EC-COUNCIL 712-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 712-50 Online Questions & Answers

• Question 81:

  What is the primary notification system for physical security?

  A. Cameras
  B. Security Guards
  C. E-mail alerts
  D. Alarms
  D. Alarms

  ---

  Explanation/Reference:

  Reference: https://resources.infosecinstitute.com/certification/certified-ethical-hacker-domain-3-security/

• Question 82:

  Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. Recently, members of your organization have been targeted through a number of sophisticated phishing attempts, resulting in compromised credentials.

  What action can you take to prevent external misuse of compromised credentials while still allowing employees to manage their bank information?

  A. Turn off VPN access for users originating from outside the country
  B. Remove VPN access for all employees except for senior management
  C. Enable monitoring on the VPN for suspicious activity
  D. Block access to the Employee-Self Service application via VPN
  D. Block access to the Employee-Self Service application via VPN

• Question 83:

  When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization.

  Which example below is the MOST creative way to maintain a strong security posture during these difficult times?

  A. Download security tools from a trusted source and deploy to production network
  B. Download open source security tools from a trusted site, test, and then deploy on production network
  C. Download trial versions of commercially available security tools and deploy on your production network
  D. Download open source security tools and deploy them on your production network
  B. Download open source security tools from a trusted site, test, and then deploy on production network

• Question 84:

  Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

  A. Human Resources and Budget
  B. Audit and Legal
  C. Budget and Compliance
  D. Legal and Human Resources
  B. Audit and Legal

• Question 85:

  What is the first thing that needs to be completed in order to create a security program for your organization?

  A. Security program budget
  B. Compliance and regulatory analysis
  C. Risk assessment
  D. Business continuity plan
  C. Risk assessment

• Question 86:

  Which is the BEST solution to monitor, measure, and report changes to critical data in a system?

  A. SNMP traps
  B. Syslog
  C. File integrity monitoring
  D. Application logs
  C. File integrity monitoring

• Question 87:

  What is the definition of Risk in Information Security?

  A. Risk = Probability x Impact
  B. Risk = Impact x Threat
  C. Risk = Threat x Probability
  D. Risk = Financial Impact x Probability
  C. Risk = Threat x Probability

  ---

  Explanation/Reference:

  Answer is C. C. In Information Security, the definition of Risk is: Risk = Threat x Probability.

  Risk refers to the potential for harm or loss resulting from a threat exploiting a vulnerability. A threat is any potential danger that could harm or compromise the confidentiality, integrity, or availability of an organization's information assets.

  Probability refers to the likelihood of a threat exploiting a vulnerability, while vulnerability is a weakness or gap in an organization's security defenses that could be exploited by a threat.

  By multiplying the likelihood of a threat exploiting a vulnerability (i.e., probability) by the potential impact of a successful attack (i.e., threat), organizations can determine the level of risk associated with a particular information asset or system.

  This formula allows organizations to quantify and prioritize risks and determine appropriate risk treatment strategies.

• Question 88:

  A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?

  A. Ensuring developers include risk control comments in code
  B. Creating risk assessment templates based on specific threats
  C. Providing a risk program governance structure
  D. Allowing for the acceptance of risk for regulatory compliance requirements
  C. Providing a risk program governance structure

• Question 89:

  The remediation of a specific audit finding is deemed too expensive and will not be implemented.

  Which of the following is a TRUE statement?

  A. The audit findings is incorrect
  B. The asset is more expensive than the remediation
  C. The asset being protected is less valuable than the remediation costs
  D. The remediation costs are irrelevant; it must be implemented regardless of cost.
  C. The asset being protected is less valuable than the remediation costs

• Question 90:

  The formal certification and accreditation process has four primary steps, what are they?

  A. Evaluating, describing, testing and authorizing
  B. Auditing, documenting, verifying, certifying
  C. Evaluating, purchasing, testing, authorizing
  D. Discovery, testing, authorizing, certifying
  A. Evaluating, describing, testing and authorizing