712-50 practice questions 121–130

1. Question 121 · 188 in bank

   As the CISO, you have been tasked with the execution of the company's key management program. You MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?

   • ADual Control
   • BSeparation of Duties
   • CSplit Knowledge
   • DLeast Privilege

   Show answer

   Answer: C

   Explanation

   Dual Control means that no one person should be able to manage your encryption keys. Creating, distributing, and defining access controls should require at least two individuals working together to accomplish the task. ---- Split Knowledge applies to the manual generation of encryption keys, or at any point where encryption keys are available in the clear. More than one person should be required to constitute or re-constitute a key in this situation. Seems A the right answer

   Source: Adapted from community discussion — Rufus1

   Next question

2. Question 122 · 188 in bank

   What is one key difference between Capital expenditures and Operating expenditures?

   • AOperating expense cannot be written off while Capital expense can
   • BOperating expenses can be depreciated over time and Capital expenses cannot
   • CCapital expenses cannot include salaries and Operating expenses can
   • DCapital expenditures allow for the cost to be depreciated over time and Operating does not

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Sometimes, salaries can be included as a capital expense (when you buy an asset, the installation labor cost can be capitalized as well), so C is not a good answer

   Source: Adapted from community discussion — GXG17

   Next question

3. Question 123 · 188 in bank

   Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?

   • ASegmentation controls.
   • BShadow applications.
   • CDeception technology.
   • DVulnerability management.

   Show answer

   Answer: C

   Explanation

   It is not B, Shadow application means the applications run by other business units without explicit permission of the IT department. The answer should be Deception technology . eg Honey pot is a type of deception technology

   Source: Adapted from community discussion — e_karma

   Next question

4. Question 124 · 188 in bank

   Which technology can provide a computing environment without requiring a dedicated hardware backend?

   • AMainframe server
   • BVirtual Desktop
   • CThin client
   • DVirtual Local Area Network

   Show answer

   Answer: B

   Next question

5. Question 125 · 188 in bank

   As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?

   • ARecovery Point Objective (RPO)
   • BDisaster Recovery Plan
   • CRecovery Time Objective (RTO)
   • DBusiness Continuity Plan

   Show answer

   Answer: C

   Explanation

   "Recovered timely" and "indicator" are in the question. DRP or BCP documents would not be classified as indicators, so it would be either RPO or RTO. RPO is not linked to timely recovery, but RTO is. so Answer is C.

   Source: Adapted from community discussion — Otto_Aulicino

   Next question

6. Question 126 · 188 in bank

   What are the three hierarchically related aspects of strategic planning and in which order should they be done?

   • A1) Information technology strategic planning, 2) Enterprise strategic planning, 3) Cybersecurity or information security strategic planning
   • B1) Cybersecurity or information security strategic planning, 2) Enterprise strategic planning, 3) Information technology strategic planning
   • C1) Enterprise strategic planning, 2) Information technology strategic planning, 3) Cybersecurity or information security strategic planning
   • D1) Enterprise strategic planning, 2) Cybersecurity or information security strategic planning, 3) Information technology strategic planning

   Show answer

   Answer: C

   Explanation

   The correct answer is C. 1) Enterprise strategic planning, 2) Information technology strategic planning, 3) Cybersecurity or information security strategic planning.

   Source: Adapted from community discussion — arifbhatkar

   Next question

7. Question 127 · 188 in bank

   Which of the following would negatively impact a log analysis of a multinational organization?

   • ACentralized log management
   • BEncrypted log files in transit
   • CEach node set to local time
   • DLog aggregation agent each node

   Show answer

   Answer: C

   Explanation

   he correct answer is C. Each node set to local time. Setting each node to local time would negatively impact a log analysis of a multinational organization. In order to perform effective log analysis, it is important to have consistent and standardized timestamps across all log entries. If each node within the organization is set to local time, it would introduce inconsistencies in the timestamps recorded in the log files, making it difficult to correlate events accurately and perform accurate analysis across different systems and regions.

   Source: Adapted from community discussion — arifbhatkar

   Next question

8. Question 128 · 188 in bank

   A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

   • AInternational Organization for Standardizations ג€" 22301 (ISO-22301)
   • BInformation Technology Infrastructure Library (ITIL)
   • CPayment Card Industry Data Security Standards (PCI-DSS)
   • DInternational Organization for Standardizations ג€" 27005 (ISO-27005)

   Show answer

   Answer: A

   Next question

9. Question 129 · 188 in bank

   Which of the following statements below regarding Key Performance indicators (KPIs) are true?

   • ADevelopment of KPI's are most useful when done independently
   • BThey are a strictly quantitative measure of success
   • CThey should be standard throughout the organization versus domain-specific so they are more easily correlated
   • DThey are a strictly qualitative measure of success

   Show answer

   Answer: C

   Explanation

   KPIs should be standardized throughout the organization to ensure consistency and comparability. This allows for easier correlation and benchmarking across different departments or business units.

   Source: Adapted from community discussion — arifbhatkar

   Next question

10. Question 130 · 188 in bank

    When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?

    • AOversees the organization's day-to-day operations, creating the policies and strategies that govern operations
    • BEnlisting support from key executives the information security program budget and policies
    • CCharged with developing and implementing policies designed to protect employees and customers' data from unauthorized access
    • DResponsible for the success or failure of the IT organization and setting strategic direction

    Show answer

    Answer: B

    Explanation

    Reference: https://www.investopedia.com/terms/c/cio.asp

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

712-50 practice, question 121. 188 questions available.