712-50 Reviews Questions

 Overly IT-Focused Approach

An IT security-centric agenda focuses narrowly on technical controls and neglects broader business risks and strategic priorities.

Effective CISOs must adopt an enterprise-level perspective, addressing compliance, risk management, and alignment with business goals.

 Why Not Other Options?

A. Lack of risk management process: While important, the primary issue is the narrow focus on IT.

B. Lack of executive sponsorship: While critical, it is a symptom of the IT-centric agenda.

D. Compliance-centric agenda: Could also be a concern, but the scenario highlights an IT-centric focus specifically.

 EC-Council References

Encourages CISOs to adopt a holistic approach that integrates security into business processes and aligns with organizational goals.

Scenario9

 Explanation:

Physical security measures typically include:

Physical: Locks, barriers, and surveillance systems.

Technical: Access control systems and alarm systems.

Operational: Security policies, procedures, and personnel training.

 Why Other Options Are Incorrect:

B. Technical, Strong Password, Operational: Passwords are part of logical security, not physical security.

C. Operational, Biometric, Physical: Biometrics is part of technical security measures, not operational.

D. Strong Password, Biometric, Common Access Card: Passwords are not physical security measures.

 EC-Council CISO Reference:The curriculum outlines the layered approach to security, with physical, technical, and operational components as critical for comprehensive protection.

 Explanation:

Non-repudiation ensures that a party cannot deny the authenticity of their digital signature or transaction.

Digital signatures provide this assurance by cryptographically linking the signer to the transaction, safeguarding transaction integrity and authenticity.

 Why Other Options Are Incorrect:

B. Conflict resolution: Refers to resolving disputes but does not describe the capability of proving a transaction.

C. Strong authentication: Relates to verifying identity but not to preventing denial of actions.

D. Digital rights management: Concerns content protection, not transaction integrity.

 EC-Council CISO Reference:Emphasizes the role of non-repudiation in maintaining trust and integrity in digital transactions.

A cold site is a backup facility that provides minimal infrastructure and requires significant time to become operational after a disaster. It typically includes only basic physical space, utilities, and possibly some hardware.

Definition of Backup Sites:

Cold Site: Minimal or no IT infrastructure; requires setting up systems, installing software, and restoring data, leading to the longest recovery time.

Hot Site: Fully equipped with operational IT infrastructure; minimal setup time required for recovery.

Warm Site: Partially equipped with essential systems but requires additional setup and restoration before becoming fully operational.

Mobile Backup Site: Portable and flexible backup sites with quicker setup times but still slower than hot sites.

Recovery Time Comparison:

Cold sites are cost-effective but slowest for recovery.

They are suitable for organizations with lower criticality needs or budget constraints.

Use Cases:

Best for non-critical applications or organizations willing to tolerate extended downtime.

Disaster Recovery Planning: EC-Council outlines the use of backup sites as part of a comprehensive disaster recovery plan, emphasizing the trade-offs between cost and recovery time.

Risk Management Framework: The importance of selecting backup sites based on organizational risk tolerance and business continuity needs is stressed.

EC-Council CISO References: