Big Halloween Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Demo: 165 questions
Total 552 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?

Options:

A.

Ensuring compliance with international data protection and privacy laws for email communication

B.

Implementing strong encryption algorithms to ensure the confidentiality of the emails

C.

Developing a robust user authentication system to prevent unauthorized access to the software

D.

Defining clear software requirements for security and identifying potential threats and risks to the software

Question 2

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 3

The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?

Options:

A.

Confidentiality, integrity, availability

B.

Physical security, access control, asset protection

C.

Intent, capability, opportunity

D.

Threat level, network security, information disposal

Question 4

In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?

Options:

A.

Stockroom inventory balance will be incorrect.

B.

Operator efficiency for the fifth operation will be overstated.

C.

Units in process will be understated.

D.

Work-in-process (WIP) cost will be understated.

Question 5

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Question 6

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

Options:

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question 7

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

Options:

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Question 8

What is the MAIN benefit of network segmentation?

Options:

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Question 9

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Question 10

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual's transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization's sensitive business information

D.

The potential for unauthorized access to user attributes

Question 11

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

Options:

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Question 12

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

Options:

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Question 13

A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?

Options:

A.

Privacy Impact Assessment (PIA)

B.

Vulnerability assessment

C.

Sensitive data assessment

D.

Personally Identifiable Information (PII) risk assessment

Question 14

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Question 15

An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?

Options:

A.

Physical access control

B.

Natural disaster insurance

C.

Natural surveillance

D.

Territorial reinforcement

Question 16

Which of the following actions will result In lower inventory levels?

Options:

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Question 17

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Question 18

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

Options:

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Question 19

What is the MOST important security benefit of comprehensive asset management?

Options:

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Question 20

During a threat modeling exercise using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) framework, it was identified that a web server allocates a socket and forks each time it receives a request from a user without limiting the number of connections or requests.

Which of the following security objectives is MOST likely absent in the web server?

Options:

A.

Integrity

B.

Authenticity

C.

Availability

D.

Authorization

Question 21

A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

Options:

A.

Tandem testing

B.

Blind testing

C.

Double-gray testing

D.

Double-blind testing

Question 22

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 23

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

Options:

A.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

B.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

C.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

D.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

Question 24

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Question 25

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 26

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

Options:

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Question 27

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

As close to the workload as possible, because it impacts authorization decisions

B.

Between the data stores and the trust engine, because it improves security policies

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the policy engine and the trust engine, because it enforces security policies

Question 28

An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?

Options:

A.

Remote using a Trusted Platform Module (TPM) due to better protection of the keys

B.

Local using Trusted Platform Module (TPM) because low-level access software can be accessed

C.

Local using Trusted Platform Module (TPM) because of benefits from Segregation Of Duties (SoD)

D.

Remote using a scanning device because of benefits from Segregation Of Duties (SoD)

E.

Local using Mobile Device Management (MDM) because of device policy enforcement

Question 29

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network's Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Question 30

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

Options:

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Question 31

Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?

Options:

A.

Accuracy of Key Risk Indicators (KRI) reported to senior management

B.

Ensure the integrity of the organization's assets

C.

Backups being completed in a timely manner

D.

Accuracy of Key Performance Indicators (KPI) reported to senior management

Question 32

Which of the following combines multiple software programming tools into one package?

Options:

A.

Program language compilers

B.

Integrated development environments

C.

Dynamic Link Libraries (DLL)

D.

Software development kit

Question 33

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 34

The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?

Options:

A.

Deploy the solution to a network terminal access point port.

B.

Deploy the solution and connect it to a Switched Port Analyzer (SPAN) port.

C.

Deploy the solution in line with the traffic flows.

D.

Deploy the solution on a separate Virtual Local Area Network (VLAN).

Question 35

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

Options:

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Question 36

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

Options:

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Question 37

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

Options:

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Question 38

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 39

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 40

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

Options:

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Question 41

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

Options:

A.

80

B.

120

C.

160

D.

200

Question 42

A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?

Options:

A.

Just-in-time

B.

Delegated

C.

Break-glass

D.

