During an internal code review, software called "ACE" was discovered to have a vulnerability that allows the execution of arbitrary code. The vulnerability is in a legacy, third-party vendor resource that is used by the ACE software. ACE is used worldwide and is essential for many businesses in this industry. Developers informed the Chief Information Security Officer that removal of the vulnerability will take time. Which of the following is the first action to take?

• A.Look for potential loCs in the company.
• B.Inform customers of the vulnerability.
• C.Remove the affected vendor resource from the ACE software.
• D.Develop a compensating control until the issue can be fixed permanently.

Comment: *

Name: *

Email: *

Verification: *

A vulnerability management team found four major vulnerabilities during an assessment and needs to provide a report for the proper prioritization for further mitigation. Which of the following vulnerabilities should have the highest priority for the mitigation process?

• A.A vulnerability that has related threats and loCs, targeting a different industry
• B.A vulnerability that is related to a specific adversary campaign, with loCs found in the SIEM
• C.A vulnerability that has no adversaries using it or associated loCs
• D.A vulnerability that is related to an isolated system, with no loCs

Comment: *

Name: *

Email: *

Verification: *

Which of the following best explains the importance of communicating with staff regarding the official public communication plan related to incidents impacting the organization?

• A.To establish what information is allowed to be released by designated employees
• B.To designate an external public relations firm to represent the organization
• C.To ensure that all news media outlets are informed at the same time
• D.To define how each employee will be contacted after an event occurs

Comment: *

Name: *

Email: *

Verification: *

An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?

• A.Configure a new SIEM specific to the management of the hosted environment.
• B.Subscribe to a threat feed related to the vendor's application.
• C.Download and manually import the logs outside of business hours.
• D.Use a vendor-provided API to automate pulling the logs in real time.

Comment: *

Name: *

Email: *

Verification: *

Following an attack, an analyst needs to provide a summary of the event to the Chief Information Security Officer. The summary needs to include the who-what-when information and evaluate the effectiveness of the plans in place. Which of the following incident management life cycle processes does this describe?

• A.Business continuity plan
• B.Lessons learned
• C.Forensic analysis
• D.Incident response plan

Comment: *

Name: *

Email: *

Verification: *