EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 361:

  A large number of accounts in a hardened system were suddenly compromised to an external party. Which of the following is the MOST probable threat actor involved in this incident?

  A. Poorly configured firewalls
  B. Malware
  C. Advanced Persistent Threat (APT)
  D. An insider
  D. An insider

• Question 362:

  An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified. What should the auditor's NEXT step be?

  A. Immediately notify the board of directors of the organization as to the finding
  B. Correct the classifications immediately based on the auditor's knowledge of the proper classification
  C. Document the missing classifications
  D. Identify the owner of the asset and induce the owner to apply a proper classification
  C. Document the missing classifications

• Question 363:

  You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority.

  Which of the following BEST describes this organization?

  A. Risk conditional
  B. Risk minimal
  C. Risk tolerant
  D. Risk averse
  C. Risk tolerant

• Question 364:

  Annual Loss Expectancy is derived from the function of which two factors?

  A. Annual rate of Occurrence and Single Loss Expectancy
  B. Annual rate of Occurrence and Asset Value
  C. Safeguard value and Annual Rate of Occurrence
  D. Single Loss Expectancy and Exposure factor
  A. Annual rate of Occurrence and Single Loss Expectancy

• Question 365:

  Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

  A. Plan-Check-Do-Act
  B. Plan-Select-Implement-Evaluate
  C. Plan-Do-Check-Act
  D. SCORE (Security Consensus Operational Readiness Evaluation)
  C. Plan-Do-Check-Act

• Question 366:

  An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application.

  What should be the NEXT step?

  A. Create technology recovery plans
  B. Determine the annual loss expectancy (ALE)
  C. Build a secondary hot site
  D. Create a crisis management plan
  A. Create technology recovery plans

• Question 367:

  An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied.

  What is the NEXT logical step in applying the controls in the organization?

  A. Determine the risk tolerance
  B. Perform an asset classification
  C. Analyze existing controls on systems
  D. Create an architecture gap analysis
  B. Perform an asset classification

• Question 368:

  A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes.

  Which of the following represents the MOST LIKELY cause of this situation?

  A. Poor audit support for the security program
  B. Poor alignment of the security program to business needs
  C. This is normal since business units typically resist security requirements
  D. A lack of executive presence within the security program
  B. Poor alignment of the security program to business needs

• Question 369:

  What is a key policy that should be part of the information security plan?

  A. Account management policy
  B. Training policy
  C. Acceptable Use policy
  D. Remote Access policy
  C. Acceptable Use policy

  ---

  Explanation/Reference:

  Reference: https://www.exabeam.com/information-security/information-security-policy/

• Question 370:

  Which of the following is the MOST effective method for discovering common technical vulnerabilities within the IT environment?

  A. Reviewing system administrator logs
  B. Auditing configuration templates
  C. Checking vendor product releases
  D. Performing system scans
  D. Performing system scans