Question 1

When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

Accepted Answer

A)  In promiscuous mode and only detect malicious traffic. 
B)  In-line and turn on blocking mode to stop malicious traffic. 
C)  In promiscuous mode and block malicious traffic. 
D)  In-line and turn on alert mode to stop malicious traffic. 
A)  In promiscuous mode and only detect malicious traffic. 
B)  In-line and turn on blocking mode to stop malicious traffic. 
C)  In promiscuous mode and block malicious traffic. 
D)  In-line and turn on alert mode to stop malicious traffic.

Question 2

What is the definition of Risk in Information Security?

Accepted Answer

A)  Risk = Probability x Impact 
B)  Risk = Threat x Probability 
C)  Risk = Financial Impact x Probability 
D)  Risk = Impact x Threat 
A)  Risk = Probability x Impact 
B)  Risk = Threat x Probability 
C)  Risk = Financial Impact x Probability 
D)  Risk = Impact x Threat

Question 3

What is a difference from the list below between quantitative and qualitative Risk Assessment?

Accepted Answer

A)  Quantitative risk assessments result in an exact number (in monetary terms) 
B)  Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green) 
C)  Qualitative risk assessments map to business objectives 
D)  Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green) 
A)  Quantitative risk assessments result in an exact number (in monetary terms) 
B)  Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green) 
C)  Qualitative risk assessments map to business objectives 
D)  Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

Question 4

One of the MAIN goals of a Business Continuity Plan is to

Accepted Answer

A)  Ensure all infrastructure and applications are available in the event of a disaster 
B)  Allow all technical first-responders to understand their roles in the event of a disaster 
C)  Provide step by step plans to recover business processes in the event of a disaster 
D)  Assign responsibilities to the technical teams responsible for the recovery of all data. 
A)  Ensure all infrastructure and applications are available in the event of a disaster 
B)  Allow all technical first-responders to understand their roles in the event of a disaster 
C)  Provide step by step plans to recover business processes in the event of a disaster 
D)  Assign responsibilities to the technical teams responsible for the recovery of all data.

Question 5

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

Accepted Answer

A)  High risk environments 6 months, low risk environments 12 months 
B)  Every 12 months 
C)  Every 18 months 
D)  Every six months 
A)  High risk environments 6 months, low risk environments 12 months 
B)  Every 12 months 
C)  Every 18 months 
D)  Every six months

Question 6

You have purchased a new insurance policy as part of your risk strategy.  Which of the following risk strategy options have you engaged in?

Accepted Answer

A)  Risk Avoidance 
B)  Risk Acceptance 
C)  Risk Transfer 
D)  Risk Mitigation 
A)  Risk Avoidance 
B)  Risk Acceptance 
C)  Risk Transfer 
D)  Risk Mitigation

Question 7

The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

Accepted Answer

A)  Due Protection 
B)  Due Care 
C)  Due Compromise 
D)  Due process 
A)  Due Protection 
B)  Due Care 
C)  Due Compromise 
D)  Due process

Question 8

What two methods are used to assess risk impact?

Accepted Answer

A)  Cost and annual rate of expectance 
B)  Subjective and Objective 
C)  Qualitative and percent of loss realized 
D)  Quantitative and qualitative 
A)  Cost and annual rate of expectance 
B)  Subjective and Objective 
C)  Qualitative and percent of loss realized 
D)  Quantitative and qualitative

Question 9

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Accepted Answer

A)  Reduction of budget 
B)  Decreased security awareness 
C)  Improper use of information resources 
D)  Fines for regulatory non-compliance 
A)  Reduction of budget 
B)  Decreased security awareness 
C)  Improper use of information resources 
D)  Fines for regulatory non-compliance

Question 10

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

Accepted Answer

A)  Threat 
B)  Vulnerability 
C)  Attack vector 
D)  Exploitation 
A)  Threat 
B)  Vulnerability 
C)  Attack vector 
D)  Exploitation

Question 11

A global health insurance company is concerned about protecting confidential information.  Which of the following is of MOST concern to this organization?

Accepted Answer

A)  Compliance to the Payment Card Industry (PCI) regulations. 
B)  Alignment with financial reporting regulations for each country where they operate. 
C)  Alignment with International Organization for Standardization (ISO) standards. 
D)  Compliance with patient data protection regulations for each country where they operate. 
A)  Compliance to the Payment Card Industry (PCI) regulations. 
B)  Alignment with financial reporting regulations for each country where they operate. 
C)  Alignment with International Organization for Standardization (ISO) standards. 
D)  Compliance with patient data protection regulations for each country where they operate.

Question 12

An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?

