing a log aggregation service for customers who no longer want tomanage an internal SIEM infrastructure. The provider expects that customers will send all types of logs to them, and that log files could contain very sensitive entries. Customers have indicated they want on-premises and cloud-based infrastructure logs tobe stored in this new service. An engineer, who is designing the new service, is deciding how to segment customers. Which of the following is the BEST statement for the engineer to take into consideration?

• A.The managed service provider should outsource security of the platform to an existing cloud company.
  This willallow the new log service to be launched faster and with well-tested security controls.
• B.Single-tenancy is often more expensive and has less efficient resource utilization. Multi-tenancy may increase the risk of cross-customer exposure in the event of service vulnerabilities.
• C.The most secure design approach would be to give customers on-premises appliances, install agents on endpoints, and then remotely manage the service via a VPN.
• D.Due to the likelihood of large log volumes, the service provider should use a multi-tenancy model for the data storage tier, enable data deduplication for storage cost efficiencies, and encrypt data at rest.

Comment: *

Name: *

Email: *

Verification: *

As a security administrator, you are asked to harden a server running Red Hat Enterprise Server 5.5 64-bit.
This server is being used as a DNS and time server. It is not used as a database, web server, or print server.
There are no wireless connections to the server, and it does not need to print.
The command window will be provided along with root access. You are connected via a secure shell with root access.
You may query help for a list of commands.
Instructions:
You need to disable and turn off unrelated services and processes.
It is possible to simulate a crash of your server session. The simulation can be reset, but the server cannot be rebooted. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Comment: *

Name: *

Email: *

Verification: *

A security engineer successfully exploits an application during a penetration test. As proof of the exploit, the security engineer takes screenshots of how data was compromised in the application. Given the information below from the screenshot.

Which of the following tools was MOST likely used to exploit the application?

• A.The engineer captured the data with a protocol analyzer, and then utilized Python to edit the data
• B.The engineer captured the HTTP headers, and then replaced the JSON data with a banner-grabbing tool
• C.The engineer used a cross-site script sent via curl to edit the data
• D.The engineer queried the server and edited the data using an HTTP proxy interceptor

Comment: *

Name: *

Email: *

Verification: *

A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the communication is stateless between the mobile application and the web services gateway. Which of the following controls MUST be implemented to enable stateless communication?

• A.Generate a one-time key as part of the device registration process.
• B.Require SSL between the mobile application and the web services gateway.
• C.The jsession cookie should be stored securely after authentication.
• D.Authentication assertion should be stored securely on the client.

Comment: *

Name: *

Email: *

Verification: *