EC-Council Information Security Manager (E|ISM) 512-50 Test Questions

dumps2022-11-25T01:40:57+08:00

The EC-Council Information Security Manager (E|ISM) certification is a light version of the Certified Chief Information Security Officer (CCISO) certification. Candidates who do not yet have 5 years of information security experience in at least 3 of the 5 CCISO domains can choose to pass the EC-Council EISM 512-50 exam to pursue a management certification to help propel their careers and put them on fast track toward obtaining the CCISO. EC-Council 512-50 test questions are available now to be your good preparation materials. Come here to read 512-50 demo questions below.

Page 1 of 13

1. When choosing a risk mitigation method what is the MOST important factor?

Approval from the board of directors

Cost of the mitigation is less than the risk

Metrics of mitigation method success

Mitigation method complies with PCI regulations

2. What role should the CISO play in properly scoping a PCI environment?

Validate the business units’ suggestions as to what should be included in the scoping process

Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment

Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data

Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope

3. What is the MAIN reason for conflicts between Information Technology and Information Security programs?

Technology governance defines technology policies and standards while security governance does not.

Security governance defines technology best practices and Information Technology governance does not.

Technology Governance is focused on process risks whereas Security Governance is focused on business risk.

The effective implementation of security controls can be viewed as an inhibitor to rapid Information Technology implementations.

4. Within an organization’s vulnerability management program, who has the responsibility to implement remediation actions?

Security officer

Data owner

Vulnerability engineer

System administrator

5. When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

In promiscuous mode and only detect malicious traffic.

In-line and turn on blocking mode to stop malicious traffic.

In promiscuous mode and block malicious traffic.

In-line and turn on alert mode to stop malicious traffic.

6. When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

An independent Governance, Risk and Compliance organization

Alignment of security goals with business goals

Compliance with local privacy regulations

Support from Legal and HR teams

7. What is the first thing that needs to be completed in order to create a security program for your organization?

Risk assessment

Security program budget

Business continuity plan

Compliance and regulatory analysis

8. A security manager has created a risk program.

Which of the following is a critical part of ensuring the program is successful?

Providing a risk program governance structure

Ensuring developers include risk control comments in code

Creating risk assessment templates based on specific threats

Allowing for the acceptance of risk for regulatory compliance requirements

9. Which of the following is a critical operational component of an Incident Response Program (IRP)?

Weekly program budget reviews to ensure the percentage of program funding remains constant.

Annual review of program charters, policies, procedures and organizational agreements.

Daily monitoring of vulnerability advisories relating to your organization’s deployed technologies.

Monthly program tests to ensure resource allocation is sufficient for supporting the needs of the organization

10. Which of the following is the MOST important for a CISO to understand when identifying threats?

How vulnerabilities can potentially be exploited in systems that impact the organization

How the security operations team will behave to reported incidents

How the firewall and other security devices are configured to prevent attacks

How the incident management team prepares to handle an attack

Page 2 of 13

11. One of the MAIN goals of a Business Continuity Plan is to

Ensure all infrastructure and applications are available in the event of a disaster

Allow all technical first-responders to understand their roles in the event of a disaster

Provide step by step plans to recover business processes in the event of a disaster

Assign responsibilities to the technical teams responsible for the recovery of all data.

12. An organization information security policy serves to

establish budgetary input in order to meet compliance requirements

establish acceptable systems and user behavior

define security configurations for systems

define relationships with external law enforcement agencies

13. A global retail company is creating a new compliance management process.

Which of the following regulations is of MOST importance to be tracked and managed by this process?

Information Technology Infrastructure Library (ITIL)

International Organization for Standardization (ISO) standards

Payment Card Industry Data Security Standards (PCI-DSS)

National Institute for Standards and Technology (NIST) standard

14. If your organization operates under a model of "assumption of breach", you should:

Protect all information resource assets equally

Establish active firewall monitoring protocols

Purchase insurance for your compliance liability

Focus your security efforts on high value assets

15. Which of the following international standards can be BEST used to define a Risk Management process in an organization?

National Institute for Standards and Technology 800-50 (NIST 800-50)

International Organization for Standardizations C 27005 (ISO-27005)

Payment Card Industry Data Security Standards (PCI-DSS)

International Organization for Standardizations C 27004 (ISO-27004)

16. What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

Determine appetite

Evaluate risk avoidance criteria

Perform a risk assessment

Mitigate risk

17. Risk appetite directly affects what part of a vulnerability management program?

Staff

Scope

Schedule

Scan tools

18. Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

Need to comply with breach disclosure laws

Need to transfer the risk associated with hosting PII data

Need to better understand the risk associated with using PII data

Fiduciary responsibility to safeguard credit card information

19. With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:

Metrics tracking security milestones, understanding criticality of information and information security, visibility into the types of information and how it is used, endorsement by the board of directors

Annual security training for all employees, continual budget reviews, endorsement of the development and implementation of a security program, metrics to track the program

Understanding criticality of information and information security, review investment in information security, endorse development and implementation of a security program, and require regular reports on adequacy and effectiveness

Endorsement by the board of directors for security program, metrics of security program milestones, annual budget review, report on integration and acceptance of program

20. Which of the following provides an audit framework?

Control Objectives for IT (COBIT)

Payment Card Industry-Data Security Standard (PCI-DSS)

International Organization Standard (ISO) 27002

National Institute of Standards and Technology (NIST) SP 800-30

Page 3 of 13

21. The exposure factor of a threat to your organization is defined by?

Asset value times exposure factor

Annual rate of occurrence

Annual loss expectancy minus current cost of controls

Percentage of loss experienced due to a realized threat event

22. A method to transfer risk is to:

Implement redundancy

move operations to another region

purchase breach insurance

Alignment with business operations

23. An organization's Information Security Policy is of MOST importance because

it communicates management’s commitment to protecting information resources

it is formally acknowledged by all employees and vendors

it defines a process to meet compliance requirements

it establishes a framework to protect confidential information

24. Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?

Poses a strong technical background

Understand all regulations affecting the organization

Understand the business goals of the organization

Poses a strong auditing background

25. Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Reduction of budget

Decreased security awareness

Improper use of information resources

Fines for regulatory non-compliance

26. The establishment of a formal risk management framework and system authorization program is essential.

The LAST step of the system authorization process is:

Contacting the Internet Service Provider for an IP scope

Getting authority to operate the system from executive management

Changing the default passwords

Conducting a final scan of the live system and mitigating all high and medium level vulnerabilities

27. A global health insurance company is concerned about protecting confidential information.

Which of the following is of MOST concern to this organization?

Compliance to the Payment Card Industry (PCI) regulations.

Alignment with financial reporting regulations for each country where they operate.

Alignment with International Organization for Standardization (ISO) standards.

Compliance with patient data protection regulations for each country where they operate.

28. An organization licenses and uses personal information for business operations, and a server containing that information has been compromised.

What kind of law would require notifying the owner or licensee of this incident?

Data breach disclosure

Consumer right disclosure

Security incident disclosure

Special circumstance disclosure

29. A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently.

Which of the following is the MOST likely reason for the policy shortcomings?

Lack of a formal security awareness program

Lack of a formal security policy governance process

Lack of formal definition of roles and responsibilities

Lack of a formal risk management policy

30. What two methods are used to assess risk impact?

Cost and annual rate of expectance

Subjective and Objective

Qualitative and percent of loss realized

Quantitative and qualitative

Page 4 of 13

31. A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure.

What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

Scan a representative sample of systems

Perform the scans only during off-business hours

Decrease the vulnerabilities within the scan tool settings

Filter the scan output so only pertinent data is analyzed

32. An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase.

What does this selection indicate?

A high threat environment

A low risk tolerance environment

I low vulnerability environment

A high risk tolerance environment

33. When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

Escalation

Recovery

Eradication

Containment

34. A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected. Who must be informed of this incident?

Internal audit

The data owner

All executive staff

Government regulators

35. The PRIMARY objective of security awareness is to:

Ensure that security policies are read.

