EC-COUNCIL EISM 512-50 Questions & Answers

• Question 401:

  What is the first thing that needs to be completed in order to create a security program for your organization?

  A. Risk assessment

  B. Security program budget

  C. Business continuity plan

  D. Compliance and regulatory analysis

  Correct Answer: A

• Question 402:

  A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?

  A. Providing a risk program governance structure

  B. Ensuring developers include risk control comments in code

  C. Creating risk assessment templates based on specific threats

  D. Allowing for the acceptance of risk for regulatory compliance requirements

  Correct Answer: A

• Question 403:

  When choosing a risk mitigation method what is the MOST important factor?

  A. Approval from the board of directors

  B. Cost of the mitigation is less than the risk

  C. Metrics of mitigation method success

  D. Mitigation method complies with PCI regulations

  Correct Answer: B

• Question 404:

  What role should the CISO play in properly scoping a PCI environment?

  A. Validate the business units' suggestions as to what should be included in the scoping process

  B. Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment

  C. Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data

  D. Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope

  Correct Answer: C