The company is about to upgrade a financial system through a third party, but wants to legally
ensure that no sensitive information is compromised throughout the project. The project manager
must also make sure that internal controls are set to mitigate the potential damage that one
individual’s actions may cause. Which of the following needs to be put in place to make certain
both organizational requirements are met? (Select TWO).

The security administrator is worried about possible SPIT attacks against the VoIP system.
Which of the following security controls would MOST likely need to be implemented to detect this
type of attack?

The helpdesk is receiving multiple calls about slow and intermittent Internet access from the

finance department. The network administrator reviews the tickets and compiles the following
information for the security administrator:
——
Caller 1, IP 172.16.35.217, NETMASK 255.255.254.0
Caller 2, IP 172.16.35.53, NETMASK 255.255.254.0
Caller 3, IP 172.16.35.173, NETMASK 255.255.254.0
All callers are connected to the same switch and are routed by a router with five built-in interfaces.
The upstream router interface’s MAC is 00-01-42-32-ab-1a
——
The security administrator brings a laptop to the finance office, connects it to one of the wall jacks,
starts up a network analyzer, and notices the following:
09:05:10.937590 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52)
09:05:15.934840 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52)
09:05:19.931482 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52)
Which of the following can the security administrator determine from the above information?

On Monday, the Chief Information Officer (CIO) of a state agency received an e-discovery request
for the release of all emails sent and received by the agency board of directors for the past five
years. The CIO has contacted the email administrator and asked the administrator to provide the
requested information by end of day on Friday. Which of the following has the GREATEST impact
on the ability to fulfill the e-discovery request?

A company is evaluating a new marketing strategy involving the use of social networking sites to
reach its customers. The marketing director wants to be able to report important company news,
product updates, and special promotions on the social websites.
After an initial and successful pilot period, other departments want to use the social websites to
post their updates as well.
The Chief Information Officer (CIO) has asked the company security administrator to document
three negative security impacts of allowing IT staff to post work related information on such
websites.
Which of the following are the major risks the security administrator should report back to the CIO?
(Select THREE).

A telecommunication company has recently upgraded their teleconference systems to multicast.
Additionally, the security team has instituted a new policy which requires VPN to access the
company’s video conference. All parties must be issued a VPN account and must connect to the
company’s VPN concentrator to participate in the remote meetings.

Which of the following settings will increase bandwidth utilization on the VPN concentrator during
the remote meetings?

An Information Security Officer (ISO) has asked a security team to randomly retrieve discarded
computers from the warehouse dumpster. The security team was able to retrieve two older
computers and a broken MFD network printer. The security team was able to connect the hard
drives from the two computers and the network printer to a computer equipped with forensic tools.
The security team was able to retrieve PDF files from the network printer hard drive but the data
on the two older hard drives was inaccessible.
Which of the following should the Warehouse Manager do to remediate the security issue?

Which of the following precautions should be taken to harden network devices in case of
VMEscape?

Which of the following should be used with caution because of its ability to provide access to block
level data instead of file level data?

Which of the following can aid a buffer overflow attack to execute when used in the creation of
applications?