712-50 — EC-Council Certified Chief Information Security Officer (C|CISO)
EC-Council

EC-Council Certified Chief Information Security Officer (C|CISO) (712-50) Practice Questions

★★★★★ 5.0 30 verified reviews
245 questions
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Governance and Risk Management (~28%)
  • Information Security Controls, Compliance, and Audit Management (~13%)
  • Security Program Management and Operations (~24%)
  • Information Security Core Competencies (~24%)
  • Strategic Planning, Finance, Procurement, and Vendor Management (~11%)

Sample Questions (25 of 245 shown)

Q1
The success of the Chief Information Security Officer is MOST dependent upon:
  1. favorable audit findings
  2. following the recommendations of consultants and contractors
  3. development of relationships with organization executives
  4. raising awareness of security issues with end users
✓ Correct Answer: C
A CISO's authority is largely informal and derives from influence. Building strong relationships with executives and the board is what lets the CISO drive security priorities, secure funding, and embed security in business decisions. Audit findings, consultant advice, and awareness are supporting activities, not the primary determinant of success.
Q2
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
  1. Public cloud
  2. Private cloud
  3. Community cloud
  4. Hybrid cloud
✓ Correct Answer: D
A hybrid cloud combines and interconnects public and private cloud environments so data and applications can move between them. Public and private clouds alone do not share across both, and a community cloud is shared by organizations with common concerns.
Q3
As the Chief Information Security Officer, you are performing an assessment of security posture to understand what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows to detect and actively stop vulnerability exploits and attacks?
  1. Gigamon
  2. Intrusion Prevention System
  3. Port Security
  4. Anti-virus
✓ Correct Answer: B
An Intrusion Prevention System (IPS) inspects traffic flows in line and can actively block or stop exploit attempts and attacks. Gigamon is a traffic aggregation tool, port security limits MAC addresses, and anti-virus is host-based rather than a network-flow exploit blocker.
Q4
What is a difference from the list below between quantitative and qualitative Risk Assessment?
  1. Quantitative risk assessments result in an exact number (in monetary terms)
  2. Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)
  3. Qualitative risk assessments map to business objectives
  4. Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)
✓ Correct Answer: A
Quantitative risk assessment assigns numeric values, typically monetary (e.g., ALE, SLE), to likelihood and impact. Qualitative assessment uses subjective ratings such as high/medium/low. Options B and D reverse the definitions.
Q5
Payment Card Industry (PCI) compliance requirements are based on what criteria?
  1. The types of cardholder data retained
  2. The duration card holder data is retained
  3. The size of the organization processing credit card data
  4. The number of transactions performed per year by an organization
✓ Correct Answer: D
PCI DSS validation level (1–4) for merchants is determined by the annual number of transactions processed. Organizations handling cardholder data must comply regardless, but the specific validation/compliance requirements and reporting level scale with transaction volume.
Q6
A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?
  1. International Organization for Standardizations 22301 (ISO-22301)
  2. Information Technology Infrastructure Library (ITIL)
  3. Payment Card Industry Data Security Standards (PCI-DSS)
  4. International Organization for Standardizations 27005 (ISO-27005)
✓ Correct Answer: A
ISO 22301 is the international standard specifically for Business Continuity Management Systems, ideal for consistent DR/BC across global units. ITIL covers service management, PCI-DSS is payment security, and ISO 27005 is risk management.
Q7
Which of the following are the triple constraints of project management?
  1. Time, quality, and scope
  2. Cost, quality, and time
  3. Scope, time, and cost
  4. Quality, scope, and cost
✓ Correct Answer: C
The classic triple constraint (iron triangle) of project management is scope, time, and cost. Quality is affected by balancing these three but is not one of the three core constraints.
Q8
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
  1. ' or 1=1 --
  2. /../../../../
  3. "DROPTABLE USERNAME"
  4. NOPS
✓ Correct Answer: A
A classic SQL injection uses a tautology such as ' OR 1=1 -- to bypass authentication or dump data. Directory traversal is option B, and NOPS (option D) relate to buffer overflow shellcode, not SQL injection.
Q9
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations. An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:
  1. Controlled spear phishing campaigns
  2. Password changes
  3. Baselining of computer systems
  4. Scanning for viruses
✓ Correct Answer: A
Controlled/simulated phishing campaigns measure whether users actually detect and report phishing, giving a measurable effectiveness metric for awareness training. Password changes, baselining, and virus scanning do not assess user awareness behavior.
Q10
What is a Statement of Objectives (SOA)?
  1. A section of a contract that defines tasks to be performed under said contract
  2. An outline of what the military will do during war
  3. A document that outlines specific desired outcomes as part of a request for proposal
  4. Business guidance provided by the CEO
✓ Correct Answer: C
In procurement, a Statement of Objectives (SOA) describes the desired outcomes and objectives the government/buyer wants achieved, used within a Request for Proposal (RFP). It states what is to be accomplished rather than how.
Q11
Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?
  1. All vulnerabilities found on servers and desktops
  2. Only critical and high vulnerabilities on servers and desktops
  3. Only critical and high vulnerabilities that impact important production servers
  4. All vulnerabilities that impact important production servers
✓ Correct Answer: C
Boards need concise, business-relevant metrics tied to what matters most. Reporting only critical/high vulnerabilities affecting important production servers translates technical risk into business impact, rather than overwhelming the board with operational detail.
Q12
Which of the following provides an audit framework?
  1. Control Objectives for IT (COBIT)
  2. Payment Card Industry-Data Security Standard (PCI-DSS)
  3. International Organization Standard (ISO) 27002
