A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?

• A. Canary
• B. Load
• C. Smoke
• D. Regression

A security officer is requiring all personnel working on a special project to obtain a security clearance requisite with the level of all information being accessed. Data on this network must be protected at the same level of each clearance holder. The need to know must be verified by the data owner. Which of the following should the security officer do to meet these requirements?

• A. Create a rule to authorize personnel only from certain IPs to access the files.
• B. Assign labels to the files and require formal access authorization.
• C. Assign roles to users and authorize access to files based on the roles.
• D. Assign attributes to each file and allow authorized users to share the files.

A systems administrator uses an internal AI-based tool to generate code that uses an API to connect to a company service. After testing the code, the systems administrator collects and posts data using the API for the internal system. The Chief Information Security Officer asks a security engineer to review the systems administrator's process. Which of the following should the security engineer do first?

• A. Analyze the large language model used to generate the output.
• B. Check for hard-coded secrets in the application's source code.
• C. Review the effectiveness of the AI tool that the administrator used.
• D. Use prompt-testing methodologies to ensure model security.

A vulnerability can on a web server identified the following:

Which of the following actions would most likely eliminate on path decryption attacks? (Select two).

• A. Implementing HIPS rules to identify and block BEAST attack attempts
• B. Removing support for CBC-based key exchange and signing algorithms
• C. Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA
• D. Disallowing cipher suites that use ephemeral modes of operation for key agreement
• E. Adding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256
• F. Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA

A development team must create a website to share indicators of compromise. The team wants to use APIs between industry peers to aid in configuring SIEM and SOAR. The team needs to create a free tier of service, and the senior developer insists on configuring rate limiting. Which of the following best describes the senior developer's reasoning?

• A. To address concerns the team has about API bandwidth utilization
• B. To limit the likelihood of resource exhaustion occurring on the API server
• C. To prevent password-spraying attacks on the services hosting the API
• D. To reduce attack surface exposure of the API endpoints connecting peers