Which of the following is seen as non-secure based on its ability to only store seven uppercase characters of
data making it susceptible to brute force attacks?

Which of the following should be used to help prevent device theft of unused assets?

Which of the following security practices should occur initially in software development?

Which of the following uses tickets to identify users to the network?

Which of the following file transfer protocols is an extension of SSH Protocol Version 2.0?

Due to sensitive data concerns, a security administrator has enacted a policy preventing the use of flash drives.
Additionally, which of the following can the administrator implement to reduce the risk of data leakage?

Performing routine security audits is a form of which of the following controls?

Which of the following web application security weaknesses can be mitigated by preventing the use of HTML
tags?

Which of the following access control technologies provides a rolling password for one-time use?

Which of the following would be the BEST action to perform when conducting a corporate vulnerability
assessment?

Which of the following would allow traffic to be redirected through a malicious machine by sending false
hardware address updates to a switch?

Which of the following devices would be installed on a single computer to prevent intrusion?

Which of the following is a policy that would force all users to organize their areas as well as help in reducing
the risk of possible data theft?

A penetration test shows that almost all database servers were able to be compromised through a default
database user account with the default password. Which of the following is MOST likely missing from the
operational procedures?

Isolation mode on an AP provides which of the following functionality types?

Which of the following secure protocols is MOST commonly used to remotely administer Unix/Linux systems?

Which of the following is MOST likely to be the last rule contained on any firewall?

During the analysis of malicious code, a security analyst discovers JavaScript being used to send random data
to another service on the same system. This is MOST likely an example of which of the following?

Which of the following is an example of verifying new software changes on a test system?

Which of the following is a technical control?

Public keys are used for which of the following?

Which of the following penetration testing types is performed by security professionals with limited inside
knowledge of the network?

Which of the following devices BEST allows a security administrator to identify malicious activity after it has
occurred?

Which of the following cloud computing concepts is BEST described as providing an Operating System on
which the customer can install your own applications or software on-demand ?

Which of the following environmental controls would BEST be used to regulate cooling and flow of air within a
datacenter?

Which of the following is used when performing a quantitative risk analysis?

Which of the following BEST describes the function of TPM?

Which of the following PKI implementation element is responsible for verifying the authenticity of certificate
contents?

Which of the following describes an active attempt to identify weaknesses?

The security administrator is getting reports from users that they are accessing certain websites and are unable
to download anything off of those sites. The security administrator is also receiving several alarms from the IDS
about suspicious traffic on the network. Which of the following is the MOST likely cause?

Which of the following should be enabled to ensure only certain wireless clients can access the network?

Which of the following is the BEST standard for encryption on a wireless network?

Which of the following would you educate your employees about in order to prevent them to become victim of
an attacker attempting to obtain bank account information?

If a user wishes to receive a file encrypted with PGP, the user must FIRST supply which of the following to the
person who wishes to securely send the file:

Which of the following is a reason to perform a penetration test?

Which of the following methods BEST describes the use of hiding data within other files?

Which of the following BEST describes the proper method and reason to implement port security?

Which of the following attacks is manifested as an embedded HTML image object or JavaScript image tag in an
email?

Which of the following is MOST likely to result in a data loss or compromise?

A security administrator has discovered through a password auditing software that most passwords can be
discovered by cracking the first seven characters and then cracking the second part of the password. Which of
the following is in use by the company?

Which of the following concepts ensures that the data is only viewable to authorized users?

Which of the following BEST describes an intrusion prevention system?

A user reports that their 802.11n capable interface connects and disconnects frequently to an access point that
was recently installed. The user has a Bluetooth enabled laptop. A company in the next building had their
wireless network breached last month. Which of the following is MOST likely causing the disconnections?

Risk can be managed in the following ways EXCEPT:

A web application has been found to be vulnerable to a SQL injection attack. Which of the following BEST
describes the required remediation action?

While browsing the Internet, an administrator notices their browser behaves erratically, appears to download
something, and then crashes. Upon restarting the PC, the administrator notices performance is extremely slow
and there are hundreds of outbound connections to various websites. Which of the following BEST describes
what has occurred?

Which of the following is a best practice when securing a switch from physical access?