Free 512-50 Exam Dumps Preview

Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

Which of the following defines the boundaries and scope of a risk assessment?

A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions.
This activity BEST demonstrates what part of a security program?

An organization licenses and uses personal information for business operations, and a server containing that information has been compromised.

What kind of law would require notifying the owner or licensee of this incident?

Which of the following most commonly falls within the scope of an information security governance steering committee?

Which of the following is true regarding expenditures?

You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.

Using the best business practices for project management you determine that the project correct aligns with the company goals.

What needs to be verified FIRST?

Annual Loss Expectancy is derived from the function of which two factors?

The PRIMARY objective for information security program development should be:

In effort to save your company money which of the following methods of training results in the lowest cost for the organization?

Which of the following is a symmetric encryption algorithm?

Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress.
You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full

access to the data on the foreign server.

What action should you take FIRST?

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

Which of the following provides an audit framework?

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called

Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus.

Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.

This global retail company is expected to accept credit card payments.

Which of the following is of MOST concern when defining a security program for this organization?

Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.

The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization.
From an organizational perspective, which of the following is the LIKELY reason for this?

Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers."

What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?

When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

In which of the following cases, would an organization be more prone to risk acceptance vs.
risk mitigation?

The new CISO was informed of all the Information Security projects that the organization has in progress.
Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.

Which of the following needs to be performed NEXT?

The company decides to release the application without remediating the high-risk vulnerabilities.

Which of the following is the MOST likely reason for the company to release the application?

As the CISO for your company you are accountable for the protection of information resources commensurate with:

Security related breaches are assessed and contained through which of the following?

A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards.

What immediate action should the information security manager take?

The Information Security Management program MUST protect:

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.

Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

Which of the following strategies provides the BEST response to a ransomware attack?

A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization.

Which of the following represents the MOST likely reason for this situation?

A missing/ineffective security control is identified.

Which of the following should be the NEXT step?

Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.

Which of the following represents the best method of ensuring business unit alignment with security program requirements?

Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application.

Which of the following is MOST likely the reason for this recurring issue?

Which of the following functions evaluates patches used to close software vulnerabilities of new systems to assure compliance with policy when implementing an information security program?

A global health insurance company is concerned about protecting confidential information.

Which of the following is of MOST concern to this organization?

The regular review of a firewall ruleset is considered a

Which of the following is a fundamental component of an audit record?

Smith, the project manager for a larger multi-location firm, is leading a software project team that has 18 members, 5 of which are assigned to testing. Due to recent recommendations by an organizational quality audit team, the project manager is convinced to add a quality professional to lead to test team at additional cost to the project.

The project manager is aware of the importance of communication for the success of the project and takes the step of introducing additional communication channels, making it more complex, in order to assure quality levels of the project.

What will be the first project management document that Smith should change in order to accommodate additional communication channels?

When creating contractual agreements and procurement processes why should security requirements be included?

A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.

When managing the security architecture for your company you must consider:

When project costs continually increase throughout implementation due to large or rapid changes in customer or user requirements, this is commonly known as:

You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):

Which of the following is MOST important when dealing with an Information Security Steering committee:

A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding.

Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?

Risk appetite directly affects what part of a vulnerability management program?

According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

Your incident response plan should include which of the following?

What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

You have purchased a new insurance policy as part of your risk strategy.

Which of the following risk strategy options have you engaged in?

When dealing with a risk management process, asset classification is important because it will impact the overall:

Information security policies should be reviewed:

What is the primary reason for performing vendor management?

To get an Information Security project back on schedule, which of the following will provide the MOST help?

Your company has a "no right to privacy" notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee's email account. What should you do? (choose the BEST answer):

Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise.

Which tool selection represents the BEST choice to achieve situational awareness?