712-50 practice questions 141–150

1. Question 141 · 188 in bank

   Many successful cyber-attacks currently include:

   • APhishing Attacks
   • BMisconfigurations
   • CSocial engineering
   • DAll of these

   Show answer

   Answer: D

   Explanation

   D. All of these Many successful cyber-attacks today involve a combination of various techniques, including phishing attacks, misconfigurations, and social engineering. Phishing attacks are a common method used by attackers to trick individuals into revealing sensitive information or performing malicious actions. Misconfigurations in software, systems, or network devices can create vulnerabilities that attackers exploit to gain unauthorized access or disrupt services. Social engineering techniques involve manipulating individuals through psychological manipulation or deception to gain unauthorized access or sensitive information.

   Source: Adapted from community discussion — arifbhatkar

   Next question

2. Question 142 · 188 in bank

   Which of the following strategies provides the BEST response to a ransomware attack?

   • AReal-time off-site replication
   • BDaily incremental backup
   • CDaily full backup
   • DDaily differential backup

   Show answer

   Answer: A

   Explanation

   Explanation: Real-time off-site replication: This strategy involves continuously copying data to an off-site location in real-time. This ensures that the most recent data is always available and can be quickly restored in case of a ransomware attack. Real-time replication minimizes data loss to the shortest possible time frame, as data is constantly being backed up as changes are made.

   Source: Adapted from community discussion — johndoe69

   Next question

3. Question 143 · 188 in bank

   XYZ is a publicly-traded software development company. Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?

   • AChief Financial Officer (CFO)
   • BChief Software Architect (CIO)
   • CCISO
   • DChief Executive Officer (CEO)

   Show answer

   Answer: D

   Explanation

   D. Chief Executive Officer (CEO). The CEO is ultimately accountable to the shareholders in the event of a cybersecurity breach. As the highest-ranking executive in the organization, the CEO has overall responsibility for the company's performance, including its financial, operational, and security aspects. Shareholders entrust the CEO with the responsibility of safeguarding the company's assets, ensuring its success, and mitigating risks

   Source: Adapted from community discussion — arifbhatkar

   Next question

4. Question 144 · 188 in bank

   A Security Operations (SecOps) Manager is considering implementing threat hunting to be able to make better decisions on protecting information and assets. What is the MAIN goal of threat hunting to the SecOps Manager?

   • AImprove discovery of valid detected events
   • BEnhance tuning of automated tools to detect and prevent attacks
   • CReplace existing threat detection strategies
   • DValidate patterns of behavior related to an attack

   Show answer

   Answer: D

   Explanation

   Reference: https://www.techtarget.com/searchsecurity/feature/7-SecOps-roles-and-responsibilities-for-the-modern-enterprise

   Next question

5. Question 145 · 188 in bank

   A bastion host should be placed:

   • AInside the DMZ
   • BIn-line with the data center firewall
   • CBeyond the outer perimeter firewall
   • DAs the gatekeeper to the organization's honeynet

   Show answer

   Answer: A

   Next question

6. Question 146 · 188 in bank

   A Security Operations Manager is finding it difficult to maintain adequate staff levels to monitor security operations during off-hours. To reduce the impact of staff shortages and increase coverage during off-hours, the SecOps manager is considering outsourcing off-hour coverage. What Security Operations Center (SOC) model does this BEST describe?

   • AVirtual SOC
   • BIn-house SOC
   • CSecurity Network Operations Center (SNOC)
   • DHybrid SOC

   Show answer

   Answer: D

   Explanation

   A Hybrid SOC combines in-house security operations capabilities with outsourced services. In this case, the organization is considering outsourcing off-hour coverage to address staffing challenges. By leveraging an external service provider for off-hour monitoring, the organization can enhance coverage during those periods while still maintaining an in-house SOC for regular business hours.

   Source: Adapted from community discussion — arifbhatkar

   Next question

7. Question 147 · 188 in bank

   As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity. The performance quality audit activity is done in what project management process group?

   • AExecuting
   • BControlling
   • CPlanning
   • DClosing

   Show answer

   Answer: A

   Explanation

   B. Controlling The performance quality audit activity falls within the Controlling process group in project management. This process group focuses on monitoring and controlling project performance, ensuring that the project stays on track, and making any necessary adjustments to keep the project aligned with its objectives. Quality audits help to assess whether the project is following the defined processes, standards, and guidelines to achieve the desired level of quality.

   Source: Adapted from community discussion — Pika26

   References

   • pmi.org documentation

   Next question

8. Question 148 · 188 in bank

   A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy. What is the MOST effective method of risk analysis to provide the CFO with the information required?

   • AConduct a quantitative risk assessment
   • BConduct a hybrid risk assessment
   • CConduct a subjective risk assessment
   • DConduct a qualitative risk assessment

   Show answer

   Answer: A

   Explanation

   The MOST effective method of risk analysis to provide the CFO with the information required in this scenario would be A. Conduct a quantitative risk assessment

   Source: Adapted from community discussion — arifbhatkar

   Next question

9. Question 149 · 188 in bank

   What is the MOST important reason for monitoring Key Risk Indicators (KRIs)?

   • AThe organization's risk profile is subject to change
   • BThe processes used to develop KRIs can be fraught with errors and must be rechecked periodically
   • CEffective KRIs will reduce the time to implement risk treatment options
   • DA large number of KRIs is a critical part of continuous improvement of management

   Show answer

   Answer: A

   Next question

10. Question 150 · 188 in bank

    You have been hired as the CISO for a hospital. The hospital currently deploys a hybrid cloud model using a Software as a Service (SaaS) product for healthcare clearinghouse services. The Health Insurance Portability and Accountability Act (HIPAA) require an agreement between Cloud Service Providers (CSP) and the covered entity. Based on HIPAA, once the agreement between the covered entity and the CSP signed, the CSP is ____________?

    • APartially liable for compliance with the applicable requirements of the HIPAA Rules
    • BDirectly liable for compliance with the applicable requirements of the HIPAA Rules
    • CNot liable for compliance with the applicable requirements of the HIPAA Rules
    • DIndirectly liable for compliance with the applicable requirements of the HIPAA Rules

    Show answer

    Answer: B

    Explanation

    In the context of a hybrid cloud model where both on-premises infrastructure and cloud services are used, the Cloud Service Provider (CSP) is still considered a Business Associate under HIPAA if it handles protected health information (PHI) on behalf of the covered entity. Regardless of whether the PHI is stored or processed on-premises or in the cloud, the HIPAA regulations apply to any entity that has access to PHI. Therefore, based on HIPAA, once the agreement between the covered entity (the hospital) and the CSP is signed, the CSP is: B. Directly liable for compliance with the applicable requirements of the HIPAA Rules

    Source: Adapted from community discussion — johndoe69

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

712-50 practice, question 141. 188 questions available.