When reviewing network traffic, a security analyst detects suspicious activity:

Based on the log above, which of the following vulnerability attacks is occurring?

• A. Zeus
• B. Heartbleed
• C. DROWN
• D. ShellShock
• E. POODLE

A company wants to update its acceptable use policy (AUP) to ensure it relates to the newly implemented password standard, which requires sponsored authentication of guest wireless devices. Which of the following is MOST likely to be incorporated in the AUP?

• A. Guests using the wireless network should provide valid identification when registering their wireless devices.
• B. The corporate network should have a wireless infrastructure that uses open authentication standards.
• C. The network should authenticate all guest users using 802.1x backed by a RADIUS or LDAP server.
• D. Sponsored guest passwords must be at least ten characters in length and contain a symbol.

An organization suspects it has had a breach, and it is trying to determine the potential impact. The organization knows the following:
The source of the breach is linked to an IP located in a foreign country.
The breach is isolated to the research and development servers.
The hash values of the data before and after the breach are unchanged.
The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)

• A. The confidentiality of the data is unaffected.
• B. The threat is an APT.
• C. The source IP of the threat has been spoofed.
• D. The integrity of the data is unaffected.
• E. The threat is an insider.

While reviewing proxy logs, the security analyst noticed a suspicious traffic pattern. Several internal hosts were observed communicating with an external IP address over port 80 constantly. An incident was declared, and an investigation was launched. After interviewing the affected users, the analyst determined the activity started right after deploying a new graphic design suite. Based on this information, which of the following actions would be the appropriate NEXT step in the investigation?

• A. Perform a network scan and identify rogue devices that may be generating the observed traffic. Remove those devices from the network.
• B. Identify what the destination IP address is and who owns it, and look at running processes on the affected hosts to determine if the activity is malicious or not.
• C. Update all antivirus and anti-malware products, as well as all other host-based security software on the servers the affected users authenticate to.
• D. Ask desktop support personnel to reimage all affected workstations and reinstall the graphic design suite. Run a virus scan to identify if any viruses are present.