ECCouncil 712-50 (EC-Council Certified CISO) Practice Test 46

Question 450

A remote identity-verification service may accept a prerecorded face video. What approach should the accountable team prioritize?

  1. Adversarial AI evaluation
  2. Model output human review
  3. Deepfake voice callback
  4. Sensitive data leakage prevention
  5. Video identity liveness challenge

Explanation

Correct Answer

E:

Liveness challenges test contemporaneous human response but need defenses against sophisticated injection attacks. By contrast, Deepfake voice callback is relevant when a realistic synthesized executive voice requests an emergency payment transfer, not as a substitute for Video identity liveness challenge in this case.

Incorrect Answers

A:

Adversarial testing evaluates robustness under intentional input manipulation and triggers defensive improvement; it helps when a fraud classifier behaves differently when inputs are slightly manipulated, whereas the present requirement arises because a remote identity-verification service may accept a prerecorded face video.

B:

Human verification checks evidence and context before consequential operational decisions; it helps when an automated risk analyst produces confident but unsupported incident conclusions, whereas the present requirement arises because a remote identity-verification service may accept a prerecorded face video.

C:

Verification through an independently established channel defeats reliance on familiar voice alone; it helps when a realistic synthesized executive voice requests an emergency payment transfer, whereas the present requirement arises because a remote identity-verification service may accept a prerecorded face video.

D:

Usage governance and data controls restrict which models and prompts may handle protected information; the condition under which it applies is that staff paste confidential incident data into an unapproved public AI assistant, unlike the condition in the question, where a remote identity-verification service may accept a prerecorded face video.

Question 451

Public audiences cannot determine whether a purported official announcement was altered. What is the best-targeted intervention?

  1. Synthetic-media response protocol
  2. Adversarial AI evaluation
  3. Synthetic content provenance
  4. Autonomous tool-call audit trail

Explanation

Correct Answer

C:

Signed provenance and verification can help authenticate origin and modification history when supported. By contrast, Synthetic-media response protocol is relevant when a fake announcement attributed to the CEO spreads rapidly across social platforms, not as a substitute for Synthetic content provenance in this case.

Incorrect Answers

A:

A response protocol coordinates authenticity checks, verified corrections, legal coordination, and monitoring; that helps with the separate case where a fake announcement attributed to the CEO spreads rapidly across social platforms, not with the issue that public audiences cannot determine whether a purported official announcement was altered.

B:

Adversarial testing evaluates robustness under intentional input manipulation and triggers defensive improvement; the condition under which it applies is that a fraud classifier behaves differently when inputs are slightly manipulated, unlike the condition in the question, where public audiences cannot determine whether a purported official announcement was altered.

D:

Tool-call logging links agent actions to identities, approvals, prompts, source references, and timestamps so reviewers can reconstruct the execution trail; it helps when an AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls, whereas the present requirement arises because public audiences cannot determine whether a purported official announcement was altered.

Question 452

An automated risk analyst produces confident but unsupported incident conclusions. What should the decision-maker choose?

  1. Sensitive data leakage prevention
  2. Model output human review
  3. Synthetic content provenance
  4. Deepfake voice callback

Explanation

Correct Answer

B:

Human verification checks evidence and context before consequential operational decisions. By contrast, Sensitive data leakage prevention is relevant when staff paste confidential incident data into an unapproved public AI assistant, not as a substitute for Model output human review in this case.

Incorrect Answers

A:

Usage governance and data controls restrict which models and prompts may handle protected information; it would be a fit if staff paste confidential incident data into an unapproved public AI assistant, whereas the required response must deal with the fact that an automated risk analyst produces confident but unsupported incident conclusions.

C:

Signed provenance and verification can help authenticate origin and modification history when supported; it helps when public audiences cannot determine whether a purported official announcement was altered, whereas the present requirement arises because an automated risk analyst produces confident but unsupported incident conclusions.

