EC-COUNCIL EC-COUNCIL Certifications 712-50 Questions & Answers

• Question 161:

  Which of the following activities must be completed BEFORE you can calculate risk?

  A. Assigning a value to each information asset

  B. Assessing the relative risk facing the organization's information assets

  C. Determining the likelihood that vulnerable systems will be attacked by specific threats

  D. Calculating the risks to which assets are exposed in their current setting

  Correct Answer: A

• Question 162:

  A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state.

  Which of the following security issues is the MOST likely reason leading to the audit findings?

  A. Lack of asset management processes

  B. Lack of hardening standards

  C. Lack of proper access controls

  D. Lack of change management processes

  Correct Answer: D

• Question 163:

  Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?

  A. Damage control plan

  B. Disaster recovery plan

  C. Business Continuity plan

  D. Incident response plan

  Correct Answer: C

• Question 164:

  An employee successfully avoids becoming a victim of a sophisticated spear phishing attack due to knowledge gained through the corporate information security awareness program.

  What type of control has been effectively utilized?

  A. Technical Control

  B. Management Control

  C. Operational Control

  D. Training Control

  Correct Answer: D

• Question 165:

  The ultimate goal of an IT security projects is:

  A. Support business requirements

  B. Implement information security policies

  C. Increase stock value

  D. Complete security

  Correct Answer: A

• Question 166:

  An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization's IT environment.

  Which of the following can be used to measure the effectiveness of this newly implemented process?

  A. Number and length of planned outages

  B. Number of change orders processed

  C. Number of change orders rejected

  D. Number of unplanned outages

  Correct Answer: D

• Question 167:

  You have implemented the new controls. What is the next step?

  A. Perform a risk assessment

  B. Monitor the effectiveness of the controls

  C. Document the process for the stakeholders

  D. Update the audit findings report

  Correct Answer: B

• Question 168:

  When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?

  A. Monthly

  B. Hourly

  C. Weekly

  D. Daily

  Correct Answer: D

• Question 169:

  The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to_________________________.

  A. assign the responsibility to the information security team

  B. assign the responsibility to the team responsible for the management of the controls

  C. perform an independent audit of the security controls

  D. create operational reports on the effectiveness of the controls.

  Correct Answer: C

• Question 170:

  Which represents PROPER separation of duties in the corporate environment?

  A. Information Security and Network teams perform two distinct functions

  B. Information Security and Identity Access Management teams perform two distinct functions

  C. Finance has access to Human Resources data

  D. Developers and Network teams both have admin rights on servers

  Correct Answer: B

  The correct answer is B. Information Security and Identity Access Management teams perform two distinct functions.

  Proper separation of duties is an important principle in the corporate environment to ensure accountability, prevent conflicts of interest, and reduce the risk of fraud or unauthorized activities. The separation of duties involves dividing responsibilities among different individuals or teams to create checks and balances. By separating the responsibilities of Information Security and Identity Access Management teams, it ensures that there is a clear distinction between the functions related to securing information and managing user access Option A is not a complete separation as both Information Security and Network teams may have overlapping responsibilities and access to sensitive information.