Encourage security-conscious employee behavior.

Meet legal and regulatory requirements.

Put employees on notice in case follow-up action for noncompliance is necessary

36. Credit card information, medical data, and government records are all examples of:

Confidential/Protected Information

Bodily Information

Territorial Information

Communications Information

37. What is the definition of Risk in Information Security?

Risk = Probability x Impact

Risk = Threat x Probability

Risk = Financial Impact x Probability

Risk = Impact x Threat

38. Which of the following is a benefit of information security governance?

Questioning the trust in vendor relationships.

Increasing the risk of decisions based on incomplete management information.

Direct involvement of senior management in developing control processes

Reduction of the potential for civil and legal liability

39. Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

They are objective and can express risk / cost in real numbers

They are subjective and can be completed more quickly

They are objective and express risk / cost in approximates

They are subjective and can express risk /cost in real numbers

40. A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program.

Which of the following qualifications and experience would be MOST desirable to find in a candidate?

Multiple certifications, strong technical capabilities and lengthy resume

Industry certifications, technical knowledge and program management skills

College degree, audit capabilities and complex project management

Multiple references, strong background check and industry certifications

Page 5 of 13

41. What is the relationship between information protection and regulatory compliance?

That all information in an organization must be protected equally.

The information required to be protected by regulatory mandate does not have to be identified in the organizations data classification policy.

That the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.

There is no relationship between the two.

42. Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization’s products and services?

Strong authentication technologies

Financial reporting regulations

Credit card compliance and regulations

Local privacy laws

43. Which of the following are the MOST important factors for proactively determining system vulnerabilities?

Subscribe to vendor mailing list to get notification of system vulnerabilities

Deploy Intrusion Detection System (IDS) and install anti-virus on systems

Configure firewall, perimeter router and Intrusion Prevention System (IPS)

Conduct security testing, vulnerability scanning, and penetration testing

44. In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

High risk environments 6 months, low risk environments 12 months

Every 12 months

Every 18 months

Every six months

45. Payment Card Industry (PCI) compliance requirements are based on what criteria?

The types of cardholder data retained

The duration card holder data is retained

The size of the organization processing credit card data

The number of transactions performed per year by an organization

46. When managing the security architecture for your company you must consider:

Security and IT Staff size

Company Values

Budget

All of the above

47. What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

Test every three years to ensure that things work as planned

Conduct periodic tabletop exercises to refine the BC plan

Outsource the creation and execution of the BC plan to a third party vendor

Conduct a Disaster Recovery (DR) exercise every year to test the plan

48. An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied.

What is the NEXT logical step in applying the controls in the organization?

Determine the risk tolerance

Perform an asset classification

Create an architecture gap analysis

Analyze existing controls on systems

49. A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions.

This activity BEST demonstrates what part of a security program?

Audit validation

Physical control testing

Compliance management

Security awareness training

50. Which of the following should be determined while defining risk management strategies?

Organizational objectives and risk tolerance

Risk assessment criteria

IT architecture complexity

Enterprise disaster recovery plans

Page 6 of 13

51. Why is it vitally important that senior management endorse a security policy?

So that they will accept ownership for security within the organization.

So that employees will follow the policy directives.

So that external bodies will recognize the organizations commitment to security.

So that they can be held legally accountable.

52. Who is responsible for securing networks during a security incident?

Chief Information Security Officer (CISO)

Security Operations Center (SO

Disaster Recovery (DR) manager

Incident Response Team (IRT)

53. Which of the following is the MOST important benefit of an effective security governance process?

Reduction of liability and overall risk to the organization

Better vendor management

Reduction of security breaches

Senior management participation in the incident response process

54. According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

Susceptibility to attack, mitigation response time, and cost

Attack vectors, controls cost, and investigation staffing needs

Vulnerability exploitation, attack recovery, and mean time to repair

Susceptibility to attack, expected duration of attack, and mitigation availability

55. Who in the organization determines access to information?

Legal department

Compliance officer

Data Owner

Information security officer

56. A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units.

Which of the following standards and guidelines can BEST address this organization’s need?

