A security administrator is tasked with conducting an assessment made to establish the baseline security
posture of the corporate IT infrastructure. The assessment must report actual flaws and weaknesses in
the infrastructure. Due to the expense of hiring outside consultants, the testing must be performed using
in-house or cheaply available resource. There cannot be a possibility of any requirement being damaged
in the test. Which of the following has the administrator been tasked to perform?

A network administrator is attempting to troubleshoot an issue regarding certificates on a secure
website. During the troubleshooting process, the network administrator notices that the web gateway
proxy on the local network has signed all of the certificates on the local machine. Which of the following
describes the type of attack the proxy has been legitimately programmed to perform?

Which of the following use the SSH protocol?

A security administrator is developing training for corporate users on basic security principles for personal
email accounts. Which of the following should be mentioned as the MOST secure way for password
recovery?

A company researched the root cause of a recent vulnerability in its software. It was determined that the
vulnerability was the result of two updates made in the last release. Each update alone would not have
resulted in the vulnerability. In order to prevent similar situations in the future, the company should
improve which of the following?

A computer on a company network was infected with a zero-day exploit after an employee accidently
opened an email that contained malicious content. The employee recognized the email as malicious and
was attempting to delete it, but accidently opened it. Which of the following should be done to prevent
this scenario from occurring again in the future?

A company wants to ensure that the validity of publicly trusted certificates used by its web server can be
determined even during an extended internet outage. Which of the following should be implemented?

An administrator intends to configure an IPSec solution that provides ESP with integrity protection, but
not confidentiality protection. Which of the following AES modes of operation would meet this integrityonly requirement?

The chief security officer (CS0) has issued a new policy that requires that all internal websites be
configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites
without incurring additional costs. Which of the following is the best solution for the network
administrator to secure each internal website?

A security program manager wants to actively test the security posture of a system. The system is not yet
in production and has no uptime requirement or active user base. Which of the following methods will
produce a report which shows vulnerabilities that were actually exploited?