EC-COUNCIL EC-COUNCIL Certifications 712-50 Questions & Answers

• Question 441:

  A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy. What is the MOST effective method of risk analysis to provide the CFO with the information required?

  A. Conduct a quantitative risk assessment

  B. Conduct a hybrid risk assessment

  C. Conduct a subjective risk assessment

  D. Conduct a qualitative risk assessment

  Correct Answer: A

• Question 442:

  What is a key policy that should be part of the information security plan?

  A. Account management policy

  B. Training policy

  C. Acceptable Use policy

  D. Remote Access policy

  Correct Answer: C

  Reference: https://www.exabeam.com/information-security/information-security-policy/

• Question 443:

  Which of the following is the MOST effective method to counter phishing attacks?

  A. User awareness and training

  B. Host based Intrusion Detection System (IPS)

  C. Acceptable use guide signed by all system users

  D. Antispam solution

  Correct Answer: A

  Reference: https://aware.eccouncil.org/4-best-ways-to-stop-phishing-with-security-awareness.html

• Question 444:

  What is the main result of a company keeping its information security functions siloed in different business units?

  A. Overlapping security initiatives, with wasted resources, or major gaps that can lead to serious security compromises

  B. Board of Directors gains greater insight into the overall functions of the company and the separate security processes

  C. Greater integration between groups that takes greater effort and expense but results in close execution of processes

  D. Security and risk management teams have a responsibility to learn every aspect of the company and find ways to integrate into each silo

  Correct Answer: A

  Reference: https://www.plixer.com/blog/data-silo-what-is-it-why-is-it-bad/

• Question 445:

  What is the primary notification system for physical security?

  A. Cameras

  B. Security Guards

  C. E-mail alerts

  D. Alarms

  Correct Answer: D

  Reference: https://resources.infosecinstitute.com/certification/certified-ethical-hacker-domain-3-security/

• Question 446:

  Which of the following is the mechanism that provides decision-makers the information they need to understand the risk factors that may adversely affect the operations and affect the outputs of the company processes?

  A. Business Impact Analysis

  B. Critical Process Assessment

  C. Vulnerability Assessment

  D. Risk Assessment

  Correct Answer: D

  Reference: https://www.mindtools.com/pages/article/newTMC_07.htm

• Question 447:

  Who is responsible for verifying that audit directives are implemented?

  A. IT Management

  B. Internal Audit

  C. IT Security

  D. BOD Audit Committee

  Correct Answer: D

  Reference: https://www.eccouncil.org/information-security-management/

• Question 448:

  What is the MOST important reason for monitoring Key Risk Indicators (KRIs)?

  A. The organization's risk profile is subject to change

  B. The processes used to develop KRIs can be fraught with errors and must be rechecked periodically

  C. Effective KRIs will reduce the time to implement risk treatment options

  D. A large number of KRIs is a critical part of continuous improvement of management

  Correct Answer: A

  Reference: https://searchcio.techtarget.com/definition/key-risk-indicator-KRI

• Question 449:

  You have been hired as the CISO for a hospital. The hospital currently deploys a hybrid cloud model using a Software as a Service (SaaS) product for healthcare clearinghouse services. The Health Insurance Portability and Accountability Act (HIPAA) require an agreement between Cloud Service Providers (CSP) and the covered entity. Based on HIPAA, once the agreement between the covered entity and the CSP signed, the CSP is ____________?

  A. Partially liable for compliance with the applicable requirements of the HIPAA Rules

  B. Directly liable for compliance with the applicable requirements of the HIPAA Rules

  C. Not liable for compliance with the applicable requirements of the HIPAA Rules

  D. Indirectly liable for compliance with the applicable requirements of the HIPAA Rules

  Correct Answer: A

• Question 450:

  You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO's first mandate to you is to develop a cybersecurity compliance framework that will meet all the store's compliance requirements.

  Which of the following compliance standard is the MOST important to the organization?

  A. The Federal Risk and Authorization Management Program (FedRAMP)

  B. ISO 27002

  C. NIST Cybersecurity Framework

  D. Payment Card Industry (PCI) Data Security Standard (DSS)

  Correct Answer: D

  Reference: https://searchcompliance.techtarget.com/definition/PCI-DSS-Payment-Card-Industry-Data-Security-Standard