EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 231:

  When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?

  A. Vendor uses their own laptop and logins using two factor authentication with their own unique credentials
  B. Vendor uses a company supplied laptop and logins using two factor authentication wit same admin credentials your security team uses
  C. Vendor uses a company supplied laptop and logins using two factor authentication with their own unique credentials
  D. Vendors uses their own laptop and logins with same admin credentials your security team uses
  C. Vendor uses a company supplied laptop and logins using two factor authentication with their own unique credentials

• Question 232:

  As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer, you see there is no badge reader.

  What should you do?

  A. Post a guard at the door to maintain physical security
  B. Close and chain the door shut and send a company-wide memo banning the practice
  C. A physical risk assessment on the facility
  D. Nothing, this falls outside your area of influence
  C. A physical risk assessment on the facility

• Question 233:

  When dealing with risk, the information security practitioner may choose to:

  A. acknowledge
  B. transfer
  C. assign
  D. defer
  A. acknowledge

• Question 234:

  Which of the following is a major benefit of applying risk levels?

  A. Resources are not wasted on risks that are already managed to an acceptable level
  B. Risk appetite increase within the organization once the levels are understood
  C. Risk budgets are more easily managed due to fewer due to fewer identified risks as a result of using a methodology
  D. Risk management governance becomes easier since most risks remain low once mitigated
  A. Resources are not wasted on risks that are already managed to an acceptable level

• Question 235:

  Which of the following is the MOST important benefit of an effective security governance process?

  A. Senior management participation in the incident response process
  B. Better vendor management
  C. Reduction of security breaches
  D. Reduction of liability and overall risk to the organization
  D. Reduction of liability and overall risk to the organization

• Question 236:

  Which of the following international standards can be BEST used to define a Risk Management process in an organization?

  A. International Organization for Standardizations ?27005 (ISO-27005)
  B. National Institute for Standards and Technology 800-50 (NIST 800-50)
  C. Payment Card Industry Data Security Standards (PCI-DSS)
  D. International Organization for Standardizations ?27004 (ISO-27004)
  A. International Organization for Standardizations ?27005 (ISO-27005)

• Question 237:

  Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.

  When formulating the remediation plan, what is a required input?

  A. Board of directors
  B. Latest virus definitions file
  C. Patching history
  D. Risk assessment
  D. Risk assessment

• Question 238:

  Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

  A. Better understand the threats and vulnerabilities affecting the environment
  B. Better understand strengths and weakness of the program
  C. Meet regulatory compliance requirements
  D. Meet legal requirements
  B. Better understand strengths and weakness of the program

• Question 239:

  Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.

  After determining the audit findings are accurate, which of the following is the MOST logical next activity?

  A. Validate gaps with the Information Technology team
  B. Begin initial gap remediation analyses
  C. Review the security organization's charter
  D. Create a briefing of the findings for executive management
  B. Begin initial gap remediation analyses

• Question 240:

  A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website.

  This type of control is considered______________________.

  A. Preventive detection control
  B. Corrective security control
  C. Zero-day attack mitigation
  D. Dynamic blocking control
  B. Corrective security control