The senior security administrator wants to redesign the company DMZ to minimize the risks
associated with both external and internal threats. The DMZ design must support security in depth,
change management and configuration processes, and support incident reconstruction. Which of
the following designs BEST supports the given requirements?

Company A needs to export sensitive data from its financial system to company B’s database,
using company B’s API in an automated manner. Company A’s policy prohibits the use of any
intermediary external systems to transfer or store its sensitive data, therefore the transfer must
occur directly between company A’s financial system and company B’s destination server using
the supplied API. Additionally, company A’s legacy financial software does not support encryption,
while company B’s API supports encryption. Which of the following will provide end-to-end
encryption for the data transfer while adhering to these requirements?

Ann, a software developer, wants to publish her newly developed software to an online store. Ann
wants to ensure that the software will not be modified by a third party or end users before being
installed on mobile devices. Which of the following should Ann implement to stop modified copies
of her software form running on mobile devices?

A vulnerability research team has detected a new variant of a stealth Trojan that disables itself
when it detects that it is running on a virtualized environment. The team decides to use dedicated
hardware and local network to identify the Trojan’s behavior and the remote DNS and IP
addresses it connects to. Which of the following tools is BEST suited to identify the DNS and IP
addresses the stealth Trojan communicates with after its payload is decrypted?

A system administrator is troubleshooting a possible denial of service on a sensitive system. The
system seems to run properly for a few hours after it is restarted, but then it suddenly stops

processing transactions. The system administrator suspects an internal DoS caused by a
disgruntled developer who is currently seeking a new job while still working for the company. After
looking into various system logs, the system administrator looks at the following output from the
main system service responsible for processing incoming transactions.
DATE/TIMEPIDCOMMAND%CPUMEM
031020141030002055com.proc10.2920K
031020141100002055com.proc12.35.2M
031020141230002055com.proc22.022M
031020141300002055com.proc33.01.6G
031020141330002055com.proc30.28.0G
Which of the following is the MOST likely cause for the DoS?

The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation. The
documentation shows that a single 24 hours downtime in a critical business function will cost the
business $2.3 million. Additionally, the business unit which depends on the critical business
function has determined that there is a high probability that a threat will materialize based on
historical data. The CIO’s budget does not allow for full system hardware replacement in case of a
catastrophic failure, nor does it allow for the purchase of additional compensating controls. Which
of the following should the CIO recommend to the finance director to minimize financial loss?

Which of the following activities is commonly deemed “OUT OF SCOPE” when undertaking a
penetration test?

A sensitive database needs its cryptographic integrity upheld. Which of the following controls
meets this goal? (Select TWO).

Some mobile devices are jail-broken by connecting via USB cable and then exploiting software
vulnerabilities to get kernel-level access. Which of the following attack types represents this
scenario? (Select TWO).

A security company is developing a new cloud-based log analytics platform. Its purpose is to
allow:
Customers to upload their log files to the “big data” platform
Customers to perform remote log search
Customers to integrate into the platform using an API so that third party business intelligence tools
can be used for the purpose of trending, insights, and/or discovery
Which of the following are the BEST security considerations to protect data from one customer
being disclosed to other customers? (Select THREE).