EC-COUNCIL EC-COUNCIL Certifications 712-50 Questions & Answers

• Question 151:

  A missing/ineffective security control is identified.

  Which of the following should be the NEXT step?

  A. Perform an audit to measure the control formally

  B. Escalate the issue to the IT organization

  C. Perform a risk assessment to measure risk

  D. Establish Key Risk Indicators

  Correct Answer: C

• Question 152:

  Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

  A. Better understand the threats and vulnerabilities affecting the environment

  B. Better understand strengths and weakness of the program

  C. Meet regulatory compliance requirements

  D. Meet legal requirements

  Correct Answer: B

• Question 153:

  Control Objectives for Information and Related Technology (COBIT) is which of the following?

  A. An audit guideline for certifying secure systems and controls

  B. An information Security audit standard

  C. A framework for Information Technology management and governance

  D. A set of international regulations for Information Technology governance

  Correct Answer: C

• Question 154:

  Which of the following are not stakeholders of IT security projects?

  A. Board of directors

  B. Help Desk

  C. Third party vendors

  D. CISO

  Correct Answer: C

• Question 155:

  Which of the following illustrates an operational control process:

  A. Classifying an information system as part of a risk assessment

  B. Conducting an audit of the configuration management process

  C. Installing an appropriate fire suppression system in the data center

  D. Establishing procurement standards for cloud vendors

  Correct Answer: C

• Question 156:

  A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability.

  What do you do?

  A. tell him to shut down the server

  B. tell him to call the police

  C. tell him to invoke the incident response process

  D. tell him to analyze the problem, preserve the evidence and provide a full analysis and report.

  Correct Answer: C

• Question 157:

  Which of the following are primary concerns for management with regard to assessing internal control objectives?

  A. Confidentiality, Availability, Integrity

  B. Compliance, Effectiveness, Efficiency

  C. Communication, Reliability, Cost

  D. Confidentiality, Compliance, Cost

  Correct Answer: B

• Question 158:

  The effectiveness of an audit is measured by?

  A. The number of security controls the company has in use

  B. How it exposes the risk tolerance of the company

  C. The number of actionable items in the recommendations

  D. How the recommendations directly support the goals of the company

  Correct Answer: D

• Question 159:

  When is an application security development project complete?

  A. When the application turned over to production.

  B. After one year

  C. When the application reaches the maintenance phase.

  D. When the application is retired.

  Correct Answer: D

• Question 160:

  An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application.

  What should be the NEXT step?

  A. Create technology recovery plans

  B. Determine the annual loss expectancy (ALE)

  C. Build a secondary hot site

  D. Create a crisis management plan

  Correct Answer: A