D:

Verification through an independently established channel defeats reliance on familiar voice alone; that is relevant if a realistic synthesized executive voice requests an emergency payment transfer, but it does not directly resolve the need arising when an automated risk analyst produces confident but unsupported incident conclusions.

Question 453

An AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls. What action would satisfy this constraint most directly?

  1. Model output human review
  2. Deepfake voice callback
  3. Autonomous tool-call audit trail
  4. Adversarial AI evaluation

Explanation

Correct Answer

C:

Tool-call logging links agent actions to identities, approvals, prompts, source references, and timestamps so reviewers can reconstruct the execution trail. By contrast, Adversarial AI evaluation is relevant when a fraud classifier behaves differently when inputs are slightly manipulated, not as a substitute for Autonomous tool-call audit trail in this case.

Incorrect Answers

A:

Human verification checks evidence and context before consequential operational decisions; it helps when an automated risk analyst produces confident but unsupported incident conclusions, whereas the present requirement arises because an AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls.

B:

Verification through an independently established channel defeats reliance on familiar voice alone; it helps when a realistic synthesized executive voice requests an emergency payment transfer, whereas the present requirement arises because an AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls.

D:

Adversarial testing evaluates robustness under intentional input manipulation and triggers defensive improvement; it helps when a fraud classifier behaves differently when inputs are slightly manipulated, whereas the present requirement arises because an AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls.

Question 454

Staff paste confidential incident data into an unapproved public AI assistant. What approach should the accountable team prioritize?

  1. Synthetic-media response protocol
  2. Sensitive data leakage prevention
  3. Deepfake voice callback
  4. Synthetic content provenance

Explanation

Correct Answer

B:

Usage governance and data controls restrict which models and prompts may handle protected information. By contrast, Synthetic content provenance is relevant when public audiences cannot determine whether a purported official announcement was altered, not as a substitute for Sensitive data leakage prevention in this case.

Incorrect Answers

A:

A response protocol coordinates authenticity checks, verified corrections, legal coordination, and monitoring; it would be a fit if a fake announcement attributed to the CEO spreads rapidly across social platforms, whereas the required response must deal with the fact that staff paste confidential incident data into an unapproved public AI assistant.

C:

Verification through an independently established channel defeats reliance on familiar voice alone; the condition under which it applies is that a realistic synthesized executive voice requests an emergency payment transfer, unlike the condition in the question, where staff paste confidential incident data into an unapproved public AI assistant.

D:

Signed provenance and verification can help authenticate origin and modification history when supported; that is relevant if public audiences cannot determine whether a purported official announcement was altered, but it does not directly resolve the need arising when staff paste confidential incident data into an unapproved public AI assistant.

Question 455

A fraud classifier behaves differently when inputs are slightly manipulated. What is the best-targeted intervention?

  1. Adversarial AI evaluation
  2. Model output human review
  3. Autonomous tool-call audit trail
  4. Video identity liveness challenge

Explanation

Correct Answer

A:

Adversarial testing evaluates robustness under intentional input manipulation and triggers defensive improvement. By contrast, Video identity liveness challenge is relevant when a remote identity-verification service may accept a prerecorded face video, not as a substitute for Adversarial AI evaluation in this case.

Incorrect Answers

B:

Human verification checks evidence and context before consequential operational decisions; that is relevant if an automated risk analyst produces confident but unsupported incident conclusions, but it does not directly resolve the need arising when a fraud classifier behaves differently when inputs are slightly manipulated.

C:

Tool-call logging links agent actions to identities, approvals, prompts, source references, and timestamps so reviewers can reconstruct the execution trail; the condition for this measure is that an AI assistant changed customer records after consulting untrusted material and investigators cannot reconstruct the authority or sequence of tool calls, whereas the current question concerns a case where a fraud classifier behaves differently when inputs are slightly manipulated.

