Exam 2: Certified Network Defender

You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don't know what to do. What is the BEST approach to handle this situation?

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Which of the following represents the MOST negative impact resulting from an ineffective security governance program?

You should make at least how many bit-stream copies of a suspect drive?

Which of the following is the MOST effective method for discovering common technical vulnerabilities within the IT environment?

Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?

What operating system would respond to the following command?

Which of the following is NOT a graphics file?

Risk appetite is typically determined by which of the following organizational functions?

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

A CISO has implemented a risk management capability within the security portfolio. Which of the following terms best describes this functionality?

What is the target host IP in the following command?

When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?

Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network. How would you answer?

Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called?

The alerting, monitoring and life-cycle management of security related events is typically handled by the_________________.

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?

When gathering security requirements for an automated business process improvement program, which of the following is MOST important?