Following a recent and very large corporate merger, the number of log files an SOC needs to review has approximately tripled. The Chief Information Security Officer (CISO) has not been allowed to hire any more staff for the SOC, but is looking for other ways to automate the log review process so the SOC receives less noise. Which of the following would BEST reduce log noise for the SOC?

• A.Machine learning
• B.Centralized IPS
• C.Outsourcing
• D.SIEM filtering

Comment: *

Name: *

Email: *

Verification: *

A consulting firm was hired to conduct assessment for a company. During the first stage, a penetration tester used a tool that provided the following output:
TCP 80 open
TCP 443 open
TCP 1434 filtered
The penetration tester then used a different tool to make the following requests:
GET / script/login.php?token=45$MHT000MND876
GET / script/login.php?token=@#984DCSPQ%091DF
Which of the following tools did the penetration tester use? (Choose two)

• A.Protocol analyzer
• B.Port scanner
• C.Fuzzer
• D.Brute forcer
• E.Log analyzer
• F.HTTP interceptor

Comment: *

Name: *

Email: *

Verification: *

A company's Chief Information Security Officer (CISO) is working with the product owners to perform a business impact assessment. The product owners provide feedback related to the critically of various business processes, personal, and technologies. Transitioning into risk assessment activities, which of the following types of information should the CISO require to determine the proper risk ranking? (Select TWO).

• A.ROI
• B.Likelihood
• C.Magnitude
• D.TCO
• E.Trend analysis
• F.Compensating controls

Comment: *

Name: *

Email: *

Verification: *

A company is migrating systems from an on-premises facility to a third-party managed datacenter. For continuity of operations and business agility, remote access to all hardware platforms must be available at all times. Access controls need to be very robust and provide an audit trail. Which of the following security controls will meet the company's objectives? (Select two.)

• A.The IP addresses of server management interfaces are located within the company's extranet
• B.Application logs are hashed cryptographically and sent to the SIEM
• C.Access is captured in event logs that include source address, time stamp, and outcome
• D.Integrated platform management interfaces are configured to allow access only via SSH
• E.Access to hardware platforms is restricted to the systems administrator's IP address
• F.Access is limited to interactive logins on the VDi

Comment: *

Name: *

Email: *

Verification: *

The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime.
The CIO has mandated that the following improvements be implemented:
- All business units must now identify IT risks and include them in
their business risk profiles.
- Key controls must be identified and monitored.
- Incidents and events must be recorded and reported with management
oversight.
- Exemptions to the information security policy must be formally
recorded, approved, and managed.
- IT strategy will be reviewed to ensure it is aligned with the
businesses strategy and objectives.
In addition to the above, which of the following would BEST help the CIO meet the requirements?

• A.Document legacy systems to be decommissioned and the disposal process
• B.Establish a formal change management process
• C.Develop a security requirement traceability matrix
• D.Establish a register of core systems and identify technical service owners

Comment: *

Name: *

Email: *

Verification: *