A developer is coding the crypto routine of an application that will be installed on a standard headless and diskless server connected to a NAS housed in the datacenter. The developer has written the following six lines of code to add entropy to the routine:
1 - If VIDEO input exists, use video data for entropy 2 - If AUDIO input exists, use audio data for entropy 3 - If MOUSE input exists, use mouse data for entropy 4 - IF KEYBOARD input exists, use keyboard data for entropy 5 - IF IDE input exists, use IDE data for entropy 6 - IF NETWORK input exists, use network data for entropy
Which of the following lines of code will result in the STRONGEST seed when combined?

• A. 3 and 5
• B. 6 and 4
• C. 5 and 2
• D. 2 and 1

A large financial company has a team of security-focused architects and designers that contribute into broader IT architecture and design solutions. Concerns have been raised due to the security contributions having varying levels of quality and consistency. It has been agreed that a more formalized methodology is needed that can take business drivers, capabilities, baselines, and re-usable patterns into account. Which of the following would BEST help to achieve these objectives?

• A. Introduce an ESA framework
• B. Construct a security control library
• C. Construct a library of re-usable security patterns
• D. Include SRTM in the SDLC

Company ABC has a 100Mbps fiber connection from headquarters to a remote office 200km (123 miles) away. This connection is provided by the local cable television company. ABC would like to extend a secure VLAN to the remote office, but the cable company says this is impossible since they already use VLANs on their internal network. Which of the following protocols should the cable company be using to allow their customers to establish VLANs to other sites?

• A. EIGRP
• B. IS-IS
• C. 802.1q
• D. MPLS

A business owner has raised concerns with the Chief Information Security Officer (CISO) because money has been spent on IT security infrastructure, but corporate assets are still found to be vulnerable. The business recently implemented a patch management product and SOE hardening initiative. A third party auditor reported findings against the business because some systems were missing patches. Which of the following statements BEST describes this situation?

• A. Security controls are generally never 100% effective and gaps should be explained to stakeholders and managed accordingly.
• B. The audit findings are invalid because remedial steps have already been applied to patch servers and the remediation takes time to complete.
• C. The business owner is at fault because they are responsible for patching the systems and have already been given patch management and SOE hardening products.
• D. The CISO has not selected the correct controls and the audit findings should be assigned to them instead of the business owner.

New zero-day attacks are announced on a regular basis against a broad range of technology systems. Which of the following best practices should a security manager do to manage the risks of these attack vectors? (Select TWO).

• A. Establish an emergency response call tree.
• B. Maintain a list of critical systems.
• C. Backup the router and firewall configurations.
• D. Create an inventory of applications.
• E. Update all network diagrams.