An internal development team has migrated away from Waterfall development to use Agile development.
Overall, this has been viewed as a successful initiative by the stakeholders as it has improved time-to-market. However, some staff within the security team have contended that Agile development is not secure. Which of the following is the MOST accurate statement?

• A. Agile development has different phases and timings compared to Waterfall. Security activities need to be adapted and performed within relevant Agile phases.
• B. Agile and Waterfall approaches have the same effective level of security posture. They both need similar amounts of security effort at the same phases of development.
• C. Agile development is more secure than Waterfall as it is a more modern methodology which has the advantage of having been able to incorporate security best practices of recent years.
• D. Agile development is fundamentally less secure than Waterfall due to the lack of formal up-front design and inability to perform security reviews.

A small customer focused bank with implemented least privilege principles, is concerned about the possibility of branch staff unintentionally aiding fraud in their day to day interactions with customers.
Bank staff has been encouraged to build friendships with customers to make the banking experience feel more personal. The security and risk team have decided that a policy needs to be implemented across all branches to address the risk. Which of the following BEST addresses the security and risk team's concerns?

• A. Information disclosure policy
• B. Job rotation
• C. Separation of duties
• D. Awareness training

A multi-national company has a highly mobile workforce and minimal IT infrastructure. The company utilizes a BYOD and social media policy to integrate presence technology into global collaboration tools by individuals and teams. As a result of the dispersed employees and frequent international travel, the company is concerned about the safety of employees and their families when moving in and out of certain countries. Which of the following could the company view as a downside of using presence technology?

• A. Physical security
• B. Insider threat
• C. Industrial espionage
• D. Network reconnaissance

Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string:
user@hostname:~s sudo nmap -0 192.168.1.54
Based on the output, nmap is unable to identify the OS running on the node, but the following ports are open on the device:
TCP/22
TCP/111
TCP/512-514
TCP/2049
TCP/32778
Based on this information, which of the following operating systems is MOST likely running on the unknown node?

• A. OSX
• B. Solaris
• C. Linux
• D. Windows

DRAG DROP
Company A has experienced external attacks on their network and wants to minimize the attacks from reoccurring. Modify the network diagram to prevent SQL injections, XSS attacks, smurf attacks, e-mail spam, downloaded malware, viruses and ping attacks. The company can spend a MAXIMUM of $50,000
USD. A cost list for each item is listed below:
Anti-Virus Server - $10,000
Firewall-$15,000
Load Balanced Server - $10,000
NIDS/NIPS-$10,000
Packet Analyzer - $5,000
Patch Server-$15,000
Proxy Server-$20,000
Router-$10,000
Spam Filter-$5,000
Traffic Shaper - $20,000
Web Application Firewall - $10,000
Instructions: Not all placeholders in the diagram need to be filled and items can only be used once. If you place an object on the network diagram, you can remove it by clicking the (x) in the upper right hand of the object.