  4. National Institute of Standards and Technology (NIST) SP 800-30
✓ Correct Answer: A
COBIT is an IT governance and control framework that provides control objectives auditors use to evaluate IT processes. PCI-DSS is a compliance standard, ISO 27002 is a code of practice, and NIST SP 800-30 is a risk assessment guide.
Q13
Credit card information, medical data, and government records are all examples of:
  1. Confidential/Protected Information
  2. Bodily Information
  3. Territorial Information
  4. Communications Information
✓ Correct Answer: A
These are categories of sensitive data that require protection and are typically classified as confidential or protected information under various regulations (PCI, HIPAA, government records laws).
Q14
A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected. Who must be informed of this incident?
  1. Internal audit
  2. The data owner
  3. All executive staff
  4. Government regulators
✓ Correct Answer: B
The data owner is accountable for the affected information and must be notified so they can make decisions about impact, notification, and response. While executives and possibly regulators are notified later, the data owner is the primary accountable party for that data.
Q15
Which of the following best describes revenue?
  1. Non-operating financial liabilities minus expenses
  2. The true profit-making potential of an organization
  3. The sum value of all assets and cash flow into the business
  4. The economic benefit derived by operating a business
✓ Correct Answer: D
Revenue is the income generated from the normal operating activities of a business (selling goods/services). Profit is revenue minus expenses, and assets are a separate balance-sheet concept.
Q16
Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?
  1. Terms and Conditions
  2. Service Level Agreements (SLA)
  3. Statement of Work
  4. Key Performance Indicators (KPI)
✓ Correct Answer: B
A Service Level Agreement (SLA) defines the measurable commitments a vendor must meet (availability, response time, quality), creating contractual obligations enforceable by the customer. SoW defines scope of work; KPIs are metrics; terms and conditions are general legal provisions.
Q17
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
  1. Plan-Check-Do-Act
  2. Plan-Do-Check-Act
  3. Plan-Select-Implement-Evaluate
  4. SCORE (Security Consensus Operational Readiness Evaluation)
✓ Correct Answer: B
ISO 27001 (and ISO management system standards generally) is built on the Plan-Do-Check-Act (PDCA) continual-improvement cycle for establishing, implementing, monitoring, and improving the ISMS.
Q18
An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security:
  1. Procedural control
  2. Management control
  3. Technical control
  4. Administrative control
✓ Correct Answer: D
Background checks are an administrative (personnel) control — a process/policy applied to people rather than a technical or physical safeguard. They are part of administrative controls in the management of human resources.
Q19
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
  1. Lack of a formal security awareness program
  2. Lack of a formal security policy governance process
  3. Lack of formal definition of roles and responsibilities
  4. Lack of a formal risk management policy
✓ Correct Answer: B
A published policy that is ignored usually fails because there is no governance process — no ownership, endorsement, enforcement, and review mechanism. Governance ensures policies are adopted, communicated, and enforced; without it, policies are paper exercises.
Q20
When analyzing and forecasting a capital expense budget what are not included?
  1. Network connectivity costs
  2. New datacenter to operate from
  3. Upgrade of mainframe
  4. Purchase of new mobile devices to improve operations
✓ Correct Answer: A
Capital expenditures (CapEx) are for acquiring or upgrading long-lived assets (datacenters, mainframes, devices). Recurring network connectivity/subscription costs are operating expenses (OpEx), not capital.
Q21
The PRIMARY objective for information security program development should be:
  1. Reducing the impact of the risk to the business
  2. Establishing strategic alignment with business continuity requirements
  3. Establishing incident response programs
  4. Identifying and implementing the best security solutions
✓ Correct Answer: A
The primary objective of a security program is to reduce risk to the business to an acceptable level. Alignment, IR programs, and solutions are means to that end; the end is risk reduction in support of the business.
Q22
When you develop your audit remediation plan what is the MOST important criteria?
  1. To remediate half of the findings before the next audit
  2. To remediate all of the findings before the next audit
  3. To validate that the cost of the remediation is less than the risk of the finding
  4. To validate the remediation process with the auditor
✓ Correct Answer: C
Remediation should be risk- and cost-justified: the cost of fixing a finding should be weighed against the risk it represents, prioritizing by risk reduction per dollar. Remediating everything or half arbitrarily ignores business rationale.
Q23
Which of the following statements about Encapsulating Security Payload (ESP) is true?
  1. It is an IPSec protocol
  2. It is a text-based communication protocol
  3. It uses TCP port 22 as the default port and operates at the application layer
  4. It uses UDP port 22
✓ Correct Answer: A
ESP is one of the core protocols of IPsec, providing confidentiality, integrity, and authentication of IP packets. It is not a text protocol and does not use port 22 (that is SSH).
Q24
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?
  1. Lack of asset management processes
  2. Lack of change management processes
  3. Lack of hardening standards
  4. Lack of proper access controls
✓ Correct Answer: B
If a system drifts from its hardened baseline, the usual cause is changes made without going through a change management process (no re-validation, no re-hardening after modifications). Change management ensures configurations stay controlled.
Q25
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates. When multiple regulations or standards apply to your industry you should set controls to meet the:
  1. Easiest regulation or standard to implement
  2. Stricter regulation or standard
  3. Most complex standard to implement
  4. Recommendations of your Legal Staff
✓ Correct Answer: B
When multiple requirements apply, controls should be set to satisfy the strictest (most protective) of them, since meeting the strictest generally satisfies the less stringent ones and reduces compliance gap.

