EC-COUNCIL CCISO 712-50 Questions & Answers

• Question 41:

  You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.

  Which of the following is NOT documented in the SSP?

  A. The controls in place to secure the system

  B. Name of the connected system

  C. The results of a third-party audits and recommendations

  D. Type of information used in the system

  Correct Answer: C

  Reference: https://www.govinfo.gov/content/pkg/GOVPUB-C13-63e84ab7af43b36228f10e4f0b5f8c38/pdf/ GOVPUB-C13-63e84ab7af43b36228f10e4f0b5f8c38.pdf (65)

• Question 42:

  To make sure that the actions of all employees, applications, and systems follow the organization's rules and regulations can BEST be described as which of the following?

  A. Compliance management

  B. Asset management

  C. Risk management

  D. Security management

  Correct Answer: D

  Reference: https://www.eccouncil.org/information-security-management/

• Question 43:

  When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?

  A. RAM and unallocated space

  B. Unallocated space and RAM

  C. Slack space and browser cache

  D. Persistent and volatile data

  Correct Answer: D

  Reference: https://study.com/academy/lesson/data-storage-formats-digital-forensics-devices-types.html

• Question 44:

  A key cybersecurity feature of a Personal Identification Verification (PIV) Card is:

  A. Inability to export the private certificate/key

  B. It can double as physical identification at the DMV

  C. It has the user's photograph to help ID them

  D. It can be used as a secure flash drive

  Correct Answer: C

  Reference: https://www.securew2.com/blog/piv-personal-identity-verification

• Question 45:

  A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).

  In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?

  A. Recovery Point Objective (RPO)

  B. Mean Time to Delivery (MTD)

  C. Recovery Time Objective (RTO)

  D. Maximum Tolerable Downtime (MTD)

  Correct Answer: C

  Reference: https://www.druva.com/glossary/what-is-a-recovery-point-objective-definition-and-related-faqs/ #:~:text=The%20recovery%20time%20objective%20(RTO,consequences%20associated%20with%20the %20disruption

• Question 46:

  What is a Statement of Objectives (SOA)?

  A. A section of a contract that defines tasks to be performed under said contract

  B. An outline of what the military will do during war

  C. A document that outlines specific desired outcomes as part of a request for proposal

  D. Business guidance provided by the CEO

  Correct Answer: A

• Question 47:

  During a cyber incident, which non-security personnel might be needed to assist the security team?

  A. Threat analyst, IT auditor, forensic analyst

  B. Network engineer, help desk technician, system administrator

  C. CIO, CFO, CSO

  D. Financial analyst, payroll clerk, HR manager

  Correct Answer: A

• Question 48:

  With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:

  A. Metrics tracking security milestones, understanding criticality of information and information security, visibility into the types of information and how it is used, endorsement by the board of directors

  B. Annual security training for all employees, continual budget reviews, endorsement of the development and implementation of a security program, metrics to track the program

  C. Understanding criticality of information and information security, review investment in information security, endorse development and implementation of a security program, and require regular reports on adequacy and effectiveness

  D. Endorsement by the board of directors for security program, metrics of security program milestones, annual budget review, report on integration and acceptance of program

  Correct Answer: C

  Reference: https://nanopdf.com/download/information-security-governance-guidance-for-boards-of_pdf (9)

• Question 49:

  You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.

  Which control is MOST important to protect AI products?

  A. Hash datasets

  B. Sanitize datasets

  C. Delete datasets

  D. Encrypt datasets

  Correct Answer: D

• Question 50:

  Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?

  A. Purge

  B. Clear

  C. Mangle

  D. Destroy

  Correct Answer: B

  Reference: https://it.brown.edu/computing-policies/electronic-equipment-disposition-policy/data-removalrecommendations