EC-COUNCIL 512-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 512-50 Online Questions & Answers

• Question 381:

  Which of the following activities is the MAIN purpose of the risk assessment process?

  A. Creating an inventory of information assets
  B. Classifying and organizing information assets into meaningful groups
  C. Assigning value to each information asset
  D. Calculating the risks to which assets are exposed in their current setting
  D. Calculating the risks to which assets are exposed in their current setting

• Question 382:

  Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:

  A. Detective Controls
  B. Proactive Controls
  C. Preemptive Controls
  D. Organizational Controls
  D. Organizational Controls

• Question 383:

  Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.

  To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

  A. Business Impact Analysis
  B. Business Continuity plan
  C. Security roadmap
  D. Annual report to shareholders
  A. Business Impact Analysis

• Question 384:

  Which of the following provides an audit framework?

  A. Control Objectives for IT (COBIT)
  B. Payment Card Industry-Data Security Standard (PCI-DSS)
  C. International Organization Standard (ISO) 27002
  D. National Institute of Standards and Technology (NIST) SP 800-30
  A. Control Objectives for IT (COBIT)

• Question 385:

  Which of the following is a term related to risk management that represents the estimated frequency at which a threat is expected to transpire?

  A. Single Loss Expectancy (SLE)
  B. Exposure Factor (EF)
  C. Annualized Rate of Occurrence (ARO)
  D. Temporal Probability (TP)
  C. Annualized Rate of Occurrence (ARO)

• Question 386:

  The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is

  A. Penetration testers
  B. External Audit
  C. Internal Audit
  D. Forensic experts
  B. External Audit

• Question 387:

  An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?

  A. Ineffective configuration management controls
  B. Lack of change management controls
  C. Lack of version/source controls
  D. High turnover in the application development department
  C. Lack of version/source controls

• Question 388:

  Which of the following backup sites takes the longest recovery time?

  A. Cold site
  B. Hot site
  C. Warm site
  D. Mobile backup site
  A. Cold site

• Question 389:

  When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

  A. At the time the security services are being performed and the vendor needs access to the network
  B. Once the agreement has been signed and the security vendor states that they will need access to the network
  C. Once the vendor is on premise and before they perform security services
  D. Prior to signing the agreement and before any security services are being performed
  D. Prior to signing the agreement and before any security services are being performed

• Question 390:

  Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

  A. Perform a vulnerability scan of the network
  B. External penetration testing by a qualified third party
  C. Internal Firewall ruleset reviews
  D. Implement network intrusion prevention systems
  B. External penetration testing by a qualified third party