Automated

Question 43

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

Options:

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Question 44

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

Options:

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Question 45

One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

Options:

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

Question 46

A health care organization’s new cloud-based customer-facing application is constantly receiving security events from dubious sources.

What BEST describes a security event that compromises the confidentiality, integrity, or availability of the application and data?

Options:

A.

Attack

B.

Breach

C.

Failure

D.

Incident

Question 47

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question 48

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 49

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Question 50

While conducting penetration testing, one of the testers noticed evidence of additional penetration activities not part of the test. Which of the following is the NEXT course of action for the lead penetration tester?

Options:

A.

Continue testing and report the event at the end of the day.

B.

Stop testing and monitor activity.

C.

Stop testing and report the event.

D.

Complete the test and report the event at the end of the test.

Question 51

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 52

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Question 53

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Question 54

An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?

Options:

A.

The organization can implement both mandatory and dynamic access controls, except where they would be in conflict.

B.

The organization can clone roles, saving time and granting broad access to persons within the same department.

C.

The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.

D.

The organization can implement both static and dynamic access controls, adjusting them to fit any individual’s access needs.

Question 55

An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?

Options:

A.

Require that the user supplies their credential to access confidential documents.

B.

Require a Virtual Private Network (VPN) connection to the organization's network to access confidential documents.

C.

Implement Security Assertion Markup Language (SAML) to validate the identity of the user requesting access to confidential documents.

D.

Implement Open Authorization (OAuth) 2.0 to require the users to request permission to access confidential documents.

Question 56

Which of the following planning modules considers the shortest-range planning goals?

Options:

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question 57

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Question 58

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

Options:

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Question 59

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

Options:

A.

Rule-based

B.

Mandatory

C.

Role-based

D.

Automated

Question 60

Broadcast traffic is causing network performance degradation of sensitive equipment.

Which of the following methods is used to prevent the broadcast traffic from impacting availability?

Options:

A.

Place the sensitive equipment behind a firewall to prevent the broadcast traffic from impacting the equipment.

B.

Implement Quality of Service (QoS) on network switches to throttle the sensitive equipment traffic.

C.

Move the sensitive equipment to a different switch port to prevent the broadcast traffic from impacting the equipment.

D.

Use Network Access Control (NAC) to prevent the broadcast traffic from broadcasting.

Question 61

An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

Options:

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Question 62

The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?

Options:

A.

Reorder point(ROP)

B.

Safety stock

C.

Inventory investment

D.

Safety factor

Question 63

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 64

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

Options:

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Question 65

According to quality function deployment (QFD), customer needs are gathered through:

Options:

A.

employee suggestions.

B.

technical specifications.

C.

surveys.

D.

historical data.

Question 66

In a make-to-stock (MTS) environment, the master production schedule (MPS) Is usually a schedule of which of the following types of items?

Options:

A.

Phantom items

B.

Finished goods items

C.

Component/subassembly items

D.

Raw material items

Question 67

Which of the following is the BEST type of fire extinguisher for a data center environment?

Options:

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Question 68

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Enforcement rules

B.

Transformation procedures

C.

Data classifications

D.

Integrity labels

Question 69

An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?

Options:

A.

Endpoint security

B.

Network security

C.

Cyber physical security

D.

Cloud security

Question 70

An organization starts to develop a drone inspection and defect detection system includes different subsystems running at different clouds from different service providers. During the architectural design phase, which security architecture principle should be the MOST important for the security engineer to apply?

Options:

A.

Security by design

B.

Default deny

C.

Security by default

D.

Security before design

Question 71

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Question 72

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Question 73

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

Options:

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Question 74

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

Options:

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Question 75

Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?

Options:

A.

Discretionary.

B.

Attribute-based.

C.

Mandatory.

D.

Role-based.

Question 76

Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?

Options:

A.

Supply disruptions

B.

Forecast inaccuracy

C.

Procurement problems

D.

Loss of intellectual property

Question 77

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

Options:

A.

Federation authorities access list

B.

Manual registration

C.

Proxied federation

D.

Signed assertion

Question 78

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Question 79

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Question 80

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question 81

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 82

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

Options:

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Question 83

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

Options:

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question 84

Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?

Options:

A.

Authentication Header (AH)

B.

