When choosing a risk mitigation method what is the MOST important factor?

Cost of the mitigation is less than the risk

Approval from the board of directors

Cost of the mitigation is less than the risk

Metrics of mitigation method success

Mitigation method complies with PCI regulations

Payment Card Industry (PCI) compliance requirements are based on what criteria?

The number of transactions performed per year by an organization

The types of cardholder data retained

The duration card holder data is retained

The size of the organization processing credit card data

The number of transactions performed per year by an organization

Which of the following provides an audit framework?

Control Objectives for IT (COBIT)

Payment Card Industry-Data Security Standard (PCI-DSS)

International Organization Standard (ISO) 27002

National Institute of Standards and Technology (NIST) SP 800-30

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Fines for regulatory non-compliance

Improper use of information resources

Fines for regulatory non-compliance

The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

Confidentiality, Integrity and Availability

Assurance, Compliance and Availability

When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

In-line and turn on blocking mode to stop malicious traffic.

In promiscuous mode and only detect malicious traffic.

In-line and turn on blocking mode to stop malicious traffic.

In promiscuous mode and block malicious traffic.

In-line and turn on alert mode to stop malicious traffic.

What is the BEST way to achieve on-going compliance monitoring in an organization?

Have Compliance and Information Security partner to correct issues as they arise.

Only check compliance right before the auditors are scheduled to arrive onsite.

Outsource compliance to a 3rd party vendor and let them manage the program.

Have Compliance and Information Security partner to correct issues as they arise.

Have Compliance direct Information Security to fix issues after the auditors report.

Which of the following is the MOST important for a CISO to understand when identifying threats?

How vulnerabilities can potentially be exploited in systems that impact the organization

How the security operations team will behave to reported incidents

How the firewall and other security devices are configured to prevent attacks

How the incident management team prepares to handle an attack

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

Conduct security testing, vulnerability scanning, and penetration testing

Subscribe to vendor mailing list to get notification of system vulnerabilities

Deploy Intrusion Detection System (IDS) and install anti-virus on systems

Configure firewall, perimeter router and Intrusion Prevention System (IPS)

Conduct security testing, vulnerability scanning, and penetration testing

What role should the CISO play in properly scoping a PCI environment?

Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data

Validate the business units' suggestions as to what should be included in the scoping process

Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment

Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data

Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope

What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

Conduct periodic tabletop exercises to refine the BC plan

Test every three years to ensure that things work as planned

Conduct periodic tabletop exercises to refine the BC plan

Outsource the creation and execution of the BC plan to a third party vendor

Conduct a Disaster Recovery (DR) exercise every year to test the plan

What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

Evaluate risk avoidance criteria

According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

Susceptibility to attack, mitigation response time, and cost

Attack vectors, controls cost, and investigation staffing needs

Vulnerability exploitation, attack recovery, and mean time to repair

Susceptibility to attack, expected duration of attack, and mitigation availability

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

Single loss expectancy multiplied by the annual rate of occurrence

Total loss expectancy multiplied by the total loss frequency

Value of the asset multiplied by the loss expectancy

Replacement cost multiplied by the single loss expectancy

Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?

Lack of notification to the public of disclosure of confidential information.

Lack of periodic examination of access rights

Failure to notify police of an attempted intrusion

Lack of reporting of a successful denial of service attack on the network.

Which of the following is a benefit of a risk-based approach to audit planning?

Resources are allocated to the areas of the highest concern

Scheduling may be performed months in advance

Budgets are more likely to be met by the IT audit staff

Staff will be exposed to a variety of technologies

Dataflow diagrams are used by IT auditors to:

Graphically summarize data paths and storage processes.

Highlight high-level data definitions.

Graphically summarize data paths and storage processes.

Portray step-by-step details of data generation.

During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:

Identify and evaluate the existing controls.

Disclose the threats and impacts to management.

Identify information assets and the underlying systems.

Identify and assess the risk assessment process used by management.

IT control objectives are useful to IT auditors as they provide the basis for understanding the:

Desired results or purpose of implementing specific control procedures.

Techniques for securing information.

An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:

Inform senior management of the risk involved.

Agree to work with the security officer on these shifts as a form of preventative control.

Develop a computer assisted audit technique to detect instances of abuses of the arrangement.

Review the system log for each of the late night shifts to determine whether any irregular actions occurred.

Which of the following is the MOST important goal of risk management?

Finding economic balance between the impact of the risk and the cost of the control

Identifying the victim of any potential exploits.

Assessing the impact of potential threats

Which of the following is a term related to risk management that represents the estimated frequency at which a threat is expected to transpire?

Annualized Rate of Occurrence (ARO)

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

A compliance test of program library controls

A substantive test of program library controls

A compliance test of program library controls

A compliance test of the program compiler controls

A substantive test of the program compiler controls

Creating a secondary authentication process for network access would be an example of?

Supporting the concept of layered security

An administrator with too much time on their hands.

Putting undue time commitment on the system administrator.

Supporting the concept of layered security

As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?

Names and phone numbers of those who conducted the audit

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader.What should you do?

Have a risk assessment performed.

Nothing, this falls outside your area of influence.

Close and chain the door shut and send a company-wide memo banning the practice.

Have a risk assessment performed.

Post a guard at the door to maintain physical security

ECCouncil 712-50 Practice Test 3 - Free Online Exam Prep & Questions

When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

The asset owner

The asset manager

The data custodian

The project manager

Comment (0)

ECCouncil 712-50 Practice Test 3

Question

ECCouncil 712-50 Practice Tests

Practice Tests