Question 156
A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated vulnerability:
Title: Remote Command Execution vulnerability in web server
Rating: Critical (CVSS 10.0)
Threat actor: any remote user of the web server
Confidence: certain
Recommendation: apply vendor patches
Which of the following actions should the security analyst perform FIRST?
Title: Remote Command Execution vulnerability in web server
Rating: Critical (CVSS 10.0)
Threat actor: any remote user of the web server
Confidence: certain
Recommendation: apply vendor patches
Which of the following actions should the security analyst perform FIRST?
Question 157
A security specialist is notified about a certificate warning that users receive when using a new internal website.
After being given the URL from one of the users and seeing the warning, the security specialist inspects the certificate and realizes it has been issued to the IP address, which is how the developers reach the site.
Which of the following would BEST resolve the issue?
After being given the URL from one of the users and seeing the warning, the security specialist inspects the certificate and realizes it has been issued to the IP address, which is how the developers reach the site.
Which of the following would BEST resolve the issue?
Question 158
To reduce disk consumption, an organization's legal department has recently approved a new policy setting the data retention period for sent email at six months. Which of the following is the BEST way to ensure this goal is met?
Question 159
An information systems owner has decided to create a more stringent password policy based on recent reports that systems are being compromised with current user credentials. The current policy has password complexity reuse and history measures in place, however, attackers are repeatedly gaming access to the systems after passwords have been changed. Which of the following would be the BEST method to add to the password policy to prevent compromise?
Question 160
Which of the following technologies would be MOST appropriate to utilize when testing a new software patch before a company-wide deployment?