EC-Council Certified Chief Information Security Officer (C|CISO) (712-50) practice questions

Exam overview 712-50

Domain coverage 5 domains

• Governance and Risk Management (~28%)
• Information Security Controls, Compliance, and Audit Management (~13%)
• Security Program Management and Operations (~24%)
• Information Security Core Competencies (~24%)
• Strategic Planning, Finance, Procurement, and Vendor Management (~11%)

Sample questions 25 of 245 shown

1. Q1

   The success of the Chief Information Security Officer is MOST dependent upon:

   1. favorable audit findings
   2. following the recommendations of consultants and contractors
   3. development of relationships with organization executives
   4. raising awareness of security issues with end users

   A CISO's authority is largely informal and derives from influence. Building strong relationships with executives and the board is what lets the CISO drive security priorities, secure funding, and embed security in business decisions. Audit findings, consultant advice, and awareness are supporting activities, not the primary determinant of success.
2. Q2

   A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?

   1. Public cloud
   2. Private cloud
   3. Community cloud
   4. Hybrid cloud

   A hybrid cloud combines and interconnects public and private cloud environments so data and applications can move between them. Public and private clouds alone do not share across both, and a community cloud is shared by organizations with common concerns.
3. Q3

   As the Chief Information Security Officer, you are performing an assessment of security posture to understand what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows to detect and actively stop vulnerability exploits and attacks?

   1. Gigamon
   2. Intrusion Prevention System
   3. Port Security
   4. Anti-virus

   An Intrusion Prevention System (IPS) inspects traffic flows in line and can actively block or stop exploit attempts and attacks. Gigamon is a traffic aggregation tool, port security limits MAC addresses, and anti-virus is host-based rather than a network-flow exploit blocker.
4. Q4

   What is a difference from the list below between quantitative and qualitative Risk Assessment?

   1. Quantitative risk assessments result in an exact number (in monetary terms)
   2. Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)
   3. Qualitative risk assessments map to business objectives
   4. Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

   Quantitative risk assessment assigns numeric values, typically monetary (e.g., ALE, SLE), to likelihood and impact. Qualitative assessment uses subjective ratings such as high/medium/low. Options B and D reverse the definitions.
5. Q5

   Payment Card Industry (PCI) compliance requirements are based on what criteria?

   1. The types of cardholder data retained
   2. The duration card holder data is retained
   3. The size of the organization processing credit card data
   4. The number of transactions performed per year by an organization

   PCI DSS validation level (1–4) for merchants is determined by the annual number of transactions processed. Organizations handling cardholder data must comply regardless, but the specific validation/compliance requirements and reporting level scale with transaction volume.
6. Q6

   A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization's need?

   1. International Organization for Standardizations 22301 (ISO-22301)
   2. Information Technology Infrastructure Library (ITIL)
   3. Payment Card Industry Data Security Standards (PCI-DSS)
   4. International Organization for Standardizations 27005 (ISO-27005)

   ISO 22301 is the international standard specifically for Business Continuity Management Systems, ideal for consistent DR/BC across global units. ITIL covers service management, PCI-DSS is payment security, and ISO 27005 is risk management.
7. Q7

   Which of the following are the triple constraints of project management?

   1. Time, quality, and scope
   2. Cost, quality, and time
   3. Scope, time, and cost
   4. Quality, scope, and cost

   The classic triple constraint (iron triangle) of project management is scope, time, and cost. Quality is affected by balancing these three but is not one of the three core constraints.
8. Q8

   SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:

   1. ' or 1=1 --
   2. /../../../../
   3. "DROPTABLE USERNAME"
   4. NOPS

   A classic SQL injection uses a tautology such as ' OR 1=1 -- to bypass authentication or dump data. Directory traversal is option B, and NOPS (option D) relate to buffer overflow shellcode, not SQL injection.
9. Q9

   Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations. An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:

   1. Controlled spear phishing campaigns
   2. Password changes
   3. Baselining of computer systems
   4. Scanning for viruses

   Controlled/simulated phishing campaigns measure whether users actually detect and report phishing, giving a measurable effectiveness metric for awareness training. Password changes, baselining, and virus scanning do not assess user awareness behavior.
10. Q10

    What is a Statement of Objectives (SOA)?

    1. A section of a contract that defines tasks to be performed under said contract
    2. An outline of what the military will do during war
    3. A document that outlines specific desired outcomes as part of a request for proposal
    4. Business guidance provided by the CEO

    In procurement, a Statement of Objectives (SOA) describes the desired outcomes and objectives the government/buyer wants achieved, used within a Request for Proposal (RFP). It states what is to be accomplished rather than how.
11. Q11

    Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?

    1. All vulnerabilities found on servers and desktops
    2. Only critical and high vulnerabilities on servers and desktops
    3. Only critical and high vulnerabilities that impact important production servers
    4. All vulnerabilities that impact important production servers

    Boards need concise, business-relevant metrics tied to what matters most. Reporting only critical/high vulnerabilities affecting important production servers translates technical risk into business impact, rather than overwhelming the board with operational detail.
12. Q12

    Which of the following provides an audit framework?

    1. Control Objectives for IT (COBIT)
    2. Payment Card Industry-Data Security Standard (PCI-DSS)
    3. International Organization Standard (ISO) 27002
    4. National Institute of Standards and Technology (NIST) SP 800-30

    COBIT is an IT governance and control framework that provides control objectives auditors use to evaluate IT processes. PCI-DSS is a compliance standard, ISO 27002 is a code of practice, and NIST SP 800-30 is a risk assessment guide.
13. Q13

    Credit card information, medical data, and government records are all examples of:

    1. Confidential/Protected Information
    2. Bodily Information
    3. Territorial Information
    4. Communications Information

    These are categories of sensitive data that require protection and are typically classified as confidential or protected information under various regulations (PCI, HIPAA, government records laws).
14. Q14

    A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected. Who must be informed of this incident?