International Organization for Standardizations C 22301 (ISO-22301)

Information Technology Infrastructure Library (ITIL)

Payment Card Industry Data Security Standards (PCI-DSS)

International Organization for Standardizations C 27005 (ISO-27005)

57. Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

Audit and Legal

Budget and Compliance

Human Resources and Budget

Legal and Human Resources

58. You have recently drafted a revised information security policy.

From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?

Chief Information Security Officer

Chief Executive Officer

Chief Information Officer

Chief Legal Counsel

59. As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.

Which is the BEST type of risk that defines this event?

Compliance Risk

Reputation Risk

Operational Risk

Strategic Risk

60. Which of the following has the GREATEST impact on the implementation of an information security governance model?

Organizational budget

Distance between physical locations

Number of employees

Complexity of organizational structure

Page 7 of 13

61. Which of the following intellectual Property components is focused on maintaining brand recognition?

Trademark

Patent

Research Logs

62. Developing effective security controls is a balance between:

Risk Management and Operations

Corporate Culture and Job Expectations

Operations and Regulations

Technology and Vendor Management

63. The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

Due Protection

Due Care

Due Compromise

Due process

64. The Information Security Governance program MUST:

integrate with other organizational governance processes

support user choice for Bring Your Own Device (BYOD)

integrate with other organizational governance processes

show a return on investment for the organization

65. The alerting, monitoring and life-cycle management of security related events is typically handled by the

security threat and vulnerability management process

risk assessment process

risk management process

governance, risk, and compliance tools

66. Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

Threat

Vulnerability

Attack vector

Exploitation

67. The success of the Chief Information Security Officer is MOST dependent upon:

favorable audit findings

following the recommendations of consultants and contractors

development of relationships with organization executives

raising awareness of security issues with end users

68. You have purchased a new insurance policy as part of your risk strategy.

Which of the following risk strategy options have you engaged in?

Risk Avoidance

Risk Acceptance

Risk Transfer

Risk Mitigation

69. You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the

Controlled mitigation effort

Risk impact comparison

Relative likelihood of event

Comparative threat analysis

70. When dealing with a risk management process, asset classification is important because it will impact the overall:

Threat identification

Risk monitoring

Risk treatment

Risk tolerance

Page 8 of 13

71. The Information Security Management program MUST protect:

all organizational assets

critical business processes and /or revenue streams

intellectual property released into the public domain

against distributed denial of service attacks

72. Regulatory requirements typically force organizations to implement

Mandatory controls

Discretionary controls

Optional controls

Financial controls

73. Which of the following is MOST likely to be discretionary?

Policies

Procedures

Guidelines

Standards

74. The single most important consideration to make when developing your security program, policies, and processes is:

Budgeting for unforeseen data compromises

Streamlining for efficiency

Alignment with the business

Establishing your authority as the Security Executive

75. When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

The asset owner

The asset manager

The data custodian

The project manager

76. What is a difference from the list below between quantitative and qualitative Risk Assessment?

Quantitative risk assessments result in an exact number (in monetary terms)

Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

Qualitative risk assessments map to business objectives

Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

77. Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Awareness

Compliance

Governance

Management

78. The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

Confidentiality, Integrity and Availability

Assurance, Compliance and Availability

International Compliance

Integrity and Availability

79. Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:

Risk management

Security management

Mitigation management

Compliance management

80. When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

How many credit card records are stored?

How many servers do you have?

What is the scope of the certification?

What is the value of the assets at risk?

Page 9 of 13

81. You have implemented a new security control.

Which of the following risk strategy options have you engaged in?

Risk Avoidance

Risk Acceptance

Risk Transfer

Risk Mitigation

82. After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD.

This is an example of

Risk Tolerance

Qualitative risk analysis

Risk Appetite

Quantitative risk analysis

83. Which of the following most commonly falls within the scope of an information security governance steering committee?

Approving access to critical financial systems

Developing content for security awareness programs

Interviewing candidates for information security specialist positions

Vetting information security policies

84. Which of the following is MOST important when dealing with an Information Security Steering committee:

Include a mix of members from different departments and staff levels.

