Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?

International Organization for Standardization 27001

National Institute of Standards and Technology Special Publication SP 800-12

National Institute of Standards and Technology Special Publication SP 800-26

Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?

Implementation of business-enabling information security

Use within an organization to formulate security requirements and objectives

Implementation of business-enabling information security

Use within an organization to ensure compliance with laws and regulations

To enable organizations that adopt it to obtain certifications

The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to

perform an independent audit of the security controls.

assign the responsibility to the information security team.

assign the responsibility to the team responsible for the management of the controls.

create operational reports on the effectiveness of the controls.

perform an independent audit of the security controls.

The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization's

Identity and Access Management Program.

Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

Better understand strengths and weaknesses of the program

Meet regulatory compliance requirements

Better understand the threats and vulnerabilities affecting the environment

Better understand strengths and weaknesses of the program

When you develop your audit remediation plan what is the MOST important criteria?

To validate that the cost of the remediation is less than the risk of the finding.

To remediate half of the findings before the next audit.

To remediate all of the findings before the next audit.

To validate that the cost of the remediation is less than the risk of the finding.

To validate the remediation process with the auditor.

Control Objectives for Information and Related Technology (COBIT) is which of the following?

A framework for Information Technology management and governance

An Information Security audit standard

An audit guideline for certifying secure systems and controls

A framework for Information Technology management and governance

A set of international regulations for Information Technology governance

A Chief Information Security Officer received a list of high, medium, and low impact audit findings.Which of the following represents the BEST course of action?

If the findings impact regulatory compliance, remediate the high findings as quickly as possible.

If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.

If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.

If the findings impact regulatory compliance, remediate the high findings as quickly as possible.

If the findings do not impact regulatory compliance, review current security controls.

Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?

Implementation of it eases an organization's auditing and compliance burden

It allows executives to more effectively monitor IT implementation costs

Implementation of it eases an organization's auditing and compliance burden

Information Security (IS) procedures often require augmentation with other standards

It provides for a consistent and repeatable staffing model for technology organizations

You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?

Conduct a thorough risk assessment against the current implementation to determine system functions

Validate that security awareness program content includes information about the potential vulnerability

Conduct a thorough risk assessment against the current implementation to determine system functions

Determine program ownership to implement compensating controls

Send a report to executive peers and business unit owners detailing your suspicions

A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?

tell him to invoke the incident response process

tell him to shut down the server

tell him to invoke the incident response process

tell him to analyze the problem, preserve the evidence and provide a full analysis and report

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered aMAJOR constraint for the project?

Encryption import/export regulations

Compliance to local hiring laws

Encryption import/export regulations

A system was hardened at the Operating System level and placed into the production environment.Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?

Lack of change management processes

Lack of asset management processes

Lack of change management processes

The ultimate goal of an IT security projects is:

Implement information security policies

When managing the critical path of an IT security project, which of the following is MOST important?

Knowing the milestones and timelines of deliverables.

Knowing who all the stakeholders are.

Knowing the people on the data center team.

Knowing the threats to the organization.

Knowing the milestones and timelines of deliverables.

When is an application security development project complete?

When the application is retired.

When the application turned over to production.

When the application reaches the maintenance phase.

When should IT security project management be outsourced?

When the benefits of outsourcing outweigh the inherent risks of outsourcing

When organizational resources are limited

When the benefits of outsourcing outweigh the inherent risks of outsourcing

On new, enterprise-wide security initiatives

On projects not forecasted in the yearly budget

A stakeholder is a person or group:

Vested in the success and/or failure of a project or initiative regardless of budget implications.

Vested in the success and/or failure of a project or initiative and is tied to the project budget.

That will ultimately use the system.

Your company has a "no right to privacy" notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee's email account. What should you do? (choose the BEST answer):

Assist her with the request, but only after her supervisor signs off on the action.

Grant her access, the employee has been adequately warned through the AUP.

Assist her with the request, but only after her supervisor signs off on the action.

Reset the employee's password and give it to the supervisor.

Deny the request citing national privacy laws.

The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted.Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):

Failed to identify all stakeholders and their needs

Deployed the encryption solution in an inadequate manner

Used 1024 bit encryption when 256 bit would have sufficed

Used hardware encryption instead of software encryption

When gathering security requirements for an automated business process improvement program, which of the following is MOST important?

Type of data contained in the process/system

Type of connection/protocol used to transfer the data

Type of encryption required for the data once it is at rest

Type of computer the data is processed on

When selecting a security solution with reoccurring maintenance costs after the first year, the CISO should: (choose the BEST answer)

Communicate future operating costs to the CIO/CFO and seek commitment from them to ensure the new solution's continued use

The CISO should cut other essential programs to ensure the new solution's continued use

Communicate future operating costs to the CIO/CFO and seek commitment from them to ensure the new solution's continued use

Defer selection until the market improves and cash flow is positive

Implement the solution and ask for the increased operating cost budget when it is time

You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll.Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):

Contract with a managed security provider and have current staff on recall for incident response

Deploy a SEIM solution and have current staff review incidents first thing in the morning

Contract with a managed security provider and have current staff on recall for incident response

Configure your syslog to send SMS messages to current staff when target events are triggered

Employ an assumption of breach protocol and defend only essential information resources

To get an Information Security project back on schedule, which of the following will provide the MOST help?

More frequent project milestone meetings

Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?

Integrate security requirements into project inception

User awareness training for all employees

Installation of new firewalls and intrusion detection systems

Launch an internal awareness campaign

Integrate security requirements into project inception

An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?

Lack of version/source controls

Ineffective configuration management controls

Lack of change management controls

Lack of version/source controls

High turnover in the application development department

Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?

Key Performance Indicators (KPI)

The company decides to release the application without remediating the high-risk vulnerabilities.Which of the following is the MOST likely reason for the company to release the application?

The company has a high risk tolerance

The company lacks a risk management process

The company does not believe the security vulnerabilities to be real

The company has a high risk tolerance

The company lacks the tools to perform a vulnerability assessment

The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?

Implement Compensating Controls

Provide developer security training

Deploy Intrusion Detection Systems

Implement Compensating Controls

Which of the following can the company implement in order to avoid this type of security issue in the future?

A security training program for developers

Network based intrusion detection systems

A security training program for developers

ECCouncil 712-50 Practice Test 5 - Free Online Exam Prep & Questions

Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.

ISO 27001

ISO 27002

ISO 27004

ISO 27005

Comment (0)

ECCouncil 712-50 Practice Test 5

Question

ECCouncil 712-50 Practice Tests

Practice Tests