Generic Routing Encapsulation (GRE)

C.

Encapsulation Security Payload

D.

Internet Key Exchange (IKE)

Question 85

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 86

Which of the following is an information security management framework?

Options:

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Question 87

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

Options:

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Question 88

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

Options:

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Question 89

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 90

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Question 91

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

Options:

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Question 92

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

Options:

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Question 93

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

Options:

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user's ability to change device settings

D.

To limit web access to only approved sites

Question 94

Which of the following statements characterizes a pull system In distribution management?

Options:

A.

Each warehouse makes its own replenishment decisions.

B.

It uses distribution requirements planning(DRP).

C.

It uses uniform performance measures.

D.

It uses fair-share allocation.

Question 95

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Question 96

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

Options:

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Question 97

Which of the following BEST effective when protecting against insider threats?

Options:

A.

Implement Two-Factor Authentication (2FA).

B.

Segment data repositories by business rules.

C.

Develop recovery and restoration procedures.

D.

Address security in third-party agreements.

Question 98

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 99

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 100

Forecast error typically triggers forecast revision when it is:

Options:

A.

used in computing the tracking signal.

B.

associated with the Introduction stage of the product life cycle.

C.

continually increasing.

D.

caused by random variation.

Question 101

Which of the following threats MUST be included while conducting threat modeling for a Cloud Service Provider (CSP)?

Options:

A.

Risks of data breaches that can result from inadequate encryption of tenant data in transit and at rest

B.

Potential legal actions from third parties due to tenants’ activities on the CSP’s platform

C.

Vulnerabilities in shared resources that can be exploited by attackers to affect multiple tenants

D.

Threats originating from the CSP’s tenants that can impact the infrastructure and other tenants

Question 102

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

Options:

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Question 103

Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?

Options:

A.

Honeypots

B.

Adding listening devices

C.

Adding noise

D.

Acoustic cryptanalysis

Question 104

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Completeness

B.

Vulnerabilities

C.

Security

D.

Logic

Question 105

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 106

If fixed costs are §200,000 and 20,000 units are produced, a unit's fixed cost is §10. This is an example of:

Options:

A.

variable costing.

B.

activity-based costing (ABC).

C.

absorption costing.

D.

overhead costing.

Question 107

Which activity follows the discovery phase of vulnerability management?

Options:

A.

Vulnerability detection

B.

Vulnerability evaluation

C.

Vulnerability identification

D.

Vulnerability governance

Question 108

In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:

Options:

A.

reduced forecast variability.

B.

fewer customer order changes.

C.

fewer customer defections.

D.

earlier Identification of shifts Incustomer preferences.

Question 109

A reduction In purchased lot sizes will reduce which of the following items?

Options:

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Question 110

A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?

Options:

A.

Logical access control against symmetric key

B.

Cryptanalysis against symmetric key

C.

Cryptanalysis against private key

D.

Logical access control against private key

Question 111

A statistical safety stock calculation would be appropriate for:

Options:

A.

components used in multiple end items.

B.

new products at time of introduction.

C.

end items with stable demand.

D.

supply-constrained raw materials.

Question 112

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 113

An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?

Options:

A.

Spoofing

B.

Spear phishing

C.

Piggybacking

D.

Insider threat

Question 114

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 115

Which of the following factors is used to determine safety stock?

Options:

A.

Number of customers

B.

Available capacity

C.

Forecast error distribution

D.

Time between customer orders

Question 116

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

Options:

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Question 117

A life cycle assessment (LCA) would be used to determine:

Options:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Question 118

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 119

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

Options:

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Question 120

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Question 121

Which of the following is the workflow of the identity and access provisioning lifecycle?

Options:

A.

Creation, Assessment, Deletion

B.

Assessment, Creation, Deletion

C.

Provision, Review, Revocation

D.

Review, Provision, Revocation

Question 122

What BEST describes the end goal of a Disaster Recovery (DR) program?

Options:

A.

Review the status of mission-critical applications.

B.

Prevent business interruption.

C.

Continue business operations during a contingency.

D.

Restore normal business operations.

Question 123

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 124

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Question 125

What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?

Options:

A.

