Great Online Dumps for EC-Council 712-50 CCISO Exam

1. Gaining Access

2. Which of the following backup sites takes the longest recovery time?

3. An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations .

What authentication method is being used?

4. Your penetration testing team installs an in-line hardware key logger onto one of your network machines .

Which of the following is of major concern to the security organization?

5. What is the FIRST step in developing the vulnerability management program?

6. Which of the following is a symmetric encryption algorithm?

7. Which of the following is a countermeasure to prevent unauthorized database access from web applications?

8. One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient .

Which of the following keys should be used to encrypt the message?

9. What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?

10. Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.

Which of the following is the reason the CISO has not been able to advance the security agenda in this organization?

11. What process defines the framework of rules and practices by which a board of directors ensure accountability, fairness and transparency in an organization's relationship with its shareholders?

12. Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?

13. A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.

14. Which of the following is a primary method of applying consistent configurations to IT systems?

15. Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.

When formulating the remediation plan, what is a required input?

16. Which type of scan is used on the eye to measure the layer of blood vessels?

17. Which of the following is true regarding expenditures?

18. If the result of an NPV is positive, then the project should be selected. The net present value shows the present value of the project, based on the decisions taken for its selection .

What is the net present value equal to?

19. Human resource planning for security professionals in your organization is a:

20. As the CISO, you have been tasked with the execution of the company’s key management program. You MUST ensure the integrity of encryption keys at the point of generation .

Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?

21. When analyzing and forecasting a capital expense budget what are not included?

22. SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.

The CISO discovers the scalability issue will only impact a small number of network segments .

What is the next logical step to ensure the proper application of risk management methodology within the two-facto implementation project?

23. The ability to demand the implementation and management of security controls on third parties providing services to an organization is

24. The formal certification and accreditation process has four primary steps, what are they?

25. What is the difference between encryption and tokenization?

26. A large number of accounts in a hardened system were suddenly compromised to an external party .

Which of the following is the MOST probable threat actor involved in this incident?

27. What is the BEST reason for having a formal request for proposal process?

28. What are the three stages of an identity and access management system?

29. Where does bottom-up financial planning primarily gain information for creating budgets?

30. Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and uses the special card in order to access the restricted area of the target company. Just as the employee opens the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so that he can enter .

What is the best way to undermine the social engineering activity of tailgating?

31. Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

Symmetric encryption in general is preferable to asymmetric encryption when:

32. Which of the following would negatively impact a log analysis of a multinational organization?

33. Which of the following terms is used to describe countermeasures implemented to minimize risks to physical property, information, and computing systems?

34. Which of the following is MOST useful when developing a business case for security initiatives?

35. Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.

To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

36. If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business, they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization .

How would you prevent such type of attacks?

37. Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?

38. Which of the following is an accurate statement regarding capital expenses?

39. Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.

You have identified potential solutions for all of your risks that do not have security controls .

What is the NEXT step?

40. Which of the following provides an independent assessment of a vendor’s internal security controls and overall posture?

41. A digital signature addresses which of the following concerns?

42. The process to evaluate the technical and non-technical security controls of an IT system to validate that a given design and implementation meet a specific set of security requirements is called

43. Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.

You have decided to deal with risk to information from people first .

How can you minimize risk to your most sensitive information before granting access?

44. A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered

45. Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of

46. Which of the following best describes the sensors designed to project and detect a light beam across an area?

47. Which of the following is considered the foundation for the Enterprise Information Security Architecture (EISA)?

48. SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.

What is the MOST logical course of action the CISO should take?

49. Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.

Using the best business practices for project management, you determine that the project correctly aligns with the organization goals .

What should be verified next?

50. Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.

What is one proven method to account for common elements found within separate regulations and/or standards?

51. Smith, the project manager for a larger multi-location firm, is leading a software project team that has 18 members, 5 of which are assigned to testing. Due to recent recommendations by an organizational quality audit team, the project manager is convinced to add a quality professional to lead to test team at additional cost to the project.

The project manager is aware of the importance of communication for the success of the project and takes the step of introducing additional communication channels, making it more complex, in order to assure quality levels of the project .

What will be the first project management document that Smith should change in order to accommodate additional communication channels?

52. Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.

How can you reduce the administrative burden of distributing symmetric keys for your employer?

53. Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.

Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time.

Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.

54. The rate of change in technology increases the importance of: