EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 381:

  Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?

  A. Purge
  B. Clear
  C. Mangle
  D. Destroy
  B. Clear

  ---

  Explanation/Reference:

  Reference: https://it.brown.edu/computing-policies/electronic-equipment-disposition-policy/data-removal-recommendations

• Question 382:

  Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.

  Your Corporate Information Security Policy should include which of the following?

  A. Roles and responsibilities
  B. Information security theory
  C. Incident response contacts
  D. Desktop configuration standards
  A. Roles and responsibilities

• Question 383:

  The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is considering a bad practice MAINLY because_______________.

  A. The IT team is not familiar in IT audit practices
  B. This represents a bad implementation of the Least Privilege principle
  C. The IT team is not certified to perform audits
  D. This represents a conflict of interest
  D. This represents a conflict of interest

• Question 384:

  Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified. The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning.

  Which of the following is the MOST logical next step?

  A. Create detailed remediation funding and staffing plans
  B. Report the audit findings and remediation status to business stake holders
  C. Validate the effectiveness of current controls
  D. Review security procedures to determine if they need modified according to findings
  C. Validate the effectiveness of current controls

  ---

  Explanation/Reference:

  The most logical next step in this scenario would be option C: Validate the effectiveness of current controls. After identifying the gaps in the security program through the audit, it is essential to verify whether the existing controls are effectively

  addressing the identified risks or if further adjustments are necessary. This validation helps ensure that the controls are providing the intended level of protection and mitigating the identified vulnerabilities.

  In summary, validating the effectiveness of current controls is the most logical next step as it ensures that the existing controls are providing the intended level of protection. This step provides a solid foundation for creating detailed

  remediation plans (option A) and reporting to business stakeholders (option B), while reviewing security procedures (option D) comes later in the process.

• Question 385:

  Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

  How can you reduce the administrative burden of distributing symmetric keys for your employer?

  A. Use certificate authority to distribute private keys
  B. Symmetrically encrypt the key and then use asymmetric encryption to unencrypt it
  C. Use a self-generated key on both ends to eliminate the need for distribution
  D. Use asymmetric encryption for the automated distribution of symmetric key
  D. Use asymmetric encryption for the automated distribution of symmetric key

• Question 386:

  During the last decade, what trend has caused the MOST serious issues in relation to physical security?

  A. Data is more portable due to the increased use of smartphones and tablets
  B. The move from centralized computing to decentralized computing
  C. Camera systems have become more economical and expanded in their use
  D. The internet of Things allows easy compromise of cloud-based systems
  A. Data is more portable due to the increased use of smartphones and tablets

• Question 387:

  Securing facilities with Faraday cages or applying TEMPEST standards prevents the ability to monitor which of the following?

  A. Electro-magnetic emanations
  B. Wired network junction points
  C. Environmental control systems
  D. Badge entry points
  A. Electro-magnetic emanations

  ---

  Explanation/Reference:

• Question 388:

  Who is responsible for verifying that audit directives are implemented?

  A. IT Management
  B. Internal Audit
  C. IT Security
  D. BOD Audit Committee
  D. BOD Audit Committee

  ---

  Explanation/Reference:

  Reference: https://www.eccouncil.org/information-security-management/

• Question 389:

  A Security Operations Manager is finding it difficult to maintain adequate staff levels to monitor security operations during off-hours. To reduce the impact of staff shortages and increase coverage during off-hours, the SecOps manager is considering outsourcing off-hour coverage.

  What Security Operations Center (SOC) model does this BEST describe?

  A. Virtual SOC
  B. In-house SOC
  C. Security Network Operations Center (SNOC)
  D. Hybrid SOC
  D. Hybrid SOC

  ---

  Explanation/Reference:

  Reference: https://www.techtarget.com/searchsecurity/tip/Benefits-of-virtual-SOCs-Enterprise-run-vs-fully-managed

• Question 390:

  Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?

  A. Terms and Conditions
  B. Statements of Work
  C. Service Level Agreements (SLA)
  D. Key Performance Indicators (KPI)
  C. Service Level Agreements (SLA)