EC-COUNCIL EC-COUNCIL Certifications 512-50 Questions & Answers

• Question 51:

  Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.

  Once supervisors and data owners have approved requests, information system administrators will implement

  A. Technical control(s)

  B. Management control(s)

  C. Policy control(s)

  D. Operational control(s)

  Correct Answer: A

• Question 52:

  Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust

  existing security controls to ensure they are adequate for risk mitigation needs.

  When formulating the remediation plan, what is a required input?

  A. Board of directors

  B. Risk assessment

  C. Patching history

  D. Latest virus definitions file

  Correct Answer: B

• Question 53:

  Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

  Symmetric encryption in general is preferable to asymmetric encryption when:

  A. The number of unique communication links is large

  B. The volume of data being transmitted is small

  C. The speed of the encryption / deciphering process is essential

  D. The distance to the end node is farthest away

  Correct Answer: C

• Question 54:

  Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.

  To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

  A. Business Impact Analysis

  B. Business Continuity plan

  C. Security roadmap

  D. Annual report to shareholders

  Correct Answer: A

• Question 55:

  What are the three stages of an identity and access management system?

  A. Authentication, Authorize, Validation

  B. Provision, Administration, Enforcement

  C. Administration, Validation, Protect

  D. Provision, Administration, Authentication

  Correct Answer: A

  Reference: https://digitalguardian.com/blog/what-identity-and-access-management-iam

• Question 56:

  Human resource planning for security professionals in your organization is a:

  A. Simple and easy task because the threats are getting easier to find and correct.

  B. Training requirement that is met through once every year user training.

  C. Training requirement that is on-going and always changing.

  D. Not needed because automation and anti-virus software has eliminated the threats.

  Correct Answer: C

• Question 57:

  Michael starts a new job and discovers that he has unnecessary access to a variety of systems.

  Which of the following best describes the problem he has encountered?

  A. Rights collision

  B. Excessive privileges

  C. Privilege creep

  D. Least privileges

  Correct Answer: B

• Question 58:

  Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers."

  Which group of people should be consulted when developing your security program?

  A. Peers

  B. End Users

  C. Executive Management

  D. All of the above

  Correct Answer: D

• Question 59:

  Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

  How can you reduce the administrative burden of distributing symmetric keys for your employer?

  A. Use asymmetric encryption for the automated distribution of the symmetric key

  B. Use a self-generated key on both ends to eliminate the need for distribution

  C. Use certificate authority to distribute private keys

  D. Symmetrically encrypt the key and then use asymmetric encryption to unencrypt it

  Correct Answer: A

• Question 60:

  The ability to demand the implementation and management of security controls on third parties providing services to an organization is

  A. Security Governance

  B. Compliance management

  C. Vendor management

  D. Disaster recovery

  Correct Answer: C