Refer to the Exhibit Practice Questions

[IDS Alert] Signature: ET TROJAN Known Botnet C2 1
Source: 10.0.1.50:443 -> Destination: 203.0.113.5:8080
Payload: [encrypted]

Security Program Dashboard:
- Patch Compliance (30-day window): 85%
- Critical Vulnerability Remediation (48h): 95%
- High-Risk Vulnerability Remediation (60-day): 88%
- Risk Acceptance: 3% of findings
- Incident Response Plan Test: Annual, last test 14 months ago.

Refer to the exhibit.

```
[SYN] 12:01:00.001 192.168.1.10:12345 -> 10.0.0.1:80
[SYN-ACK] 12:01:00.002 10.0.0.1:80 -> 192.168.1.10:12345
[ACK] 12:01:00.003 192.168.1.10:12345 -> 10.0.0.1:80
[GET /index.html] 12:01:00.004 192.168.1.10:12345 -> 10.0.0.1:80
[SYN] 12:01:00.005 192.168.1.11:23456 -> 10.0.0.1:80
[SYN-ACK] 12:01:00.006 10.0.0.1:80 -> 192.168.1.11:23456
[ACK] 12:01:00.007 192.168.1.11:23456 -> 10.0.0.1:80
[GET /login.php] 12:01:00.008 192.168.1.11:23456 -> 10.0.0.1:80
[SYN] 12:01:00.009 192.168.1.12:34567 -> 10.0.0.1:80
[SYN-ACK] 12:01:00.010 10.0.0.1:80 -> 192.168.1.12:34567
[ACK] 12:01:00.011 192.168.1.12:34567 -> 10.0.0.1:80
[GET /admin.php] 12:01:00.012 192.168.1.12:34567 -> 10.0.0.1:80
```

Risk Register Extract:
Risk ID: R-001
Description: Unauthorized access to sensitive data
Current Controls: Firewall, Access control lists
Inherent Risk: High (Likelihood: 4, Impact: 5)
Residual Risk: Medium (Likelihood: 3, Impact: 4)
Risk Appetite: Low

Risk ID: R-002
Description: Data corruption due to malware
Current Controls: Antivirus software
Inherent Risk: High (Likelihood: 5, Impact: 4)
Residual Risk: High (Likelihood: 4, Impact: 4)
Risk Appetite: Low

[Windows Event Log] Event ID 4688: A new process has been created.
Creator Subject: Security ID: S-1-5-21-...  Account Name: jdoe
Process Information: New Process ID: 0x1a2b  New Process Name: C:\Users\jdoe\AppData\Local\Temp\svchost.exe

Refer to the exhibit.

```
$ cat governance_policy.json
{
  "policyName": "Information Security Governance Policy",
  "version": "2.0",
  "scope": "All business units and subsidiaries",
  "roles": {
    "board": "Approve risk appetite and review security performance quarterly",
    "ceo": "Provide strategic direction and resources",
    "ciso": "Develop and implement security program",
    "businessManagers": "Ensure compliance within their units",
    "internalAudit": "Independent assurance on governance effectiveness"
  },
  "processes": {
    "riskAssessment": "Annual risk assessment and quarterly updates",
    "strategyAlignment": "Annual review of security strategy with business strategy",
    "reporting": "Quarterly dashboard to board, monthly to management"
  }
}
```

CISO Quarterly Report:
- Patch Compliance (30-day window): 85%
- Critical Vulnerability Remediation (48h): 95%
- High-Risk Vulnerability Remediation (60-day): 88%
- Risk Acceptance: 3% of findings
- Incident Response Plan Test: Annual, last test 14 months ago.

Refer to the exhibit.

Exhibit: Network Architecture Description

The network consists of three zones: External, DMZ, and Internal. The external interface connects to the internet. The DMZ hosts public-facing web servers and an email relay. The internal zone hosts database servers and application servers. A firewall separates External from DMZ, and another firewall separates DMZ from Internal. The firewall rules are:
- External to DMZ: allow HTTP, HTTPS, SMTP.
- DMZ to Internal: allow MySQL (3306) from web servers to database servers, and allow LDAP (389) from application servers to domain controllers.
- Internal to External: allow outbound HTTP/HTTPS from application servers.
- All other traffic is denied.
The IDS is placed on the DMZ segment, monitoring traffic between DMZ and Internal. The IDS signatures include critical, high, and medium severity, and the action is 'alert and log'.

Refer to the exhibit.

```
Risk Assessment Log
Date: 2025-03-01
Asset: Database Server DB-01
Threat: Unauthorized access
Vulnerability: Weak password policy
Current Controls: Password complexity enabled, account lockout after 5 failed attempts
Likelihood: 3 (Moderate)
Impact: 4 (Major)
Risk Level: 12 (High)
Risk Appetite Threshold: 10
```

Refer to the exhibit.

```
# netstat -an | grep :443
tcp4  0      0  *.443                 *.*                    LISTEN
tcp4  0      0  192.168.1.100.443     10.0.0.1.54321        ESTABLISHED
tcp4  0      0  192.168.1.100.443     10.0.0.2.54322        ESTABLISHED
tcp4  0      0  192.168.1.100.443     203.0.113.5.44333     ESTABLISHED
```

Refer to the exhibit.

```
[Alert] Correlation Rule: Multiple Failed Logins
Source IP: 10.0.0.55
Destination IP: 192.168.1.10
Event Count: 150 failed logins to admin account 'jsmith' within 5 minutes
Action: Triggered
```

Refer to the exhibit.

```
[2025-03-10 14:32:15] CRITICAL: File integrity violation on /etc/passwd
[2025-03-10 14:32:15] File: /etc/passwd, Expected hash: a1b2c3d4e5f6, Actual hash: 9z8y7x6w5v4u
[2025-03-10 14:32:16] ALERT: Unauthorized SSH key added to /home/admin/.ssh/authorized_keys
[2025-03-10 14:32:18] ALERT: New user 'backup_agent' created with UID 0
```

[2025-04-09 10:23:45] ALERT: User 'jdoe' logged in from IP 198.51.100.100 (unusual location) at 10:23:45.
[2025-04-09 10:24:10] EVENT: User 'jdoe' attempted to access /admin/config with lack of privilege.
[2025-04-09 10:25:00] EVENT: User 'jdoe' accessed /finance/customers.xlsx and downloaded 500MB.
[2025-04-09 10:25:30] ALERT: Large data transfer from internal IP to external IP 203.0.113.5.

Refer to the exhibit.

```
Risk Register Excerpt:
Risk ID: R001
Risk Description: Unauthorized disclosure of sensitive customer data due to weak encryption.
Inherent Risk: High
Control Effectiveness: Partially effective
Residual Risk: High
Risk Owner: CISO
Risk Treatment: Accept
```

Refer to the exhibit.

Exhibit:
```
Log Entry:
Jan 15 09:23:45 server1 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 09:23:47 server1 sshd[1235]: Failed password for admin from 10.0.0.5 port 22 ssh2
Jan 15 09:23:50 server1 sshd[1236]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 09:23:52 server1 sshd[1237]: Failed password for admin from 10.0.0.5 port 22 ssh2
```