712-50 Practice Test

712-50 Practice Test practice questions, page 14 of 25, with answer review and explanations.

Question 66

The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for:

  1. Integrity and Availability
  2. Assurance, Compliance and Availability
  3. International Compliance
  4. Confidentiality, Integrity and Availability

Question 67

An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security___________.

  1. Technical control
  2. Management control
  3. Procedural control
  4. Administrative control

Question 68

Information security policies should be reviewed _____________________.

  1. by the internal audit semiannually
  2. by the CISO when new systems are brought online
  3. by the Incident Response team after an audit
  4. by stakeholders at least annually

Question 69

Risk is defined as:

  1. Quantitative plus qualitative impact
  2. Asset loss times likelihood of event
  3. Advisory plus capability plus vulnerability
  4. Threat times vulnerability divided by control

Question 70

In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

  1. The organization uses exclusively a qualitative process to measure risk
  2. The organization's risk tolerance is low
  3. The organization uses exclusively a quantitative process to measure risk
  4. The organization's risk tolerance is high