A high-tech company dealing with sensitive data seized the mobile device of an employee suspected of leaking company secrets to a competitive organization. Which of the following is the BEST order for mobile phone evidence extraction?

• A. Device isolation, evidence intake, device identification, data processing, verification of data accuracy, documentation, reporting, presentation and archival.
• B. Evidence log, device isolation, device identification, preparation to identify the necessary tools, data processing, verification of data accuracy, presentation and archival.
• C. Device identification, evidence log, preparation to identify the necessary tools, data processing, verification of data accuracy, device isolation, documentation, reporting, presentation and archival.
• D. Evidence intake, device identification, preparation to identify the necessary tools, device isolation, data processing, verification of data accuracy, documentation, reporting, presentation and archival.

A new internal network segmentation solution will be implemented into the enterprise that consists of 200 internal firewalls. As part of running a pilot exercise, it was determined that it takes three changes to deploy a new application onto the network before it is operational.
Security now has a significant effect on overall availability. Which of the following would be the FIRST process to perform as a result of these findings?

• A. Engage internal auditors to perform a review of the project to determine why and how the project did not meet the security requirements. As part of the review ask them to review the control effectiveness.
• B. Lower the SLA to a more tolerable level and perform a risk assessment to see if the solution could be met by another solution. Reuse the firewall infrastructure on other projects.
• C. Perform a cost benefit analysis and implement the solution as it stands as long as the risks are understood by the business owners around the availability issues. Decrease the current SLA expectations to match the new solution.
• D. Review to determine if control effectiveness is in line with the complexity of the solution.
  Determine if the requirements can be met with a simpler solution.

In an effort to reduce internal email administration costs, a company is determining whether to outsource its email to a managed service provider that provides email, spam, and malware protection. The security manager is asked to provide input regarding any security implications of this change.
Which of the following BEST addresses risks associated with disclosure of intellectual property?

• A. Establish an acceptable use policy and incident response policy.
• B. Require the managed service provider to implement additional data separation.
• C. Require encrypted communications when accessing email.
• D. Enable data loss protection to minimize emailing PII and confidential data.

Customers have recently reported incomplete purchase history and other anomalies while accessing their account history on the web server farm. Upon investigation, it has been determined that there are version mismatches of key e-commerce applications on the production web servers. The development team has direct access to the production servers and is most likely the cause of the different release versions. Which of the following process level solutions would address this problem?

• A. Adjust the firewall ACL to prohibit development from directly accessing the production server farm.
• B. Implement change control practices at the organization level.
• C. Update the vulnerability management plan to address data discrepancy issues.
• D. Change development methodology from strict waterfall to agile.

An industry organization has implemented a system to allow trusted authentication between all of its partners. The system consists of a web of trusted RADIUS servers communicating over the Internet. An attacker was able to set up a malicious server and conduct a successful man-in-the-middle attack. Which of the following controls should be implemented to mitigate the attack in the future?

• A. Use a shared secret for each pair of RADIUS servers
• B. Use PAP for secondary authentication on each RADIUS server
• C. Enforce TLS connections between RADIUS servers
• D. Disable unused EAP methods on each RADIUS server