EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 191:

  What oversight should the information security team have in the change management process for application security?

  A. Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production
  B. Information security should be aware of all application changes and work with developers before changes and deployed in production
  C. Information security should be informed of changes to applications only
  D. Development team should tell the information security team about any application security flaws
  A. Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production

• Question 192:

  You have been hired as the CISO for a hospital. The hospital currently deploys a hybrid cloud model using a Software as a Service (SaaS) product for healthcare clearinghouse services. The Health Insurance Portability and Accountability Act (HIPAA) require an agreement between Cloud Service Providers (CSP) and the covered entity. Based on HIPAA, once the agreement between the covered entity and the CSP signed, the CSP is ____________?

  A. Partially liable for compliance with the applicable requirements of the HIPAA Rules
  B. Directly liable for compliance with the applicable requirements of the HIPAA Rules
  C. Not liable for compliance with the applicable requirements of the HIPAA Rules
  D. Indirectly liable for compliance with the applicable requirements of the HIPAA Rules
  A. Partially liable for compliance with the applicable requirements of the HIPAA Rules

• Question 193:

  Which of the following is the MOST logical method of deploying security controls within an organization?

  A. Obtain funding for all desired controls and then create project plans for implementation
  B. Apply the simpler controls as quickly as possible and use a risk-based approach for the more difficult and costly controls
  C. Apply the least costly controls to demonstrate positive program activity
  D. Obtain business unit buy-in through close communication and coordination
  D. Obtain business unit buy-in through close communication and coordination

  ---

  Explanation/Reference:

• Question 194:

  Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?

  A. Servers, routers, switches, modem
  B. Firewall, anti-virus console, IDS, syslog
  C. Firewall, exchange, web server, intrusion detection system (IDS)
  D. IDS, syslog, router, switches
  B. Firewall, anti-virus console, IDS, syslog

• Question 195:

  Which security technologies are MOST critical to implementing a zero trust model?

  A. MFA, IAM, Endpoint Security
  B. DLP, SIEM, IPS
  C. ACLs, secure gateways, IPS
  D. Firewalls, IPS, WAF
  A. MFA, IAM, Endpoint Security

  ---

  Explanation/Reference:

• Question 196:

  When choosing a risk mitigation method what is the MOST important factor?

  A. Approval from the board of directors
  B. Metrics of mitigation method success
  C. Cost of the mitigation is less than a risk
  D. Mitigation method complies with PCI regulations
  C. Cost of the mitigation is less than a risk

• Question 197:

  One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient.

  Which of the following keys should be used to encrypt the message?

  A. Certificate authority key
  B. The recipient's private key
  C. The recipient's public key
  D. Your public key
  C. The recipient's public key

• Question 198:

  A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?

  A. Enforce the existing security standards and do not allow the deployment of the new technology.
  B. If the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.
  C. Amend the standard to permit the deployment.
  D. Permit a 90-day window to see if an issue occurs and then amend the standard if there are no issues.
  A. Enforce the existing security standards and do not allow the deployment of the new technology.

  ---

  Explanation/Reference:

• Question 199:

  Which of the following functions evaluates patches used to close software vulnerabilities and perform validation of new systems to assure compliance with security?

  A. Incident response
  B. Risk management
  C. System security administration
  D. System testing
  C. System security administration

  ---

  Explanation/Reference:

  This function is directly responsible for maintaining the security of systems. It includes tasks such as applying patches to fix vulnerabilities, configuring systems securely, and validating new systems for compliance with security standards. This is the most relevant function for the activities described in your question.

• Question 200:

  Which of the following tests is performed by an Information Systems (IS) auditor when a sample of programs is selected to determine if the source and object versions are the same?

  A. Substantive test of program library controls
  B. A compliance test of the program compiler controls
  C. A compliance test of program library controls
  D. A substantive test of the program compiler controls
  C. A compliance test of program library controls