A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all email data older than 90 days should be eliminated. As there are no technical controls in place, users have been instructed to stick to a storage quota of 500Mb of network storage and 200Mb of email storage. After being presented with an e-discovery request from an opposing legal council, the security administrator discovers that the user in the suit has 1Tb of files and 300Mb of email spanning over two years. Which of the following should the security administrator provide to opposing council?

• A. Provide the first 200Mb of e-mail and the first 500Mb of files as per policy.
• B. Provide the 1Tb of files on the network and the 300Mb of email files regardless of age.
• C. Delete files and email exceeding policy thresholds and turn over the remaining files and email.
• D. Delete email over the policy threshold and hand over the remaining emails and all of the files.

Company XYZ plans to donate 1,000 used computers to a local school. The company has a large research and development section and some of the computers were previously used to store proprietary research.
The security administrator is concerned about data remnants on the donated machines, but the company does not have a device sanitization section in the data handling policy.
Which of the following is the BEST course of action for the security administrator to take?

• A. Delay the donation until a new policy is approved by the Chief Information Officer (CIO), and then donate the machines.
• B. Move forward with the donation, but remove all software license keys from the machines.
• C. Delay the donation until all storage media on the computers can be sanitized.
• D. Reload the machines with an open source operating system and then donate the machines.

An administrator notices the following file in the Linux server's /tmp directory.
-rwsr-xr-x. 4 root root 234223 Jun 6 22:52 bash*
Which of the following should be done to prevent further attacks of this nature?

• A. Stop the rpcidmapd service from running
• B. Mount all tmp directories nosuid, noexec
• C. Restrict access to the /tmp directory
• D. Never mount the /tmp directory over NFS

A developer is coding the crypto routine of an application that will be installed on a standard headless and diskless server connected to a NAS housed in the datacenter. The developer has written the following six lines of code to add entropy to the routine:
1 - If VIDEO input exists, use video data for entropy 2 - If AUDIO input exists, use audio data for entropy 3 - If MOUSE input exists, use mouse data for entropy 4 - IF KEYBOARD input exists, use keyboard data for entropy 5 - IF IDE input exists, use IDE data for entropy 6 - IF NETWORK input exists, use network data for entropy
Which of the following lines of code will result in the STRONGEST seed when combined?

• A. 2 and 1
• B. 6 and 4
• C. 5 and 2
• D. 3 and 5

The Chief Executive Officer (CEO) has asked the IT administrator to protect the externally facing web server from SQL injection attacks and ensure the backend database server is monitored for unusual behavior while enforcing rules to terminate unusual behavior. Which of the following would BEST meet the CEO's requirements?

• A. UTM and HSM
• B. WAF and SIEM
• C. DAM and SIEM
• D. WAF and DAM
• E. UTM and NIDS