You've viewed 3 of 245 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The EC-Council Certified Chief Information Security Officer (C|CISO), exam code 712-50, is a board-level credential built by sitting CISOs for current and aspiring security executives. Unlike hands-on technical certifications, it validates the ability to lead an enterprise security program, defend budget to the board, and make risk decisions that balance business value against threat exposure.

Mid- and senior-level security leaders pursue the 712-50 exam: incumbent CISOs, heads of GRC, security directors, and senior managers transitioning from technical roles into executive positions. EC-Council requires five years of experience across each of the five domains for self-study candidates, or five years in three of the five domains when official training is completed. A working command of security finance formulas such as ROI, TCO, and ALE is expected.

The exam spans five domains — Governance & Risk Management, Information Security Controls / Compliance / Audit, Security Program Management & Operations, Information Security Core Competencies, and Strategic Planning / Finance / Procurement / Vendor Management — with questions framed at the Knowledge, Application, and Analysis levels. Expect scenario-driven items that ask what a CISO should do FIRST or NEXT, grounded in frameworks like NIST 800-53, ISO 27001, COBIT 2019, and SOC 2.

Our 712-50 practice materials reproduce the governance, risk, and program-management scenarios you will meet on test day, from board-level risk-tolerance decisions to third-party vendor assurance. Every online practice question ships with a detailed answer explanation that ties the choice back to CISO-level judgment and the relevant framework, while the downloadable PDF packages the full bank for offline review during commutes or travel.