Accepted Answer

A)  A high threat environment 
B)  A low risk tolerance environment 
C)  I low vulnerability environment 
D)  A high risk tolerance environment 
A)  A high threat environment 
B)  A low risk tolerance environment 
C)  I low vulnerability environment 
D)  A high risk tolerance environment

Question 13

When managing the security architecture for your company you must consider:

Accepted Answer

A)  Security and IT Staff size 
B)  Company Values 
C)  Budget 
D)  All of the above 
A)  Security and IT Staff size 
B)  Company Values 
C)  Budget 
D)  All of the above

Question 14

A method to transfer risk is to:

Accepted Answer

A)  Implement redundancy 
B)  move operations to another region 
C)  purchase breach insurance 
D)  Alignment with business operations 
A)  Implement redundancy 
B)  move operations to another region 
C)  purchase breach insurance 
D)  Alignment with business operations

Question 15

Payment Card Industry (PCI) compliance requirements are based on what criteria?

Accepted Answer

A)  The types of cardholder data retained 
B)  The duration card holder data is retained 
C)  The size of the organization processing credit card data 
D)  The number of transactions performed per year by an organization 
A)  The types of cardholder data retained 
B)  The duration card holder data is retained 
C)  The size of the organization processing credit card data 
D)  The number of transactions performed per year by an organization

Question 16

When choosing a risk mitigation method what is the MOST important factor?

Accepted Answer

A)  Approval from the board of directors 
B)  Cost of the mitigation is less than the risk 
C)  Metrics of mitigation method success 
D)  Mitigation method complies with PCI regulations 
A)  Approval from the board of directors 
B)  Cost of the mitigation is less than the risk 
C)  Metrics of mitigation method success 
D)  Mitigation method complies with PCI regulations

Question 17

A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

Accepted Answer

A)  International Organization for Standardizations - 22301 (ISO-22301) 
B)  Information Technology Infrastructure Library (ITIL) 
C)  Payment Card Industry Data Security Standards (PCI-DSS) 
D)  International Organization for Standardizations - 27005 (ISO-27005) 
A)  International Organization for Standardizations - 22301 (ISO-22301) 
B)  Information Technology Infrastructure Library (ITIL) 
C)  Payment Card Industry Data Security Standards (PCI-DSS) 
D)  International Organization for Standardizations - 27005 (ISO-27005)

Question 18

A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

Accepted Answer

A)  Audit validation 
B)  Physical control testing 
C)  Compliance management 
D)  Security awareness training 
A)  Audit validation 
B)  Physical control testing 
C)  Compliance management 
D)  Security awareness training

Question 19

Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

Accepted Answer

A)  Need to comply with breach disclosure laws 
B)  Need to transfer the risk associated with hosting PII data 
C)  Need to better understand the risk associated with using PII data 
D)  Fiduciary responsibility to safeguard credit card information 
A)  Need to comply with breach disclosure laws 
B)  Need to transfer the risk associated with hosting PII data 
C)  Need to better understand the risk associated with using PII data 
D)  Fiduciary responsibility to safeguard credit card information

Question 20

The exposure factor of a threat to your organization is defined by?

Accepted Answer

A)  Asset value times exposure factor 
B)  Annual rate of occurrence 
C)  Annual loss expectancy minus current cost of controls 
D)  Percentage of loss experienced due to a realized threat event 
A)  Asset value times exposure factor 
B)  Annual rate of occurrence 
C)  Annual loss expectancy minus current cost of controls 
D)  Percentage of loss experienced due to a realized threat event

When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

What is the definition of Risk in Information Security?

What is a difference from the list below between quantitative and qualitative Risk Assessment?

One of the MAIN goals of a Business Continuity Plan is to

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?

The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

What two methods are used to assess risk impact?

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?

When managing the security architecture for your company you must consider:

A method to transfer risk is to:

Payment Card Industry (PCI) compliance requirements are based on what criteria?

When choosing a risk mitigation method what is the MOST important factor?

A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

The exposure factor of a threat to your organization is defined by?

Certified Network Defender

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters

Exam 1: EC-Council Certified Incident Handler

When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

What is the definition of Risk in Information Security?

What is a difference from the list below between quantitative and qualitative Risk Assessment?

One of the MAIN goals of a Business Continuity Plan is to

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?

The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

What two methods are used to assess risk impact?

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?

When managing the security architecture for your company you must consider:

A method to transfer risk is to:

Payment Card Industry (PCI) compliance requirements are based on what criteria?

When choosing a risk mitigation method what is the MOST important factor?

A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

The exposure factor of a threat to your organization is defined by?

Certified Network Defender

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters