Security + quiz 15

An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering it the organization may need to scale down just as quickly as it scaled up. The ClO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the ClO's concerns?

• Disallow new hires from using mobile devices for six months

• Select four devices for the sales department to use in a CYOD model

• Implement BYOD for the sates department while leveraging the MDM

• Deploy mobile devices using the COPE methodology

A public relations team will be taking a group of guest on a tour through the facility of a large ecommerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboars are cleaned and all desks are cleared. The company is MOST likely trying to protect against.

• Loss of proprietary information

• Damage to the company's reputation

• Social engineering

• Credential exposure

A network engineer needs to create a plan for upgrading the wireless infrastructure in a large office Priority must be given to areas that are currently experiencing latency and connection issues. Which of the following would be the BEST resource for determining the order of priority?

• Nmapn

• Heat maps

• Network diagrams

• Wireshark

A security analyst is preparing a threat for an upcoming internal penetration test. The analyst needs to identify a method for determining the tactics, techniques, and procedures of a threat against the organization's network. Which of the following will the analyst MOST likely use to accomplish the objective?

• A table exercise

• NST CSF

• MTRE ATT$CK

• OWASP

A security analyst has received an alert about being sent via email. The analyst's Chief information Security Officer (CISO) has made it clear that PII must be handle with extreme care From which of the following did the alert MOST likely originate?

• S/MIME

• DLP

• IMAP

• HIDS

A document that appears to be malicious has been discovered in an email that was sent to a company's Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

• Open the document on an air-gapped network

• View the document's metadata for origin clues

• Search for matching file hashes on malware websites

• Detonate the document in an analysis sandbox

A network engineer notices the VPN concentrator overloaded and crashes on days when there are a lot of remote workers. Senior management has placed greater importance on the availability of VPN resources for the remote workers than the security of the end users' traffic. Which of the following would be BEST to solve this issue?

• iPSec

• Always On

• Split tunneling

• L2TP

A recent malware outbreak across a subnet included successful rootkit installations on many PCs, ensuring persistence by rendering remediation efforts ineffective. Which of the following would BEST detect the presence of a rootkit in the future?

• FDE

• NIDS

• EDR

• DLP

A security administrator currently spends a large amount of time on common security tasks, such aa report generation, phishing investigations, and user provisioning and deprovisioning This prevents the administrator from spending time on other security projects. The business does not have the budget to add more staff members. Which of the following should the administrator implement?

• DAC

• ABAC

• SCAP

• SOAR

A security analyst sees the following log output while reviewing web logs:

[02/Feb/2019:03:39:21 -0000] 23.35.212.99 12.59.34.88 - "GET /uri/input.action?query=42f..42f..%2fetc%2passwd HTTP/1.0" 80 200 200

[02/Feb/2019:03:39:21 -0000] 23.35.212.99 12.59.34.88 - "GET /uri/input.action?query=/../../../etc/passwd HTTP/1.0" 80 200 200

Which of the following mitigation strategies would be BEST to prevent this attack from being

successful?

• Secure cookies

• Input validation

• Code signing

• Stored procedures