Legal authorities notify a company that its network has been compromised for the second time in two
years. The investigation shows the attackers were able to use the same vulnerability on different systems
in both attacks. Which of the following would have allowed the security team to use historical information to
protect against the second attack?

• A.Lessons learned
• B.Recovery point objectives
• C.Key risk indicators
• D.Tabletop exercise

Comment: *

Name: *

Email: *

Verification: *

A company contracts a security engineer to perform a penetration test of its client-facing web portal. Which
of the following activities would be MOST appropriate?

• A.Use network enumeration tools to identify if the server is running behind a load balancer
• B.Use a protocol analyzer against the site to see if data input can be replayed from the browser
• C.Scan the website through an interception proxy and identify areas for the code injection
• D.Scan the site with a port scanner to identify vulnerable services running on the web server

Comment: *

Name: *

Email: *

Verification: *

An administrator wants to enable policy based flexible mandatory access controls on an open source OS to prevent abnormal application modifications or executions. Which of the following would BEST accomplish this?

• A.Access control lists
• B.SELinux
• C.IPtables firewall
• D.HIPS

Comment: *

Name: *

Email: *

Verification: *

A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled from a report through the company's security information and event management server.
Logs:
Log 1:
Feb 5 23:55:37.743: %SEC-6-IPACCESSLOGS: list 10 denied 10.2.5.81 3 packets Log 2:
HTTP://www.company.com/index.php?user=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Log 3:
Security Error Alert
Event ID 50: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client Log 4:
Encoder oe = new OracleEncoder ();
String query = "Select user_id FROM user_data WHERE user_name = ' "
+ oe.encode ( req.getParameter("userID") ) + " ' and user_password = ' "
+ oe.encode ( req.getParameter("pwd") ) +" ' ";
Vulnerabilities
Buffer overflow
SQL injection
ACL
XSS
Which of the following logs and vulnerabilities would MOST likely be related to the security breach? (Select TWO).

• A.Log 1
• B.Log 2
• C.Log 3
• D.Log 4
• E.Buffer overflow
• F.ACL
• G.XSS
• H.SQL injection

Comment: *

Name: *

Email: *

Verification: *

A company has hired an external security consultant to conduct a thorough review of all aspects of corporate security. The company is particularly concerned about unauthorized access to its physical offices resulting in network compromises. Which of the following should the consultant recommend be performed to evaluate potential risks?

• A.The consultant should attempt to gain access to physical offices through social engineering and then attempt data exfiltration
• B.The consultant should be granted access to all physical access control systems to review logs and evaluate the likelihood of the threat
• C.The company should conduct internal audits of access logs and employee social media feeds to identify potential insider threats
• D.The company should install a temporary CCTV system to detect unauthorized access to physical offices

Comment: *

Name: *

Email: *

Verification: *