512-50 Online Practice Questions and Answers

Which of the following international standards can be BEST used to define a Risk Management process in an organization?

A. National Institute for Standards and Technology 800-50 (NIST 800-50)

B. International Organization for Standardizations ?27005 (ISO-27005)

C. Payment Card Industry Data Security Standards (PCI-DSS)

D. International Organization for Standardizations ?27004 (ISO-27004)

The exposure factor of a threat to your organization is defined by?

A. Asset value times exposure factor

B. Annual rate of occurrence

C. Annual loss expectancy minus current cost of controls

D. Percentage of loss experienced due to a realized threat event

Who in the organization determines access to information?

A. Legal department

B. Compliance officer

C. Data Owner

D. Information security officer

You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the

A. Controlled mitigation effort

B. Risk impact comparison

C. Relative likelihood of event

D. Comparative threat analysis

Risk that remains after risk mitigation is known as

A. Persistent risk

B. Residual risk

C. Accepted risk

D. Non-tolerated risk

Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

A. Perform a vulnerability scan of the network

B. External penetration testing by a qualified third party

C. Internal Firewall ruleset reviews

D. Implement network intrusion prevention systems

The amount of risk an organization is willing to accept in pursuit of its mission is known as

A. Risk mitigation

B. Risk transfer

C. Risk tolerance

D. Risk acceptance

The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because

A. The IT team is not familiar in IT audit practices

B. This represents a bad implementation of the Least Privilege principle

C. This represents a conflict of interest

D. The IT team is not certified to perform audits

A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?

A. Lack of asset management processes

B. Lack of change management processes

C. Lack of hardening standards

D. Lack of proper access controls

A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?

A. Poor audit support for the security program

B. A lack of executive presence within the security program

C. Poor alignment of the security program to business needs

D. This is normal since business units typically resist security requirements

The process for identifying, collecting, and producing digital information in support of legal proceedings is called

A. chain of custody.

B. electronic discovery.

C. evidence tampering.

D. electronic review.

A key cybersecurity feature of a Personal Identification Verification (PIV) Card is:

A. Inability to export the private certificate/key

B. It can double as physical identification at the DMV

C. It has the user's photograph to help ID them

D. It can be used as a secure flash drive

What are the primary reasons for the development of a business case for a security project?

A. To estimate risk and negate liability to the company

B. To understand the attack vectors and attack sources

C. To communicate risk and forecast resource needs

D. To forecast usage and cost per software licensing

As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?

A. The existing IT environment.

B. The company business plan.

C. The present IT budget.

D. Other corporate technology trends.

A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization.

Which of the following principles does this best demonstrate?

A. Effective use of existing technologies

B. Create a comprehensive security awareness program and provide success metrics to business units

C. Proper budget management

D. Leveraging existing implementations