NEW QUESTION 1
A group of non-profit agencies wants to implement a cloud service to share resources with each other and minimize costs. Which of the following cloud deployment models BEST describes this type of effort?

• A. Public
• B. Hybrid
• C. Community
• D. Private

Answer: C

NEW QUESTION 2
For each of the given items, select the appropriate authentication category from the dropdown choices. Instructions: When you have completed the simulation, please select the Done button to submit.

Answer:

Explanation: Something you are includes fingerprints, retina scans, or voice recognition. Something you have includes smart cards, token devices, or keys.
Something you know includes a password, codes, PINs, combinations, or secret phrases. Somewhere you are including a physical location s or logical addresses, such as domain name, an IP address, or a MAC address.
Something you do includes your typing rhythm, a secret handshake, or a private knock http://en.wikipedia.org/wiki/Password_authentication_protocol#Working_cycle http://en.wikipedia.org/wiki/Smart_card#Security

NEW QUESTION 3
A security manager is creating an account management policy for a global organization with sales personnel who must access corporate network resources while traveling all over the world. Which of the following practices is the security manager MOST likely to enforce with the policy? (Select TWO)

• A. Time-of-day restrictions
• B. Password complexity
• C. Location-based authentication
• D. Group-based access control
• E. Standard naming convention

Answer: BD

NEW QUESTION 4
Audit logs from a small company’s vulnerability scanning software show the following findings: Destinations scanned:
-Server001- Internal human resources payroll server
-Server101-Internet-facing web server
-Server201- SQL server for Server101
-Server301-Jumpbox used by systems administrators accessible from the internal network Validated vulnerabilities found:
-Server001- Vulnerable to buffer overflow exploit that may allow attackers to install software
-Server101- Vulnerable to buffer overflow exploit that may allow attackers to install software
-Server201-OS updates not fully current
-Server301- Accessible from internal network without the use of jumpbox
-Server301-Vulnerable to highly publicized exploit that can elevate user privileges
Assuming external attackers who are gaining unauthorized information are of the highest concern, which of the following servers should be addressed FIRST?

• A. Server001
• B. Server101
• C. Server201
• D. Server301

Answer: B

NEW QUESTION 5
Malware that changes its binary pattern on specific dates at specific times to avoid detection is known as a (n):

• A. armored virus
• B. logic bomb
• C. polymorphic virus
• D. Trojan

Answer: C

NEW QUESTION 6
An organization plans to implement multifactor authentication techniques within the enterprise network architecture. Each authentication factor is expected to be a unique control. Which of the following BEST describes the proper employment of multifactor authentication?

• A. Proximity card, fingerprint scanner, PIN
• B. Fingerprint scanner, voice recognition, proximity card
• C. Smart card, user PKI certificate, privileged user certificate
• D. Voice recognition, smart card, proximity card

Answer: A

NEW QUESTION 7
A security analyst is securing smartphones and laptops for a highly mobile workforce.
Priorities include:
Remote wipe capabilities
Geolocation services
Patch management and reporting
Mandatory screen locks
Ability to require passcodes and pins
Ability to require encryption
Which of the following would BEST meet these requirements?

• A. Implementing MDM software
• B. Deploying relevant group policies to the devices
• C. Installing full device encryption
• D. Removing administrative rights to the devices

Answer: A

NEW QUESTION 8
A security administrator wants to implement a logon script that will prevent MITM attacks on the local LAN. Which of the following commands should the security administrator implement within the script to accomplish this task?

• A. arp - s 192.168.1.1 00-3a-d1-fa-b1-06
• B. dig - x@192.168.1.1 mypc.comptia.com
• C. nmap - A - T4 192.168.1.1
• D. tcpdump - lnv host 192.168.1.1 or either 00:3a:d1:fa:b1:06

Answer: A

NEW QUESTION 9
A security analyst is reviewing patches on servers. One of the servers is reporting the following error message in the WSUS management console:
The computer has not reported status in 30 days.
Given this scenario, which of the following statements BEST represents the issue with the output above?

