The Chief Security Officer (CSO) is concerned about misuse of company assets and wishes to
determine who may be responsible. Which of the following would be the BEST course of action?

An IT staff member was entering the datacenter when another person tried to piggyback into the
datacenter as the door was opened. While the IT staff member attempted to question the other
individual by politely asking to see their badge, the individual refused and ran off into the
datacenter. Which of the following should the IT staff member do NEXT?

During a recent user awareness and training session, a new staff member asks the Chief
Information Security Officer (CISO) why the company does not allow personally owned devices
into the company facilities. Which of the following represents how the CISO should respond?

Jane, a VPN administrator, was asked to implement an encryption cipher with a MINIMUM
effective security of 128-bits. Which of the following should Jane select for the tunnel encryption?

A user has received an email from an external source which asks for details on the company’s
new product line set for release in one month. The user has a detailed spec sheet but it is marked
“Internal Proprietary Information”. Which of the following should the user do NEXT?

Which of the following uses both a public and private key?

Which of the following techniques enables a highly secured organization to assess security
weaknesses in real time?

Which of the following would Matt, a security administrator, use to encrypt transmissions from an
internal database to an internal server, keeping in mind that the encryption process must add as
little latency to the process as possible?

A database administrator receives a call on an outside telephone line from a person who states
that they work for a well-known database vendor. The caller states there have been problems
applying the newly released vulnerability patch for their database system, and asks what version is
being used so that they can assist. Which of the following is the BEST action for the administrator

to take?

Which of the following techniques can be used to prevent the disclosure of system information
resulting from arbitrary inputs when implemented properly?