A security operations center analyst is investigating anomalous activity between a database server and an unknown external IP address and gathered the following data:
* dbadmin last logged in at 7:30 a.m. and logged out at 8:05 a.m.
* A persistent TCP/6667 connection to the external address was established at 7:55 a.m. The connection is still active.
* Other than bytes transferred to keep the connection alive, only a few kilobytes of data transfer every hour since the start of the connection.
* A sample outbound request payload from PCAP showed the ASCII content: "JOIN #community".
Which of the following is the MOST likely root cause?

• A.A SQL injection was used to exfiltrate data from the database server.
• B.The system has been hijacked for cryptocurrency mining.
• C.A botnet Trojan is installed on the database server.
• D.The dbadmin user is consulting the community for help via Internet Relay Chat.

Comment: *

Name: *

Email: *

Verification: *

An organization requires a contractual document that includes
* An overview of what is covered
* Goals and objectives
* Performance metrics for each party
* A review of how the agreement is managed by all parties
Which of the following BEST describes this type of contractual document?

• A.NDA
• B.BAA
• C.SLA
• D.ISA

Comment: *

Name: *

Email: *

Verification: *

A small business requires a low-cost approach to theft detection for the audio recordings it produces and sells.
Which of the following techniques will MOST likely meet the business's needs?

• A.Performing deep-packet inspection of all digital audio files
• B.Adding identifying filesystem metadata to the digital audio files
• C.Implementing steganography
• D.Purchasing and installing a DRM suite

Comment: *

Name: *

Email: *

Verification: *

A security analyst is validating the MAC policy on a set of Android devices. The policy was written to ensure non-critical applications are unable to access certain resources. When reviewing dmesg, the analyst notes many entries such as:
Despite the deny message, this action was still permit following is the MOST likely fix for this issue?

• A.Create separate domain and context files for irc.
• B.Set the devices to enforcing
• C.Add the objects of concern to the default context.
• D.Rebuild the policy, reinstall, and test.

Comment: *

Name: *

Email: *

Verification: *

An organization is establishing a new software assurance program to vet applications before they are introduced into the production environment, Unfortunately. many Of the applications are provided only as compiled binaries. Which Of the following should the organization use to analyze these applications? (Select TWO).

• A.SAST
• B.IDE SAST
• C.Fuzz testing
• D.IAST
• E.Regression testing
• F.Third-party dependency management

Comment: *

Name: *

Email: *

Verification: *