Joe needs to track employees who log into a confidential database and edit files. In the past,
critical files have been edited, and no one admits to making the edits. Which of the following does
Joe need to implement in order to enforce accountability?

A new mobile banking application is being developed and uses SSL / TLS certificates but
penetration tests show that it is still vulnerable to man-in-the-middle attacks, such as DNS
hijacking. Which of the following would mitigate this attack?

One month after a software developer was terminated the helpdesk started receiving calls that
several employees’ computers were being infected with malware. Upon further research, it was
determined that these employees had downloaded a shopping toolbar. It was this toolbar that
downloaded and installed the errant code. Which of the following attacks has taken place?

Which of the following would an attacker use to penetrate and capture additional traffic prior to
performing an IV attack?

An administrator has concerns regarding the company’s server rooms Proximity badge readers
were installed, but it is discovered this is not preventing unapproved personnel from tailgating into
these area. Which of the following would BEST address this concern?

Which of the following would be a reason for developers to utilize an AES cipher in CCM mode
(Counter with Chain Block Message Authentication Code)?

One of the findings of risk assessment is that many of the servers on the data center subnet
contain data that is in scope for PCI compliance, Everyone in the company has access to these
servers, regardless of their job function. Which of the following should the administrator do?

Various employees have lost valuable customer data due to hard drives failing in company
provided laptops. It has been discovered that the hard drives used in one model of laptops
provided by the company has been recalled by the manufactory, The help desk is only able to
replace the hard drives after they fail because there is no centralized records of the model of

laptop given to each specific user. Which of the following could have prevented this situation from
occurring?

Attempting to inject 50 alphanumeric key strokes including spaces into an application input field
that only expects four alpha characters in considered which of the following attacks?

An organization is required to log all user internet activity. Which of the following would accomplish
this requirement?