The total cost of security controls should:

Be less than the value of the information resource being protected

Be equal to the value of the information resource being protected

Be greater than the value of the information resource being protected

Be less than the value of the information resource being protected

Should not matter, as long as the information resource is protected

Annual Loss Expectancy is derived from the function of which two factors?

Annual Rate of Occurrence and Single Loss Expectancy

Annual Rate of Occurrence and Asset Value

Single Loss Expectancy and Exposure Factor

Safeguard Value and Annual Rate of Occurrence

Annual Rate of Occurrence and Single Loss Expectancy

The rate of change in technology increases the importance of:

Implementing and enforcing good processes.

Understanding user requirements.

Hiring personnel with leading edge skills.

Implementing and enforcing good processes.

As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?

Other corporate technology trends.

Involvement of senior management is MOST important in the development of:

IT security implementation plans.

The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?

There is a clear definition of the IT security mission and vision.

There is integration between IT security and business staffing.

There is a clear definition of the IT security mission and vision.

There is an auditing methodology in place.

The plan requires return on investment for all security projects.

John is the project manager for a large project in his organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed.The vendor is refusing to make the changes as they've already completed the project work they were contracted to do. What can John do in this instance?

Refer to the contract agreement for direction.

Refer the vendor to the Service Level Agreement (SLA) and insist that they make the changes.

Review the Request for Proposal (RFP) for guidance.

Withhold the vendor's payments until the issue is resolved.

Refer to the contract agreement for direction.

When updating the security strategic planning document what two items must be included?

The alignment with the business goals and the risk tolerance

Alignment with the business goals and the vision of the CIO

The risk tolerance of the company and the company mission statement

The executive summary and vision of the board of directors

The alignment with the business goals and the risk tolerance

Acceptable levels of information security risk tolerance in an organization should be determined by?

CISO with reference to the company goals

The formal certification and accreditation process has four primary steps, what are they?

Evaluating, describing, testing and authorizing

Evaluating, purchasing, testing, authorizing

Auditing, documenting, verifying, certifying

Discovery, testing, authorizing, certifying

Human resource planning for security professionals in your organization is a:

Training requirement that is on-going and always changing.

Simple and easy task because the threats are getting easier to find and correct.

Training requirement that is met through once every year user training.

Training requirement that is on-going and always changing.

Not needed because automation and anti-virus software has eliminated the threats.

What are the primary reasons for the development of a business case for a security project?

To communicate risk and forecast resource needs

To estimate risk and negate liability to the company

To understand the attack vectors and attack sources

To communicate risk and forecast resource needs

To forecast usage and cost per software licensing

When analyzing and forecasting a capital expense budget what are not included?

Purchase of new mobile devices to improve operations

When analyzing and forecasting an operating expense budget what are not included?

Software and hardware license fees

What is the primary reason for performing a return on investment analysis?

To decide is the solution costs less than the risk it is mitigating

To decide between multiple vendors

To decide is the solution costs less than the risk it is mitigating

To determine the current present value of a project

To determine the annual rate of loss

What is the primary reason for performing vendor management?

To understand the risk coverage that are being mitigated by the vendor

To establish a vendor selection process

To document the relationship between the company and the vendor

To define the partnership for long-term success

What is the BEST reason for having a formal request for proposal process?

Clearly identifies risks and benefits before funding is spent

Creates a timeline for purchasing and budgeting

Allows small companies to compete with larger companies

Clearly identifies risks and benefits before funding is spent

Informs suppliers a company is going to make a purchase

When creating contractual agreements and procurement processes why should security requirements be included?

To make sure the costs of security is included and understood

To make sure they are added on after the process is completed

To make sure the costs of security is included and understood

To make sure the security process aligns with the vendor's security process

To make sure the patching process is included with the costs

Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?

Conduct background checks on individuals before hiring them

Develop an Information Security Awareness program

Monitor employee browsing and surfing habits

Set your firewall permissions aggressively and monitor logs regularly.

Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:

Controlled spear phishing campaigns

Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.What is one proven method to account for common elements found within separate regulations and/or standards?

Use the Find function of your word processor

Design your program to meet the strictest government standards

Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.When multiple regulations or standards apply to your industry you should set controls to meet the:

Most complex standard to implement

Easiest regulation or standard to implement

Stricter regulation or standard

Most complex standard to implement

Recommendations of your Legal Staff

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.Your Corporate Information Security Policy should include which of the following?

Desktop configuration standards

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

International Organization for Standardization – ISO 27001/2

National Institute of Standards and Technology (NIST) Special Publication 800-53

Payment Card Industry Digital Security Standard (PCI DSS)

International Organization for Standardization – ISO 27001/2

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?

ISO 27000 and Payment Card Industry Data Security Standards

NIST and data breach notification laws

ISO 27000 and Human resources best practices

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.Which of the following would be the FIRST step when addressing Information Security formally and consistently in this organization?

Define formal roles and responsibilities for Information Security

Contract a third party to perform a security risk assessment

Define formal roles and responsibilities for Internal audit functions

Define formal roles and responsibilities for Information Security

Create an executive security steering committee

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?

Compliance to Payment Card Industry (PCI) data security standards

International encryption restrictions

Compliance to Payment Card Industry (PCI) data security standards

Compliance with local government privacy laws

Adherence to local data breach notification laws

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?

Lack of compliance to the Payment Card Industry (PCI) standards

Ineffective security awareness program

Security practices not in alignment with ISO 27000 frameworks

Lack of technical controls when dealing with credit card data

SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team's activities?

Regular communication of incident status to executives

Eradication of malware and system restoration

Determination of the attack source

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.Which of the following is the FIRST action the CISO will perform after receiving the audit report?

Validate gaps and accept or dispute the audit findings

Inform peer executives of the audit results

Validate gaps and accept or dispute the audit findings

Create remediation plans to address program gaps

Determine if security policies and procedures are adequate

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.After determining the audit findings are accurate, which of the following is the MOST logical next activity?

Begin initial gap remediation analyses

Review the security organization's charter

Validate gaps with the Information Technology team

Create a briefing of the findings for executive management

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning. Which of the following is the MOST logical next step?

Report the audit findings and remediation status to business stake holders

Validate the effectiveness of current controls

Create detailed remediation funding and staffing plans

Report the audit findings and remediation status to business stake holders

Review security procedures to determine if they need modified according to findings

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.The CISO has implemented remediation activities. Which of the following is the MOST logical next step?

Validate the effectiveness of applied controls

Validate security program resource requirements

Report the audit findings and remediation status to business stake holders

Review security procedures to determine if they need modified according to findings

Scenario: You are the CISO and have just completed your first risk assessment for your organization.You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?

Verify that the cost of mitigation is less than the risk

Get approval from the board of directors

Screen potential vendor solutions

Verify that the cost of mitigation is less than the risk

Create a risk metrics for all unmitigated risks

ECCouncil 712-50 Practice Test 8 - Free Online Exam Prep & Questions

Your company has limited resources to spend on security initiatives. The Chief Financial Officer asks you to prioritize the protection of information resources based on their value to the company. It is essential that you be able to communicate in language that your fellow executives will understand.

You should:

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 712-50 Practice Test 8

Question

ECCouncil 712-50 Practice Tests

Practice Tests