EC-Council 712-50 Practice Exams
Last updated on Oct 22,2026- Exam Code: 712-50
- Exam Name: EC-Council Certified CISO (CCISO)
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?
- A . Identify threats, risks, impacts and vulnerabilities
- B . Decide how to manage risk
- C . Define the budget of the Information Security Management System
- D . Define Information Security Policy
Which of the following is considered one of the most frequent failures in project management?
- A . Overly restrictive management
- B . Excessive personnel on project
- C . Failure to meet project deadlines
- D . Insufficient resources
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights.
Which of the following would be the MOST concerning?
- A . Lack of notification to the public of disclosure of confidential information.
- B . Lack of periodic examination of access rights
- C . Failure to notify police of an attempted intrusion
- D . Lack of reporting of a successful denial of service attack on the network.
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
From an Information Security Leadership perspective, which of the following is a MAJOR concern about the CISO’s approach to security?
- A . Lack of risk management process
- B . Lack of sponsorship from executive management
- C . IT security centric agenda
- D . Compliance centric agenda
Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?
- A . Reduction of budget
- B . Decreased security awareness
- C . Improper use of information resources
- D . Fines for regulatory non-compliance
The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?
- A . Risk metrics
- B . Management metrics
- C . Operational metrics
- D . Compliance metrics
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader.
What should you do?
- A . Nothing, this falls outside your area of influence.
- B . Close and chain the door shut and send a company-wide memo banning the practice.
- C . Have a risk assessment performed.
- D . Post a guard at the door to maintain physical security
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?
- A . Management
- B . Operational
- C . Technical
- D . Administrative
What role should the CISO play in properly scoping a PCI environment?
- A . Validate the business units’ suggestions as to what should be included in the scoping process
- B . Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment
- C . Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data
- D . Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope
Where does bottom-up financial planning primarily gain information for creating budgets?
- A . By adding all capital and operational costs from the prior budgetary cycle, and determining potential financial shortages
- B . By reviewing last year’s program-level costs and adding a percentage of expected additional portfolio costs
- C . By adding the cost of all known individual tasks and projects that are planned for the next budgetary cycle
- D . By adding all planned operational expenses per quarter then summarizing them in a budget request