712-50 practice questions 11–20

1. Question 11 · 188 in bank

   Which of the following BEST describes an international standard framework that is based on the security model Information Technology-Code of Practice for Information Security Management?

   • ANational Institute of Standards and technology Special Publication SP 800-12
   • BRequest for Comment 2196
   • CInternational Organization for Standardization 27001
   • DNational Institute of Standards and technology Special Publication SP 800-26

   Show answer

   Answer: C

   Next question

2. Question 12 · 188 in bank

   The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization's

   • ARisk Management Program
   • BAnti-Spam controls
   • CIdentity and Access Management Program
   • DSecurity Awareness Program

   Show answer

   Answer: D

   Next question

3. Question 13 · 188 in bank

   Which of the following has the GREATEST impact on the implementation of an information security governance model?

   • AComplexity of organizational structure
   • BDistance between physical locations
   • COrganizational budget
   • DNumber of employees

   Show answer

   Answer: A

   Next question

4. Question 14 · 188 in bank

   You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?

   • ADetermine program ownership to implement compensating controls
   • BSend a report to executive peers and business unit owners detailing your suspicions
   • CValidate that security awareness program content includes information about the potential vulnerability
   • DConduct a throughout risk assessment against the current implementation to determine system functions

   Show answer

   Answer: D

   Next question

5. Question 15 · 188 in bank

   Which is the BEST solution to monitor, measure, and report changes to critical data in a system?

   • ASNMP traps
   • BSyslog
   • CFile integrity monitoring
   • DApplication logs

   Show answer

   Answer: D

   Next question

6. Question 16 · 188 in bank

   When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

   • AEradication
   • BEscalation
   • CContainment
   • DRecovery

   Show answer

   Answer: C

   Explanation

   This philosophy comes from Medicine. First you have to contain it like Pandemic. Close it -> fix the problem. Correct answer is C

   Source: Adapted from community discussion — musagul

   Next question

7. Question 17 · 188 in bank

   A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be your first priority?

   • AReview the recommendations and follow up to see if audit implemented the changes
   • BMeet with audit team to determine a timeline for corrections
   • CHave internal audit conduct another audit to see what has changed.
   • DContract with an external audit company to conduct an unbiased audit

   Show answer

   Answer: C

   Next question

8. Question 18 · 188 in bank

   Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

   • APlan-Check-Do-Act
   • BPlan-Select-Implement-Evaluate
   • CPlan-Do-Check-Act
   • DSCORE (Security Consensus Operational Readiness Evaluation)

   Show answer

   Answer: C

   Next question

9. Question 19 · 188 in bank

   When you develop your audit remediation plan what is the MOST important criteria?

   • ATo validate the remediation process with the auditor.
   • BTo validate that the cost of the remediation is less than risk of the finding.
   • CTo remediate half of the findings before the next audit.
   • DTo remediate all of the findings before the next audit.

   Show answer

   Answer: B

   Next question

10. Question 20 · 188 in bank

    What is the relationship between information protection and regulatory compliance?

    • AThat all information in an organization must be protected equally.
    • BThe information required to be protected by regulatory mandate does not have to be identified in the organizations data classification policy.
    • CThere is no relationship between the two.
    • DThat the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

712-50 practice, question 11. 188 questions available.