[Jun-2022] 712-50 Dumps With 100% Verified Q&As – Pass Guarantee or Full Refund [Q138-Q162]

Rate this post

[Jun-2022] 712-50 Dumps With 100% Verified Q&As – Pass Guarantee or Full Refund

Pass EC-COUNCIL 712-50 Exam With Practice Test Questions Dumps Bundle

NO.138 A Chief Information Security Officer received a list of high, medium, and low impact audit findings.
Which of the following represents the BEST course of action?

If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.

If the findings do not impact regulatory compliance, review current security controls.

If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.

if the findings impact regulatory compliance, remediate the high findings as quickly as possible.

NO.139 The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called

Security certification

Security system analysis

Security accreditation

Alignment with business practices and goals.

NO.140 Risk that remains after risk mitigation is known as

Persistent risk

Residual risk

Accepted risk

Non-tolerated risk

NO.141 Creating a secondary authentication process for network access would be an example of?

An administrator with too much time on their hands.

Putting undue time commitment on the system administrator.

Supporting the concept of layered security

Network segmentation.

NO.142 As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?

Executive summary

Penetration test agreement

Names and phone numbers of those who conducted the audit

Business charter

NO.143 SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next step?

Validate the effectiveness of applied controls

Validate security program resource requirements

Report the audit findings and remediation status to business stake holders

Review security procedures to determine if they need modified according to findings

NO.144 You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll.
Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff?

Employ an assumption of breach protocol and defend only essential information resources.

Deploy a SEIM solution and have current staff review incidents first in the morning

Configure your syslog to send SMS messages to current staff when target events are triggered.

Contract with a managed security provider and have current staff on recall for incident response

NO.145 Which of the following functions evaluates patches used to close software vulnerabilities and perform validation of new systems to assure compliance with security?

Incident response

Risk management

System security administration

System testing

NO.146 Scenario: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs. The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system’s scalability.
This demonstrates which of the following?

A methodology-based approach to ensure authentication mechanism functions

An approach providing minimum time impact to the implementation schedules

An approach that allows for minimum budget impact if the solution is unsuitable

A risk-based approach to determine if the solution is suitable for investment

NO.147 When dealing with a risk management process, asset classification is important because it will impact the overall:

Threat identification

Risk monitoring

Risk treatment

Risk tolerance

NO.148 In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

The organization uses exclusively a qualitative process to measure risk

The organization’s risk tolerance is low

The organization uses exclusively a quantitative process to measure risk

The organization’s risk tolerance is high

NO.149 Which of the following is the MOST important reason for performing assessments of the security portfolio?

To assure that the portfolio is aligned to the needs of the broader organization

To create executive support of the portfolio

To discover new technologies and processes for implementation within the portfolio

To provide independent 3rd party reviews of security effectiveness

NO.150 The process of creating a system which divides documents based on their security level to manage access to private data is known as

security coding

data security system

data classification

privacy protection

NO.151 A newly-hired CISO needs to understand the organization’s financial management standards for business units and operations. Which of the following would be the best source of this information?

The internal accounting department

The Chief Financial Officer (CFO)

The external financial audit service

The managers of the accounts payables and accounts receivables teams

NO.152 A stakeholder is a person or group:

Vested in the success and/or failure of a project or initiative regardless of budget implications.

Vested in the success and/or failure of a project or initiative and is tied to the project budget.

That has budget authority.

That will ultimately use the system.

NO.153 You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?

Scope of the project

Training of the personnel on the project

Timeline of the project milestones

Vendor for the project

NO.154 A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen, and the database server was disconnected.
Who must be informed of this incident?

Internal audit

The data owner

All executive staff

Government regulators

NO.155 Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Governance

Compliance

Awareness

Management

NO.156 From an information security perspective, information that no longer supports the main purpose of the business should be:

protected under the information classification policy

analyzed under the data ownership policy

assessed by a business impact analysis.

analyzed under the retention policy.

NO.157 The alerting, monitoring and life-cycle management of security related events is typically handled by the_________________.

risk management process

risk assessment process

governance, risk, and compliance tools

security threat and vulnerability management process

NO.158 John is the project manager for a large project in his organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed. The vendor is refusing to make the changes as they’ve already completed the project work they were contracted to do.
What can John do in this instance?

Withhold the vendor’s payments until the issue is resolved.

refer to the contract agreement for direction.

Refer the vendor to the Service Level Agreement (SLA) and insist that they make the changes.

Review the Request for proposal (RFP) for guidance.

NO.159 What is the primary reason for performing vendor management?

To understand the risk coverage that are being mitigated by the vendor

To establish a vendor selection process

To document the relationship between the company and the vendor

To define the partnership for long-term success

NO.160 When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

At the time the security services are being performed and the vendor needs access to the network

Once the agreement has been signed and the security vendor states that they will need access to the network

Once the vendor is on premise and before they perform security services

Prior to signing the agreement and before any security services are being performed

NO.161 Your penetration testing team installs an in-line hardware key logger onto one of your network machines.
Which of the following is of major concern to the security organization?

In-line hardware keyloggers are undetectable by software

In-line hardware keyloggers are relatively inexpensive

In-line hardware keyloggers don’t require physical access

In-line hardware keyloggers don’t comply to industry regulations

NO.162 A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

Audit validation

Physical control testing

Compliance management

Security awareness training