A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product's reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO's requirements?

• A. Sign a MOU with a marketing firm to preserve the company reputation and use in-house resources for random testing.
• B. Sign a BPA with a small software consulting firm and use the firm to perform Black box testing and address all findings.
• C. Sign a NOA with a large security consulting firm and use the firm to perform Grey box testing and address all findings.
• D. Use the most qualified and senior developers on the project to perform a variety of White box testing and code reviews.

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

Company policy requires that all company laptops meet the following baseline requirements:
Software requirements:
Antivirus
Anti-malware
Anti-spyware
Log monitoring
Full-disk encryption
Terminal services enabled for RDP
Administrative access for local users
Hardware restrictions:
Bluetooth disabled
FireWire disabled
WiFi adapter disabled
Ann, a web developer, reports performance issues with her laptop and is not able to access any network resources. After further investigation, a bootkit was discovered and it was trying to access external websites. Which of the following hardening techniques should be applied to mitigate this specific issue from reoccurring? (Select TWO).

• A. Restrict/disable USB access
• B. Restrict VPN access for all mobile users
• C. Restrict/disable TELNET access to network resources
• D. Group policy to limit web access
• E. Remove full-disk encryption
• F. Remove administrative access to local users
• G. Perform vulnerability scanning on a daily basis

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self-service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.
Which of the following security activities should be implemented as part of the SDL in order to provide the
MOST security coverage over the solution? (Select TWO).

• A. Perform black box penetration testing over the solution
• B. Perform grey box penetration testing over the solution
• C. Perform static code review over the front end source code
• D. Perform unit testing of the binary code
• E. Perform code review over a sampling of the front end source code

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).

The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees:
Employee A: Works in the accounts receivable office and is in charge of entering data into the finance system.
Employee B: Works in the accounts payable office and is in charge of approving purchase orders.
Employee C: Is the manager of the finance department, supervises Employee A and Employee B, and can perform the functions of both Employee A and Employee B.
Which of the following should the auditor suggest be done to avoid future security breaches?

• A. The manager should only be able to review the data and approve purchase orders.
• B. All employees should have the same access level to be able to check on each others.
• C. Employee A and Employee B should rotate jobs at a set interval and cross-train.
• D. The manager should be able to both enter and approve information.

A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the communication is stateless between the mobile application and the web services gateway.
Which of the following controls MUST be implemented to enable stateless communication?

• A. The jsession cookie should be stored securely after authentication.
• B. Require SSL between the mobile application and the web services gateway.
• C. Authentication assertion should be stored securely on the client.
• D. Generate a one-time key as part of the device registration process.

Explanation: Only visible for Actual4dump members. You can sign-up / login (it's free).