During a penetration test from the Internet, Jane, the system administrator, was able to establish a
connection to an internal router, but not successfully log in to it. Which ports and protocols are
MOST likely to be open on the firewall? (Select FOUR).

Mike, a security professional, is tasked with actively verifying the strength of the security controls
on a company’s live modem pool. Which of the following activities is MOST appropriate?

Which of the following is BEST utilized to actively test security controls on a particular system?

A security administrator is aware that a portion of the company’s Internet-facing network tends to
be non-secure due to poorly configured and patched systems. The business owner has accepted
the risk of those systems being compromised, but the administrator wants to determine the degree
to which those systems can be used to gain access to the company intranet. Which of the
following should the administrator perform?

Ann, a security analyst, is preparing for an upcoming security audit. To ensure that she identifies
unapplied security controls and patches without attacking or compromising the system, Ann would
use which of the following?

Which of the following BEST represents the goal of a vulnerability assessment?

A security administrator wants to perform routine tests on the network during working hours when
certain applications are being accessed by the most people. Which of the following would allow

the security administrator to test the lack of security controls for those applications with the least
impact to the system?

Jane has recently implemented a new network design at her organization and wishes to passively
identify security issues with the new network. Which of the following should Jane perform?

A company hires outside security experts to evaluate the security status of the corporate network.
All of the company’s IT resources are outdated and prone to crashing. The company requests that
all testing be performed in a way which minimizes the risk of system failures. Which of the
following types of testing does the company want performed?

Which of the following tests a number of security controls in the least invasive manner?