Topic 2: IS Management Controls and Auditing Management
In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?
A.
Internal Audit
B.
Database Administration
C.
Information Security
D.
Compliance
Information Security
Dataflow diagrams are used by IT auditors to:
A.
Order data hierarchically
B.
Highlight high-level data definitions.
C.
Graphically summarize data paths and storage processes.
D.
Portray step-by-step details of data generation.
Graphically summarize data paths and storage processes.
When you develop your audit remediation plan what is the MOST important criteria?
A.
To remediate half of the findings before the next audit.
B.
To remediate all of the findings before the next audit.
C.
To validate that the cost of the remediation is less than the risk of the finding.
D.
To validate the remediation process with the auditor.
To validate that the cost of the remediation is less than the risk of the finding.
A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?
A.
Have internal audit conduct another audit to see what has changed.
B.
Contract with an external audit company to conduct an unbiased audit
C.
Review the recommendations and follow up to see if audit implemented the changes
D.
Meet with audit team to determine a timeline for corrections
Review the recommendations and follow up to see if audit implemented the changes
The patching and monitoring of systems on a consistent schedule is required by?
A.
Local privacy laws
B.
Industry best practices
C.
Risk Management frameworks
D.
Audit best practices
Risk Management frameworks
As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?
A.
Executive summary
B.
Penetration test agreement
C.
Names and phone numbers of those who conducted the audit
D.
Business charter
Executive summary
Which of the following activities results in change requests?
A.
Preventive actions
B.
Inspection
C.
Defect repair
D.
Corrective actions
Defect repair
Which is the BEST solution to monitor, measure, and report changes to critical data in a system?
A.
Application logs
B.
File integrity monitoring
C.
SNMP traps
D.
Syslog
File integrity monitoring
Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?
A.
International Organization for Standardization 27001
B.
National Institute of Standards and Technology Special Publication SP 800-12
C.
Request For Comment 2196
D.
National Institute of Standards and Technology Special Publication SP 800-26
International Organization for Standardization 27001
Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?
A.
Single loss expectancy multiplied by the annual rate of occurrence
B.
Total loss expectancy multiplied by the total loss frequency
C.
Value of the asset multiplied by the loss expectancy
D.
Replacement cost multiplied by the single loss expectancy
Single loss expectancy multiplied by the annual rate of occurrence
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?
A.
Servers, routers, switches, modem
B.
Firewall, exchange, web server, intrusion detection system (IDS)
C.
Firewall, anti-virus console, IDS, syslog
D.
IDS, syslog, router, switches
Firewall, anti-virus console, IDS, syslog
Which of the following is the MOST important goal of risk management?
A.
Identifying the risk
B.
Finding economic balance between the impact of the risk and the cost of the control
C.
Identifying the victim of any potential exploits
D.
Assessing the impact of potential threats
Finding economic balance between the impact of the risk and the cost of the control
| Page 13 out of 38 Pages |
| 789101112131415161718 |
| 712-50 Practice Test Home |
Real-World Scenario Mastery: Our 712-50 practice exam don't just test definitions. They present you with the same complex, scenario-based problems you'll encounter on the actual exam.
Strategic Weakness Identification: Each practice session reveals exactly where you stand. Discover which domains need more attention, before EC-Council Certified CISO (CCISO) exam day arrives.
Confidence Through Familiarity: There's no substitute for knowing what to expect. When you've worked through our comprehensive 712-50 practice exam questions pool covering all topics, the real exam feels like just another practice session.
Copyright © All Rights Reserved