Official Exam Domains & Weighting

To successfully pass the 712-50 exam, candidates must master the following core domains (approximate question distribution; EC-Council does not publish official per-domain weights):
  • Domain 1: Governance and Risk Management (~28%)
Establishes the information security governance framework, risk management methodology, risk register, and board-level reporting. Covers policy development, legal and regulatory drivers, and aligning security strategy with organizational objectives.
  • Domain 2: Information Security Controls, Compliance, and Audit Management (~13%)
Designs and tests information systems controls, manages compliance with frameworks such as ISO 27001 and COBIT 2019, and runs audit programs including SOC 1/2 and third-party assurance reviews.
  • Domain 3: Security Program Management and Operations (~24%)
Manages security projects, technology rollouts, and operational metrics (KPI/KRI), including budget ownership, staffing models such as virtual and hybrid SOCs, and BCP/DR with RTO/RPO/MTD.
  • Domain 4: Information Security Core Competencies (~24%)
Covers technical baseline knowledge at leadership depth: cryptography, network and cloud security, endpoint and application security, IDS/IPS, security architecture, and physical security fundamentals.
  • Domain 5: Strategic Planning, Finance, Procurement, and Vendor Management (~11%)
Focuses on the executive toolkit: security finance (ROI, TCO, NPV, ALE), procurement and SLA/contract management, vendor risk with BAAs/DPAs and the Shared Responsibility Model, and strategic planning presented to the board.

What Our Customers Say 30 verified reviews

5.0 ★★★★★ Based on 30 reviews
★★★★★★
Amazing resource for 712-50! The unlimited practice attempts and detailed tracking helped me focus my study time effectively.
— Thomas B.
★★★★★★
Excellent value for 712-50 prep. The lifetime access means I can always come back to review concepts when needed.
— Samantha L.
★★★★★
Got 856 out of 900 on the 712-50 exam. This question bank was my primary study resource. Highly recommend.
— Alyssa D.
★★★★★★
Used this 712-50 prep extensively for three weeks. The progress tracking feature kept me accountable.
— Violet W.
★★★★★
I bought the 712-50 question bank a week before my exam and passed with 90%+. The questions are that good.
— Maria V.
★★★★★★
I was really impressed by the depth of the 712-50 answer explanations. Feels like having a tutor walk you through each question.
— Jack W.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Self-study candidates need five years of experience in each of the five CCISO domains, while candidates who complete official EC-Council training need five years in three of the five domains. Education and other certifications can offset up to three years per domain. A $100 non-refundable application fee applies to self-study candidates; official-training candidates have it waived. Practicing with governance and risk-management scenarios helps confirm you meet the bar.

CISSP covers broad technical security knowledge across eight domains for senior practitioners, whereas C|CISO is purpose-built for the executive role — emphasizing governance, security finance (ROI/TCO/NPV), procurement, vendor management, and strategic planning rather than hands-on implementation. Many CISOs hold both. Our practice bank leans into the CISO-level judgment the 712-50 specifically tests.

Expect questions on ROI = (gain − cost) / cost, TCO, NPV, IRR, payback period, and ALE = SLE × ARO, plus how to present security spend to the board. These appear most in Domain 5 (Strategic Planning, Finance, Procurement & Vendor Management). Drilling finance word problems with answer explanations is one of the highest-yield ways to prepare.

The real exam is 150 scenario-based multiple-choice questions in 2.5 hours (150 minutes). EC-Council sets a cut score per exam form that ranges from 60% to 85%, so there is no single fixed passing percentage. Questions span all five domains at the Knowledge, Application, and Analysis levels. The downloadable PDF lets you rehearse timing offline.

Yes. Our 712-50 mock exam reproduces the situational, "what should the CISO do FIRST/NEXT" items that define the real test, with the same governance, program-management, and vendor-risk emphasis. Running it under a 2.5-hour timer builds the pacing and executive-decision stamina you need on exam day.

Absolutely. Alongside the online practice questions and explanations, the full question bank is available as a downloadable PDF so you can review governance frameworks, finance formulas, and audit concepts during commutes or in environments without stable internet — the same material, just portable.

The exam frequently tests which framework fits which scenario: NIST SP 800-53, ISO 27001/27002, COBIT 2019, CIS Controls v8, and SOC 1/2/3 (Type I vs Type II). It also expects familiarity with risk methodologies such as FAIR, OCTAVE, ISO 31000, and NIST SP 800-30/37/39. Practicing side-by-side framework comparisons is the most reliable way to handle these items.