A Review Of Vivid 712-50 Question

NEW QUESTION 1

Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?

• A. Risk Management
• B. Risk Assessment
• C. System Testing
• D. Vulnerability Assessment

Answer: B

NEW QUESTION 2

Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of

• A. Network based security preventative controls
• B. Software segmentation controls
• C. Network based security detective controls
• D. User segmentation controls

Answer: A

NEW QUESTION 3

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

• A. Subscribe to vendor mailing list to get notification of system vulnerabilities
• B. Deploy Intrusion Detection System (IDS) and install anti-virus on systems
• C. Configure firewall, perimeter router and Intrusion Prevention System (IPS)
• D. Conduct security testing, vulnerability scanning, and penetration testing

Answer: D

NEW QUESTION 4

The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to

• A. assign the responsibility to the information security team.
• B. assign the responsibility to the team responsible for the management of the controls.
• C. create operational reports on the effectiveness of the controls.
• D. perform an independent audit of the security controls.

Answer: D

NEW QUESTION 5

Risk is defined as:

• A. Threat times vulnerability divided by control
• B. Advisory plus capability plus vulnerability
• C. Asset loss times likelihood of event
• D. Quantitative plus qualitative impact

Answer: A

NEW QUESTION 6

The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?

• A. The asset is more expensive than the remediation
• B. The audit finding is incorrect
• C. The asset being protected is less valuable than the remediation costs
• D. The remediation costs are irrelevant; it must be implemented regardless of cost.

Answer: C

NEW QUESTION 7

An organization recently acquired a Data Loss Prevention (DLP) solution, and two months after the implementation, it was found that sensitive data was posted to numerous Dark Web sites. The DLP application was checked, and there are no apparent malfunctions and no errors.
What is the MOST likely reason why the sensitive data was posted?

• A. The DLP Solution was not integrated with mobile device anti-malware
• B. Data classification was not properly performed on the assets
• C. The sensitive data was not encrypted while at rest
• D. A risk assessment was not performed after purchasing the DLP solution

Answer: D

NEW QUESTION 8

Which of the following is the MOST logical method of deploying security controls within an organization?

• A. Obtain funding for all desired controls and then create project plans for implementation
• B. Apply the simpler controls as quickly as possible and use a risk-based approach for the more difficult andcostly controls
• C. Apply the least costly controls to demonstrate positive program activity
• D. Obtain business unit buy-in through close communication and coordination

Answer: B

NEW QUESTION 9

Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:

• A. Risk management
• B. Security management
• C. Mitigation management
• D. Compliance management

Answer: D

NEW QUESTION 10

Which technology can provide a computing environment without requiring a dedicated hardware backend?

• A. Mainframe server
• B. Virtual Desktop
• C. Thin client
• D. Virtual Local Area Network

Answer: B

NEW QUESTION 11

The patching and monitoring of systems on a consistent schedule is required by?

• A. Local privacy laws
• B. Industry best practices
• C. Risk Management frameworks
• D. Audit best practices

Answer: C

NEW QUESTION 12

An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?

• A. Immediately notify the board of directors of the organization as to the finding
• B. Correct the classifications immediately based on the auditor’s knowledge of the proper classification
• C. Document the missing classifications
• D. Identify the owner of the asset and induce the owner to apply a proper classification

Answer: C

NEW QUESTION 13

SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
What is the MOST logical course of action the CISO should take?

• A. Review the original solution set to determine if another system would fit the organization’s risk appetite and budgetregulatory compliance requirements
• B. Continue with the implementation and submit change requests to the vendor in order to ensure required functionality will be provided when needed
• C. Continue with the project until the scalability issue is validated by others, such as an auditor or third party assessor
• D. Cancel the project if the business need was based on internal requirements versus regulatory compliance requirements

Answer: A

NEW QUESTION 14

What is the FIRST step in developing the vulnerability management program?

• A. Baseline the Environment
• B. Maintain and Monitor
• C. Organization Vulnerability
• D. Define Policy

Answer: A

NEW QUESTION 15

A bastion host should be placed:

• A. Inside the DMZ
• B. In-line with the data center firewall
• C. Beyond the outer perimeter firewall
• D. As the gatekeeper to the organization’s honeynet

Answer: C

Explanation:
Reference: https://www.skillset.com/questions/a-bastion-host-is-which-of-the-following

NEW QUESTION 16

Which of the following is the MOST important for a CISO to understand when identifying threats?

• A. How vulnerabilities can potentially be exploited in systems that impact the organization
• B. How the security operations team will behave to reported incidents
• C. How the firewall and other security devices are configured to prevent attacks
• D. How the incident management team prepares to handle an attack

Answer: A

NEW QUESTION 17

Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

• A. Perform a vulnerability scan of the network
• B. External penetration testing by a qualified third party
• C. Internal Firewall ruleset reviews
• D. Implement network intrusion prevention systems

Answer: B

NEW QUESTION 18

Risk appetite is typically determined by which of the following organizational functions?

• A. Security
• B. Business units
• C. Board of Directors
• D. Audit and compliance

Answer: C

NEW QUESTION 19
......