Free 512-50 – EC-Council Information Security Manager (E|ISM) Practice Test Question

Select an option, then click Submit answer.

• ○

  The Net Present Value (NPV) of the project is positive

• ○

  The NPV of the project is negative

• ○

  The Return on Investment (ROI) is larger than 10 months

• ○

  The ROI is lower than 10 months

Select an option, then click Submit answer.

• ○

  Validate the effectiveness of current controls

• ○

  Create detailed remediation funding and staffing plans

• ○

  Report the audit findings and remediation status to business stake holders

• ○

  Review security procedures to determine if they need modified according to findings

Select an option, then click Submit answer.

• ○

  Susceptibility to attack, mitigation response time, and cost

• ○

  Attack vectors, controls cost, and investigation staffing needs

• ○

  Vulnerability exploitation, attack recovery, and mean time to repair

• ○

  Susceptibility to attack, expected duration of attack, and mitigation availability

Select an option, then click Submit answer.

• ○

  The percentage of earnings that are retained by the organization for reinvestment in the business

• ○

  The details of expenses and revenue over a long period of time

• ○

  A summarized statement of all assets and liabilities at a specific point in time

• ○

  A review of regulations and requirements impacting the business from a financial perspective
  

Select an option, then click Submit answer.

• ○

  Network based security preventative control

• ○

  Software segmentation control

• ○

  Security detective control

• ○

  User segmentation control

Select an option, then click Submit answer.

• ○

  Configure logging on each access point

• ○

  Install a firewall software on each wireless access point.

• ○

  Provide IP and MAC address

• ○

  Disable SSID Broadcast and enable MAC address filtering on all wireless access points.

Select an option, then click Submit answer.

• ○

  Need to comply with breach disclosure laws

• ○

  Need to transfer the risk associated with hosting PII data

• ○

  Need to better understand the risk associated with using PII data

• ○

  Fiduciary responsibility to safeguard credit card information

Select an option, then click Submit answer.

• ○

  The asset is more expensive than the remediation

• ○

  The audit finding is incorrect

• ○

  The asset being protected is less valuable than the remediation costs

• ○

  The remediation costs are irrelevant; it must be implemented regardless of cost.

Select an option, then click Submit answer.

• ○

  Every 6 months

• ○

  Quarterly

• ○

  Before an audit

• ○

  At least once a year

Select an option, then click Submit answer.

• ○

  by stakeholders at least annually

• ○

  by the CISO when new systems are brought online

• ○

  by the Incident Response team after an audit

• ○

  by internal audit semiannually

Select an option, then click Submit answer.

• ○

  Poor audit support for the security program

• ○

  A lack of executive presence within the security program

• ○

  Poor alignment of the security program to business needs

• ○

  This is normal since business units typically resist security requirements

Select an option, then click Submit answer.

• ○

  Subscribe to vendor mailing list to get notification of system vulnerabilities

• ○

  Deploy Intrusion Detection System (IDS) and install anti-virus on systems

• ○

  Configure firewall, perimeter router and Intrusion Prevention System (IPS)

• ○

  Conduct security testing, vulnerability scanning, and penetration testing

Select an option, then click Submit answer.

• ○

  When organizational resources are limited

• ○

  When the benefits of outsourcing outweigh the inherent risks of outsourcing

• ○

  On new, enterprise-wide security initiatives

• ○

  On projects not forecasted in the yearly budget

Select an option, then click Submit answer.

• ○

  Annually

• ○

  Semi-annually

• ○

  Quarterly

• ○

  Never

Select an option, then click Submit answer.

• ○

  Enforce the existing security standards and do not allow the deployment of the new technology.

• ○

  Amend the standard to permit the deployment.

• ○

  If the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.

• ○

  Permit a 90-day window to see if an issue occurs and then amend the standard if there are no issues.

Select an option, then click Submit answer.

• ○

  Single loss expectancy multiplied by the annual rate of occurrence

• ○

  Total loss expectancy multiplied by the total loss frequency

• ○

  Value of the asset multiplied by the loss expectancy

• ○

  Replacement cost multiplied by the single loss expectancy

Select an option, then click Submit answer.

• ○

  When there is a need to develop a more unified incident response capability.

• ○

  When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

• ○

  When there is a variety of technologies deployed in the infrastructure.

• ○

  When it results in an overall lower cost of operating the security program.

Select an option, then click Submit answer.

• ○

  Reducing the impact of the risk to the business.

• ○

  Establishing strategic alignment with business continuity requirements

• ○

  Establishing incident response programs.

• ○

  Identifying and implementing the best security solutions.

Select an option, then click Submit answer.

• ○

  Determining the likelihood that vulnerable systems will be attacked by specific threats

• ○

  Calculating the risks to which assets are exposed in their current setting

• ○

  Assigning a value to each information asset

• ○

  Assessing the relative risk facing the organization’s information assets

Select an option, then click Submit answer.

• ○

  Network based intrusion detection systems

• ○

  A security training program for developers

• ○

  A risk management process

• ○

  A audit management process