How to Easily Pass the ECCouncil 512-50 Exam: Expert Advice

Information security should be informed of changes to applications only

Development team should tell the information security team about any application security flaws

Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production

Information security should be aware of all application changes and work with developers before changes are deployed in production

Gaining access to an affiliated employee’s work email account as part of an officially sanctioned internal investigation

Sharing copyrighted material with other members of a professional organization where all members have legitimate access to the material

Copying documents from an employer’s server which you assert that you have an intellectual property claim to possess, but the company disputes

Storing client lists and other sensitive corporate internal documents on a removable thumb drive

Network based intrusion detection systems

A security training program for developers

A risk management process

A audit management process

Allow the business units to decide which controls apply to their systems, such as the encryption of sensitive data

Create separate controls for the business units based on the types of business and functions they perform

Ensure business units are involved in the creation of controls and defining conditions under which they must be applied

Provide the business units with control mandates and schedules of audits for compliance validation

Deploy a SEIM solution and have current staff review incidents first thing in the morning

Contract with a managed security provider and have current staff on recall for incident response

Configure your syslog to send SMS messages to current staff when target events are triggered

Employ an assumption of breach protocol and defend only essential information resources

low risk-tolerance

high risk-tolerance

moderate risk-tolerance

medium-high risk-tolerance

Vested in the success and/or failure of a project or initiative regardless of budget implications.

Vested in the success and/or failure of a project or initiative and is tied to the project budget.

That has budget authority.

That will ultimately use the system.

Time zone differences

Compliance to local hiring laws

Encryption import/export regulations

Local customer privacy laws

Vendor’s client list of reputable organizations currently using their solution

Vendor provided attestation of the detailed security controls from a reputable accounting firm

Vendor provided reference from an existing reputable client detailing their implementation

Vendor provided internal risk assessment and security control documentation

Failed to identify all stakeholders and their needs

Deployed the encryption solution in an inadequate manner

Used 1024 bit encryption when 256 bit would have sufficed

Used hardware encryption instead of software encryption