Exam 1: EC-Council Certified Incident Handler

Risk is defined as:

A security professional has been promoted to be the CISO of an organization.  The first task is to create a security policy for this organization.  The CISO creates and publishes the security policy.  This policy however, is ignored and not enforced consistently.  Which of the following is the MOST likely reason for the policy shortcomings?

You have implemented a new security control.  Which of the following risk strategy options have you engaged in?

Which of the following is considered the MOST effective tool against social engineering?

An organization information security policy serves to

An organization's Information Security Policy is of MOST importance because

A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

The success of the Chief Information Security Officer is MOST dependent upon:

Developing effective security controls is a balance between:

A global retail company is creating a new compliance management process.  Which of the following regulations is of MOST importance to be tracked and managed by this process?

Regulatory requirements typically force organizations to implement

After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD.  This is an example of

The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

Which of the following is MOST important when dealing with an Information Security Steering committee:

When briefing senior management on the creation of a governance process, the MOST important aspect should be:

Which of the following is MOST likely to be discretionary?

Which of the following most commonly falls within the scope of an information security governance steering committee?

Which of the following is a benefit of information security governance?

In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

If your organization operates under a model of "assumption of breach", you should: