Legal counsel has notified the information security manager of a legal matter that will require the preservation of electronic records for 2000 sales force employees. Source records will be email, PC, network shares, and applications.
After all restrictions have been lifted, which of the following should the information manager review?

• A.Data retention policy
• B.Scope statement
• C.Legal hold
• D.Chain of custody

Comment: *

Name: *

Email: *

Verification: *

After investigating virus outbreaks that have cost the company $1000 per incident, the company's Chief Information Security Officer (CISO) has been researching new antivirus software solutions to use and be fully supported for the next two years. The CISO has narrowed down the potential solutions to four candidates that meet all the company's performance and capability requirements:

Using the table above, which of the following would be the BEST business-driven choice among five possible solutions?

• A.Product B
• B.Product E
• C.Product C
• D.Product A
• E.Product D

Comment: *

Name: *

Email: *

Verification: *

The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop support director has asked the Information Security department to determine if any changes were made to the source image. Which of the following methods would BEST help with this process?
(Select TWO).

• A.Retrieve source system image from backup and run file comparison analysis on the two images.
• B.Parse all images to determine if extra data is hidden using steganography.
• C.Calculate a new hash and compare it with the previously captured image hash.
• D.Ask desktop support if any changes to the images were made.
• E.Check key system files to see if date/time stamp is in the past six months.

Comment: *

Name: *

Email: *

Verification: *

A company's claims processed department has a mobile workforce that receives a large number of email submissions from personal email addresses. An employees recently received an email that approved to be claim form, but it installed malicious software on the employee's laptop when was opened.

• A.Implement cloud-based content filtering with sandboxing capabilities.
• B.Install a mail gateway to scan incoming messages and strip attachments before they reach the mailbox.
• C.Impalement application whitelisting and add only the email client to the whitelist for laptop in the claims processing department.
• D.Required all laptops to connect to the VPN before accessing email.

Comment: *

Name: *

Email: *

Verification: *

An external red team is brought into an organization to perform a penetration test of a new network-based application. The organization deploying the network application wants the red team to act like remote, external attackers, and instructs the team to use a black-box approach. Which of the following is the BEST methodology for the red team to follow?

• A.Sendoutspear-phishingemailsagainstuserswhoare known to have accesstothenetwork-based application, so the red team can go on-site with valid credentials and use the software.
• B.Examinethe application using a portscanner, thenrun a vulnerabilityscanner againstopenports looking for known, exploitable weaknesses the application and related services may have.
• C.Runa protocolanalyzertodetermine whattrafficis flowingin and outof theserver,andlookforways to alter the data stream that will result in information leakage or a system failure.
• D.Askfor moredetailsregardingthe engagementusingsocial engineering tacticsinan attempttogetthe organization to disclose more information about the network application to make attacks easier.

Comment: *

Name: *

Email: *

Verification: *