D:

Liveness challenges test contemporaneous human response but need defenses against sophisticated injection attacks; the condition for this measure is that a remote identity-verification service may accept a prerecorded face video, whereas the current question concerns a case where a fraud classifier behaves differently when inputs are slightly manipulated.

Question 456

The CISO must resolve these three conditions: (1) a fake announcement attributed to the CEO spreads rapidly across social platforms; (2) a remote identity-verification service may accept a prerecorded face video; (3) public audiences cannot determine whether a purported official announcement was altered. Which THREE options directly satisfy these requirements? Choose THREE.

  1. Synthetic-media response protocol
  2. Deepfake voice callback
  3. Model output human review
  4. Video identity liveness challenge
  5. Adversarial AI evaluation
  6. Synthetic content provenance

Explanation

Correct Answers

A:

For the requirement that a fake announcement attributed to the CEO spreads rapidly across social platforms, a response protocol coordinates authenticity checks, verified corrections, legal coordination, and monitoring; Video identity liveness challenge separately addresses the need that a remote identity-verification service may accept a prerecorded face video.

D:

For the requirement that a remote identity-verification service may accept a prerecorded face video, liveness challenges test contemporaneous human response but need defenses against sophisticated injection attacks; Synthetic-media response protocol separately addresses the need that a fake announcement attributed to the CEO spreads rapidly across social platforms.

F:

For the requirement that public audiences cannot determine whether a purported official announcement was altered, signed provenance and verification can help authenticate origin and modification history when supported; Synthetic-media response protocol separately addresses the need that a fake announcement attributed to the CEO spreads rapidly across social platforms.

Incorrect Answers

B:

Verification through an independently established channel defeats reliance on familiar voice alone; such an effect addresses a situation where a realistic synthesized executive voice requests an emergency payment transfer rather than the situation where a fake announcement attributed to the CEO spreads rapidly across social platforms.

C:

Human verification checks evidence and context before consequential operational decisions; it would be a fit if an automated risk analyst produces confident but unsupported incident conclusions, whereas the required response must deal with the fact that a fake announcement attributed to the CEO spreads rapidly across social platforms.

E:

Adversarial testing evaluates robustness under intentional input manipulation and triggers defensive improvement; that helps with the separate case where a fraud classifier behaves differently when inputs are slightly manipulated, not with the issue that a fake announcement attributed to the CEO spreads rapidly across social platforms.

Question 457

A consumer platform is improving response to stolen and fabricated identities. A customer who regained account access cannot determine which profile changes made by an intruder are trustworthy. What is the best-targeted intervention?

  1. Credit-fraud notification workflow
  2. SIM-swap defense
  3. Customer account restoration
  4. New-device enrollment verification

Explanation

Correct Answer

C:

Restoration verifies legitimate profile attributes, reverses unauthorized changes, and validates account integrity before normal use resumes. By contrast, Credit-fraud notification workflow is relevant when a breach exposes identity documents and affected clients may face downstream impersonation, not as a substitute for Customer account restoration in this case.

Incorrect Answers

A:

Notification and protective guidance support monitoring and remediation consistent with applicable duties; the alternative concern is that a breach exposes identity documents and affected clients may face downstream impersonation, but the tested need stems from the fact that a customer who regained account access cannot determine which profile changes made by an intruder are trustworthy.

B:

Phishing-resistant or app-bound factors reduce dependence on carrier-controlled SMS delivery; it helps when fraudsters take over a victim's phone number to intercept SMS verification, whereas the present requirement arises because a customer who regained account access cannot determine which profile changes made by an intruder are trustworthy.

D:

High-assurance enrollment requires proof of an existing trusted factor or equivalent recovery process; the condition under which it applies is that a criminal with a password tries to add their own authenticator to a customer profile, unlike the condition in the question, where a customer who regained account access cannot determine which profile changes made by an intruder are trustworthy.

Question 458

New applicants use stolen documents to open fraudulent customer accounts. What should the decision-maker choose?