    1. Internal audit
    2. The data owner
    3. All executive staff
    4. Government regulators

    The data owner is accountable for the affected information and must be notified so they can make decisions about impact, notification, and response. While executives and possibly regulators are notified later, the data owner is the primary accountable party for that data.
15. Q15

    Which of the following best describes revenue?

    1. Non-operating financial liabilities minus expenses
    2. The true profit-making potential of an organization
    3. The sum value of all assets and cash flow into the business
    4. The economic benefit derived by operating a business

    Revenue is the income generated from the normal operating activities of a business (selling goods/services). Profit is revenue minus expenses, and assets are a separate balance-sheet concept.
16. Q16

    Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?

    1. Terms and Conditions
    2. Service Level Agreements (SLA)
    3. Statement of Work
    4. Key Performance Indicators (KPI)

    A Service Level Agreement (SLA) defines the measurable commitments a vendor must meet (availability, response time, quality), creating contractual obligations enforceable by the customer. SoW defines scope of work; KPIs are metrics; terms and conditions are general legal provisions.
17. Q17

    Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

    1. Plan-Check-Do-Act
    2. Plan-Do-Check-Act
    3. Plan-Select-Implement-Evaluate
    4. SCORE (Security Consensus Operational Readiness Evaluation)

    ISO 27001 (and ISO management system standards generally) is built on the Plan-Do-Check-Act (PDCA) continual-improvement cycle for establishing, implementing, monitoring, and improving the ISMS.
18. Q18

    An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security:

    1. Procedural control
    2. Management control
    3. Technical control
    4. Administrative control

    Background checks are an administrative (personnel) control — a process/policy applied to people rather than a technical or physical safeguard. They are part of administrative controls in the management of human resources.
19. Q19

    A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?

    1. Lack of a formal security awareness program
    2. Lack of a formal security policy governance process
    3. Lack of formal definition of roles and responsibilities
    4. Lack of a formal risk management policy

    A published policy that is ignored usually fails because there is no governance process — no ownership, endorsement, enforcement, and review mechanism. Governance ensures policies are adopted, communicated, and enforced; without it, policies are paper exercises.
20. Q20

    When analyzing and forecasting a capital expense budget what are not included?

    1. Network connectivity costs
    2. New datacenter to operate from
    3. Upgrade of mainframe
    4. Purchase of new mobile devices to improve operations

    Capital expenditures (CapEx) are for acquiring or upgrading long-lived assets (datacenters, mainframes, devices). Recurring network connectivity/subscription costs are operating expenses (OpEx), not capital.
21. Q21

    The PRIMARY objective for information security program development should be:

    1. Reducing the impact of the risk to the business
    2. Establishing strategic alignment with business continuity requirements
    3. Establishing incident response programs
    4. Identifying and implementing the best security solutions

    The primary objective of a security program is to reduce risk to the business to an acceptable level. Alignment, IR programs, and solutions are means to that end; the end is risk reduction in support of the business.
22. Q22

    When you develop your audit remediation plan what is the MOST important criteria?

    1. To remediate half of the findings before the next audit
    2. To remediate all of the findings before the next audit
    3. To validate that the cost of the remediation is less than the risk of the finding
    4. To validate the remediation process with the auditor

    Remediation should be risk- and cost-justified: the cost of fixing a finding should be weighed against the risk it represents, prioritizing by risk reduction per dollar. Remediating everything or half arbitrarily ignores business rationale.
23. Q23

    Which of the following statements about Encapsulating Security Payload (ESP) is true?

    1. It is an IPSec protocol
    2. It is a text-based communication protocol
    3. It uses TCP port 22 as the default port and operates at the application layer
    4. It uses UDP port 22

    ESP is one of the core protocols of IPsec, providing confidentiality, integrity, and authentication of IP packets. It is not a text protocol and does not use port 22 (that is SSH).
24. Q24

    A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?

    1. Lack of asset management processes
    2. Lack of change management processes
    3. Lack of hardening standards
    4. Lack of proper access controls

    If a system drifts from its hardened baseline, the usual cause is changes made without going through a change management process (no re-validation, no re-hardening after modifications). Change management ensures configurations stay controlled.
25. Q25

    Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates. When multiple regulations or standards apply to your industry you should set controls to meet the:

    1. Easiest regulation or standard to implement
    2. Stricter regulation or standard
    3. Most complex standard to implement
    4. Recommendations of your Legal Staff

    When multiple requirements apply, controls should be set to satisfy the strictest (most protective) of them, since meeting the strictest generally satisfies the less stringent ones and reduces compliance gap.

Answer all 245 questions with instant feedback →

Reader reviews 59 ratings

• I bought the 712-50 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• I used this for three months on and off for 712-50. The progress tracker helped me stay consistent.

  ★★★★★★ Hannah K.

• Detailed, organized, and accurate. Exactly what you want in 712-50 prep material. The explanations deserve special mention.

  ★★★★★★ Gabriel L.

• I scored 890 on the 712-50 exam. Went through about 80% of this question bank and it was more than enough to pass.

  ★★★★★★ Levi C.

• Very realistic 712-50 exam simulation. The timer feature helped me practice pacing before the actual test.

  ★★★★★★ Ellie B.

• The domain-based breakdown in the 712-50 questions really helped me identify which areas needed more work.

  ★★★★★★ Elena R.

Frequently asked questions

More EC-Council exams