512-50 Dumps To Pass EC-COUNCIL Exam in 24 Hours - Exam4Labs
Buy Latest 512-50 Exam Q&A PDF - One Year Free Update
NEW QUESTION 90
Which of the following best describes the purpose of the International Organization for Standardization (ISO)
27002 standard?
- A. To provide effective security management practice and to provide confidence in inter-organizational dealings
- B. To provide a common basis for developing organizational security standards
- C. To give information security management recommendations to those who are responsible for initiating, implementing, or maintaining security in their organization.
- D. To established guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization
Answer: D
NEW QUESTION 91
Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting?
(choose the BEST answer):
- A. moderate risk-tolerance
- B. medium-high risk-tolerance
- C. low risk-tolerance
- D. high risk-tolerance
Answer: C
NEW QUESTION 92
What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?
- A. Evaluate risk avoidance criteria
- B. Mitigate risk
- C. Perform a risk assessment
- D. Determine appetite
Answer: B
NEW QUESTION 93
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
- A. Risk Assessment
- B. Incident Response
- C. Risk Management
- D. Network Security administration
Answer: C
NEW QUESTION 94
When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?
- A. What is the value of the assets at risk?
- B. How many servers do you have?
- C. How many credit card records are stored?
- D. What is the scope of the certification?
Answer: D
NEW QUESTION 95
A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?
- A. International Organization for Standardizations - 27005 (ISO-27005)
- B. Payment Card Industry Data Security Standards (PCI-DSS)
- C. Information Technology Infrastructure Library (ITIL)
- D. International Organization for Standardizations - 22301 (ISO-22301)
Answer: D
NEW QUESTION 96
Which of the following information may be found in table top exercises for incident response?
- A. Security control selection
- B. Process improvements
- C. Real-time to remediate
- D. Security budget augmentation
Answer: B
NEW QUESTION 97
Which represents PROPER separation of duties in the corporate environment?
- A. Finance has access to Human Resources data
- B. Developers and Network teams both have admin rights on servers
- C. Information Security and Network teams perform two distinct functions
- D. Information Security and Identity Access Management teams perform two distinct functions
Answer: C
NEW QUESTION 98
What is the primary reason for performing vendor management?
- A. To define the partnership for long-term success
- B. To understand the risk coverage that are being mitigated by the vendor
- C. To document the relationship between the company and the vendor
- D. To establish a vendor selection process
Answer: B
NEW QUESTION 99
Which type of scan is used on the eye to measure the layer of blood vessels?
- A. Retinal scan
- B. Facial recognition scan
- C. Iris scan
- D. Signature kinetics scan
Answer: A
NEW QUESTION 100
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
- A. Allow the business units to decide which controls apply to their systems, such as the encryption of sensitive data
- B. Provide the business units with control mandates and schedules of audits for compliance validation
- C. Ensure business units are involved in the creation of controls and defining conditions under which they must be applied
- D. Create separate controls for the business units based on the types of business and functions they perform
Answer: C
NEW QUESTION 101
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization's needs.
The CISO discovers the scalability issue will only impact a small number of network segments. What is the next logical step to ensure the proper application of risk management methodology within the two-facto implementation project?
- A. Create new use cases for operational use of the solution
- B. Report the deficiency to the audit team and create process exceptions
- C. Determine if sufficient mitigating controls can be applied
- D. Decide to accept the risk on behalf of the impacted business units
Answer: C
Explanation:
Explanation
Scenario8
NEW QUESTION 102
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Once supervisors and data owners have approved requests, information system administrators will implement
- A. Operational control(s)
- B. Policy control(s)
- C. Management control(s)
- D. Technical control(s)
Answer: D
NEW QUESTION 103
The PRIMARY objective of security awareness is to:
- A. Meet legal and regulatory requirements.
- B. Ensure that security policies are read.
- C. Encourage security-conscious employee behavior.
- D. Put employees on notice in case follow-up action for noncompliance is necessary
Answer: C
NEW QUESTION 104
Which of the following organizations is typically in charge of validating the implementation and effectiveness of security controls?
- A. Security Operations
- B. Security Administrators
- C. Risk Management
- D. Internal/External Audit
Answer: D
NEW QUESTION 105
A digital signature addresses which of the following concerns?
- A. Message alteration
- B. Message copying
- C. Unauthorized reading
- D. Message theft
Answer: A
Explanation:
Reference: https://www.entrust.com/resources/certificate-solutions/learn/digital-signatures
NEW QUESTION 106
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?
- A. Firewall, exchange, web server, intrusion detection system (IDS)
- B. Servers, routers, switches, modem
- C. IDS, syslog, router, switches
- D. Firewall, anti-virus console, IDS, syslog
Answer: D
NEW QUESTION 107
Acceptable levels of information security risk tolerance in an organization should be determined by?
- A. Corporate compliance committee
- B. CEO and board of director
- C. Corporate legal counsel
- D. CISO with reference to the company goals
Answer: B
NEW QUESTION 108
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
- A. Demonstrate executive support with written mandates for security policy adherence
- B. Create collaborative risk management approaches within the organization
- C. Perform increased audits of security processes and procedures
- D. Provide clear communication of security requirements throughout the organization
Answer: B
NEW QUESTION 109
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
- A. Risk Avoidance, Threat Level, and Consequences of Compromise
- B. Reputational Impact, Financial Impact, and Risk of Compromise
- C. Risk Transfer, Reputational Impact, and Consequences of Compromise
- D. Threat Level, Risk of Compromise, and Consequences of Compromise
Answer: D
NEW QUESTION 110
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
- A. Public
- B. Read
- C. Execute
- D. Administrator
Answer: A
NEW QUESTION 111
What oversight should the information security team have in the change management process for application security?
- A. Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production
- B. Information security should be informed of changes to applications only
- C. Information security should be aware of all application changes and work with developers before changes are deployed in production
- D. Development team should tell the information security team about any application security flaws
Answer: A
NEW QUESTION 112
The effectiveness of an audit is measured by?
- A. The number of actionable items in the recommendations
- B. How the recommendations directly support the goals of the company
- C. The number of security controls the company has in use
- D. How it exposes the risk tolerance of the company
Answer: B
NEW QUESTION 113
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
- A. ISO 27005
- B. ISO 27002
- C. ISO 27004
- D. ISO 27001
Answer: A
NEW QUESTION 114
......
Who should take the 512-50 exam
The EC-Council Information Security Manager 512-50 Exam certification is an internationally-recognized validation that identifies persons who earn it as possessing skilled as an EC-Council Information Security Manager. If a candidate wants significant improvement in career growth needs enhanced knowledge, skills, and talents. The EC-Council Information Security Manager 512-50 Exam certification provides proof of this advanced knowledge and skill. If a candidate has knowledge of associated technologies and skills that are required to pass EC-Council Information Security Manager 512-50 Exam then he should take this exam.
Download the Latest 512-50 Dump - 2022 512-50 Exam Question Bank: https://actual4test.exam4labs.com/512-50-practice-torrent.html