EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 331:

  Which of the following is MOST likely to be discretionary?

  A. Policies
  B. Procedures
  C. Guidelines
  D. Standards
  B. Procedures

  ---

  Explanation/Reference:

• Question 332:

  The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.

  Which of the following needs to be performed NEXT?

  A. Verify technical resources
  B. Verify capacity constraints
  C. Verify the scope of the project
  D. Verify the regulatory requirements
  A. Verify technical resources

• Question 333:

  A Chief Information Security Officer received a list of high, medium, and low impact audit findings.

  Which of the following represents the BEST course of action?

  A. If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.
  B. If the findings do not impact regulatory compliance, review current security controls.
  C. If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.
  D. if the findings impact regulatory compliance, remediate the high findings as quickly as possible.
  D. if the findings impact regulatory compliance, remediate the high findings as quickly as possible.

• Question 334:

  With respect to the audit management process, management response serves what function?

  A. revealing the "root cause" of the process failure and mitigating for all internal and external units
  B. adding controls to ensure that proper oversight is achieved by management
  C. determining whether or not resources will be allocated to remediate a finding
  D. placing underperforming units on notice for failing to meet standards
  C. determining whether or not resources will be allocated to remediate a finding

• Question 335:

  You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process.

  Which of the following represents your BEST course of action?

  A. Determine program ownership to implement compensating controls
  B. Send a report to executive peers and business unit owners detailing your suspicions
  C. Validate that security awareness program content includes information about the potential vulnerability
  D. Conduct a throughout risk assessment against the current implementation to determine system functions
  D. Conduct a throughout risk assessment against the current implementation to determine system functions

• Question 336:

  The ability to demand the implementation and management of security controls on third parties providing services to an organization is_________________________.

  A. Disaster recovery
  B. Security Governance
  C. Vendor management
  D. Compliance management
  C. Vendor management

• Question 337:

  After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of____________.

  A. Qualitative risk analysis
  B. Risk Appetite
  C. Quantitative risk analysis
  D. Risk Tolerance
  C. Quantitative risk analysis

• Question 338:

  Devising controls for information security is a balance between?

  A. Governance and compliance
  B. Auditing and security
  C. Budget and risk tolerance
  D. Threats and vulnerabilities
  C. Budget and risk tolerance

  ---

  Explanation/Reference:

  Reference: https://www.cybok.org/media/downloads/cybok_version_1.0.pdf

• Question 339:

  A missing/ineffective security control is identified.

  Which of the following should be the NEXT step?

  A. Perform an audit to measure the control formally
  B. Escalate the issue to the IT organization
  C. Perform a risk assessment to measure risk
  D. Establish Key Risk Indicators
  C. Perform a risk assessment to measure risk

• Question 340:

  A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company's building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform?

  A. Shoulder surfing
  B. Tailgating
  C. Social engineering
  D. Mantrap
  B. Tailgating