Which of the following is the BEST indicator of a successful project?

the deliverables are accepted by the key stakeholders

it is completed on time or early as compared to the baseline project plan

it meets most of the specifications as outlined in the approved project definition

it comes in at or below the expenditures planned for in the baseline budget

the deliverables are accepted by the key stakeholders

Which of the following methodologies references the recommended industry standard that Information security project managers should follow?

Project Management Body of Knowledge

The Security Systems Development Life Cycle

The Security Project And Management Methodology

Project Management System Methodology

Project Management Body of Knowledge

Which of the following is considered one of the most frequent failures in project management?

Failure to meet project deadlines

When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?

Vendor uses a company supplied laptop and logins using two factor authentication with their own unique credentials

Vendors uses their own laptop and logins with same admin credentials your security team uses

Vendor uses a company supplied laptop and logins using two factor authentication with same admin credentials your security team uses

Vendor uses a company supplied laptop and logins using two factor authentication with their own unique credentials

Vendor uses their own laptop and logins using two factor authentication with their own unique credentials

When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

Prior to signing the agreement and before any security services are being performed

At the time the security services are being performed and the vendor needs access to the network

Once the agreement has been signed and the security vendor states that they will need access to the network

Once the vendor is on premise and before they perform security services

Prior to signing the agreement and before any security services are being performed

When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?

Download open source security tools from a trusted site, test, and then deploy on production network

Download open source security tools and deploy them on your production network

Download trial versions of commercially available security tools and deploy on your production network

Download open source security tools from a trusted site, test, and then deploy on production network

Download security tools from a trusted source and deploy to production network

The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?

Explain to the IT group that the IPS will fail open once in-line however it will be deployed in monitor mode for a set period of time to ensure that it doesn't block any legitimate traffic

Work with the IT group and tell them to put IPS in-line and say it won't cause any network impact

Explain to the IT group that the IPS won't cause any network impact because it will fail open

Explain to the IT group that this is a business need and the IPS will fail open however, if there is a network failure the CISO will accept responsibility

Explain to the IT group that the IPS will fail open once in-line however it will be deployed in monitor mode for a set period of time to ensure that it doesn't block any legitimate traffic

What oversight should the information security team have in the change management process for application security?

Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production

Information security should be informed of changes to applications only

Development team should tell the information security team about any application security flaws

Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production

Information security should be aware of all application changes and work with developers before changes are deployed in production

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

Vmware, router, switch, firewall, syslog, vulnerability management system (VMS)

Intrusion Detection System (IDS), firewall, switch, syslog

Security Incident Event Management (SIEM), IDS, router, syslog

You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don't know what to do. What is the BEST approach to handle this situation?

Tune the sensors to help reduce false positives so the team can react better

Tell the team to do their best and respond to each alert

Tune the sensors to help reduce false positives so the team can react better

Request additional resources to handle the workload

Tell the team to only respond to the critical and high alerts

An example of professional unethical behavior is:

Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes

Gaining access to an affiliated employee's work email account as part of an officially sanctioned internal investigation

Sharing copyrighted material with other members of a professional organization where all members have legitimate access to the material

Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes

Storing client lists and other sensitive corporate internal documents on a removable thumb drive

A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:

Vendor provided attestation of the detailed security controls from a reputable accounting firm

Vendor's client list of reputable organizations currently using their solution

Vendor provided attestation of the detailed security controls from a reputable accounting firm

Vendor provided reference from an existing reputable client detailing their implementation

Vendor provided internal risk assessment and security control documentation

A recommended method to document the respective roles of groups and individuals for a given process is to:

Develop a Responsible, Accountable, Consulted, Informed (RACI) chart

Develop a detailed internal organization chart

Develop a telephone call tree for emergency response

Develop an isolinear response matrix with cost benefit analysis projections

Develop a Responsible, Accountable, Consulted, Informed (RACI) chart

Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?

More frequent project milestone meetings

A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?

Poor alignment of the security program to business needs

Poor audit support for the security program

A lack of executive presence within the security program

Poor alignment of the security program to business needs

This is normal since business units typically resist security requirements

Which of the following represents the best method of ensuring business unit alignment with security program requirements?

Create collaborative risk management approaches within the organization

Provide clear communication of security requirements throughout the organization

Demonstrate executive support with written mandates for security policy adherence

Create collaborative risk management approaches within the organization

Perform increased audits of security processes and procedures

A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

Security alignment to business goals

Regulatory compliance effectiveness

Increased security program presence

Proper organizational policy enforcement

Which of the following is critical in creating a security program aligned with an organization's goals?

Develop a culture in which users, managers and IT professionals all make good decisions about information risk

Ensure security budgets enable technical acquisition and resource allocation based on internal compliance requirements

Develop a culture in which users, managers and IT professionals all make good decisions about information risk

Provide clear communication of security program support requirements and audit schedules

Create security awareness programs that include clear definition of security program goals and charters

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?

Effective use of existing technologies

Leveraging existing implementations

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?

Effective use of existing technologies

Leveraging existing implementations

Which of the following represents the BEST method of ensuring security program alignment to business needs?

Create security consortiums, such as strategic security planning groups, that include business unit participation

Create a comprehensive security awareness program and provide success metrics to business units

Create security consortiums, such as strategic security planning groups, that include business unit participation

Ensure security implementations include business unit testing and functional validation prior to production rollout

Ensure the organization has strong executive-level security representation through clear sponsorship or the creation of a CISO role

A newly appointed security officer finds data leakage software licenses that had never been used.The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?

The project was initiated without an effort to get support from impacted business units in the organization

The software license expiration is probably out of synchronization with other software licenses

The project was initiated without an effort to get support from impacted business units in the organization

The software is out of date and does not provide for a scalable solution across the enterprise

The security officer should allow time for the organization to get accustomed to her presence before initiating security projects

Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?

Ensure business units are involved in the creation of controls and defining conditions under which they must be applied

Allow the business units to decide which controls apply to their systems, such as the encryption of sensitive data

Create separate controls for the business units based on the types of business and functions they perform

Ensure business units are involved in the creation of controls and defining conditions under which they must be applied

Provide the business units with control mandates and schedules of audits for compliance validation

A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?

A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in

A security organization that is adequately staffed to apply required mitigation strategies and regulatory compliance solutions

A clear set of security policies and procedures that are more concept-based than controls-based

A complete inventory of Information Technology assets including infrastructure, networks, applications and data

A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in

Which of the following is a major benefit of applying risk levels?

Resources are not wasted on risks that are already managed to an acceptable level

Risk management governance becomes easier since most risks remain low once mitigated

Resources are not wasted on risks that are already managed to an acceptable level

Risk budgets are more easily managed due to fewer identified risks as a result of using a methodology

Risk appetite can increase within the organization once the levels are understood

Which of the following best summarizes the primary goal of a security program?

Manage risk within the organization

Provide security reporting to all levels of an organization

Create effective security awareness to employees

Manage risk within the organization

Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?

Network Security administration

In effort to save your company money which of the following methods of training results in the lowest cost for the organization?

Self –Study (noncomputerized)

ECCouncil 712-50 Practice Test 6 - Free Online Exam Prep & Questions

Which of the following is considered a project versus a managed process?

monitoring external and internal environment during incident response

ongoing risk assessments of routine operations

continuous vulnerability assessment and vulnerability repair

installation of a new firewall system

Comment (0)

ECCouncil 712-50 Practice Test 6

Question

ECCouncil 712-50 Practice Tests

Practice Tests