QUESTION 40
An Internet retailer’s database was recently exploited by a foreign criminal organization via a remote attack.
The initial exploit resulted in immediate root-level access. What could have been done to prevent this level of access being given to the intruder upon successful exploitation?

QUESTION 41
What is the list displaying?

QUESTION 42
Based on the data shown below.

Which wireless access point has the manufacturer default settings still in place?

QUESTION 43
What is the business goal of the Inventory and Control of Software Assets Control?

QUESTION 44
Janice is auditing the perimeter of the network at Sugar Water InC. According to documentation, external SMTP traffic is only allowed to and from 10.10.10.25. Which of the following actions would demonstrate the rules are configured incorrectly?

QUESTION 45
Given the audit finding below, which CIS Control was being measured?

QUESTION 46
Why is it important to enable event log storage on a system immediately after it is installed?

QUESTION 47
An organization has failed a test for compliance with a policy of continual detection and removal of malicious software on its network. Which of the following errors is the root cause?

QUESTION 48
The settings in the screenshot would be configured as part of which CIS Control?

QUESTION 49
When evaluating the Wireless Access Control CIS Control, which of the following systems needs to be tested?

QUESTION 50
Executive management approved the storage of sensitive data on smartphones and tablets as long as they were encrypted. Later a vulnerability was announced at an information security conference that allowed attackers to bypass the device’s authentication process, making the data accessible. The smartphone manufacturer said it would take six months for the vulnerability to be fixed and distributed through the cellular carriers. Four months after the vulnerability was announced, an employee lost his tablet and the sensitive information became public.
What was the failure that led to the information being lost?

QUESTION 51
If an attacker wanted to dump hashes or run wmic commands on a target machine, which of the following tools would he use?

QUESTION 52
Which approach is recommended by the CIS Controls for performing penetration tests?

QUESTION 53
Which of the following is a benefit of stress-testing a network?

QUESTION 54
Which of the following archiving methods would maximize log integrity?

QUESTION 55
Which of the following can be enabled on a Linux based system in order to make it more difficult for an attacker to execute malicious code after launching a buffer overflow attack?

QUESTION 56
An organization is implementing an application software security control their custom-written code that provides web-based database access to sales partners. Which action will help mitigate the risk of the application being compromised?

QUESTION 57
An organization has installed a firewall for Boundary Defense. It allows only outbound traffic from internal workstations for web and SSH, allows connections from the internet to the DMZ, and allows guest wireless access to the internet only. How can an auditor validate these rules?

QUESTION 58
What is an organization’s goal in deploying a policy to encrypt all mobile devices?

QUESTION 59
Which projects enumerates or maps security issues to CVE?

QUESTION 60
What is a recommended defense for the CIS Control for Application Software Security?

QUESTION 61
An organization has implemented a policy to continually detect and remove malware from its network. Which of the following is a detective control needed for this?

QUESTION 62
Which type of scan is best able to determine if user workstations are missing any important patches?

QUESTION 63
What documentation should be gathered and reviewed for evaluating an Incident Response program?