A server dedicated to the storage and processing of sensitive information was compromised with a
rootkit and sensitive data was extracted. Which of the following incident response procedures is best
suited to restore the server?

In the initial stages of an incident response, Matt, the security administrator, was provided the hard
drives in question from the incident manager. Which of the following incident response procedures
would he need to perform in order to begin the analysis? (Select TWO).

Which of the following is the LEAST volatile when performing incident response procedures?

The security officer is preparing a read-only USB stick with a document of important personal phone
numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At which of the
following points in an incident should the officer instruct employees to use this information?

After a number of highly publicized and embarrassing customer data leaks as a result of social
engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will reduce
the risk of another data leak. Which of the following would be MOST effective in reducing data leaks in
this situation?

Sara, a company’s security officer, often receives reports of unauthorized personnel having access codes
to the cipher locks of secure areas in the building. Sara should immediately implement which of the
following?

Human Resources (HR) would like executives to undergo only two specific security training programs a
year. Which of the following provides the BEST level of security training for the executives? (Select TWO).

The method to provide end users of IT systems and applications with requirements related to acceptable
use, privacy, new threats and trends, and use of social networking is:

Sara, an employee, tethers her smartphone to her work PC to bypass the corporate web security gateway
while connected to the LAN. While Sara is out at lunch her PC is compromised via the tethered
connection and corporate data is stolen. Which of the following would BEST prevent this from occurring
again?

Which of the following is the BEST reason to provide user awareness and training programs for
organizational staff?