Big Cyber Monday Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Demo: 175 questions
Total 585 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Question 2

The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?

Cost CategoryCost

Custom fees$125

Freight$700

Warehouse rent$200

Matenal cost$500

Options:

A.

$825

B.

$1,325

C.

$1,400

D.

$1,525

Question 3

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

Options:

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Question 4

When considering Defense in Depth (DiD) as part of a network’s architectural design, what is the FIRST layer in a multi-layered defensive strategy?

Options:

A.

Distributed Denial-of-Service (DDoS)

B.

Managed Domain Name System (DNS)

C.

Reverse proxies

D.

Edge routers

Question 5

Which of the following BEST describes the responsibility of an information System Security Officer?

Options:

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Question 6

In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:

Options:

A.

reduced forecast variability.

B.

fewer customer order changes.

C.

fewer customer defections.

D.

earlier Identification of shifts Incustomer preferences.

Question 7

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 8

The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:

Options:

A.

pipeline inventory.

B.

transportation costs.

C.

inventory turns.

D.

sales revenue.

Question 9

An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?

Options:

A.

Dictionary

B.

Hybrid

C.

Inference

D.

Rainbow table

Question 10

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question 11

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

Options:

A.

Interview the candidates' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question 12

Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?

Options:

A.

Intrusion Detection System (IDS)

B.

Internet Protocol Security (IPSec)

C.

Virtual Private Network (VPN)

D.

Network Access Control (NAC)

Question 13

What does the Role-Based Access Control (RBAC) method define?

Options:

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

Question 14

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 15

A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?

Options:

A.

They are proprietary and incompatible between vendors.

B.

They can be complex to configure.

C.

They do not provide any authentication or encryption protection.

D.

They are unreliable due to high protocol overhead.

Question 16

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization's BEST next step?

Options:

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Question 17

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

Options:

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Question 18

An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?

Options:

A.

Ensure that the call agents are using an additional authentication method.

B.

Implement a Network Access Control (NAC) solution.

C.

Ensure that the voice media is using Secure Real-Time Transport Protocol.

D.

Segment the voice network and add Next-Generation Firewalls (NGFW).

Question 19

Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?

Options:

A.

Software security team

B.

Product management

C.

Third-party reviews

D.

Senior management

Question 20

After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization's IAM solution?

Options:

A.

Enhanced background checks

B.

Mobile Multi-Factor Authentication (MFA) application

C.

Biometric system

D.

Personal Identification Number (PIN) code

Question 21

A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?

Options:

A.

Ensuring compliance with international data protection and privacy laws for email communication

B.

Implementing strong encryption algorithms to ensure the confidentiality of the emails

C.

Developing a robust user authentication system to prevent unauthorized access to the software

D.

Defining clear software requirements for security and identifying potential threats and risks to the software

Question 22

In which of the following environments is capable-to-promise (CTP) more appropriate than available-to-promise (ATP)?

Options:

A.

Consumer electronics sold through local retailers

B.

Industrial supplies shipped from regional distribution centers (DCs)

C.

Packaged foods sold in grocery stores

D.

Specialty chemicals packaged and shipped to order

Question 23

Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?

Options:

A.

Offsite backup

B.

High availability

C.

Diverse routing

D.

System mirroring

Question 24

A health care organization's new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?

Options:

A.

Failure

B.

Incident

C.

Attack

D.

Breach

Question 25

When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

Options:

A.

The vendor provides documented safeguards in handling confidential data.

B.

The vendor provides a copy of their externally performed risk assessment.

C.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

D.

The vendor has a signed contract in place before work with data begins.

Question 26

Which Virtual Private Network (VPN) protocol provides a built-in encryption?

Options:

A.

Layer 2 Tunneling Protocol

B.

Point-to-Point Tunneling Protocol

C.

Layer 2 Forwarding Protocol

D.

Internet Protocol Security (IPsec)

Question 27

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 28

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

Options:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Question 29

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Question 30

The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?

Options:

A.

Confidentiality, integrity, availability

B.

Physical security, access control, asset protection

C.

Intent, capability, opportunity

D.

Threat level, network security, information disposal

Question 31

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Question 32

Asymmetric cryptography uses which type of key to encrypt data?

Options:

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Question 33

Maintaining software asset security is MOST dependent on what information?

Options:

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Question 34

Based on the values reported in the table below, what is the inventory turnover?

Options:

A.

0.50

B.

0.58

C.

1.73

D.

2.60

Question 35

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 36

An organization is planning to streamline its Identity and Access Management (IAM) processes and platform. The executive team mandated a compact platform to efficiently manage identities for internal and third-party services access. What is the BEST platform choice?

Options:

A.

Cloud Single Sign-On (SSO)

B.

On-premise IAM

C.

Cloud IAM

D.

Identity as a Service (IDaaS)

Question 37

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 38

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 39

An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?

Options:

A.

When the software is being released for testing

B.

