Latest EC-COUNCIL 712-50 Exam questions and answers [Q198-Q220]

4.4/5 - (5 votes)

Latest EC-COUNCIL 712-50 Exam questions and answers

SurePassExams 712-50 Exam Practice Test Questions (Updated 447 Questions)

What Are Program Details?

With 712-50 exam, the EC-Council CCISO (Certified Chief Information Security Officer) certification is associated. This one is the gold-standard of IT executive management certifications and is famed to infuse core knowledge related to IS control, human capital management, program development, financial expertise, and the like. Because of this high-end learning, the CCISO designation is the key to get placed in pivotal information security management job roles. Using the professionally designed exam domains, such a certification fills the gap that exists between real-time work expertise that a CISO aspirant needs at the job and what an emerging CISO already has.

NO.198 Which of the following is MOST important when dealing with an Information Security Steering committee:

Include a mix of members from different departments and staff levels.

Ensure that security policies and procedures have been vetted and approved.

Review all past audit and compliance reports.

Be briefed about new trends and products at each meeting by a vendor.

NO.199 In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

The organization uses exclusively a qualitative process to measure risk

The organization’s risk tolerance is low

The organization uses exclusively a quantitative process to measure risk

The organization’s risk tolerance is high

Explanation/Reference:

NO.200 An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?

Shared key

Asynchronous

Open

None

NO.201 Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

Substantive test of program library controls

A compliance test of the program compiler controls

A compliance test of program library controls

A substantive test of the program compiler controls

NO.202 An audit was conducted and many critical applications were found to have no disaster recovery plans in place.
You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application.
What should be the NEXT step?

Create technology recovery plans

Determine the annual loss expectancy (ALE)

Build a secondary hot site

Create a crisis management plan

NO.203 A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?

Alignment with the business

Effective use of existing technologies

Leveraging existing implementations

Proper budget management

NO.204 Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Recently, members of your organization have been targeted through a number of sophisticated phishing attempts and have compromised their system credentials.
What action can you take to prevent the misuse of compromised credentials to change bank account information from outside your organization while still allowing employees to manage their bank information?

Turn off VPN access for users originating from outside the country

Force a change of all passwords

Enable monitoring on the VPN for suspicious activity

Block access to the Employee-Self Service application via VPN

NO.205 The Information Security Management program MUST protect:

Against distributed denial of service attacks

Intellectual property released into the public domain

all organizational assets

critical business processes and/or revenue streams

NO.206 An organization recently acquired a Data Loss Prevention (DLP) solution, and two months after the implementation, it was found that sensitive data was posted to numerous Dark Web sites. The DLP application was checked, and there are no apparent malfunctions and no errors.
What is the MOST likely reason why the sensitive data was posted?

The DLP Solution was not integrated with mobile device anti-malware

Data classification was not properly performed on the assets

The sensitive data was not encrypted while at rest

A risk assessment was not performed after purchasing the DLP solution

NO.207 The Information Security Management program MUST protect:

all organizational assets

critical business processes and /or revenue streams

intellectual property released into the public domain

against distributed denial of service attacks

NO.208 Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

They are subjective and can be completed more quickly

They are objective and express risk / cost in approximates

They are subjective and can express risk / cost in real numbers

They are objective and can express risk / cost in real numbers

NO.209 Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?

Conduct background checks on individuals before hiring them

Develop an Information Security Awareness program

Monitor employee browsing and surfing habits

Set your firewall permissions aggressively and monitor logs regularly.

NO.210 In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

The organization uses exclusively a quantitative process to measure risk

The organization uses exclusively a qualitative process to measure risk

The organization’s risk tolerance is high

The organization’s risk tolerance is lo

NO.211 An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents.
Which of the following would be considered a MAJOR constraint for the project?

Compliance to local hiring laws

Encryption import/export regulations

Local customer privacy laws

Time zone differences

NO.212 Which of the following is considered one of the most frequent failures in project management?

Overly restrictive management

Excessive personnel on project

Failure to meet project deadlines

Insufficient resources

NO.213 Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?

Cost benefit

Risk appetite

Business continuity

Likelihood of impact

NO.214 A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims.
Which of the following vendor provided documents is BEST to make your decision:

Vendor’s client list of reputable organizations currently using their solution

Vendor provided attestation of the detailed security controls from a reputable accounting firm

Vendor provided reference from an existing reputable client detailing their implementation

Vendor provided internal risk assessment and security control documentation

NO.215 Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

Need to comply with breach disclosure laws

Need to transfer the risk associated with hosting PII data

Need to better understand the risk associated with using PII data

Fiduciary responsibility to safeguard credit card information

NO.216 Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus.
Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

Eradication

Containment

Recovery

Identification

Explanation/Reference:

NO.217 Why is it vitally important that senior management endorse a security policy?

So that they will accept ownership for security within the organization.

So that employees will follow the policy directives.

So that external bodies will recognize the organizations commitment to security.

So that they can be held legally accountable.

NO.218 When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

At the time the security services are being performed and the vendor needs access to the network

Once the agreement has been signed and the security vendor states that they will need access to the network

Once the vendor is on premise and before they perform security services

Prior to signing the agreement and before any security services are being performed

NO.219 When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?

Vendor uses their own laptop and logins using two factor authentication with their own unique credentials

Vendor uses a company supplied laptop and logins using two factor authentication wit same admin credentials your security team uses

Vendor uses a company supplied laptop and logins using two factor authentication with their own unique credentials

Vendors uses their own laptop and logins with same admin credentials your security team uses

NO.220 You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.
Which of the following is NOT documented in the SSP?

The controls in place to secure the system

Name of the connected system

The results of a third-party audits and recommendations

Type of information used in the system

Loading …

EC-Council Certified CISO 712-50 Exam

EC-Council Certified CISO 712-50 Exam which is related to EC-Council Certified CISO certification. This 712-50 exam validates the ability to a candidate to implement, manage and maintain an information security governance program, Coordinate the application of information security strategies, plans, policies, and procedures to reduce regulatory risk, control Information Security Management, Identify, negotiate and manage vendor agreement and community, Identify the basic network architecture, models, protocols and components such as routers and hubs that play a role in network security.

Pass Your EC-COUNCIL Exam with 712-50 Exam Dumps: https://www.surepassexams.com/712-50-exam-bootcamp.html

What Are Program Details?

EC-Council Certified CISO 712-50 Exam

Leave a Reply Cancel reply