Q32. Allied services have recently purchased NAC devices to detect and prevent non-company owned devices from attaching to their internal wired and wireless network. Corporate devices will be automatically added to the approved device list by querying Active Directory for domain devices. Non-approved devices will be placed on a protected VLAN with no network access. The NAC also offers a web portal that can be integrated with Active Directory to allow for employee device registration which will not be utilized in this deployment.
Which of the following recommendations would make NAC installation more secure?

Q33. How can the results of automated network configuration scans be used to improve the security of the network?

Q34. An organization is implementing a control for the Account Monitoring and Control CIS Control, and have set the Account Lockout Policy as shown below. What is the risk presented by these settings?

Q35. Which of the following assigns a number indicating the severity of a discovered software vulnerability?

Q36. Which of the following actions will assist an organization specifically with implementing web application software security?

Q37. Which of the following baselines is considered necessary to implement the Boundary Defense CIS Control?

Q38. As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic. Which event should they receive an alert on?

Q39. A need has been identified to organize and control access to different classifications of information stored on a fileserver. Which of the following approaches will meet this need?

Q40. Which of the following actions produced the output seen below?

Q41. Which type of scan is best able to determine if user workstations are missing any important patches?

Q42. Janice is auditing the perimeter of the network at Sugar Water InC. According to documentation, external SMTP traffic is only allowed to and from 10.10.10.25. Which of the following actions would demonstrate the rules are configured incorrectly?

Q43. An organization has implemented a policy to detect and remove malicious software from its network. Which of the following actions is focused on correcting rather than preventing attack?

Q44. Which activity increases the risk of a malware infection?

Q45. What is a zero-day attack?

Q46. According to attack lifecycle models, what is the attacker’s first step in compromising an organization?

Q47. An Internet retailer’s database was recently exploited by a foreign criminal organization via a remote attack.
The initial exploit resulted in immediate root-level access. What could have been done to prevent this level of access being given to the intruder upon successful exploitation?

Q48. Why is it important to enable event log storage on a system immediately after it is installed?

Q49. An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks). Assess the metrics below and determine the appropriate interpretation with respect to this control.

Q50. An organization has failed a test for compliance with a policy of continual detection and removal of malicious software on its network. Which of the following errors is the root cause?

Q51. To effectively implement the Data Protection CIS Control, which task needs to be implemented first?

Q52. What documentation should be gathered and reviewed for evaluating an Incident Response program?