EC-COUNCIL EC-Council Information Security Manager (E|ISM) 認定 512-50 試験問題:

1. Which of the following international standards can be BEST used to define a Risk Management process in an organization?

A) National Institute for Standards and Technology 800-50 (NIST 800-50)
B) International Organization for Standardizations - 27005 (ISO-27005)
C) International Organization for Standardizations - 27004 (ISO-27004)
D) Payment Card Industry Data Security Standards (PCI-DSS)

2. What role should the CISO play in properly scoping a PCI environment?

A) Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment
B) Validate the business units' suggestions as to what should be included in the scoping process
C) Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope
D) Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data

3. Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?

A) The NPV of the project is negative
B) The Return on Investment (ROI) is larger than 10 months
C) The ROI is lower than 10 months
D) The Net Present Value (NPV) of the project is positive

4. You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct. What is the NEXT step?

A) Verify budget
B) Verify constraints
C) Verify resources
D) Review time schedules

5. You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?

A) Risk Transfer
B) Risk Acceptance
C) Risk Mitigation
D) Risk Avoidance

質問と回答：