Free 712-50 Exam Dumps Preview

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years. This global retail company is expected to accept credit card payments.

Which of the following is of MOST concern when defining a security program for this organization?

Which of the following strategies provides the BEST response to a ransomware attack?

An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase.

What does this selection indicate?

When choosing a risk mitigation method what is the MOST important factor?

When managing the critical path of an IT security project, which of the following is MOST important?

Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?

Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers."

Which group of people should be consulted when developing your security program?

Which of the following is a fundamental component of an audit record?

When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:

Risk is defined as:

How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?

The main purpose of the SOC is:

Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.

When formulating the remediation plan, what is a required input?

Human resource planning for security professionals in your organization is a:

Which of the following represents the best method of ensuring business unit alignment with security program requirements?

A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company's building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area.

Which type of attack did the consultant perform?

SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:

Which of the following is the MOST important for a CISO to understand when identifying threats?

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.

What type of control is being implemented by supervisors and data owners?

You have been hired as the CISO for a hospital. The hospital currently deploys a hybrid cloud model using a Software as a Service (SaaS) product for healthcare clearinghouse services. The Health Insurance Portability and Accountability Act (HIPAA) require an agreement between Cloud Service Providers (CSP) and the covered entity.
Based on HIPAA, once the agreement between the covered entity and the CSP signed, the CSP is ____________?

The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is _______________.

Which of the following is a benefit of a risk-based approach to audit planning?

Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?

At what level of governance are individual projects monitored and managed?

A newly-hired CISO needs to understand the organization's financial management standards for business units and operations.

Which of the following would be the best source of this information?

Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?

Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?

The process of identifying and classifying assets is typically included in the________________.

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization.

Which of the following principles does this best demonstrate?

What is the name of a formal statement that defines the strategy, approach, or expectations related to specific concerns within an organization?

Which of the following refers to the quantity or quality of project deliverables expanding from the original project plan?

Which of the following is the MOST important goal of risk management?

The ultimate goal of an IT security projects is:

Which of the following best describes the sensors designed to project and detect a light beam across an area?

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.

Control Objectives for Information and Related Technology (COBIT) is which of the following?

When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?

The process for identifying, collecting, and producing digital information in support of legal proceedings is called _____________________________.

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

Scenario: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization's needs. The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system's scalability.

This demonstrates which of the following?

The PRIMARY objective for information security program development should be:

Which type of scan is used on the eye to measure the layer of blood vessels?

Which of the following is MOST likely to be discretionary?

If a CISO wants to understand the liabilities of the company, she will refer to the:

Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?

An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.

Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.

Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?

Security related breaches are assessed and contained through which of the following?

As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can
jeopardize your own brand.

Which is the BEST type of risk that defines this event?

Which of the following is MOST useful when developing a business case for security initiatives?

Which wireless encryption technology makes use of temporal keys?

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.

Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

When reviewing a Solution as a Service (SaaS) provider's security health and posture, which key document should you review?

Which of the following has the GREATEST impact on the implementation of an information security governance model?

Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.

Developing effective security controls is a balance between:

IT control objectives are useful to IT auditors as they provide the basis for understanding the:

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

When dealing with a risk management process, asset classification is important because it will impact the overall:

Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?

Which of the following items of a computer system will an anti-virus program scan for viruses?

Which of the following can the company implement in order to avoid this type of security issue in the future?

A stakeholder is a person or group:

What is a key policy that should be part of the information security plan?

Which of the following is the MOST important benefit of an effective security governance process?

When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

Which of the following intellectual Property components is focused on maintaining brand recognition?

The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization's information technology assets to the cloud.
They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.

Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?

A security manager has created a risk program.

Which of the following is a critical part of ensuring the program is successful?

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. Recently, members of your organization have been targeted through a number of sophisticated phishing attempts, resulting in compromised credentials.

What action can you take to prevent external misuse of compromised credentials while still allowing employees to manage their bank information?

Scenario: Your company has many encrypted telecommunications links for their world-wide operations.
Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

Symmetric encryption in general is preferable to asymmetric encryption when: