EC-Council Information Security Manager (E|ISM): 512-50

When choosing a risk mitigation method what is the MOST important factor?

A. Approval from the board of directors

B. Cost of the mitigation is less than the risk

C. Metrics of mitigation method success

D. Mitigation method complies with PCI regulations

When analyzing and forecasting a capital expense budget what are not included?

A. Network connectivity costs

B. New datacenter to operate from

C. Upgrade of mainframe

D. Purchase of new mobile devices to improve operations

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.

Recently, members of your organization have been targeted through a number of sophisticated phishing attempts and have compromised their system credentials.

What action can you take to prevent the misuse of compromised credentials to change bank account information from outside your organization while still allowing employees to manage their bank information?

A. Turn off VPN access for users originating from outside the country

B. Enable monitoring on the VPN for suspicious activity

C. Force a change of all passwords

D. Block access to the Employee-Self Service application via VPN