A security administrator plans on replacing a critical business application in five years. Recently,
there was a security flaw discovered in the application that will cause the IT department to
manually re-enable user accounts each month at a cost of $2,000. Patching the application today
would cost $140,000 and take two months to implement. Which of the following should the security
administrator do in regards to the application?

Acme Corp has selectively outsourced proprietary business processes to ABC Services. Due to
some technical issues, ABC services wants to send some of Acme Corp’s debug data to a third
party vendor for problem resolution. Which of the following MUST be considered prior to sending
data to a third party?

An administrator wants to minimize the amount of time needed to perform backups during the
week. It is also acceptable to the administrator for restoration to take an extended time frame.
Which of the following strategies would the administrator MOST likely implement?

A security administrator needs to update the OS on all the switches in the company. Which of the
following MUST be done before any actual switch configuration is performed?

Developers currently have access to update production servers without going through an approval
process. Which of the following strategies would BEST mitigate this risk?

Which of the following mitigation strategies is established to reduce risk when performing updates
to business critical systems?

The network administrator is responsible for promoting code to applications on a DMZ web server.
Which of the following processes is being followed to ensure application integrity?

Which of the following MOST specifically defines the procedures to follow when scheduled system
patching fails resulting in system outages?

A security engineer is given new application extensions each month that need to be secured prior
to implementation. They do not want the new extensions to invalidate or interfere with existing
application security. Additionally, the engineer wants to ensure that the new requirements are
approved by the appropriate personnel. Which of the following should be in place to meet these
two goals? (Select TWO).

A user has received an email from an external source which asks for details on the company’s
new product line set for release in one month. The user has a detailed spec sheet but it is marked
“Internal Proprietary Information”. Which of the following should the user do NEXT?