712-50無料問題集「EC-COUNCIL EC-Council Certified CISO (CCISO)」

質問 1

An ineffective security control was identified during an audit. What is the next action that should happen?

（A）Perform another complete audit to verify the finding

（B）Escalate the issue to the helpdesk function

（C）Establish Key Risk Indicators (KRIs)

（D）Perform a risk assessment on the impacted system or process

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

（A）Determine the risk tolerance

（B）Perform an asset classification

（C）Analyze existing controls on systems

（D）Create an architecture gap analysis

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

What is the definition of Risk in Information Security?

（A）Risk = Financial Impact x Probability

（B）Risk = Impact x Threat

（C）Risk = Threat x Probability

（D）Risk = Probability x Impact

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

Which of the following are necessary to formulate responses to external audit findings?

（A）Internal Audit, Management, and Technical Staff

（B）Technical Staff, Budget Authority, Management

（C）Internal Audit, Budget Authority, Management

（D）Technical Staff, Internal Audit, Budget Authority

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

Which of the following is a primary method of applying consistent configurations to IT systems?

（A）Patching

（B）Templates

（C）Audits

（D）Administration

正解：A 解答を投票する

質問 6

A stakeholder is a person or group:

（A）Vested in the success and/or failure of a project or initiative and is tied to the project budget.

（B）That has budget authority.

（C）That will ultimately use the system.

（D）Vested in the success and/or failure of a project or initiative regardless of budget implications.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization's IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process:

（A）Number of change orders processed

（B）Number of unplanned outages

（C）Number of change orders rejected

（D）Number and length of planned outages

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

Which publication serves as a resource of enterprise security-based standards and BEST practices?

（A）ISO 27004

（B）PCI DSS

（C）NIS Standard Publication 800-53 R5

（D）HIPAA

正解：C 解答を投票する

質問 9

The exposure factor of a threat to your organization is defined by?

（A）Annual loss expectancy minus current cost of controls

（B）Annual rate of occurrence

（C）Percentage of loss experienced due to a realized threat event

（D）Asset value times exposure factor

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

In effort to save your company money which of the following methods of training results in the lowest cost for the organization?

（A）Distance learning/Web seminars

（B）Formal Class

（C）Self -Study (noncomputerized)

（D）One-One Training

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:

（A）Scanning for viruses

（B）Baselining of computer systems

（C）Password changes

（D）Controlled spear phishing campaigns

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

Which of the following is the BEST choice of security metrics to present to a Board of Directors?

（A）Critical and high vulnerabilities on printers and faxes

（B）Critical and high vulnerabilities within production environments

（C）All vulnerabilities that impact critical production servers

（D）Vulnerabilities found on servers and desktops

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 13

You are evaluating an audit report and notice it only contains lists of findings and technical diagrams. What additional component should be integrated?

（A）Business risk appetite statements

（B）Audit team contact information

（C）Prior audit reports

（D）Executive summary

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 14

Which of the following would be used to measure the effectiveness of an Information Security Management System (ISMS)?

（A）Control Objectives for Information and Related Technology (COBIT)

（B）International Organization for Standardization (ISO) 27005

（C）Information Technology Infrastructure Library (ITIL)

（D）International Organization for Standardization (ISO) 27004

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 15

A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?

（A）A security organization that is adequately staffed to apply required mitigation strategies and regulatory compliance solutions

（B）A clear set of security policies and procedures that are more concept-based than controls-based

（C）A complete inventory of Information Technology assets including infrastructure, networks, applications and data

（D）A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

712-50 無料問題集「EC-COUNCIL EC-Council Certified CISO (CCISO)」

弊社を連絡する

関連リンク

トップ試験