The security administrator has just installed an active\passive cluster of two firewalls for enterprise
perimeter defense of the corporate network. Stateful firewall inspection is being used in the firewall
implementation. There have been numerous reports of dropped connections with external clients.
Which of the following is MOST likely the cause of this problem?

Company XYZ is in negotiations to acquire Company ABC for $1.2millon. Due diligence activities
have uncovered systemic security issues in the flagship product of Company ABC. It has been
established that a complete product rewrite would be needed with average estimates indicating a
cost of $1.6millon. Which of the following approaches should the risk manager of Company XYZ
recommend?

Which of the following are components defined within an Enterprise Security Architecture
Framework? (Select THREE).

An audit at a popular on-line shopping site reveals that a flaw in the website allows customers to
purchase goods at a discounted rate. To improve security the Chief Information Security Officer
(CISO) has requested that the web based shopping cart application undergo testing to validate
user input in both free form text fields and drop down boxes.
Which of the following is the BEST combination of tools and / or methods to use?

An external auditor has found that IT security policies in the organization are not maintained and in
some cases are nonexistent. As a result of the audit findings, the CISO has been tasked with the
objective of establishing a mechanism to manage the lifecycle of IT security policies. Which of the
following can be used to BEST achieve the CISO’s objectives?

In a SPML exchange, which of the following BEST describes the three primary roles?

A trust relationship has been established between two organizations with web based services.
One organization is acting as the Requesting Authority (RA) and the other acts as the Provisioning
Service Provider (PSP). Which of the following is correct about the trust relationship?

A Security Administrator has some concerns about the confidentiality of data when using SOAP.
Which of the following BEST describes the Security Administrator’s concerns?

Which of the following protocols only facilitates access control?

Company ABC will test connecting networks with Company XYZ as part of their upcoming merger
and are both concerned with minimizing security exposures to each others network throughout the
test. Which of the following is the FIRST thing both sides should do prior to connecting the
networks?