ECCouncil 712-50 (EC-Council Certified CISO) Practice Test 23

Question 220

Repeated missed control duties persist despite documented coaching. What approach should the accountable team prioritize?

  1. Active listening
  2. Structured performance improvement
  3. Interest-based mediation
  4. Negotiated commitment record

Explanation

Correct Answer

B:

A performance plan establishes measurable expectations, support, checkpoints, and consequences. By contrast, Negotiated commitment record is relevant when a meeting produces verbal agreement but parties later dispute promised deadlines, not as a substitute for Structured performance improvement in this case.

Incorrect Answers

A:

Listening seeks to understand constraints before advocating a solution; that is relevant if an operations executive refuses a proposed change because the security team never asked about plant constraints, but it does not directly resolve the need arising when repeated missed control duties persist despite documented coaching.

C:

Mediation identifies underlying interests and searches for options meeting shared priorities; its proper use case is one in which two leaders argue over preferred tools though both are trying to avoid service disruption, not one in which repeated missed control duties persist despite documented coaching.

D:

A written commitment records owners, terms, dates, and unresolved dependencies; it helps when a meeting produces verbal agreement but parties later dispute promised deadlines, whereas the present requirement arises because repeated missed control duties persist despite documented coaching.

Question 221

Two departments cannot resolve a dispute that is now delaying a mandatory control. What is the best-targeted intervention?

  1. Fact-behavior-impact feedback
  2. Private corrective discussion
  3. Conflict escalation protocol
  4. Interest-based mediation

Explanation

Correct Answer

C:

Escalation applies predefined decision authority when direct resolution fails. By contrast, Private corrective discussion is relevant when a manager plans to shame an analyst publicly after a nonmalicious reporting error, not as a substitute for Conflict escalation protocol in this case.

Incorrect Answers

A:

Specific feedback describes observed actions and consequences without assigning motives; its proper use case is one in which an employee disputes vague criticism about their reliability, not one in which two departments cannot resolve a dispute that is now delaying a mandatory control.

B:

Private discussion maintains dignity while addressing evidence and expectations; that helps with the separate case where a manager plans to shame an analyst publicly after a nonmalicious reporting error, not with the issue that two departments cannot resolve a dispute that is now delaying a mandatory control.

D:

Mediation identifies underlying interests and searches for options meeting shared priorities; the alternative concern is that two leaders argue over preferred tools though both are trying to avoid service disruption, but the tested need stems from the fact that two departments cannot resolve a dispute that is now delaying a mandatory control.

Question 222

An operations executive refuses a proposed change because the security team never asked about plant constraints. What should the decision-maker choose?

  1. Interest-based mediation
  2. Active listening
  3. Negotiated commitment record
  4. Structured performance improvement
  5. Nondefensive acknowledgment

Explanation

Correct Answer

B:

Listening seeks to understand constraints before advocating a solution. By contrast, Nondefensive acknowledgment is relevant when a security leader made an incorrect forecast and now blames the data team, not as a substitute for Active listening in this case.

Incorrect Answers

A:

Mediation identifies underlying interests and searches for options meeting shared priorities; that helps with the separate case where two leaders argue over preferred tools though both are trying to avoid service disruption, not with the issue that an operations executive refuses a proposed change because the security team never asked about plant constraints.

C:

A written commitment records owners, terms, dates, and unresolved dependencies; this is pertinent when a meeting produces verbal agreement but parties later dispute promised deadlines, in contrast with the actual gap where an operations executive refuses a proposed change because the security team never asked about plant constraints.

D:

A performance plan establishes measurable expectations, support, checkpoints, and consequences; that helps with the separate case where repeated missed control duties persist despite documented coaching, not with the issue that an operations executive refuses a proposed change because the security team never asked about plant constraints.

E:

Acknowledgment takes ownership and corrects the decision instead of damaging trust; it helps when a security leader made an incorrect forecast and now blames the data team, whereas the present requirement arises because an operations executive refuses a proposed change because the security team never asked about plant constraints.

Question 223

A security leader made an incorrect forecast and now blames the data team. What action would satisfy this constraint most directly?

  1. Private corrective discussion
  2. Active listening
  3. Nondefensive acknowledgment
  4. Structured performance improvement

Explanation

Correct Answer

C:

Acknowledgment takes ownership and corrects the decision instead of damaging trust. By contrast, Private corrective discussion is relevant when a manager plans to shame an analyst publicly after a nonmalicious reporting error, not as a substitute for Nondefensive acknowledgment in this case.

Incorrect Answers

A:

Private discussion maintains dignity while addressing evidence and expectations; that is relevant if a manager plans to shame an analyst publicly after a nonmalicious reporting error, but it does not directly resolve the need arising when a security leader made an incorrect forecast and now blames the data team.

