A company is transitioning to a new VDI environment, and a system engineer is responsible for developing a sustainable security strategy for the VDIs.
Which of the following is the MOST appropriate order of steps to be taken?

• A.Firmware update, OS patching, HIDS, antivirus, baseline, monitoring agent
• B.Baseline, antivirus, OS patching, monitoring agent, HIDS, firmware update
• C.OS patching, baseline, HIDS, antivirus, monitoring agent, firmware update
• D.Firmware update, OS patching, HIDS, antivirus, monitoring agent, baseline

Comment: *

Name: *

Email: *

Verification: *

An organization relies heavily on third-party mobile applications for official use within a BYOD deployment scheme. An excerpt from an approved text-based-chat client application AndroidManifest.xml is as follows:

Which of the following would restrict application permissions while minimizing the impact to normal device operations?

• A.Wrap the application before deployment
• B.Install the application outside of the corporate container
• C.Add the application to the enterprise mobile whitelist.
• D.Use the MDM to disable the devices' recording microphones and SMS

Comment: *

Name: *

Email: *

Verification: *

To meet a SLA, which of the following document should be drafted, defining the company's internal interdependent unit responsibilities and delivery timelines.

• A.BPA
• B.OLA
• C.MSA
• D.MOU

Comment: *

Name: *

Email: *

Verification: *

A security administrator is updating corporate policies to respond to an incident involving collusion between two systems administrators that went undetected for more than six months.
Which of the following policies would have MOST likely uncovered the collusion sooner? (Choose two.)

• A.Job rotation
• B.Incident response
• C.Continuous monitoring
• D.Mandatory vacation
• E.Time-of-day restrictions
• F.Separation of duties

Comment: *

Name: *

Email: *

Verification: *

A security administrator is shown the following log excerpt from a Unix system:
2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2
2013 Oct 10 07:14:57 web14 sshd[1635]: Failed password for root from 198.51.100.23 port 37915 ssh2
2013 Oct 10 07:14:58 web14 sshd[1638]: Failed password for root from 198.51.100.23 port 37916 ssh2
2013 Oct 10 07:15:59 web14 sshd[1640]: Failed password for root from 198.51.100.23 port 37918 ssh2
2013 Oct 10 07:16:00 web14 sshd[1641]: Failed password for root from 198.51.100.23 port 37920 ssh2
2013 Oct 10 07:16:00 web14 sshd[1642]: Successful login for root from 198.51.100.23 port 37924 ssh2 Which of the following is the MOST likely explanation of what is occurring and the BEST immediate response? (Select TWO).

• A.An authorized administrator has logged into the root account remotely.
• B.The administrator should disable remote root logins.
• C.Isolate the system immediately and begin forensic analysis on the host.
• D.A remote attacker has compromised the root account using a buffer overflow in sshd.
• E.A remote attacker has guessed the root password using a dictionary attack.
• F.Use iptables to immediately DROP connections from the IP 198.51.100.23.
• G.A remote attacker has compromised the private key of the root account.
• H.Change the root password immediately to a password not found in a dictionary.

Comment: *

Name: *

Email: *

Verification: *