EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 51:

  The Information Security Governance program MUST:

  A. integrate with other organizational governance processes
  B. show a return on investment for the organization
  C. integrate with other organizational governance processes
  D. support user choice for Bring Your Own Device (BYOD)
  C. integrate with other organizational governance processes

• Question 52:

  The single most important consideration to make when developing your security program, policies, and processes is:

  A. Alignment with the business
  B. Budgeting for unforeseen data compromises
  C. Establishing your authority as the Security Executive
  D. Streaming for efficiency
  A. Alignment with the business

• Question 53:

  Payment Card Industry (PCI) compliance requirements are based on what criteria?

  A. The size of the organization processing credit card data
  B. The types of cardholder data retained
  C. The duration card holder data is retained
  D. The number of transactions performed per year by an organization
  D. The number of transactions performed per year by an organization

• Question 54:

  When briefing senior management on the creation of a governance process, the MOST important aspect should be:

  A. knowledge required to analyze each issue
  B. information security metrics
  C. linkage to business area objectives
  D. baseline against which metrics are evaluated
  C. linkage to business area objectives

• Question 55:

  Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information.

  All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. The organization wants a more permanent solution to the threat to user credential compromise through phishing.

  What technical solution would BEST address this issue?

  A. Multi-factor authentication employing hard tokens
  B. Forcing password changes every 90 days
  C. Decreasing the number of employees with administrator privileges
  D. Professional user education on phishing conducted by a reputable vendor
  A. Multi-factor authentication employing hard tokens

• Question 56:

  Risk appetite is typically determined by which of the following organizational functions?

  A. Business units
  B. Board of Directors
  C. Audit and compliance
  D. Security
  B. Board of Directors

  ---

  Explanation/Reference:

  The risk appetite of an organization refers to the level of risk that an organization is willing to accept to achieve its objectives. This decision is typically made by senior management or the board of directors, as they are responsible for setting the overall strategic direction and risk tolerance of the organization. Business units, audit and compliance, and security may provide input into the risk appetite decision-making process, but they do not typically have the authority to make the final decision.

• Question 57:

  When reviewing a Solution as a Service (SaaS) provider's security health and posture, which key document should you review?

  A. SaaS provider's website certifications and representations (certs and reps)
  B. SOC-2 Report
  C. Metasploit Audit Report
  D. Statement from SaaS provider attesting their ability to secure your data
  B. SOC-2 Report

  ---

  Explanation/Reference:

  Reference: https://www.threatstack.com/blog/how-saas-companies-can-build-a-compliance-roadmap

• Question 58:

  A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy. What is the MOST effective method of risk analysis to provide the CFO with the information required?

  A. Conduct a quantitative risk assessment
  B. Conduct a hybrid risk assessment
  C. Conduct a subjective risk assessment
  D. Conduct a qualitative risk assessment
  A. Conduct a quantitative risk assessment

  ---

  Explanation/Reference:

• Question 59:

  An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security___________.

  A. Technical control
  B. Management control
  C. Procedural control
  D. Administrative control
  D. Administrative control

  ---

  Explanation/Reference:

  Administrative control, Administrative controls refer to the policies, procedures, and practices implemented by an organization to manage and mitigate risks. Background checks are typically considered an administrative control as they involve implementing specific measures and processes to verify the credentials and background of individuals before granting them access to sensitive information or systems.

• Question 60:

  Which of the following is an example of risk transference?

  A. Purchasing Cyber insurance
  B. Outsourcing the function to a 3rd party
  C. Writing specific language in an agreement that puts the burden back on the other party
  D. Implementing changes to current operating procedure
  A. Purchasing Cyber insurance

  ---

  Explanation/Reference: