712-50 sample questions

Question 1

You are establishing a new Enterprise Risk Management (ERM) framework. You need to define the process for risk treatment decisions. Review the diagram below representing the decision logic. Which logic flow correctly represents the standard risk treatment methodology based on ISO 31000 principles?

```mermaid
flowchart TD
Start[Risk Identified] --> Assess{Risk > Appetite?}
Assess -->|No| A[Monitor]
Assess -->|Yes| Cost{Cost of Control < Impact?}
Cost -->|Yes| B[Treat/Mitigate]
Cost -->|No| Crit{Is Risk Critical?}
Crit -->|Yes| C[Transfer/Avoid]
Crit -->|No| D[Accept]
```

Accepted Answer

The logic is correct as shown.

Answer

The logic is incorrect; Risks below the Risk Appetite should still be Mitigated if the cost is low.

Answer

The logic is incorrect; Risk Transfer should occur before assessing Cost of Control.

Answer

The logic is incorrect; if Cost of Control > Impact, the risk should always be Accepted regardless of criticality.

Question 2

Which of the following documents is the PRIMARY source for an external auditor to determine if an organization's security controls are operating effectively over a period of time?

Accepted Answer

Population of evidence samples (logs, tickets, change records) covering the audit period

Answer

Point-in-time vulnerability assessment report

Answer

Information Security Policy signed by the CEO

Answer

Network topology diagrams and data flow charts

Question 3

A CISO is designing a Key Performance Indicator (KPI) dashboard for the executive team. The goal is to measure the efficiency of the Incident Response (IR) team. Which TWO metrics would provide the most meaningful insight into operational efficiency? (Select TWO)

Accepted Answer

Mean Time to Detect (MTTD)

Accepted Answer

Mean Time to Remediate (MTTR)

Answer

Total number of attacks blocked by the firewall

Answer

Number of security awareness training modules completed

Question 4

Case Study:

Scenario:
A retail organization is migrating its e-commerce platform to a public cloud provider. The CISO is concerned about the 'Shared Responsibility Model'. The development team wants to use a Function-as-a-Service (FaaS) / Serverless architecture to reduce operational overhead. They plan to process credit card transactions directly within these functions.

Constraint:
The organization must remain PCI DSS compliant. The cloud provider is PCI DSS certified.

Question:
In this Serverless architecture, which security control remains the SOLE responsibility of the customer (the retail organization)?

Accepted Answer

Application logic security and proper configuration of IAM roles assigned to the functions

Answer

Physical security of the data centers hosting the serverless functions

Answer

Network intrusion detection at the hypervisor level

Answer

Patching the underlying operating system of the serverless runtime environment

Question 5

True or False: In a robust Third-Party Risk Management (TPRM) program, obtaining a vendor's SOC 2 Type II report eliminates the need for the organization to define its own security requirements in the Master Services Agreement (MSA).

Accepted Answer

False

Answer

True

Question 6

An organization is calculating the Return on Security Investment (ROSI) for a new Data Loss Prevention (DLP) solution.

Given:
- Annual Loss Expectancy (ALE) without DLP: $1,000,000
- Estimated mitigation percentage: 80%
- Annual cost of DLP solution: $150,000

What is the ROSI percentage?

Accepted Answer

433%

Answer

150%

Answer

85%

Answer

533%

Question 7

You are reviewing the Identity and Access Management (IAM) architecture for a hybrid environment. The organization wants to implement Single Sign-On (SSO) across on-premise Active Directory and multiple cloud SaaS applications. Which protocol is the industry standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP) in this context?

Accepted Answer

SAML (Security Assertion Markup Language)

Answer

Kerberos

Answer

RADIUS (Remote Authentication Dial-In User Service)

Answer

LDAP (Lightweight Directory Access Protocol)

Question 8

The internal audit team has issued a finding regarding 'Excessive Administrative Privileges' on the corporate network. The IT Director argues that the administrators need these rights to perform their daily tasks efficiently. What is the CISO's best course of action to resolve this conflict while improving security?

Accepted Answer

Implement a Privileged Access Management (PAM) solution with Just-In-Time (JIT) elevation and session recording.

Answer

Remove all administrative rights immediately and require a written ticket for every administrative action.

Answer

Create a separate 'Admin' VLAN that is not monitored by the audit team.

Answer

Support the IT Director and mark the finding as 'Accepted Risk' due to operational necessity.

Question 9

A multinational corporation is updating its Data Retention Policy to comply with both GDPR in Europe and various state laws in the US (like CCPA/CPRA). The legal team indicates a conflict: GDPR mandates data minimization and deletion, while certain US financial regulations require data retention for 7 years. Which strategy is most effective for the CISO to recommend?

Accepted Answer

Implement a tiered data retention schedule based on data classification and jurisdiction, using metadata tagging to apply specific retention rules to specific data sets.

Answer

Separate the EU and US businesses into completely different legal entities with no shared infrastructure.

Answer

Apply the strictest standard (GDPR) globally and delete all data after the shortest mandate, accepting the risk of US non-compliance.

Answer

Store all data for 7 years to ensure US financial compliance, as financial penalties are generally higher than privacy penalties.

Question 10

During a Business Impact Analysis (BIA), the CISO identifies that the 'Order Processing System' has a Maximum Tolerable Downtime (MTD) of 4 hours. However, the current Disaster Recovery (DR) solution provides a Recovery Time Objective (RTO) of 12 hours. What is this discrepancy called, and what is the primary risk?

Accepted Answer

RTO Gap; risk that the business will suffer irreparable harm before the system is restored.

Answer

Availability Gap; risk of the system failing to restart after a crash.

Answer

Control Gap; risk that the backup integrity is not verified.

Answer

Recovery Point Gap; risk of data loss exceeding the organization's tolerance.

Free 712-50 sample questions

Which of the following documents is the PRIMARY source for an external auditor to determine if an organization's security controls are operating effectively over a period of time?

A CISO is designing a Key Performance Indicator (KPI) dashboard for the executive team. The goal is to measure the efficiency of the Incident Response (IR) team. Which TWO metrics would provide the most meaningful insight into operational efficiency? (Select TWO)

True or False: In a robust Third-Party Risk Management (TPRM) program, obtaining a vendor's SOC 2 Type II report eliminates the need for the organization to define its own security requirements in the Master Services Agreement (MSA).

An organization is calculating the Return on Security Investment (ROSI) for a new Data Loss Prevention (DLP) solution. Given: - Annual Loss Expectancy (ALE) without DLP: $1,000,000 - Estimated mitigation percentage: 80% - Annual cost of DLP solution: $150,000 What is the ROSI percentage?

10 more free samples are waiting