Using code signing ensures that any third-party libraries or DLLs are signed by a trusted source before they are loaded by the application. This method helps mitigate the risk of DLL injection by ensuring the integrity and origin of the code being executed. DLL injection attacks typically involve the introduction of an unauthorized DLL into the application's process space. Code signing does not prevent the presence of third-party DLLs but verifies their legitimacy. Digital certificates are used in conjunction with code signing, but they do not directly prevent DLL injection; they are part of the broader code signing validation process. Restricting admin privileges prevents unauthorized changes to system files and configurations but does not specifically target the risk of loading malicious DLLs. Sandboxing isolates the application but does not specifically verify the integrity of loaded DLLs.

This type of penetration test is known as a black box test. In this scenario the tests have little to no information on how the website works. For example they are not given the type of web server or access to the source code. Instead the 'attackers' will have to gather information and test different attack methods to see what works and what doesn't.

The primary purpose of conducting interviews is to gather additional information and insights that may not be evident from digital evidence alone. Interviews can provide context to the digital artifacts, identify potential witnesses, understand user behavior, and offer leads that can be followed up during the investigation. They are part of the information-gathering process that is vital for building a comprehensive understanding of the incident.

Containment techniques are options for limiting the spread of malware after it has been discovered on a network. The best response is to isolate any systems that are infected or believed to be infected so they cannot propagate the malware to other systems. From the security and IT teams can begin determining the impact and remediation options.

The correct answer is ARP poisoning. ARP poisoning is an attack where the attacker sends false ARP messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. Once the attacker's MAC address is associated with an IP address, the attacker will begin receiving any data that is intended for that IP address, enabling interception and possible modification of the data. The other options, such as DNS poisoning and URL redirection would not be conducted on Layer 2, and do not deal directly with the resolution of IP addresses to MAC addresses.

Implementing a SOAR solution primarily benefits cybersecurity teams by automating repetitive tasks associated with incident response. This efficiency allows analysts to focus on more complex tasks that require human judgment. While streamlined communication is a component of incident management, it is not the main purpose of SOAR. Integrated threat intelligence is often a feature of SOAR solutions, but not the core benefit. Providing a centralized location for log aggregation is a feature more closely associated with SIEM systems than with SOAR.

Platform/vendor-specific guides are tailored to provide detailed hardening instructions for specific systems and software. Consulting a guide for the specific open-source operating system in the Deploying phase ensures that the server is configured securely before it becomes part of the production environment. The effective use of such guides facilitates a defense-in-depth approach and aligns with the concept of secure baselines.

Corporate-owned, personally enabled (COPE) is the model where the organization provides the mobile devices, retains full control and management of the devices, but allows employees to use them for personal purposes. This model strikes a balance between corporate control and employee satisfaction. BYOD implies employees are using their own personal devices for work, which are not owned by the organization. CYOD offers a range of company-approved devices for employees to choose from and does not necessarily imply personal use. VDI involves accessing a desktop environment over a network and does not pertain to the physical provision of mobile devices.

Data Loss Prevention (DLP) is a term used to describe all of the means used to protect data from loss or leakage. This includes the policies, procedures, software, etc…

A stateless firewall filters traffic based on static values such as source and destination IP addresses, port numbers, and protocols. It does not have the ability to understand or determine the state of network connections, which differentiates it from stateful firewalls that can monitor the full state of active connections and make decisions based on the context of the traffic. Stateless firewalls are faster and less complex, but they are not as secure as stateful firewalls because they cannot understand the state of the network connections. A web application firewall (WAF) is designed to protect web applications by filtering and monitoring HTTP traffic, while a unified threat management (UTM) firewall is an advanced firewall that combines multiple security features into a single device. Network-based intrusion prevention systems (NIPS) monitor the network for malicious activities, which is not directly related to basic filtering rules based on static values.

Issuing a legal hold is the correct first step in the e-discovery process. A legal hold is a directive to preserve all forms of relevant information when litigation is reasonably anticipated. The preservation of this information is critical to prevent data tampering, deletion, or any other actions that could compromise the integrity of the evidence. Although all other options listed are essential parts of the process, they follow the initial preservation step ensured by a legal hold.

A deterrent control is a control that simply deters from taking an action. The control in no way prevents the action from being taken but is only there to persuade not to. The other choices are other types of controls that serve other purposes.

In a watering hole attack the attacker infects a website that is known to be commonly used by an organisation or industry. For example a specific industry news site to attack a business in that industry or the entire industry in general. With the knowledge that users frequent the website the attackers are able to target them with malware and if the attack is successful to install malicious software.

The correct answer is 'Authorized Hackers' typically do not seek to exploit vulnerabilities, as their hacking activities are done with permission for testing and improvement purposes. 'Script Kiddies' might exploit known vulnerabilities but often lack the in-depth knowledge to perform systematic scans. A 'Competitor' would have motives to harm the company's business but would not typically be involved in hands-on technical exploitation. Thus, 'Unauthorized Hackers' is the correct answer, as they are individuals who access computer systems without permission, exploiting known vulnerabilities with the intent to cause harm or steal data.

FTP uses ports 20 and 21, so those should be left open and the others should be closed. Note: The question asks which should REMAIN open, not which should be closed.