NO.24 What tool creates visual network topology output and results that can be analyzed by Ndiff to determine if a service or network asset has changed?

NO.25 A security incident investigation identified the following modified version of a legitimate system file on a compromised client:
C:WindowsSystem32winxml.dll Addition Jan. 16, 2014 4:53:11 PM
The infection vector was determined to be a vulnerable browser plug-in installed by the user. Which of the organization’s CIS Controls failed?

NO.26 An administrator looking at a web application’s log file found login attempts by the same host over several seconds. Each user ID was attempted with three different passwords. The event took place over 5 seconds.
* ROOT
* TEST
* ADMIN
* SQL
* USER
* NAGIOSGUEST
What is the most likely source of this event?

NO.27 An organization has installed a firewall for Boundary Defense. It allows only outbound traffic from internal workstations for web and SSH, allows connections from the internet to the DMZ, and allows guest wireless access to the internet only. How can an auditor validate these rules?

NO.28 John is implementing a commercial backup solution for his organization. Which of the following steps should be on the configuration checklist?

NO.29 Which type of scan is best able to determine if user workstations are missing any important patches?

NO.30 Scan 1 was taken on Monday. Scan 2 was taken of the same network on Wednesday. Which of the following findings is accurate based on the information contained in the scans?

NO.31 Which projects enumerates or maps security issues to CVE?

NO.32 Which approach is recommended by the CIS Controls for performing penetration tests?

NO.33 Which of the following actions would best mitigate against phishing attempts such as the example below?

NO.34 An organization is implementing a control for the Limitation and Control of Network Ports, Protocols, and Services CIS Control. Which action should they take when they discover that an application running on a web server is no longer needed?

NO.35 Kenya is a system administrator for SANS. Per the recommendations of the CIS Controls she has a dedicated host (kenya- adminbox / 10.10.10.10) for any administrative tasks. She logs into the dedicated host with her domain admin credentials. Which of the following connections should not exist from kenya-adminbox?

NO.36 Which of the following is a benefit of stress-testing a network?

NO.37 A need has been identified to organize and control access to different classifications of information stored on a fileserver. Which of the following approaches will meet this need?

NO.38 Acme Corporation performed an investigation of its centralized logging capabilities. It found that the central server is missing several types of logs from three servers in Acme’s inventory. Given these findings, what is the most appropriate next step?

NO.39 Which of the options below will do the most to reduce an organization’s attack surface on the internet?

NO.40 Which of the following should be measured and analyzed regularly when implementing the Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CIS Control?

NO.41 What type of Unified Modelling Language (UML) diagram is used to show dependencies between logical groupings in a system?

NO.42 An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks). Assess the metrics below and determine the appropriate interpretation with respect to this control.

NO.43 As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic. Which event should they receive an alert on?

NO.44 An Internet retailer’s database was recently exploited by a foreign criminal organization via a remote attack.
The initial exploit resulted in immediate root-level access. What could have been done to prevent this level of access being given to the intruder upon successful exploitation?

NO.45 Why is it important to enable event log storage on a system immediately after it is installed?

NO.46 Review the below results of an audit on a server. Based on these results, which document would you recommend be reviewed for training or updates?