EC-Council 712-50 Practice Exams
Last updated on Oct 22,2026- Exam Code: 712-50
- Exam Name: EC-Council Certified CISO (CCISO)
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
- A . Use within an organization to formulate security requirements and objectives
- B . Implementation of business-enabling information security
- C . Use within an organization to ensure compliance with laws and regulations
- D . To enable organizations that adopt it to obtain certifications
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
- A . Chief Financial Officer (CFO)
- B . Chief Software Architect (CIO)
- C . CISO
- D . Chief Executive Officer (CEO)
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?
- A . Destroy the repository of stolen data
- B . Contact your local law enforcement agency
- C . Consult with other C-Level executives to develop an action plan
- D . Contract with a credit reporting company for paid monitoring services for affected customers
Which of the following information may be found in table top exercises for incident response?
- A . Security budget augmentation
- B . Process improvements
- C . Real-time to remediate
- D . Security control selection
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
- A . Patch management
- B . Network monitoring
- C . Ability to provide security services tailored to the business’ needs
- D . 24/7 tollfree number
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
The CISO discovers the scalability issue will only impact a small number of network segments.
What is the next logical step to ensure the proper application of risk management methodology within the two-facto implementation project?
- A . Create new use cases for operational use of the solution
- B . Determine if sufficient mitigating controls can be applied
- C . Decide to accept the risk on behalf of the impacted business units
- D . Report the deficiency to the audit team and create process exceptions
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
- A . Metrics tracking security milestones, understanding criticality of information and information security, visibility into the types of information and how it is used, endorsement by the board of directors
- B . Annual security training for all employees, continual budget reviews, endorsement of the development and implementation of a security program, metrics to track the program
- C . Understanding criticality of information and information security, review investment in information security, endorse development and implementation of a security program, and require regular reports on adequacy and effectiveness
- D . Endorsement by the board of directors for security program, metrics of security program milestones, annual budget review, report on integration and acceptance of program
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority.
Which of the following BEST describes this organization?
- A . Risk averse
- B . Risk tolerant
- C . Risk conditional
- D . Risk minimal
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
- A . Transfer financial resources from other critical programs
- B . Take the system off line until the budget is available
- C . Deploy countermeasures and compensating controls until the budget is available
- D . Schedule an emergency meeting and request the funding to fix the issue
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization.
From an organizational perspective, which of the following is the LIKELY reason for this?
- A . The CISO does not report directly to the CEO of the organization
- B . The CISO reports to the IT organization
- C . The CISO has not implemented a policy management framework
- D . The CISO has not implemented a security awareness program