1. A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevatedpermissions, but accounts in the group are given access to the companys sensitive financial management application by default. Which of the following is theBEST course of action?

A) Monitor the outbound traffic from the application for signs of data exfiltration
B) Follow the incident response plan for the introduction of new accounts
C) Remove the accounts access privileges to the sensitive application
D) Disable the user accounts
E) Confirm the accounts are valid and ensure role-based permissions are appropriate


2. A recent vulnerability scan found four vulnerabilities on an organizations public Internet-facing IP addresses. Prioritizing in order to reduce the risk of a breach to theorganization, which of the following should be remediated FIRST?

A) An HTTP response that reveals an internal IP address.
B) A cipher that is known to be cryptographically weak.
C) A website using a self-signed SSL certificate.
D) A buffer overflow that allows remote code execution.



3. An executive tasked a security analyst to aggregate past logs, traffic, and alerts on a particular attack vector. The analyst was then tasked with analyzing the dataand making predictions on future complications regarding this attack vector. Which of the following types of analysis is the security analyst MOST likely conducting?

A) Availability analysis
B) Trend analysis
C) Behavior analysis
D) Business analysis



4. The new Chief Technology Officer (CTO) is seeking recommendations for network monitoring services for the local intranet. The CTO would like the capability tomonitor all traffic to and from the gateway, as well as the capability to block certain content. Which of the following recommendations would meet the needs of theorganization?

A) Recommend setup of IP filtering on both the internal and external interfaces of the gateway router.
B) Recommend installation of an IPS on both the internal and external interfaces of the gateway router.
C) Recommend installation of an IDS on the internal interface and a firewall on the external interface of the gateway router.
D) Recommend installation of a firewall on the internal interface and a NIDS on the external interface of the gateway router.



5. A staff member reported that a laptop has degraded performance. The security analyst has investigated the issue and discovered that CPU utilization, memoryutilization, and outbound network traffic are consuming the laptop resources. Which of the following is the BEST course of actions to resolve the problem?

A) Disable scheduled tasks.
B) Identify and remove malicious processes.
C) Suspend virus scan.
D) Increase laptop memory.
E) Ensure the laptop OS is properly patched.