712-50 Updated Dumps (V11.02) – Maximize Your Chances of Success in the EC-Council Certified CISO (CCISO) Exam on the First Try

1. Credit card information, medical data, and government records are all examples of:

2. The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

3. The single most important consideration to make when developing your security program, policies, and processes is:

4. An organization's Information Security Policy is of MOST importance because

5. Developing effective security controls is a balance between:

6. The PRIMARY objective for information security program development should be:

7. Which of the following should be determined while defining risk management strategies?

8. Who in the organization determines access to information?

9. Which of the following is a benefit of information security governance?

10. Which of the following is the MOST important benefit of an effective security governance process?

11. The FIRST step in establishing a security governance program is to?

12. Which of the following has the GREATEST impact on the implementation of an information security

governance model?

13. From an information security perspective, information that no longer supports the main purpose of the business should be:

14. When briefing senior management on the creation of a governance process, the MOST important aspect should be:

15. Which of the following most commonly falls within the scope of an information security governance steering committee?

16. A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently.

Which of the following is the MOST likely reason for the policy shortcomings?

17. Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

18. The alerting, monitoring and life-cycle management of security related events is typically handled by the

19. One of the MAIN goals of a Business Continuity Plan is to

20. When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

21. Which of the following is considered the MOST effective tool against social engineering?

22. When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

23. Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?

24. In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

25. Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization’s products and services?

26. You have implemented a new security control.

Which of the following risk strategy options have you engaged in?

27. You have purchased a new insurance policy as part of your risk strategy.

Which of the following risk strategy options have you engaged in?

28. Risk that remains after risk mitigation is known as

29. After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of

30. When dealing with a risk management process, asset classification is important because it will impact the overall:

31. Which of the following intellectual Property components is focused on maintaining brand recognition?

32. The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

33. When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

34. What is a difference from the list below between quantitative and qualitative Risk Assessment?

35. What is the definition of Risk in Information Security?

36. Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

37. Which of the following is MOST important when dealing with an Information Security Steering committee:

38. A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards.

What immediate action should the information security manager take?

39. The PRIMARY objective of security awareness is to:

40. Which of the following is MOST likely to be discretionary?

41. Why is it vitally important that senior management endorse a security policy?

42. When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

43. What is the relationship between information protection and regulatory compliance?

44. Regulatory requirements typically force organizations to implement

45. When managing the security architecture for your company you must consider:

46. If your organization operates under a model of "assumption of breach", you should:

47. A method to transfer risk is to:

48. You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the

49. Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:

50. A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions.

This activity BEST demonstrates what part of a security program?

51. A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected.

Who must be informed of this incident?

52. A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program.

Which of the following qualifications and experience would be MOST desirable to find in a candidate?

53. An organization licenses and uses personal information for business operations, and a server containing that information has been compromised.

What kind of law would require notifying the owner or licensee of this incident?

54. An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced

concerns about sensitive data breaches but the decision is made to purchase.

What does this selection indicate?

55. An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied.

What is the NEXT logical step in applying the controls in the organization?

56. A security manager has created a risk program.

Which of the following is a critical part of ensuring the program is successful?

57. Which of the following international standards can be BEST used to define a Risk Management process in an organization?

58. An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System.

Which of the following international standards can BEST assist this organization?

59. A global retail company is creating a new compliance management process.

Which of the following regulations is of MOST importance to be tracked and managed by this process?

60. A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units.

Which of the following standards and guidelines can BEST address this organization’s need?

61. A global health insurance company is concerned about protecting confidential information.

Which of the following is of MOST concern to this organization?

62. In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

63. The exposure factor of a threat to your organization is defined by?

64. Risk is defined as:

65. What two methods are used to assess risk impact?

66. According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

67. You have recently drafted a revised information security policy.

From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?

68. The success of the Chief Information Security Officer is MOST dependent upon:

69. An organization information security policy serves to

70. Information security policies should be reviewed:

71. Who is responsible for securing networks during a security incident?

72. Which of the following is a critical operational component of an Incident Response Program (IRP)?

73. What is the first thing that needs to be completed in order to create a security program for your organization?

74. What is the main purpose of the Incident Response Team?

75. Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

76. Within an organization’s vulnerability management program, who has the responsibility to implement remediation actions?

77. The Information Security Management program MUST protect:

78. What is the MAIN reason for conflicts between Information Technology and Information Security programs?

79. The Information Security Governance program MUST:

80. A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure.

What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

81. When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

82. Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

83. Risk appetite directly affects what part of a vulnerability management program?

84. When choosing a risk mitigation method what is the MOST important factor?

85. Payment Card Industry (PCI) compliance requirements are based on what criteria?

86. Which of the following provides an audit framework?

87. Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

88. Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

89. The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

90. When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

91. What is the BEST way to achieve on-going compliance monitoring in an organization?

92. Which of the following is the MOST important for a CISO to understand when identifying threats?

93. Which of the following are the MOST important factors for proactively determining system vulnerabilities?

94. What role should the CISO play in properly scoping a PCI environment?

95. What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

96. What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

97. According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

98. Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

99. When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?

100. The regular review of a firewall ruleset is considered a