B:

Listening seeks to understand constraints before advocating a solution; this is pertinent when an operations executive refuses a proposed change because the security team never asked about plant constraints, in contrast with the actual gap where a security leader made an incorrect forecast and now blames the data team.

D:

A performance plan establishes measurable expectations, support, checkpoints, and consequences; this provides its benefit when repeated missed control duties persist despite documented coaching; the matter at hand is instead that a security leader made an incorrect forecast and now blames the data team.

Question 224

A meeting produces verbal agreement but parties later dispute promised deadlines. What approach should the accountable team prioritize?

  1. Structured performance improvement
  2. Negotiated commitment record
  3. Active listening
  4. Fact-behavior-impact feedback

Explanation

Correct Answer

B:

A written commitment records owners, terms, dates, and unresolved dependencies. By contrast, Structured performance improvement is relevant when repeated missed control duties persist despite documented coaching, not as a substitute for Negotiated commitment record in this case.

Incorrect Answers

A:

A performance plan establishes measurable expectations, support, checkpoints, and consequences; this is pertinent when repeated missed control duties persist despite documented coaching, in contrast with the actual gap where a meeting produces verbal agreement but parties later dispute promised deadlines.

C:

Listening seeks to understand constraints before advocating a solution; such an effect addresses a situation where an operations executive refuses a proposed change because the security team never asked about plant constraints rather than the situation where a meeting produces verbal agreement but parties later dispute promised deadlines.

D:

Specific feedback describes observed actions and consequences without assigning motives; its proper use case is one in which an employee disputes vague criticism about their reliability, not one in which a meeting produces verbal agreement but parties later dispute promised deadlines.

Question 225

An international airline is testing the leadership response to a major cyber disruption. Too many executives issue contradictory directions to incident responders. What action would satisfy this constraint most directly?

  1. Crisis decision log
  2. Authority fallback
  3. Incident command structure
  4. Crisis stakeholder update

Explanation

Correct Answer

C:

A defined command structure clarifies tactical authority and coordination during disruption. By contrast, Crisis stakeholder update is relevant when customers, staff, and regulators require different timely messages after material disruption, not as a substitute for Incident command structure in this case.

Incorrect Answers

A:

A decision log documents inputs, approvals, timing, and rationale for later accountability; the alternative concern is that high-stakes containment choices are made rapidly and nobody records why, but the tested need stems from the fact that too many executives issue contradictory directions to incident responders.

B:

Fallback authority predefines who may authorize emergency decisions when primary leadership is absent; the condition for this measure is that the usual approving executive is unavailable when a containment action exceeds operational limits, whereas the current question concerns a case where too many executives issue contradictory directions to incident responders.

D:

A coordinated update plan tailors verified information to duties and audience needs; it would be a fit if customers, staff, and regulators require different timely messages after material disruption, whereas the required response must deal with the fact that too many executives issue contradictory directions to incident responders.

Question 226

High-stakes containment choices are made rapidly and nobody records why. What approach should the accountable team prioritize?

  1. Crisis staff welfare
  2. Authority fallback
  3. Crisis decision log
  4. Executive war-game exercise

Explanation

Correct Answer

C:

A decision log documents inputs, approvals, timing, and rationale for later accountability. By contrast, Crisis staff welfare is relevant when responders have worked without rest for two days and are making unsafe decisions, not as a substitute for Crisis decision log in this case.

Incorrect Answers

A:

Fatigue management rotates staff and protects response quality during sustained pressure; the condition under which it applies is that responders have worked without rest for two days and are making unsafe decisions, unlike the condition in the question, where high-stakes containment choices are made rapidly and nobody records why.

B:

Fallback authority predefines who may authorize emergency decisions when primary leadership is absent; the alternative concern is that the usual approving executive is unavailable when a containment action exceeds operational limits, but the tested need stems from the fact that high-stakes containment choices are made rapidly and nobody records why.

D:

An executive exercise rehearses strategic roles and trade-offs before a real crisis; such an effect addresses a situation where directors have never practiced decisions involving ransom, disclosure, and service restoration rather than the situation where high-stakes containment choices are made rapidly and nobody records why.

Question 227

Different teams circulate conflicting outage counts and speculative attack claims. What is the best-targeted intervention?

  1. Single source of situation truth
  2. Crisis staff welfare
  3. Crisis stakeholder update
  4. Crisis decision log

Explanation

Correct Answer

A:

A validated situation report establishes agreed facts, uncertainty, and update cadence. By contrast, Crisis decision log is relevant when high-stakes containment choices are made rapidly and nobody records why, not as a substitute for Single source of situation truth in this case.

Incorrect Answers

B:

Fatigue management rotates staff and protects response quality during sustained pressure; deploying it would matter if responders have worked without rest for two days and are making unsafe decisions, but the deciding issue here is that different teams circulate conflicting outage counts and speculative attack claims.

C:

A coordinated update plan tailors verified information to duties and audience needs; deploying it would matter if customers, staff, and regulators require different timely messages after material disruption, but the deciding issue here is that different teams circulate conflicting outage counts and speculative attack claims.

D:

A decision log documents inputs, approvals, timing, and rationale for later accountability; the condition for this measure is that high-stakes containment choices are made rapidly and nobody records why, whereas the current question concerns a case where different teams circulate conflicting outage counts and speculative attack claims.

Question 228

The CISO must resolve these three conditions: (1) directors have never practiced decisions involving ransom, disclosure, and service restoration; (2) leadership declares victory after restoring service without examining strategic failures; (3) customers, staff, and regulators require different timely messages after material disruption. Which THREE options directly satisfy these requirements? Choose THREE.

  1. Single source of situation truth
  2. Executive war-game exercise
  3. Incident command structure
  4. Post-crisis executive review
  5. Crisis stakeholder update
  6. Crisis decision log

Explanation

Correct Answers

B:

For the requirement that directors have never practiced decisions involving ransom, disclosure, and service restoration, an executive exercise rehearses strategic roles and trade-offs before a real crisis; Post-crisis executive review separately addresses the need that leadership declares victory after restoring service without examining strategic failures.

D:

For the requirement that leadership declares victory after restoring service without examining strategic failures, a review revisits decisions, governance gaps, resilience, and improvement commitments; Executive war-game exercise separately addresses the need that directors have never practiced decisions involving ransom, disclosure, and service restoration.

E:

For the requirement that customers, staff, and regulators require different timely messages after material disruption, a coordinated update plan tailors verified information to duties and audience needs; Executive war-game exercise separately addresses the need that directors have never practiced decisions involving ransom, disclosure, and service restoration.

Incorrect Answers

A:

A validated situation report establishes agreed facts, uncertainty, and update cadence; its proper use case is one in which different teams circulate conflicting outage counts and speculative attack claims, not one in which directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.

C:

A defined command structure clarifies tactical authority and coordination during disruption; that helps with the separate case where too many executives issue contradictory directions to incident responders, not with the issue that directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.

F:

A decision log documents inputs, approvals, timing, and rationale for later accountability; deploying it would matter if high-stakes containment choices are made rapidly and nobody records why, but the deciding issue here is that directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.

Question 229

Directors have never practiced decisions involving ransom, disclosure, and service restoration. What action would satisfy this constraint most directly?

  1. Executive war-game exercise
  2. Authority fallback
  3. Crisis staff welfare
  4. Post-crisis executive review

Explanation

Correct Answer

A:

An executive exercise rehearses strategic roles and trade-offs before a real crisis. By contrast, Crisis staff welfare is relevant when responders have worked without rest for two days and are making unsafe decisions, not as a substitute for Executive war-game exercise in this case.

Incorrect Answers

B:

Fallback authority predefines who may authorize emergency decisions when primary leadership is absent; that is relevant if the usual approving executive is unavailable when a containment action exceeds operational limits, but it does not directly resolve the need arising when directors have never practiced decisions involving ransom, disclosure, and service restoration.

C:

Fatigue management rotates staff and protects response quality during sustained pressure; the condition for this measure is that responders have worked without rest for two days and are making unsafe decisions, whereas the current question concerns a case where directors have never practiced decisions involving ransom, disclosure, and service restoration.

D:

A review revisits decisions, governance gaps, resilience, and improvement commitments; it would be a fit if leadership declares victory after restoring service without examining strategic failures, whereas the required response must deal with the fact that directors have never practiced decisions involving ransom, disclosure, and service restoration.

Question 230

The usual approving executive is unavailable when a containment action exceeds operational limits. What approach should the accountable team prioritize?

  1. Authority fallback
  2. Post-crisis executive review
  3. Crisis decision log
  4. Crisis staff welfare

Explanation

Correct Answer

A:

Fallback authority predefines who may authorize emergency decisions when primary leadership is absent. By contrast, Crisis staff welfare is relevant when responders have worked without rest for two days and are making unsafe decisions, not as a substitute for Authority fallback in this case.

Incorrect Answers

B:

A review revisits decisions, governance gaps, resilience, and improvement commitments; the condition under which it applies is that leadership declares victory after restoring service without examining strategic failures, unlike the condition in the question, where the usual approving executive is unavailable when a containment action exceeds operational limits.

C:

A decision log documents inputs, approvals, timing, and rationale for later accountability; the condition for this measure is that high-stakes containment choices are made rapidly and nobody records why, whereas the current question concerns a case where the usual approving executive is unavailable when a containment action exceeds operational limits.

D:

Fatigue management rotates staff and protects response quality during sustained pressure; that is relevant if responders have worked without rest for two days and are making unsafe decisions, but it does not directly resolve the need arising when the usual approving executive is unavailable when a containment action exceeds operational limits.

EC-Council Certified CISO (712-50) Practice Tests