EC-COUNCIL 512-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 512-50 Online Questions & Answers

• Question 141:

  A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered

  A. Zero-day attack mitigation
  B. Preventive detection control
  C. Corrective security control
  D. Dynamic blocking control
  C. Corrective security control

• Question 142:

  What is the difference between encryption and tokenization?

  A. Tokenization combined with hashing is always better than encryption
  B. Encryption can be mathematically reversed to provide the original information
  C. The token contains the all original information
  D. Tokenization can be mathematically reversed to provide the original information
  B. Encryption can be mathematically reversed to provide the original information

• Question 143:

  How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?

  A. Quarterly
  B. Semi-annually
  C. Bi-annually
  D. Annually
  D. Annually

• Question 144:

  SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.

  After determining the audit findings are accurate, which of the following is the MOST logical next activity?

  A. Begin initial gap remediation analyses
  B. Review the security organization's charter
  C. Validate gaps with the Information Technology team
  D. Create a briefing of the findings for executive management
  A. Begin initial gap remediation analyses

• Question 145:

  Which of the following international standards can be BEST used to define a Risk Management process in an organization?

  A. National Institute for Standards and Technology 800-50 (NIST 800-50)
  B. International Organization for Standardizations ?27005 (ISO-27005)
  C. Payment Card Industry Data Security Standards (PCI-DSS)
  D. International Organization for Standardizations ?27004 (ISO-27004)
  B. International Organization for Standardizations ?27005 (ISO-27005)

• Question 146:

  With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:

  A. Metrics tracking security milestones, understanding criticality of information and information security, visibility into the types of information and how it is used, endorsement by the board of directors
  B. Annual security training for all employees, continual budget reviews, endorsement of the development and implementation of a security program, metrics to track the program
  C. Understanding criticality of information and information security, review investment in information security, endorse development and implementation of a security program, and require regular reports on adequacy and effectiveness
  D. Endorsement by the board of directors for security program, metrics of security program milestones, annual budget review, report on integration and acceptance of program
  C. Understanding criticality of information and information security, review investment in information security, endorse development and implementation of a security program, and require regular reports on adequacy and effectiveness

• Question 147:

  Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers."

  What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?

  A. Cite compliance with laws, statutes, and regulations ?explaining the financial implications for the company for non-compliance
  B. Understand the business and focus your efforts on enabling operations securely
  C. Draw from your experience and recount stories of how other companies have been compromised
  D. Cite corporate policy and insist on compliance with audit findings
  B. Understand the business and focus your efforts on enabling operations securely

• Question 148:

  Which of the following is the MOST important for a CISO to understand when identifying threats?

  A. How vulnerabilities can potentially be exploited in systems that impact the organization
  B. How the security operations team will behave to reported incidents
  C. How the firewall and other security devices are configured to prevent attacks
  D. How the incident management team prepares to handle an attack
  A. How vulnerabilities can potentially be exploited in systems that impact the organization

• Question 149:

  Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

  A. Audit and Legal
  B. Budget and Compliance
  C. Human Resources and Budget
  D. Legal and Human Resources
  A. Audit and Legal

• Question 150:

  Creating a secondary authentication process for network access would be an example of?

  A. An administrator with too much time on their hands.
  B. Putting undue time commitment on the system administrator.
  C. Supporting the concept of layered security
  D. Network segmentation.
  C. Supporting the concept of layered security