After analyzing and correlating activity from multiple sensors, the security administrator has determined that a
group of very well organized individuals from an enemy country is responsible for various attempts to breach
the company network, through the use of very sophisticated and targeted attacks. Which of the following is this
an example of?

A new security analyst is given the task of determining whether any of the company’s servers are vulnerable to
a recently discovered attack on an old version of SSH. Which of the following is the quickest FIRST step toward
determining the version of SSH running on these servers?

Which device monitors network traffic in a passive manner?

Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and
operating systems are running on the corporate network. Which of the following should be used to complete
this task?

Which of the following tools would a security administrator use in order to identify all running services
throughout an organization?

During a security assessment, an administrator wishes to see which services are running on a remote server.
Which of the following should the administrator use?

A security administrator wants to get a real time look at what attackers are doing in the wild, hoping to lower the
risk of zero-day attacks. Which of the following should be used to accomplish this goal?

Jane, a security analyst, is reviewing logs from hosts across the Internet which her company uses to gather
data on new malware. Which of the following is being implemented by Jane’s company?

The security team would like to gather intelligence about the types of attacks being launched against the
organization. Which of the following would provide them with the MOST information?

What is a system that is intended or designed to be broken into by an attacker?