Eccouncil EC-Council Certified CISO 712-50 CCISO Exam Questions

Page: 1 / 14
Total 637 questions
Question 1

Management]

Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?



Answer : B

*

Risk appetite defines the amount and type of risk an organization is willing to accept in pursuit of its objectives.

Knowing the potential financial loss the organization is willing to tolerate reflects its risk appetite, guiding decisions around risk management and investment in mitigation measures.

* Why Other Options Are Incorrect:

A . Cost benefit: Cost-benefit analysis evaluates the economic trade-offs of an action but does not define the level of acceptable risk.

C . Business continuity: Focuses on maintaining operations during disruptions, not the organization's tolerance for financial loss.

D . Likelihood of impact: Refers to the probability of a risk occurring, not the willingness to accept financial loss.

* EC-Council CISO Reference:

The CISO role involves aligning risk appetite with business strategy, as highlighted in the program's risk management framework.


Question 2

Which security technologies are MOST critical to implementing a zero trust model?



Answer : D


Question 3

An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.

What should the auditor's NEXT step be?



Answer : D

Proper Asset Classification Responsibility:

Asset classification is the responsibility of the asset owner, as they have the best understanding of the asset's value and sensitivity.

The auditor's role is to identify gaps and guide the process, not to directly reclassify assets.

Why Not Other Options:

A: Immediate board notification is premature without thorough documentation and recommendations.

B: The auditor does not have the authority or detailed knowledge to classify assets.

C: Documenting the issue is part of the process but does not resolve the problem.

References:

EC-Council CISO Material: Asset Management and Classification Best Practices.


Question 4

Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.

Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.



Answer : B

* Best Technology for Preventing Data Exfiltration

DLP solutions monitor, detect, and prevent unauthorized data transfers, ensuring sensitive information does not leave the network.

DLP would have detected and blocked the analyst's attempt to upload data to a cloud service.

* Why Not Other Options?

A . Security guards: Ineffective for digital data exfiltration.

C . Rigorous syslog reviews: Reactive, not preventive.

D . Intrusion Detection Systems (IDS): IDS focuses on detecting external threats, not internal data transfers.

* EC-Council References

Highlights DLP as a critical tool for protecting sensitive data from unauthorized access and movement.


Question 5

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.

Your Corporate Information Security Policy should include which of the following?



Answer : B

A corporate information security policy must define roles and responsibilities to ensure clear accountability and effective execution of security measures.

Components of a Security Policy:

Roles and Responsibilities: Identifies stakeholders (e.g., CISO, IT staff, employees) and their security-related duties.

Excludes operational details like desktop configuration standards or incident response contacts, which belong in procedural documents.

Importance of Defining Roles:

Establishes accountability for implementing and maintaining security measures.

Provides clarity to employees about their security obligations.

Why Other Options Are Less Relevant:

Information Security Theory: Too abstract for a policy document.

Incident Response Contacts: Operational detail, not policy-level.

Policy Development: Stresses the need for defining roles to align security objectives with organizational hierarchy.

Governance Frameworks: Highlights the role of policies in assigning security responsibilities.


Question 6

Ciphertext is encrypted with the same key used by the recipient to decrypt it. What encryption method is being used?



Answer : C

Comprehensive and Detailed Explanation (250--350 words)

===========

According to EC-Council CCISO documentation, when the same cryptographic key is used for both encryption and decryption, the encryption method is known as shared key encryption, also commonly referred to as symmetric key encryption.

In shared key encryption, both the sender and the recipient must possess the same secret key and ensure it is protected throughout its lifecycle. CCISO materials explain that symmetric encryption is computationally efficient and well-suited for encrypting large volumes of data, which is why it is widely used for data-at-rest and data-in-transit once a secure key exchange has occurred.

The term private key (Option A) is associated with asymmetric encryption, where a private key is paired with a public key. Key pairing (Option B) also refers to asymmetric cryptography, not shared-key methods. Discrete key (Option D) is not a recognized cryptographic term within CCISO or industry standards.

CCISO emphasizes that while shared key encryption is efficient, it introduces key distribution and management risks, which must be addressed through secure key exchange mechanisms and governance controls.

Therefore, Option C: Shared key is the correct answer.


Question 7

A CISO has implemented a risk management capability within the security portfolio. Which of the following

terms best describes this functionality?



Answer : B

* Risk Management as a Program

A program denotes a coordinated set of initiatives and activities aimed at achieving specific security objectives, such as risk management. It involves policies, processes, and tools to mitigate organizational risks.

* Why Not Other Options?

A . Service: Implies a specific deliverable, not the overarching coordination of initiatives.

C . Portfolio: Encompasses multiple programs but does not describe risk management alone.

D . Cost center: Focuses on financial aspects, not operational functionality.

* EC-Council References

Defines risk management as a strategic program within the broader context of enterprise security operations.


Page:    1 / 14   
Total 637 questions