1. A zero-day crypto-worm is quickly spreading through the internal network on port 25 and exploiting a software vulnerability found within the email servers.Which of the following countermeasures needs to be implemented as soon as possible to mitigate the worm from continuing to spread?

A) Block all known port/services.
B) Patch affected systems.
C) Implement a traffic sinkhole.
D) Isolate impacted servers.



2. A pharmacy gives its clients online access to their records and the ability to review bills and make payments. A new SSL vulnerability on a special platform wasdiscovered, allowing an attacker to capture the data between the end user and the web server providing these services. After investigating the platform vulnerability,it was determined that the web services provided are being impacted by this new threat.Which of the following data types are MOST likely at risk of exposure based on this new threat? (Choose two.)(Select 2answers)

A) Personal health information
B) Corporate financial data
C) Cardholder data
D) Intellectual property
E) Employee records


3. An investigation showed a worm was introduced from an engineers laptop. It was determined the company does not provide engineers with company-ownedlaptops, which would be subject to company policy and technical controls.Which of the following would be the MOST secure control implement?

A) Deploy a company-wide approved engineering workstation for management access.
B) Implement role-based group policies on the management network for client access.
C) Utilize a jump box that is only allowed to connect to clients from the management network.
D) Deploy HIDS on all engineer-provided laptops, and put a new router in the management network.



4. An analyst is observing unusual network traffic from a workstation. The workstation is communicating with a known malicious site over an encrypted tunnel. A fullantivirus scan with an updated antivirus signature file does not show any sign of infection. Which of the following has occurred on the workstation?

A) Zero-day attack
B) Cookie stealing
C) Session hijack
D) Known malware attack



5. A cybersecurity analyst is hired to review the security measures implemented within the domain controllers of a company. Upon review, the cybersecurity analystnotices a brute force attack can be launched against domain controllers that run on a Windows platform. The first remediation step implemented by thecybersecurity analyst is to make the account passwords more complex. Which of the following is the NEXT remediation step the cybersecurity analyst needs toimplement?

A) Move administrator accounts to a new security group.
B) Install a different antivirus software.
C) Disable the ability to store a LAN manager hash.
D) Deploy a vulnerability scanner tool.
E) Perform more frequent port scanning.