EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 411:

  The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?

  A. Risk metrics
  B. Operational metrics
  C. Compliance metrics
  D. Management metrics
  B. Operational metrics

• Question 412:

  As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand. Which is the BEST type of risk that defines this event?

  A. Compliance Risk
  B. Reputation Risk
  C. Operational Risk
  D. Strategic Risk
  B. Reputation Risk

• Question 413:

  As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams.

  What else should be in the reporting process?

  A. Names and phone numbers of those who conducted the audit
  B. Executive summary
  C. Penetration test agreement
  D. Business charter
  B. Executive summary

• Question 414:

  A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach.

  Which of the following is a foundational requirement in order to initiate this type of program?

  A. A complete inventory of Information technology assets including infrastructure, networks, applications and data
  B. A security organization that is adequately staffed to apply required mitigation strategies and regulatory compliance solutions
  C. A clear set of security policies and procedures that are more concept-based than controls-based than controls-based
  D. A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in
  D. A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in

• Question 415:

  Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that

  your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements.

  During your investigation of the rumored compromise, you discover that data has been breached and that the repository of stolen data is on a server located in a foreign country. Your team now has full access to the data on the foreign server.

  What action should you take FIRST?

  A. Consult with other executives to develop an action plan
  B. Contract with a credit reporting company for paid monitoring services for affected customers
  C. Contact your local law enforcement agency
  D. Destroy the repository of stolen data
  C. Contact your local law enforcement agency

  ---

  Explanation/Reference:

• Question 416:

  An example of professional unethical behavior is:

  A. Sharing copyrighted material with other members of a professional organization where all members have legitimate access to the material
  B. Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes
  C. Storing client lists and other sensitive corporate internal documents on a removable thumb drive
  D. Gaining access to an affiliated employee's work email account as part of an officially sanctioned internal investigation
  B. Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes

• Question 417:

  A bastion host should be placed:

  A. Inside the DMZ
  B. In-line with the data center firewall
  C. Beyond the outer perimeter firewall
  D. As the gatekeeper to the organization's honeynet
  A. Inside the DMZ

  ---

  Explanation/Reference:

• Question 418:

  Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?

  A. Information Security (IS) procedures often require augmentation with other standards
  B. Implementation of it eases an organization's auditing and compliance burden
  C. It provides for a consistent and repeatable staffing model for technology organizations
  D. It allows executives to more effectively monitor IT implementation costs
  B. Implementation of it eases an organization's auditing and compliance burden

• Question 419:

  A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure.

  What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

  A. Decrease the vulnerabilities within the scan tool settings
  B. Scan a representative sample of systems
  C. Filter the scan output so only pertinent data is analyzed
  D. Perform the scans only during off-business hours
  B. Scan a representative sample of systems

• Question 420:

  A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims.

  Which of the following vendor provided documents is BEST to make your decision?

  A. Vendor provided reference from an existing reputable client detailing their implementation
  B. Vendor's client list of reputable organizations currently using their solution
  C. Vendor provided internal risk assessment and security control documentation
  D. Vendor provided attestation of the detailed security controls from a reputable accounting firm
  D. Vendor provided attestation of the detailed security controls from a reputable accounting firm