Ensure that security policies and procedures have been vetted and approved.

Review all past audit and compliance reports.

Be briefed about new trends and products at each meeting by a vendor.

85. When briefing senior management on the creation of a governance process, the MOST important aspect should be:

information security metrics.

knowledge required to analyze each issue.

baseline against which metrics are evaluated.

linkage to business area objectives.

86. What is the BEST way to achieve on-going compliance monitoring in an organization?

Only check compliance right before the auditors are scheduled to arrive onsite.

Outsource compliance to a 3rd party vendor and let them manage the program.

Have Compliance and Information Security partner to correct issues as they arise.

Have Compliance direct Information Security to fix issues after the auditors report.

87. Which of the following is considered the MOST effective tool against social engineering?

Anti-phishing tools

Anti-malware tools

Effective Security Vulnerability Management Program

Effective Security awareness program

88. Risk is defined as:

Threat times vulnerability divided by control

Advisory plus capability plus vulnerability

Asset loss times likelihood of event

Quantitative plus qualitative impact

89. When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

When there is a need to develop a more unified incident response capability.

When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

When there is a variety of technologies deployed in the infrastructure.

When it results in an overall lower cost of operating the security program.

90. The FIRST step in establishing a security governance program is to?

Conduct a risk assessment.

Obtain senior level sponsorship.

Conduct a workshop for all end users.

Prepare a security budget.

Page 10 of 13

91. Risk that remains after risk mitigation is known as

Persistent risk

Residual risk

Accepted risk

Non-tolerated risk

92. In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

The organization uses exclusively a quantitative process to measure risk

The organization uses exclusively a qualitative process to measure risk

The organization’s risk tolerance is high

The organization’s risk tolerance is lo

93. The PRIMARY objective for information security program development should be:

Reducing the impact of the risk to the business.

Establishing strategic alignment with business continuity requirements

Establishing incident response programs.

Identifying and implementing the best security solutions.

94. A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards.

What immediate action should the information security manager take?

Enforce the existing security standards and do not allow the deployment of the new technology.

Amend the standard to permit the deployment.

If the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.

Permit a 90-day window to see if an issue occurs and then amend the standard if there are no issues.

95. According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

Identify threats, risks, impacts and vulnerabilities

Decide how to manage risk

Define the budget of the Information Security Management System

Define Information Security Policy

96. From an information security perspective, information that no longer supports the main purpose of the business should be:

assessed by a business impact analysis.

protected under the information classification policy.

analyzed under the data ownership policy.

analyzed under the retention policy

97. What is the main purpose of the Incident Response Team?

Ensure efficient recovery and reinstate repaired systems

Create effective policies detailing program activities

Communicate details of information security incidents

Provide current employee awareness programs

98. Information security policies should be reviewed:

by stakeholders at least annually

by the CISO when new systems are brought online

by the Incident Response team after an audit

by internal audit semiannually

99. An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System.

Which of the following international standards can BEST assist this organization?

International Organization for Standardizations C 27004 (ISO-27004)

Payment Card Industry Data Security Standards (PCI-DSS)

Control Objectives for Information Technology (COBIT)

International Organization for Standardizations C 27005 (ISO-27005)

100. Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?

Use within an organization to formulate security requirements and objectives

Implementation of business-enabling information security

Use within an organization to ensure compliance with laws and regulations

To enable organizations that adopt it to obtain certifications

Page 11 of 13

101. Which represents PROPER separation of duties in the corporate environment?

Information Security and Identity Access Management teams perform two distinct functions

Developers and Network teams both have admin rights on servers

Finance has access to Human Resources data

Information Security and Network teams perform two distinct functions

102. As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader.

What should you do?

Nothing, this falls outside your area of influence.

Close and chain the door shut and send a company-wide memo banning the practice.

Have a risk assessment performed.

Post a guard at the door to maintain physical security

103. Creating good security metrics is essential for a CISO.

What would be the BEST sources for creating security metrics for baseline defenses coverage?

