Q24. An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks). Assess the metrics below and determine the appropriate interpretation with respect to this control.

Q25. Which approach is recommended by the CIS Controls for performing penetration tests?

Q26. Which of the following is used to prevent spoofing of e-mail addresses?

Q27. An organization is implementing a control within the Application Software Security CIS Control. How can they best protect against injection attacks against their custom web application and database applications?

Q28. What is the first step suggested before implementing any single CIS Control?

Q29. A need has been identified to organize and control access to different classifications of information stored on a fileserver. Which of the following approaches will meet this need?

Q30. An organization has implemented a policy to continually detect and remove malware from its network. Which of the following is a detective control needed for this?

Q31. Which of the following best describes the CIS Controls?

Q32. Which of the following assigns a number indicating the severity of a discovered software vulnerability?

Q33. As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic. Which event should they receive an alert on?

Q34. An organization is implementing a control for the Limitation and Control of Network Ports, Protocols, and Services CIS Control. Which action should they take when they discover that an application running on a web server is no longer needed?

Q35. What is a recommended defense for the CIS Control for Application Software Security?

Q36. DHCP logging output in the screenshot would be used for which of the following?

Q37. Which of the following is necessary for implementing and automating the Continuous Vulnerability Assessment and Remediation CIS Control?

Q38. An organization is implementing an application software security control their custom-written code that provides web-based database access to sales partners. Which action will help mitigate the risk of the application being compromised?

Q39. What could a security team use the command line tool Nmap for when implementing the Inventory and Control of Hardware Assets Control?

Q40. John a network administrator at Northeast High School. Faculty have been complaining that although they can detect and authenticate to the faculty wireless network, they are unable to connect. While troubleshooting, John discovers that the wireless network server is out of DHCP addresses due to a large number of unauthorized student devices connecting to the network. Which course of action would be an effective temporary stopgap to secure the network until a permanent solution can be found?

Q41. Which of the following actions would best mitigate against phishing attempts such as the example below?

Q42. An Internet retailer’s database was recently exploited by a foreign criminal organization via a remote attack.
The initial exploit resulted in immediate root-level access. What could have been done to prevent this level of access being given to the intruder upon successful exploitation?

Q43. According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

Q44. An administrator looking at a web application’s log file found login attempts by the same host over several seconds. Each user ID was attempted with three different passwords. The event took place over 5 seconds.
* ROOT
* TEST
* ADMIN
* SQL
* USER
* NAGIOSGUEST
What is the most likely source of this event?

Q45. Acme Corporation performed an investigation of its centralized logging capabilities. It found that the central server is missing several types of logs from three servers in Acme’s inventory. Given these findings, what is the most appropriate next step?