RC0-C02 試験問題を無料オンラインアクセス

A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

• A.Assigning of follow up items
• B.Discussion of event timeline
• C.Demonstration of IPS system
• D.Review vendor selection process
• E.Calculate the ALE for the event

The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage, and realizes this is a risk to the company. In response, the
CISO implements a mandatory training course in which all employees are instructed on the proper use of cloud-based storage. Which of the following risk strategies did the CISO implement?

• A.Accept
• B.Mitigate
• C.Avoid
• D.Transfer

News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer. After the initial exploit, network mapping and fingerprinting is conducted to prepare for further exploitation. Which of the following is the MOST effective solution to protect against unrecognized malware infections?

• A.Deploy a network based heuristic IDS, configure all layer 3 switches to feed data to the IDS for more effective monitoring.
• B.Update router configuration to pass all network traffic through a new proxy server with advanced malware detection.
• C.Implement an application whitelist at all levels of the organization.
• D.Remove local admin permissions from all users and change anti-virus to a cloud aware, push technology.

Customers are receiving emails containing a link to malicious software. These emails are subverting spam filters. The email reads as follows:
Delivered-To: [email protected]
Received: by 10.14.120.205
Mon, 1 Nov 2010 11:15:24 -0700 (PDT)
Received: by 10.231.31.193
Mon, 01 Nov 2010 11:15:23 -0700 (PDT)
Return-Path: <[email protected]>
Received: from 127.0.0.1 for <[email protected]>; Mon, 1 Nov 2010 13:15:14 -0500
(envelope-from <[email protected]>)
Received: by smtpex.example.com (SMTP READY) with ESMTP (AIO); Mon, 01 Nov 2010 13:15:14
-0500
Received: from 172.18.45.122 by 192.168.2.55; Mon, 1 Nov 2010 13:15:14 -0500
From: Company <[email protected]>
To: "[email protected]" <[email protected]>
Date: Mon, 1 Nov 2010 13:15:11-0500
Subject: New Insurance Application
Thread-Topic: New Insurance Application
Please download and install software from the site below to maintain full access to your account.
www.examplesite.com
Additional information: The authorized mail servers IPs are 192.168.2.10 and 192.168.2.11.
The network's subnet is 192.168.2.0/25.
Which of the following are the MOST appropriate courses of action a security administrator could take to eliminate this risk? (Select TWO).

• A.Shut down the SMTP service on the unauthorized mail server.
• B.Identify the origination point for malicious activity on the unauthorized mail server.
• C.Block port 25 on the firewall for all unauthorized mail servers.
• D.Disable open relay functionality.
• E.Enable STARTTLS on the spam filter.

An insurance company is looking to purchase a smaller company in another country. Which of the following tasks would the security administrator perform as part of the security due diligence?

• A.Review the security policies and standards
• B.Review switch and router configurations
• C.Review the firewall rule set and IPS logs
• D.Perform a network penetration test