NEW QUESTION 1
Company XYZ recently acquired a manufacturing plant from Company ABC which uses a different manufacturing ICS platform. Company XYZ has strict ICS security regulations while Company ABC does not. Which of the following approaches would the network security administrator for Company XYZ MOST likely proceed with to integrate the new manufacturing plant?

• A. Conduct a network vulnerability assessment of acquired plant ICS platform and correct all identified flaws during integration.
• B. Convert the acquired plant ICS platform to the Company XYZ standard ICS platform solely to eliminate potential regulatory conflicts.
• C. Conduct a risk assessment of the acquired plant ICS platform and implement any necessary or required controls during integration.
• D. Require Company ABC to bring their ICS platform into regulatory compliance prior to integrating the new plant into Company XYZ’s network.

Answer: C

NEW QUESTION 2
A hosting company provides inexpensive guest virtual machines to low-margin customers. Customers manage their own guest virtual machines. Some customers want basic guarantees of logical separation from other customers and it has been indicated that some customers would like to have configuration control of this separation; whereas others want this provided as a value-added service by the hosting company. Which of the following BEST meets these requirements?

• A. The hosting company should install a hypervisor-based firewall and allow customers to manage this on an as-needed basis.
• B. The hosting company should manage the hypervisor-based firewall; while allowing customers to configure their own host-based firewall.
• C. Customers should purchase physical firewalls to protect their guest hosts and have the hosting company manage these if requested.
• D. The hosting company should install a host-based firewall on customer guest hosts and offer to administer host firewalls for customers if requested.

Answer: B

NEW QUESTION 3
Which of the following does SAML uses to prevent government auditors or law enforcement from identifying specific entities as having already connected to a service provider through an SSO operation?

• A. Transient identifiers
• B. Directory services
• C. Restful interfaces
• D. Security bindings

Answer: A

NEW QUESTION 4
Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international standards. He has recommended that the company use his cryptographic method. Which of the following methodologies should be adopted?

• A. The company should develop an in-house solution and keep the algorithm a secret.
• B. The company should use the CEO’s encryption scheme.
• C. The company should use a mixture of both systems to meet minimum standards.
• D. The company should use the method recommended by other respected information security organizations.

Answer: D

NEW QUESTION 5
A large hospital has implemented BYOD to allow doctors and specialists the ability to access patient medical records on their tablets. The doctors and specialists access patient records over the hospital’s guest WiFi network which is isolated from the internal network with appropriate security controls. The patient records management system can be accessed from the guest network and requires two factor authentication. Using a remote desktop type interface, the doctors and specialists can interact with the hospital’s system. Cut and paste and printing functions are disabled to prevent the copying of data to BYOD devices. Which of the following are of MOST concern? (Select TWO).

• A. Privacy could be compromised as patient records can be viewed in uncontrolled areas.
• B. Device encryption has not been enabled and will result in a greater likelihood of data loss.
• C. The guest WiFi may be exploited allowing non-authorized individuals access to confidential patient data.
• D. Malware may be on BYOD devices which can extract data via key logging and screen scrapes.
• E. Remote wiping of devices should be enabled to ensure any lost device is rendered inoperable.

Answer: AD

NEW QUESTION 6
A company decides to purchase commercially available software packages. This can introduce new security risks to the network. Which of the following is the BEST description of why this is true?

• A. Commercially available software packages are typically well known and widely availabl
• B. Information concerning vulnerabilities and viable attack patterns are never revealed by the developer to avoid lawsuits.
• C. Commercially available software packages are often widely availabl
• D. Information concerning vulnerabilities is often kept internal to the company that developed the software.
• E. Commercially available software packages are not widespread and are only available in limited area
• F. Information concerning vulnerabilities is often ignored by business managers.
• G. Commercially available software packages are well known and widely availabl
• H. Information concerning vulnerabilities and viable attack patterns are always shared within the IT community.

Answer: B

NEW QUESTION 7
A security tester is testing a website and performs the following manual query: https://www.comptia.com/cookies.jsp?products=5%20and%201=1
The following response is received in the payload: “ORA-000001: SQL command not properly ended”
Which of the following is the response an example of?

• A. Fingerprinting
• B. Cross-site scripting
• C. SQL injection
• D. Privilege escalation

Answer: A

NEW QUESTION 8
A health service provider is considering the impact of allowing doctors and nurses access to the internal email system from their personal smartphones. The Information Security Officer (ISO) has received a technical document from the security administrator explaining that the current email system is capable of enforcing security policies to personal smartphones, including screen lockout and mandatory PINs. Additionally, the system is able to remotely wipe a phone if reported lost or stolen. Which of the following should the Information Security Officer be MOST concerned with based on this scenario? (Select THREE).

• A. The email system may become unavailable due to overload.
• B. Compliance may not be supported by all smartphones.
• C. Equipment loss, theft, and data leakage.
• D. Smartphone radios can interfere with health equipment.
• E. Data usage cost could significantly increase.
• F. Not all smartphones natively support encryption.
• G. Smartphones may be used as rogue access points.

Answer: BCF

NEW QUESTION 9
After connecting to a secure payment server at https://pay.xyz.com, an auditor notices that the SSL certificate was issued to *.xyz.com. The auditor also notices that many of the internal development servers use the same certificate. After installing the certificate on dev1.xyz.com, one of the developers reports misplacing the USB thumb-drive where the SSL certificate was stored. Which of the following should the auditor recommend FIRST?

