Free ECCouncil 312-76 Practice Exam with Questions & Answers

ISO/IEC 27005 is an information security risk management standard that requires identifying, assessing, and prioritizing risks (like George’s exercise) to develop a mitigation plan. It fits his prioritization of electrical surges.

Option A (ISO 27001):Broad security management, not risk-specific.

Option B (INCITS 483-2012):Virtualization security, not risk management.

Option C (ISO 27031):ICT continuity, narrower than 27005.

“ISO/IEC 27005 guides organizations in risk identification, assessment, and prioritization, forming the basis for security and DR planning” (Module: Risk Management, Section: Standards).

RMAN (Recovery Manager) is Oracle’s tool for backing up, restoring, and recovering database files using server sessions, matching Joanna’s description.

Option A (Virtuozzo):Virtualization platform, not database-specific.

Option B (Disk Drill):General data recovery, not database-focused.

Option C (Recuva):File recovery, not server-session-based.

“RMAN leverages database server sessions to manage backup, restoration, and recovery of Oracle databases efficiently” (Module: Database Recovery, Section: Recovery Tools).

Crisis Management involves strategies to handle sudden, significant events (e.g., disasters), focusing on immediate response and mitigation, as described.

Option A (Risk Assessment):Identifies risks, not manages events.

Option B (Application Recovery):Restores applications, not a broad strategy.

Option D (BIA):Analyzes impacts, not event handling.

“Crisis Management applies strategies to address sudden, disruptive events, ensuring organizational stability during emergencies” (Module: Crisis Management, Section: Overview).

Data Archiving selects records for long-term retention and reference, as described.

Option B (Data Backup):Short-term protection, not long-term.

Option C (Data Restore):Recovery process, not retention.

Option D (Data Deletion):Opposite of retention.

“Data Archiving preserves historical records for long-term storage and future use, distinct from temporary backups” (Module: Data Archiving, Section: Archiving Definition).

Tier 6 in DR tier models (e.g., SHARE) provides automated recovery of data and applications with near-zero downtime and data loss, fitting Phil’s scenario.

Option A (Tier 4):Point-in-time copies, less automated.

Option B (Tier 7):Fully mirrored, zero loss, more than needed here.

Option D (Tier 2):Basic offsite backup, not automated.

“Tier 6 offers automated recovery of data and applications, minimizing manual intervention and downtime” (Module: Disaster Recovery Tiers, Section: Tier Definitions).

The Disaster Recovery Coordinator manages the daily execution and maintenance of the DR program, making option B the most accurate responsibility. It reflects operational oversight, a core coordinator role.

Option A:More aligned with an auditor or compliance role.

Option C:Technical design, typically a technology team task.

Option D:Executive authority belongs to higher management, not the coordinator.

“The Disaster Recovery Coordinator handles day-to-day management, execution, and maintenance of the DR program, ensuring operational readiness” (Module: Disaster Recovery Teams, Section: Coordinator Roles).

Risk response strategies include Acceptance (tolerating risk), Mitigation (reducing risk), and Sharing (transferring risk, e.g., insurance). Safety is a goal or outcome, not a risk response strategy.

Option A/B/D:Standard risk responses.

Option C (Safety):Not a recognized strategy.

“Risk response strategies—acceptance, mitigation, and sharing—address identified risks; safety is an objective, not a strategy” (Module: Risk Management, Section: Risk Response Strategies).

An Exchange Server (Microsoft) provides mail and calendar services, managing email, scheduling, and collaboration.

Option A (Application Server):Runs applications, not mail-specific.

Option B (Web Server):Hosts websites, not mail/calendar.

Option D (Domain Controller):Manages network authentication, not mail.

“Exchange Servers deliver email and calendar services, critical for communication continuity in organizations” (Module: Server Management, Section: Server Roles).

Polly estimated theImpact, which is the magnitude of damage (here, $200,000) resulting from a risk event (data leak). This drove her decision to upgrade, comparing it to the cost.

Option B (Hazard):A potential source of harm, not the damage estimate.

Option C (Likelihood):Probability of occurrence, not addressed here.

Option D (Vulnerability):Weakness (vulnerable server), not the damage itself.

“Impact, the estimated magnitude of loss from a risk event, such as a data leak costing $200,000, guides mitigation decisions in risk assessment” (Module: Risk Management, Section: Risk Factors).

Risk Valuation assesses risk likelihood and impact (e.g., failure percentages), as Remy did by evaluating fire safety’s effect on investment risk.

Option A (RORAC):Financial return metric, not risk evaluation.

Option B (Value at Risk):Quantifies loss potential, not likelihood shift.

Option C (RAROC):Adjusts returns for risk, not direct evaluation.

“Risk Valuation estimates the probability and impact of risks, such as facility vulnerabilities, to inform investment decisions” (Module: Risk Management, Section: Risk Evaluation Methods).