EC-COUNCIL 512-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 512-50 Online Questions & Answers

• Question 221:

  An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?

  A. Data breach disclosure
  B. Consumer right disclosure
  C. Security incident disclosure
  D. Special circumstance disclosure
  A. Data breach disclosure

• Question 222:

  A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?

  A. Lack of asset management processes
  B. Lack of change management processes
  C. Lack of hardening standards
  D. Lack of proper access controls
  B. Lack of change management processes

• Question 223:

  A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company's building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area.

  Which type of attack did the consultant perform?

  A. Shoulder surfing
  B. Tailgating
  C. Social engineering
  D. Mantrap
  B. Tailgating

• Question 224:

  When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

  A. How many credit card records are stored?
  B. How many servers do you have?
  C. What is the scope of the certification?
  D. What is the value of the assets at risk?
  C. What is the scope of the certification?

• Question 225:

  What are the three stages of an identity and access management system?

  A. Authentication, Authorize, Validation
  B. Provision, Administration, Enforcement
  C. Administration, Validation, Protect
  D. Provision, Administration, Authentication
  A. Authentication, Authorize, Validation

• Question 226:

  If your organization operates under a model of "assumption of breach", you should:

  A. Protect all information resource assets equally
  B. Establish active firewall monitoring protocols
  C. Purchase insurance for your compliance liability
  D. Focus your security efforts on high value assets
  C. Purchase insurance for your compliance liability

• Question 227:

  Which of the following is a primary method of applying consistent configurations to IT systems?

  A. Audits
  B. Administration
  C. Patching
  D. Templates
  C. Patching

• Question 228:

  Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?

  A. Define the risk appetite
  B. Determine budget constraints
  C. Review project charters
  D. Collaborate security projects
  A. Define the risk appetite

• Question 229:

  Creating a secondary authentication process for network access would be an example of?

  A. Nonlinearities in physical security performance metrics
  B. Defense in depth cost enumerated costs
  C. System hardening and patching requirements
  D. Anti-virus for mobile devices
  A. Nonlinearities in physical security performance metrics

• Question 230:

  Which business stakeholder is accountable for the integrity of a new information system?

  A. CISO
  B. Compliance Officer
  C. Project manager
  D. Board of directors
  A. CISO