  1. Identity proofing
  2. Customer account restoration
  3. Session anomaly investigation
  4. New-device enrollment verification

Explanation

Correct Answer

A:

Identity proofing verifies asserted real-world identity before sensitive enrollment. By contrast, New-device enrollment verification is relevant when a criminal with a password tries to add their own authenticator to a customer profile, not as a substitute for Identity proofing in this case.

Incorrect Answers

B:

Restoration verifies legitimate profile attributes, reverses unauthorized changes, and validates account integrity before normal use resumes; that is relevant if a customer who regained account access cannot determine which profile changes made by an intruder are trustworthy, but it does not directly resolve the need arising when new applicants use stolen documents to open fraudulent customer accounts.

C:

Session investigation correlates tokens, device history, and user confirmation before remediation; this is pertinent when an account exhibits impossible concurrent locations and unrecognized device registrations, in contrast with the actual gap where new applicants use stolen documents to open fraudulent customer accounts.

D:

High-assurance enrollment requires proof of an existing trusted factor or equivalent recovery process; that is relevant if a criminal with a password tries to add their own authenticator to a customer profile, but it does not directly resolve the need arising when new applicants use stolen documents to open fraudulent customer accounts.

Question 459

Attackers use leaked personal details to persuade agents to reset legitimate accounts. What action would satisfy this constraint most directly?

  1. Recovery fraud protection
  2. Session anomaly investigation
  3. Customer account restoration
  4. New-device enrollment verification

Explanation

Correct Answer

A:

Independent recovery checks avoid treating easily obtained biographical data as strong proof. By contrast, Session anomaly investigation is relevant when an account exhibits impossible concurrent locations and unrecognized device registrations, not as a substitute for Recovery fraud protection in this case.

Incorrect Answers

B:

Session investigation correlates tokens, device history, and user confirmation before remediation; it would be a fit if an account exhibits impossible concurrent locations and unrecognized device registrations, whereas the required response must deal with the fact that attackers use leaked personal details to persuade agents to reset legitimate accounts.

C:

Restoration verifies legitimate profile attributes, reverses unauthorized changes, and validates account integrity before normal use resumes; it would be a fit if a customer who regained account access cannot determine which profile changes made by an intruder are trustworthy, whereas the required response must deal with the fact that attackers use leaked personal details to persuade agents to reset legitimate accounts.

D:

High-assurance enrollment requires proof of an existing trusted factor or equivalent recovery process; that helps with the separate case where a criminal with a password tries to add their own authenticator to a customer profile, not with the issue that attackers use leaked personal details to persuade agents to reset legitimate accounts.

Question 460

An account exhibits impossible concurrent locations and unrecognized device registrations. What approach should the accountable team prioritize?

  1. New-device enrollment verification
  2. SIM-swap defense
  3. Session anomaly investigation
  4. Recovery fraud protection

Explanation

Correct Answer

C:

Session investigation correlates tokens, device history, and user confirmation before remediation. By contrast, New-device enrollment verification is relevant when a criminal with a password tries to add their own authenticator to a customer profile, not as a substitute for Session anomaly investigation in this case.

Incorrect Answers

A:

High-assurance enrollment requires proof of an existing trusted factor or equivalent recovery process; its proper use case is one in which a criminal with a password tries to add their own authenticator to a customer profile, not one in which an account exhibits impossible concurrent locations and unrecognized device registrations.

B:

Phishing-resistant or app-bound factors reduce dependence on carrier-controlled SMS delivery; such an effect addresses a situation where fraudsters take over a victim's phone number to intercept SMS verification rather than the situation where an account exhibits impossible concurrent locations and unrecognized device registrations.

D:

Independent recovery checks avoid treating easily obtained biographical data as strong proof; this is pertinent when attackers use leaked personal details to persuade agents to reset legitimate accounts, in contrast with the actual gap where an account exhibits impossible concurrent locations and unrecognized device registrations.

EC-Council Certified CISO (712-50) Practice Tests