The Chief Technology Officer (CTO) of a company, Ann, is putting together a hardware budget for the
next 10 years. She is asking for the average lifespan of each hardware device so that she is able to
calculate when she will have to replace each device. Which of the following categories BEST describes
what she is looking?

A software development company needs to share information between two remote server, using
encryption to protect it. A programmer suggests developing a new encryption protocol, arguing that
using an unknown protocol with secure, existing cryptographic algorithem libraries will provide strong
encryption without being susceptible to attacks on other unknown protocols. Which of the following
summarizes the BEST response to programmer’s proposal?

A security administrator is tasked with conducting an assessment made to establish the baseline security
posture of the corporate IT infrastructure. The assessment must report actual flaws and weaknesses in
the infrastructure. Due to the expense of hiring outside consultant, the testing must be performed usingin-house or cheaply available resources. There cannot be a possibility of equipment being damaged in the
test. Which of the following has the administrator been tasked to perform?

Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from
someone claiming to be from the helpdesk. The caller is asking to verify her network authentication
credentials because her computer is broadcasting across the network. This is MOST likely which of the
following types of attacks?

A security guard has informed the Chief information Security Officer that a person with a tablet has been
walking around the building. The guard also noticed strange white markings in different areas of the
parking lot. The person is attempting which of the following types of attacks?

Phishing emails frequently take advantage of high-profile catastrophes reported in the news. Which of
the following principles BEST describes the weakness being exploited?

Which the following would verify that a threat does exist and security controls can easily be bypassed
without actively testing an application?

When of the following technologies would be MOST appropriate to utilize when testing a new software
patch before a company-wide deplyment?

A system administrator needs to implement 802.1x whereby when user logs into the network, the
authentication server communicates to the network switch and assigns the user to the proper VLAN.
Which of the following protocols should be used?

A Security technician would like that to obscure sensitive data within a file so that can be transferred
without causing suspicion. Which of the following technologies would BEST be suited to accomplish this?