During the analysis of a PCAP file, a security analyst noticed several communications with a
remote server on port 53. Which of the following protocol types is observed in this traffic?

A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has
been removed from the network and an image of the hard drive has been created. However,
the system administrator stated that the system was left unattended for several hours before
the image was created. In the event of a court case, which of the following is likely to be an
issue with this incident?

During which of the following phases of the Incident Response process should a security
administrator define and implement general defense against malware?

Due to hardware limitation, a technician must implement a wireless encryption algorithm that
uses the RC4 protocol. Which of the following is a wireless encryption solution that the
technician should implement while ensuring the STRONGEST level of security?

Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need
to use to verify that the email came from Joe and decrypt it? (Select TWO).

Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need
to use to verify the validity’s of Joe’s certificate? (Select TWO).

A technician wants to implement a dual factor authentication system that will enable the
organization to authorize access to sensitive systems on a need-to-know basis. Which of the
following should be implemented during the authorization stage?

A security researcher wants to reverse engineer an executable file to determine if it is
malicious. The file was found on an underused server and appears to contain a zero-day
exploit. Which of the following can the researcher do to determine if the file is malicious in
nature?

A recent spike in virus detections has been attributed to end-users visiting
www.compnay.com. The business has an established relationship with an organization using
the URL of www.company.com but not with the site that has been causing the infections.
Which of the following would BEST describe this type of attack?

A company has proprietary mission critical devices connected to their network which are
configured remotely by both employees and approved customers. The administrator wants
to monitor device security without changing their baseline configuration. Which of the
following should be implemented to secure the devices without risking availability?