Q18. Which of the following can be enabled on a Linux based system in order to make it more difficult for an attacker to execute malicious code after launching a buffer overflow attack?

Q19. Review the below results of an audit on a server. Based on these results, which document would you recommend be reviewed for training or updates?

Q20. Which approach is recommended by the CIS Controls for performing penetration tests?

Q21. Acme Corporation is doing a core evaluation of its centralized logging capabilities. Which of the following scenarios indicates a failure in more than one CIS Control?

Q22. Which of the following CIS Controls is used to manage the security lifecycle by validating that the documented controls are in place?

Q23. What is the first step suggested before implementing any single CIS Control?

Q24. During a security audit which test should result in a source packet failing to reach its intended destination?

Q25. Which activity increases the risk of a malware infection?

Q26. Which CIS Control includes storing system images on a hardened server, scanning production systems for out-of-date software, and using file integrity assessment tools like tripwire?

Q27. How can the results of automated network configuration scans be used to improve the security of the network?

Q28. An organization has implemented a policy to continually detect and remove malware from its network. Which of the following is a detective control needed for this?

Q29. An organization has implemented a control for Controlled Use of Administrative Privileges. They are collecting audit data for each login, logout, and location for the root account of their MySQL server, but they are unable to attribute each of these logins to a specific user. What action can they take to rectify this?

Q30. An organization has installed a firewall for Boundary Defense. It allows only outbound traffic from internal workstations for web and SSH, allows connections from the internet to the DMZ, and allows guest wireless access to the internet only. How can an auditor validate these rules?

Q31. Of the options shown below, what is the first step in protecting network devices?

Q32. An organization has implemented a control for Controlled Use of Administrative Privilege. The control requires users to enter a password from their own user account before being allowed elevated privileges, and that no client applications (e.g. web browsers, e-mail clients) can be run with elevated privileges. Which of the following actions will validate this control is implemented properly?

Q33. To effectively implement the Data Protection CIS Control, which task needs to be implemented first?

Q34. Below is a screenshot from a deployed next-generation firewall. These configuration settings would be a defensive measure for which CIS Control?

Q35. What is the business goal of the Inventory and Control of Software Assets Control?

Q36. Beta corporation is doing a core evaluation of its centralized logging capabilities. The security staff suspects that the central server has several log files over the past few weeks that have had their contents changed. Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?

Q37. Which of the following actions would best mitigate against phishing attempts such as the example below?

Q38. An organization has implemented a policy to detect and remove malicious software from its network. Which of the following actions is focused on correcting rather than preventing attack?

Q39. Which of the following is used to prevent spoofing of e-mail addresses?

Q40. An organization has created a policy that allows software from an approved list of applications to be installed on workstations. Programs not on the list should not be installed. How can the organization best monitor compliance with the policy?

Q41. John is implementing a commercial backup solution for his organization. Which of the following steps should be on the configuration checklist?