712-50 Sample Questions Answers

The PRIMARY objective of security awareness is to:

What is a Statement of Objectives (SOA)?

What is the primary difference between regulations and standards?

Who is responsible for securing networks during a security incident?

An organization has decided to develop an in-house BCM capability. The organization has determined it is best to follow a BCM standard published by the International Organization for Standardization (ISO).

The BEST ISO standard to follow that outlines the complete lifecycle of BCM is?

When managing a project, the MOST important activity in managing the expectations of stakeholders is:

What is the purpose of the statement of retained earnings of an organization?

When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?

With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:

An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.

What should the auditor’s NEXT step be?

As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.

Which is the BEST type of risk that defines this event?

You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.

Which control is MOST important to protect AI products?

The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to organizational implementation and management requirements. Which of the following principles does this BEST demonstrate?

ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.

Which metric would meet the requirement?

Who is responsible for verifying that audit directives are implemented?

You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO’s first mandate to you is to develop a cybersecurity compliance framework that will meet all the store’s compliance requirements.

Which of the following compliance standard is the MOST important to the organization?

Which of the following is the MOST effective method to counter phishing attacks?

Which of the following BEST mitigates ransomware threats?

What is an approach to estimating the strengths and weaknesses of alternatives used to determine options, which provide the BEST approach to achieving benefits while preserving savings called?

You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.

Which of the following is NOT documented in the SSP?

Which of the following are the triple constraints of project management?

The primary responsibility for assigning entitlements to a network share lies with which role?

Which of the following terms is used to describe countermeasures implemented to minimize risks to physical

property, information, and computing systems?

A Security Operations Manager is finding it difficult to maintain adequate staff levels to monitor security operations during off-hours. To reduce the impact of staff shortages and increase coverage during off-hours, the SecOps manager is considering outsourcing off-hour coverage.

What Security Operations Center (SOC) model does this BEST describe?

Optical biometric recognition such as retina scanning provides access to facilities through reading the unique characteristics of a person’s eye.

However, authorization failures can occur with individuals who have?

Which type of scan is used on the eye to measure the layer of blood vessels?

Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?

Annual Loss Expectancy is derived from the function of which two factors?

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.

After determining the audit findings are accurate, which of the following is the MOST logical next activity?

Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.

What action should you take FIRST?

As the Chief Information Security Officer, you want to ensure data shared securely, especially when shared with

third parties outside the organization. What protocol provides the ability to extend the network perimeter with

the use of encapsulation and encryption?

What process defines the framework of rules and practices by which a board of directors ensure accountability, fairness and transparency in an organization's relationship with its shareholders?

Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.

What is one proven method to account for common elements found within separate regulations and/or standards?

The process to evaluate the technical and non-technical security controls of an IT system to validate that a given design and implementation meet a specific set of security requirements is called

SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.

The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system’s scalability. This demonstrates which of the following?

What are the primary reasons for the development of a business case for a security project?

If the result of an NPV is positive, then the project should be selected. The net present value shows the present

value of the project, based on the decisions taken for its selection. What is the net present value equal to?

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals

the increasing need to address security consistently at the enterprise level. This new CISO, while confident with

skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.

From an Information Security Leadership perspective, which of the following is a MAJOR concern about the

CISO’s approach to security?

Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.

Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?

Involvement of senior management is MOST important in the development of:

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how

hardware and software is implemented and managed within the organization. Which of the following principles

does this best demonstrate?

Where does bottom-up financial planning primarily gain information for creating budgets?

You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.

Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?

When analyzing and forecasting a capital expense budget what are not included?

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.

The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?

What is meant by password aging?

Which of the following is a common technology for visual monitoring?

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.

Which of the following would be the FIRST step when addressing Information Security formally and consistently in this organization?

What type of attack requires the least amount of technical equipment and has the highest success rate?

What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?

Which of the following statements about Encapsulating Security Payload (ESP) is true?

One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?

Which of the following backup sites takes the longest recovery time?

Physical security measures typically include which of the following components?

While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?

SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:

What is the FIRST step in developing the vulnerability management program?

When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?

Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?

Security related breaches are assessed and contained through which of the following?

Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?

The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?

The process for identifying, collecting, and producing digital information in support of legal proceedings is called

Which wireless encryption technology makes use of temporal keys?

An anonymity network is a series of?

Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?

Which of the following is a countermeasure to prevent unauthorized database access from web applications?

Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?

Which of the following is the MAIN security concern for public cloud computing?

When you develop your audit remediation plan what is the MOST important criteria?

When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?

The regular review of a firewall ruleset is considered a

When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?

An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization’s IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process:

The amount of risk an organization is willing to accept in pursuit of its mission is known as

The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?

An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security

The effectiveness of an audit is measured by?

Which of the following is the MOST important goal of risk management?

How often should an environment be monitored for cyber threats, risks, and exposures?

An employee successfully avoids becoming a victim of a sophisticated spear phishing attack due to knowledge gained through the corporate information security awareness program. What type of control has been effectively utilized?

A missing/ineffective security control is identified. Which of the following should be the NEXT step?

Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.

Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?

To have accurate and effective information security policies how often should the CISO review the organization policies?

Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?

Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?

When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?

Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):

How often should the SSAE16 report of your vendors be reviewed?

You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?

Which of the following is a major benefit of applying risk levels?

The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?

Which of the following is considered a project versus a managed process?

A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:

Which of the following represents the BEST method of ensuring security program alignment to business needs?

Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?

Which of the following functions evaluates patches used to close software vulnerabilities of new systems to assure compliance with policy when implementing an information security program?

A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?

A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?

Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?

What oversight should the information security team have in the change management process for application security?

You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?

You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):

Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?

The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?

In effort to save your company money which of the following methods of training results in the lowest cost for the organization?

Which of the following is considered the MOST effective tool against social engineering?

What is the first thing that needs to be completed in order to create a security program for your organization?

An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?

Which of the following intellectual Property components is focused on maintaining brand recognition?

The Information Security Governance program MUST:

The single most important consideration to make when developing your security program, policies, and processes is:

You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the

Which of the following is the MOST important benefit of an effective security governance process?

When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

When briefing senior management on the creation of a governance process, the MOST important aspect should be:

A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of

Which of the following is MOST likely to be discretionary?

Risk is defined as:

Who in the organization determines access to information?

The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of: