712-50 Practice Questions

 Temporal Keys in WPA2:

WPA2 uses the Temporal Key Integrity Protocol (TKIP) or Advanced Encryption Standard (AES) to

dynamically generate unique keys for each session.

Temporal keys enhance security by preventing key reuse.

 Key Features of WPA2:

Strong encryption and authentication mechanisms.

Improved resilience against attacks compared to WEP.

 Why Not Other Options:

A . WAP: Refers to Wireless Application Protocol, unrelated to encryption.

C . WEP: Uses static keys, not temporal keys.

D. EAP: An authentication framework, not a wireless encryption protocol.

 EC-Council CISO Alignment:

WPA2’s use of temporal keys demonstrates its suitability for secure wireless communication, as

emphasized in encryption best practices.

:

Adding communication channels and changing project elements require updating the change control

document, which tracks project changes and ensures proper review and approval.

Change Control Process:

Ensures project changes are documented, analyzed, and approved.

Prevents scope creep and miscommunication.

Other Options:

WBS Document: Outlines tasks but does not manage changes.

Scope Statement: Defines project objectives but does not track updates.

Risk Management Plan: Assesses risks, unrelated to communication changes.

EC-Council CISO Reference:

Project Management Best Practices: Stresses maintaining an updated change control document for

project success.

Risk Mitigation in Projects: Links change control to effective risk and scope management.

 Definition and Role

Network-based security preventative controls are measures designed to prevent unauthorized

access, attacks, or breaches. Examples include:

Access Control Lists (ACLs): Define rules for network traffic.

Firewalls: Block unauthorized traffic based on predefined rules.

Intrusion Prevention Systems (IPS): Actively block identified threats.

 Comparison of Options

B . Software segmentation controls: Related to application security, not network-level security.

C . Network-based security detective controls: These include tools like IDS, which detect but do not

prevent attacks.

D . User segmentation controls: Focus on user-based access restrictions, not network controls.

 EC-Council Reference

Highlighted in network security strategies as critical tools for perimeter defense and attack

prevention.

 Purpose of a Business Case

A business case for a security project is developed to:

Communicate risks to stakeholders.

Provide a justification for resource allocation and investment.

Forecast budgetary and resource requirements.

 Comparison of Options

A . Estimate risk and negate liability: Business cases estimate risk but do not primarily negate

liability.

B . Understand attack vectors and sources: While important, this is not the primary focus of a

business case.

D . Forecast usage and cost per software licensing: This may be part of a business case but is not its

primary purpose.

 EC-Council Reference

Emphasized in EC-Council frameworks, a business case is essential for aligning security projects with

organizational priorities and securing executive buy-in.

 Alignment with Business Objectives

An IT security strategic plan must align with the company’s overall business goals to ensure that

security supports and enhances organizational objectives.

 Why Review the Business Plan First

Provides a clear understanding of organizational priorities, risks, and strategic directions.

Helps identify critical assets and processes that require security investment.

 Comparison of Options

A . The existing IT environment: Important but secondary to aligning with business goals.

C . The present IT budget: Helps in resource allocation but doesn’t guide strategic alignment.

D . Other corporate technology trends: Relevant but less critical than the business plan.

 EC-Council Reference

Strategic alignment is a core principle in EC-Council CISO guidance, ensuring security efforts support

business resilience and growth.

 Role of the Incident Response Team (IRT):

The IRT is tasked with managing and mitigating security incidents, including securing networks and

restoring operations.

Their responsibilities include identifying affected systems, containing breaches, and ensuring secure

environments during and after incidents.

 Collaboration:

While other roles like the CISO provide oversight, the IRT performs hands-on incident management

tasks.

 Supporting Reference:

EC-Council CCISO materials designate the IRT as the primary operational unit during incident

response activities.

The first step in developing a vulnerability management program is to define a policy, as it

establishes the foundation for consistent and effective management of vulnerabilities.

Define Policy:

A policy outlines the organization's approach to identifying, evaluating, and addressing

vulnerabilities. It includes scope, objectives, roles, and responsibilities.

Baseline the Environment:

After defining the policy, the current IT environment is assessed to identify existing vulnerabilities

and benchmark security posture.

Maintain and Monitor:

Regular updates and monitoring are implemented to ensure the program remains effective over

time.

Organizational Vulnerability Awareness:

Awareness activities follow the policy definition to align teams with organizational goals for

vulnerability management.

Implementation Order:

Without a clear policy, efforts to baseline or maintain the environment may lack focus and

consistency.

EC-Council CISO Reference:

Vulnerability Management Framework: Highlights the importance of establishing policies before

operationalizing vulnerability scanning and remediation.

Policy-Driven Security: EC-Council emphasizes the role of policies in aligning vulnerability

management efforts with organizational goals and compliance requirements.

 Layered Security Approach:

Secondary authentication adds another layer of security, contributing to the Defense in Depth

strategy.

Enumerating costs ensures the layered approach is cost-effective and aligns with organizational

budgets.

 Why This is Correct:

Secondary authentication strengthens access controls, a critical aspect of Defense in Depth.

 Why Other Options Are Incorrect:

A . Nonlinearities in metrics: Irrelevant to authentication processes.

C . System hardening: Focuses on system configurations, not authentication.

D . Anti-virus for mobile devices: Unrelated to authentication processes.

 Reference:

EC-Council highlights Defense in Depth strategies as essential for layered protection mechanisms like

secondary authentication.

 Primary Responsibility of Senior Executives:

Under the InfoSec governance framework, senior executives are tasked with providing oversight of

the organization's comprehensive information security program. They ensure alignment with

business goals and risk management strategies.

 Role in Governance:

Senior executives set the tone at the top, allocate resources, and oversee the implementation of

security policies and frameworks.

 Supporting Reference:

CCISO materials identify senior executives as key stakeholders in InfoSec governance, responsible for

strategic oversight.