EC-COUNCIL EC-COUNCIL Certifications 512-50 Questions & Answers

• Question 331:

  Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

  A. Awareness

  B. Compliance

  C. Governance

  D. Management

  Correct Answer: C

• Question 332:

  The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

  A. Confidentiality, Integrity and Availability

  B. Assurance, Compliance and Availability

  C. International Compliance

  D. Integrity and Availability

  Correct Answer: A

• Question 333:

  Ensuring that the actions of a set of people, applications and systems follow the organization's rules is BEST described as:

  A. Risk management

  B. Security management

  C. Mitigation management

  D. Compliance management

  Correct Answer: D

• Question 334:

  When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

  A. How many credit card records are stored?

  B. How many servers do you have?

  C. What is the scope of the certification?

  D. What is the value of the assets at risk?

  Correct Answer: C

• Question 335:

  Which of the following is the MOST important benefit of an effective security governance process?

  A. Reduction of liability and overall risk to the organization

  B. Better vendor management

  C. Reduction of security breaches

  D. Senior management participation in the incident response process

  Correct Answer: A

• Question 336:

  According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

  A. Susceptibility to attack, mitigation response time, and cost

  B. Attack vectors, controls cost, and investigation staffing needs

  C. Vulnerability exploitation, attack recovery, and mean time to repair

  D. Susceptibility to attack, expected duration of attack, and mitigation availability

  Correct Answer: A

• Question 337:

  Who in the organization determines access to information?

  A. Legal department

  B. Compliance officer

  C. Data Owner

  D. Information security officer

  Correct Answer: C

• Question 338:

  A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

  A. International Organization for Standardizations ?22301 (ISO-22301)

  B. Information Technology Infrastructure Library (ITIL)

  C. Payment Card Industry Data Security Standards (PCI-DSS)

  D. International Organization for Standardizations ?27005 (ISO-27005)

  Correct Answer: A

• Question 339:

  Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

  A. Audit and Legal

  B. Budget and Compliance

  C. Human Resources and Budget

  D. Legal and Human Resources

  Correct Answer: A

• Question 340:

  You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?

  A. Chief Information Security Officer

  B. Chief Executive Officer

  C. Chief Information Officer

  D. Chief Legal Counsel

  Correct Answer: B