A security analyst at Company A has been trying to convince the Information Security Officer
(ISO) to allocate budget towards the purchase of a new intrusion prevention system (IPS) capable
of analyzing encrypted web transactions.
Which of the following should the analyst provide to the ISO to support the request? (Select TWO).

The IT department of a pharmaceutical research company is considering whether the company
should allow or block access to social media websites during lunch time. The company is
considering the possibility of allowing access only through the company’s guest wireless network,
which is logically separated from the internal research network. The company prohibits the use of
personal devices; therefore, such access will take place from company owned laptops.
Which of the following is the HIGHEST risk to the organization?

A security audit has uncovered a lack of security controls with respect to employees’ network
account management. Specifically, the audit reveals that employee’s network accounts are not
disabled in a timely manner once an employee departs the organization. The company policy
states that the network account of an employee should be disabled within eight hours of
termination. However, the audit shows that 5% of the accounts were not terminated until three
days after a dismissed employee departs. Furthermore, 2% of the accounts are still active.
Which of the following is the BEST course of action that the security officer can take to avoid
repeat audit findings?