Joe, the information security manager, is tasked with calculating risk and selecting controls to protect a
new system. He has identified people, environmental conditions, and events that could affect the new
system. Which of the following does he need to estimate NEXT in order to complete his risk calculations?

A network administrator identifies sensitive files being transferred from a workstation in the LAN to an
unauthorized outside IP address in a foreign country. An investigation determines that the firewall has
not been altered, and antivirus is up-to-date on the workstation. Which of the following is the MOST likely
reason for the incident?

A security administrator must implement a network that is immune to ARP spoofing attacks. Which of the
following should be implemented to ensure that a malicious insider will not be able to successfully use
ARP spoofing techniques?

After working on his doctoral dissertation for two years, Joe, a user, is unable to open his dissertation file.
The screen shows a warning that the dissertation file is corrupted because it is infected with a backdoor,and can only be recovered by upgrading the antivirus software from the free version to the commercial
version. Which of the following types of malware is the laptop MOST likely infected with?

An employee connects a wireless access point to the only jack in the conference room to provide Internet
access during a meeting. The access point is configured to use WPA2-TKIP. A malicious user is able to
intercept clear text HTTP communication between the meeting attendees and the Internet. Which of the
following is the reason the malicious user is able to intercept and see the clear text communication?

Which of the following password attacks is MOST likely to crack the largest number of randomly
generated passwords?

Which of the following attacks involves the use of previously captured network traffic?

An attacker crafts a message that appears to be from a trusted source, but in reality it redirects the
recipient to a malicious site where information is harvested. The message is narrowly tailored so it is
effective on only a small number of victims. This describes which of the following?

An administrator is instructed to disable IP-directed broadcasts on all routers in an organization. Which of
the following attacks does this prevent?

An administrator has to determine host operating systems on the network and has deployed a
transparent proxy. Which of the following fingerprint types would this solution use?