Servers, routers, switches, modem

Firewall, exchange, web server, intrusion detection system (IDS)

Firewall, anti-virus console, IDS, syslog

IDS, syslog, router, switches

104. A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding.

Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?

The auditors have not followed proper auditing processes

The CIO of the organization disagrees with the finding

The risk tolerance of the organization permits this risk

The organization has purchased cyber insurance

105. The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?

Risk metrics

Management metrics

Operational metrics

Compliance metrics

106. The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s

Risk Management Program.

Anti-Spam controls.

Security Awareness Program.

Identity and Access Management Program.

107. A Chief Information Security Officer received a list of high, medium, and low impact audit findings.

Which of the following represents the BEST course of action?

If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.

If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.

If the findings impact regulatory compliance, remediate the high findings as quickly as possible.

If the findings do not impact regulatory compliance, review current security controls.

108. Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?

It allows executives to more effectively monitor IT implementation costs

Implementation of it eases an organization’s auditing and compliance burden

Information Security (IS) procedures often require augmentation with other standards

It provides for a consistent and repeatable staffing model for technology organizations

109. Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

Perform a vulnerability scan of the network

External penetration testing by a qualified third party

Internal Firewall ruleset reviews

Implement network intrusion prevention systems

110. Which is the BEST solution to monitor, measure, and report changes to critical data in a system?

Application logs

File integrity monitoring

SNMP traps

Syslog

Page 12 of 13

111. When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?

Threat Level, Risk of Compromise, and Consequences of Compromise

Risk Avoidance, Threat Level, and Consequences of Compromise

Risk Transfer, Reputational Impact, and Consequences of Compromise

Reputational Impact, Financial Impact, and Risk of Compromise

112. Which of the following is a fundamental component of an audit record?

Date and time of the event

Failure of the event

Originating IP-Address

Authentication type

113. Which of the following BEST describes an international standard framework that is based on the security model Information Technology―Code of Practice for Information Security Management?

International Organization for Standardization 27001

National Institute of Standards and Technology Special Publication SP 800-12

Request For Comment 2196

National Institute of Standards and Technology Special Publication SP 800-26

114. Which of the following activities is the MAIN purpose of the risk assessment process?

Creating an inventory of information assets

Classifying and organizing information assets into meaningful groups

Assigning value to each information asset

Calculating the risks to which assets are exposed in their current setting

115. During the course of a risk analysis your IT auditor identified threats and potential impacts.

Next, your IT auditor should:

Identify and evaluate the existing controls.

Disclose the threats and impacts to management.

Identify information assets and the underlying systems.

Identify and assess the risk assessment process used by management.

116. The amount of risk an organization is willing to accept in pursuit of its mission is known as

Risk mitigation

Risk transfer

Risk tolerance

Risk acceptance

117. The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is

Penetration testers

External Audit

Internal Audit

Forensic experts

118. Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?

To give information security management recommendations to those who are responsible for initiating, implementing, or maintaining security in their organization.

To provide a common basis for developing organizational security standards

To provide effective security management practice and to provide confidence in inter-organizational dealings

To established guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization

119. Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

Plan-Check-Do-Act

Plan-Do-Check-Act

Plan-Select-Implement-Evaluate

SCORE (Security Consensus Operational Readiness Evaluation)

120. As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams.

What else should be in the reporting process?

Executive summary

Penetration test agreement

Names and phone numbers of those who conducted the audit

Business charter

Page 13 of 13

121. To have accurate and effective information security policies how often should the CISO review the organization policies?

Every 6 months

Quarterly

Before an audit

At least once a year

122. Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?

Senior Executives

Office of the Auditor

Office of the General Counsel

All employees and users

123. The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because

The IT team is not familiar in IT audit practices

This represents a bad implementation of the Least Privilege principle

This represents a conflict of interest

The IT team is not certified to perform audits

EC-Council Information Security Manager (E|ISM) 512-50 Test Questions

EC-Council Information Security Manager (E|ISM) 512-50 Test Questions

Share this post

Leave a Reply Cancel reply

Related Posts