- (Exam Topic 1)
You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

1. A. Packet filtering firewall
2. B. Circuit-level proxy firewall
3. C. Application-level proxy firewall
4. D. Stateful firewall

Correct Answer: D

- (Exam Topic 2)
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

1. A. Record the system state by taking photographs of physical system and the display
2. B. Perform data acquisition without disturbing the state of the systems
3. C. Open the systems, remove the hard disk and secure it
4. D. Switch off the systems and carry them to the laboratory

Correct Answer: A

- (Exam Topic 3)
During an investigation of an XSS attack, the investigator comes across the term “[a-zA-Z0-9%]+” in analyzed evidence details. What is the expression used for?

1. A. Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation
2. B. Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
3. C. Checks for opening angle bracket, its hex or double-encoded hex equivalent
4. D. Checks for closing angle bracket, hex or double-encoded hex equivalent

Correct Answer: B

- (Exam Topic 4)
In which loT attack does the attacker use multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?

1. A. Replay attack
2. B. Jamming attack
3. C. Blueborne attack
4. D. Sybil attack

Correct Answer: D

- (Exam Topic 1)
The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?

1. A. Any data not yet flushed to the system will be lost
2. B. All running processes will be lost
3. C. The /tmp directory will be flushed
4. D. Power interruption will corrupt the pagefile

Correct Answer: A