• A. Generate a new public key on both servers.
• B. Replace the SSL certificate on dev1.xyz.com.
• C. Generate a new private key password for both servers.
• D. Replace the SSL certificate on pay.xyz.com.

Answer: D

NEW QUESTION 10
A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would MOST likely be uncovered by this tool?

• A. The tool could show that input validation was only enabled on the client side
• B. The tool could enumerate backend SQL database table and column names
• C. The tool could force HTTP methods such as DELETE that the server has denied
• D. The tool could fuzz the application to determine where memory leaks occur

Answer: A

NEW QUESTION 11
A security administrator is tasked with increasing the availability of the storage networks while enhancing the performance of existing applications. Which of the following technologies should the administrator implement to meet these goals? (Select TWO).

• A. LUN masking
• B. Snapshots
• C. vSAN
• D. Dynamic disk pools
• E. Multipath
• F. Deduplication

Answer: DE

NEW QUESTION 12
An organization is concerned with potential data loss in the event of a disaster, and created a backup datacenter as a mitigation strategy. The current storage method is a single NAS used by all servers in both datacenters. Which of the following options increases data availability in the event of a datacenter failure?

• A. Replicate NAS changes to the tape backups at the other datacenter.
• B. Ensure each server has two HBAs connected through two routes to the NAS.
• C. Establish deduplication across diverse storage paths.
• D. Establish a SAN that replicates between datacenters.

Answer: D

NEW QUESTION 13
A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?

• A. Change the IDS to use a heuristic anomaly filter.
• B. Adjust IDS filters to decrease the number of false positives.
• C. Change the IDS filter to data mine the false positives for statistical trending data.
• D. Adjust IDS filters to increase the number of false negatives.

Answer: B

NEW QUESTION 14
A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening, HIPS/NIDS) the security architect needs to implement a mechanism to securely store cryptographic keys used to sign code and code modules on the VMs. Which of the following will meet this goal without requiring any hardware pass-through implementations?

• A. vTPM
• B. HSM
• C. TPM
• D. INE

Answer: A

NEW QUESTION 15
A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.
Which of the following security activities should be implemented as part of the SDL in order to provide the MOST security coverage over the solution? (Select TWO).

• A. Perform unit testing of the binary code
• B. Perform code review over a sampling of the front end source code
• C. Perform black box penetration testing over the solution
• D. Perform grey box penetration testing over the solution
• E. Perform static code review over the front end source code

Answer: DE

NEW QUESTION 16
When attending the latest security conference, an information security administrator noticed only a few people carrying a laptop around. Most other attendees only carried their smartphones.
Which of the following would impact the security of conference’s resources?

• A. Wireless network security may need to be increased to decrease access of mobile devices.
• B. Physical security may need to be increased to deter or prevent theft of mobile devices.
• C. Network security may need to be increased by reducing the number of available
• D. physical network jacks.
• E. Wireless network security may need to be decreased to allow for increased access of mobile devices.

Answer: C

NEW QUESTION 17
A company is in the process of outsourcing its customer relationship management system to a cloud provider. It will host the entire organization’s customer database. The database will be accessed by both the company’s users and its customers. The procurement department has asked what security activities must be performed for the deal to proceed. Which of the following are the MOST appropriate security activities to be performed as part of due diligence? (Select TWO).

• A. Physical penetration test of the datacenter to ensure there are appropriate controls.
• B. Penetration testing of the solution to ensure that the customer data is well protected.
• C. Security clauses are implemented into the contract such as the right to audit.
• D. Review of the organizations security policies, procedures and relevant hosting certifications.
• E. Code review of the solution to ensure that there are no back doors located in the software.

Answer: CD

NEW QUESTION 18
A company that must comply with regulations is searching for a laptop encryption product to use for its 40,000 end points. The product must meet regulations but also be flexible enough to minimize overhead and support in regards to password resets and lockouts. Which of the following implementations would BEST meet the needs?

• A. A partition-based software encryption product with a low-level boot protection and authentication
• B. A container-based encryption product that allows the end users to select which files to encrypt
• C. A full-disk hardware-based encryption product with a low-level boot protection and authentication
• D. A file-based encryption product using profiles to target areas on the file system to encrypt

Answer: D

NEW QUESTION 19
The technology steering committee is struggling with increased requirements stemming from an increase in telecommuting. The organization has not addressed telecommuting in the past. The implementation of a new SSL-VPN and a VOIP phone solution enables personnel to work from remote locations with corporate assets. Which of the following steps must the committee take FIRST to outline senior management’s directives?

• A. Develop an information classification scheme that will properly secure data on corporate systems.
• B. Implement database views and constrained interfaces so remote users will be unable to access PII from personal equipment.
• C. Publish a policy that addresses the security requirements for working remotely with company equipment.
• D. Work with mid-level managers to identify and document the proper procedures for telecommuting.

Answer: C

NEW QUESTION 20
A Chief Information Security Officer (CISO) is approached by a business unit manager who heard a report on the radio this morning about an employee at a competing firm who shipped a VPN token overseas so a fake employee could log into the corporate VPN. The CISO asks what can be done to mitigate the risk of such an incident occurring within the organization. Which of the following is the MOST cost effective way to mitigate such a risk?

• A. Require hardware tokens to be replaced on a yearly basis.
• B. Implement a biometric factor into the token response process.
• C. Force passwords to be changed every 90 days.
• D. Use PKI certificates as part of the VPN authentication process.

Answer: B