Inventory use cases, categorize threats, evaluate business impact

B.

Understand attack front, identify trust levels, decompose application

C.

Inventory countermeasures, identify threats, implement mitigations

D.

Establish monitoring, identify risks, implement countermeasures

Question 126

Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?

Options:

A.

Production cost and lot size quantity

B.

Purchase cost and shrinkage rates

C.

Transportation cost and delivery time

D.

Customer price and order quantity

Question 127

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

Options:

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Question 128

An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Internet layer

B.

Transport layer

C.

Application layer

D.

Network layer

Question 129

The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:

Options:

A.

revise the rough-cut capacity plan.

B.

reschedule a related component on the shop floor.

C.

check the accuracy of the bills for the MPS items.

D.

determine if a customer order will be impacted.

Question 130

Which of the following prioritization rules will have the greatest impact In reducing the number of orders In queue?

Options:

A.

Critical ratio

B.

Shortest processing time

C.

Fewest operations remaining

D.

First come, first served

Question 131

Which of the physiological biometric scanning methods is considered the MOST invasive?

Options:

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Question 132

Which of the following factors Is considered a carrying cost?

Options:

A.

Setup

B.

Transportation

C.

Obsolescence

D.

Scrap rate

Question 133

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

Options:

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Question 134

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 135

A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Web application unit test

B.

Online application development test

C.

Web application penetration test

D.

Online application assurance test

Question 136

An organization wants to establish an information security program and has assigned a security analyst to put it in place. What is the NEXT step?

Options:

A.

Develop and implement an information security standards manual.

B.

security control review.

C.

Perform a risk assessment to establish baseline security.

D.

Implement security access control software.

Question 137

Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?

Options:

A.

Switched Port Analyzer (SPAN)

B.

Representational State Transfer (REST)

C.

Remote Desktop Protocol (RDP)

D.

Virtual Private Network (VPN)

Question 138

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 139

A new organization building is being designed and the security manager has been asked for input on needed security requirements. Which of the following controls are MOST applicable to this scenario?

Options:

A.

Deterrent controls, such as signs announcing video cameras and alarms, are installed.

B.

Preventative controls, such as Intrusion Detection Systems (IDS) and security guards, are used.

C.

Preventative controls, such as Intrusion Detection Systems (IDS) and mechanical locks, are used.

D.

Deterrent controls, such as signs announcing video cameras and alarms, are installed.

Question 140

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Question 141

It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours. One modeler finished 5 models a day, and the other finished 1 model a day. What was the demonstrated capacity last week?

Options:

A.

25models

B.

15models

C.

10models

D.

30models

Question 142

Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?

Options:

A.

Signed Non-Disclosure Agreement (NDA)

B.

Signed Acceptable Use Policy (AUP)

C.

ISC2 Code of Ethics

D.

Suspicious that a crime is being committed

Question 143

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

Options:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Question 144

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question 145

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Question 146

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Question 147

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Question 148

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 149

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

Options:

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Question 150

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

B.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

C.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

D.

Security-focused CM surpasses existing security requirements of the organization.

Question 151

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

Options:

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question 152

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 153

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Question 154

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 155

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

Options:

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

Question 156

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 157

Which of the following is an access control method that organizations can use to prevent unauthorized access?

Options:

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Question 158

A contractor hacked into an unencrypted session on an organization's wireless network. Which authentication configuration is MOST likely to have enabled this?

Options:

A.

Remote Authentication Dial-In User Service (RADIUS)

B.

Captive web portal

C.

Lightweight Directory Access Protocol (LDAP)

D.

Token authentication

Question 159

Asymmetric cryptography uses which type of key to encrypt data?

Options:

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Question 160

Which of the following provides for continuous improvement of the change control process?

Options:

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Question 161

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Question 162

Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?

Options:

A.

Accounts receivable

B.

Inventory value

C.

Accounts payable

D.

Cost of capital

Question 163

Which of the following combines multiple software programming tools into one package?

Options:

A.

Integrated development environments

B.

Software development kit

C.

Dynamic Link Libraries (DLL)

D.

Program language compilers

Question 164

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Question 165

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

Options:

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Demo: 165 questions
Total 552 questions