EC-Council 712-50 Practice Exams
Last updated on Oct 23,2026- Exam Code: 712-50
- Exam Name: EC-Council Certified CISO (CCISO)
- Certification Provider: EC-Council
- Latest update: Oct 23,2026
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach.
Which of the following is a foundational requirement in order to initiate this type of program?
- A . A security organization that is adequately staffed to apply required mitigation strategies and regulatory compliance solutions
- B . A clear set of security policies and procedures that are more concept-based than controls-based
- C . A complete inventory of Information Technology assets including infrastructure, networks, applications and data
- D . A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
- A . Test every three years to ensure that things work as planned
- B . Conduct periodic tabletop exercises to refine the BC plan
- C . Outsource the creation and execution of the BC plan to a third party vendor
- D . Conduct a Disaster Recovery (DR) exercise every year to test the plan
Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?
- A . ITIL
- B . Privacy Act
- C . Sarbanes Oxley
- D . PCI-DSS
Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?
- A . Business Impact Analysis
- B . Business Continuity plan
- C . Security roadmap
- D . Annual report to shareholders
Which of the following is an accurate description of a balance sheet?
- A . The percentage of earnings that are retained by the organization for reinvestment in the business
- B . The details of expenses and revenue over a long period of time
- C . A summarized statement of all assets and liabilities at a specific point in time
- D . A review of regulations and requirements impacting the business from a financial perspective
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees.
Which of the following can be used as a KPI?
- A . Number of callers who report security issues.
- B . Number of callers who report a lack of customer service from the call center
- C . Number of successful social engineering attempts on the call center
- D . Number of callers who abandon the call before speaking with a representative
Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?
- A . Segmentation controls.
- B . Shadow applications.
- C . Deception technology.
- D . Vulnerability management.
You have recently drafted a revised information security policy.
From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?
- A . Chief Information Security Officer
- B . Chief Executive Officer
- C . Chief Information Officer
- D . Chief Legal Counsel
Which of the following best describes an access control process that confirms the identity of the entity seeking access to a logical or physical area?
- A . Identification
- B . Authorization
- C . Authentication
- D . Accountability
You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll.
Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):
- A . Deploy a SEIM solution and have current staff review incidents first thing in the morning
- B . Contract with a managed security provider and have current staff on recall for incident response
- C . Configure your syslog to send SMS messages to current staff when target events are triggered
- D . Employ an assumption of breach protocol and defend only essential information resources