• A. The computer in QUESTION NO: has not pulled the latest ACL policies for the firewall.
• B. The computer in QUESTION NO: has not pulled the latest GPO policies from the management server.
• C. The computer in QUESTION NO: has not pulled the latest antivirus definitions from the antivirus program.
• D. The computer in QUESTION NO: has not pulled the latest application software updates.

Answer: D

NEW QUESTION 10
An administrator is testing the collision resistance of different hashing algorithms. Which of the following is the strongest collision resistance test?

• A. Find two identical messages with different hashes
• B. Find two identical messages with the same hash
• C. Find a common has between two specific messages
• D. Find a common hash between a specific message and a random message

Answer: A

NEW QUESTION 11
When considering a third-party cloud service provider, which of the following criteria would be the BEST to include in the security assessment process? (Select two.)

• A. Use of performance analytics
• B. Adherence to regulatory compliance
• C. Data retention policies
• D. Size of the corporation
• E. Breadth of applications support

Answer: BC

NEW QUESTION 12
A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.

Answer:

Explanation: When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone. Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts.
Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and expenses associated with the investigation.

NEW QUESTION 13
An office manager found a folder that included documents with various types of data relating to corporate clients. The office manager notified the data included dates of birth, addresses, and phone numbers for the clients. The office manager then reported this finding to the security compliance officer. Which of the following portions of the policy would the security officer need to consult to determine if a breach has occurred?

• A. Public
• B. Private
• C. PHI
• D. PII

Answer: D

NEW QUESTION 14
During a routine audit, it is discovered that someone has been using a stale administrator account to log into a seldom used server. The person has been using the server to view inappropriate websites that are prohibited to end users.
Which of the following could best prevent this from occurring again?

• A. Credential management
• B. Group policy management
• C. Acceptable use policy
• D. Account expiration policy

Answer: B

NEW QUESTION 15
After a routine audit, a company discovers that engineering documents have been leaving the network on a particular port. The company must allow outbound traffic on this port, as it has a legitimate business use. Blocking the port would cause an outage. Which of the following technology controls should the company implement?

• A. NAC
• B. Web proxy
• C. DLP
• D. ACL

Answer: C

NEW QUESTION 16
Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users' email contacts are complaining of an increase in spam and social networking requests. Due to the large number of affected accounts, remediation must be accomplished quickly. Which of the following actions should be taken FIRST? (Select TWO)

• A. Disable the compromised accounts
• B. Update WAF rules to block social networks
• C. Remove the compromised accounts with all AD groups
• D. Change the compromised accounts' passwords
• E. Disable the open relay on the email server
• F. Enable sender policy framework

Answer: EF

Explanation: Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators. n a Small Business Server environment, you may have to prevent your Microsoft Exchange Server-based server from being used as an open relay SMTP server for unsolicited commercial e-mail messages, or spam.
You may also have to clean up the Exchange server's SMTP queues to delete the unsolicited commercial email messages.
If your Exchange server is being used as an open SMTP relay, you may experience one or more of the following symptoms:
The Exchange server cannot deliver outbound SMTP mail to a growing list of e-mail domains. Internet browsing is slow from the server and from local area network (LAN) clients.
Free disk space on the Exchange server in the location of the Exchange information store databases or the Exchange information store transaction logs is reduced more rapidly than you expect.
The Microsoft Exchange information store databases spontaneously dismount. You may be able to manually mount the stores by using Exchange System Manager, but the stores may dismount on their own after they run for a short time. For more information, click the following article number to view the article in the Microsoft Knowledge Base.

NEW QUESTION 17
A security analyst has been asked to perform a review of an organization's software development lifecycle. The analyst reports that the lifecycle does not contain a phase in which team members evaluate and provide critical feedback of another developer's code. Which of the following assessment techniques is BEST described in the analyst's report?

• A. Architecture evaluation
• B. Baseline reporting
• C. Whitebox testing
• D. Peer review

Answer: D

NEW QUESTION 18
A user typically works remotely over the holidays using a web-based VPN to access corporate resources. The user reports getting untrusted host errors and being unable to connect. Which of the following is MOST likely the case?

• A. The certificate has expired
• B. The browser does not support SSL
• C. The user's account is locked out
• D. The VPN software has reached the seat license maximum

Answer: A