Correct Answer:

Regular audit of personnel credentials is correct. By regularly checking user accounts and permissions, you ensure that current users only have the rights and permissions required for their current positions. If you find accounts from users who have left the organization, you can disable those accounts.

Incorrect Answers:

Set account expiration dates is incorrect. Only contracted employees should have expiration dates on their accounts for when their contract is completed.

Use password rotation is incorrect. Password rotation does not ensure that user accounts are disabled if the user has left the company.

Change HR policy to notify you of any employee status changes is incorrect. Although this information is helpful, you must still perform regular reviews if you do not receive a notification from HR or the account management was never completed.

Correct Answer:

CIS Controls is correct. The Center for Internet Security (CIS) Critical Security Controls (CSC), otherwise known as the “Top 20 Controls” or “CIS Controls,” is a framework composed of 20 control groups covering topics that range from hardware inventory to penetration testing within an organization. The underlying thesis for the CSC framework is to pare down the controls to those that are most critical, helping prevent organizations from becoming overwhelmed or choosing the wrong controls to apply to reduce risk.

Incorrect Answers:

NIST RMF is incorrect. The National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) is a seven-step methodology that provides for risk management through the entire information systems life cycle.

PCI DSS is incorrect. The Payment Card Industry Data Security Standard (PCI DSS) is a standard for the payment card industry, namely, companies that process payment card information.

SOC2 Type I is incorrect. A Service and Organization Controls (SOC) 1 report is a statement of an organization’s financial posture through a test of its accounting controls.

Correct Answer:

636 is correct. TCP port 636 is used by LDAP over TLS (i.e., Lightweight Directory Access Protocol over Transport Layer Security). Filtering the results for this port displays only the information you need to troubleshoot the issue.

Incorrect Answers:

143 and 110 are incorrect. Port 143 is used by the Internet Message Access Protocol (IMAP) and port 110 is used by the Post Office Protocol (POP), both of which are used for e-mail.

161 is incorrect. Port 161 is used by the Simple Network Management Protocol (SNMP) for network monitoring.

Correct Answer:

Industrial camouflage is correct. Industrial camouflage is a protective measure that hides lights, sensors, and other security measures from detection. This camouflage matches its subject device to its surroundings through paint matching, terrain matching, use of trees and bushes, and so on or by hiding the device inside another device, often to camouflage facilities from aerial surveillance (satellite, drone, etc.).

Incorrect Answers:

Surveillance is incorrect. Surveillance includes guards and video cameras.

Drone footage is incorrect. Drones (or UAVs) are used to fly over different areas to take pictures, record video, or gather other data that can help an organization to physically secure its premises.

Motion detection is incorrect. Motion detection involves using one or more different types of sensors to detect the presence of a person in a restricted area.

Correct Answer:

Clients have become part of a botnet and are attacking a server is correct. Several of your clients have been infected with malware and have become part of a botnet that has been activated to attack a specific web server on the Internet.

Incorrect Answers:

Clients are illegally downloading movies from the Internet and clients are retrieving antivirus updates are incorrect. This network activity would be inbound.

Clients are being backed up to a local server is incorrect. The network traffic to a backup server would stay internal to your network.

Correct Answer:

Network access control is correct. Network access control (NAC) can be configured on your network devices to deny access to clients that do not have the latest antivirus signatures or that are running an older version of their operating system.

Incorrect Answers:

Forcing the use of HTTPS is incorrect. Forcing the use of Hypertext Transfer Protocol over SSL/TLS (HTTPS) is for web browsing and does not affect network client access.

VLANs is incorrect. Virtual local area networks (VLANs) are used to create logical networks on your physical network and will not control client access based on their software configuration.

Network address translation is incorrect. Network address translation (NAT) allows private IP addresses on your internal network to be translated into routable public addresses for communication on the Internet.

Correct Answer:

Not disabling the account to disallow use is correct. To best protect an account, you should disable it so it cannot be used.

Incorrect Answers:

Setting an account expiry date, setting a maximum password length, and using your primary administrator account as a default are incorrect. These are all best practices for configuration.

Correct Answer:

Regular audits is correct. Only by performing regular audits and reviews of user permissions can you be sure that users are adhering to organizational policies. Regular audits ensure that any security lapses in account management are quickly resolved.

Incorrect Answers:

All other choices are incorrect. These methods will not reveal which users are not adhering to organizational policies.

Correct Answer:

Delete the message and do not forward it is correct. A hoax e-mail does nothing but waste time, network bandwidth, and system resources, especially when it is forwarded like a chain letter throughout the organization. It is best to educate your users to delete the hoax e-mail immediately and not forward it.

Incorrect Answers:

Forward the message to your co-workers to warn them, reply to the message, and forward the message to a home e-mail address are incorrect. These options all involve resending the hoax e-mail, thereby wasting mail server resources.

Correct Answer:

Locked in a server cabinet in a secure server room is correct. The server should be stored in a locked cabinet within a secure server room with access controls.

Incorrect Answers:

Login and password required on the management console screen is incorrect. Requiring a login and password on the management console screen does not prevent physical theft of the device.

Fastened with a cable lock to a desk is incorrect. The cable lock could be easily cut by someone.

Video recordings sent to a remote server is incorrect. Although video surveillance will provide evidence of the theft, it will not prevent it from occurring.