When full system code is being merged

C.

When business analysis is being performed and systems requirements are being identified

D.

When system architecture is being defined and user interface is being designed

Question 40

An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?

Options:

A.

Physical access control

B.

Natural disaster insurance

C.

Natural surveillance

D.

Territorial reinforcement

Question 41

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

Options:

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Question 42

Corporate fraud has historically been difficult to detect. Which of the following methods has been the MOST helpful in unmasking embezzlement?

Options:

A.

Accidental discovery

B.

Management review

C.

Anonymous tip lines

D.

Internal audit

Question 43

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 44

A company's primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Question 45

The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:

Options:

A.

represents the forecast before changes are made in S&OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Question 46

Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

Options:

A.

Generally includes threat modeling, requirements risk analysis, and security modeling

B.

Focused on ensuring that the security functionally performed by a web service meets its stated requirements

C.

Ensure individual protocol implementations adhere to the relevant published standards

D.

Focused on the smallest unit of the web service application, apart from the rest of the application

Question 47

The question below is based on the following alternative schedules for a lot of 1,200.

A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.

Which of the following statements is correct?

Options:

A.

Operation overlapping results in reduced total setup costs.

B.

Operation overlapping results in reduced total span time.

C.

Lot splitting results in the shortest overall lead time.

D.

Lot splitting results in reduced total setup costs.

Question 48

A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?

Options:

A.

An increased number of receipts and issues for subassemblies

B.

An increased number of production order feedback transactions

C.

A reduced number of production orders planned by MRP

D.

An inability to process orders for replacement drawers

Question 49

The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?

Options:

A.

Deploy the solution to a network terminal access point port.

B.

Deploy the solution and connect it to a Switched Port Analyzer (SPAN) port.

C.

Deploy the solution in line with the traffic flows.

D.

Deploy the solution on a separate Virtual Local Area Network (VLAN).

Question 50

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Question 51

What is the total load requirement for this work center based on the following data?

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Question 52

An organization’s computer incident response team PRIMARILY responds to which type of control?

Options:

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Question 53

Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?

Options:

A.

Econometric models

B.

Computer simulation

C.

Time series decomposition

D.

Weighted moving average

Question 54

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Question 55

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Question 56

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Question 57

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

Options:

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Question 58

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 59

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

Options:

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Question 60

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Question 61

An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?

Options:

A.

International Organization For Standardization (ISO) 27001

B.

International Organization For standardization (ISO) 27002

C.

International Technology Infrastructure Library (ITIL)

D.

Capability Maturity Model (CMM)

Question 62

A firm's cash conversion cycle is most likely to improve when the firm:

Options:

A.

Increases the cash-to-cash cycle time.

B.

Reduces the days sales outstanding (DSO).

C.

Increases the equipment utilization rate.

D.

Extends payment terms to customers.

Question 63

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 64

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Question 65

An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?

Options:

A.

Spoofing

B.

Spear phishing

C.

Piggybacking

D.

Insider threat

Question 66

An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

B.

National Institute Of Standards And Technology (NIST) and International Organization For Standardization (ISO) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

Question 67

An advantage of applying ABC classification to a firm's replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Question 68

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 69

What BEST describes the end goal of a Disaster Recovery (DR) program?

Options:

A.

Review the status of mission-critical applications.

B.

Prevent business interruption.

C.

Continue business operations during a contingency.

D.

Restore normal business operations.

Question 70

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Question 71

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

Options:

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Question 72

At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?

Options:

A.

Layer 1

B.

Layer 2

C.

Layer 4

D.

Layer 3

Question 73

Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?

Options:

A.

Boundary condition

B.

Buffer overflow

C.

Race condition

D.

Integer overflow

Question 74

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

Options:

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Question 75

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Question 76

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 77

Which of the following is typically used to control physical access to highly secure facilities?

Options:

A.

Surveillance

B.

Mantrap

C.

Dual control

D.

Door locks

Question 78

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

Options:

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Question 79

A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?

Options:

A.

Produceto backorders

B.

Produceat a constant level

C.

Produceto the sales forecast

D.

Produceto demand

Question 80

Which security audit phase is MOST important to ensure correct controls are applied to classified data in a production environment?

Options:

A.

Data gathering

B.

Data analysis

C.

Planning and research

D.

Audit reporting and follow-up

Question 81

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Question 82

An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.

Which of the following will BEST help remediate this issue?

Options:

A.

Provide access restrictions for resources stored in a low-volume network or subnetwork location.

B.

Provide access restrictions for resources stored on a network that uses a unique platform.

C.

Provide access restrictions for resources stored in a high-volume network or subnetwork location.

D.

Provide access restrictions for resources stored on a network or on a subnetwork.

Question 83

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Question 84

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Question 85

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question 86

A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer's pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?

Options:

A.

Cross-Site Request Forgery (CSRF)

B.

On-path attack

C.

Cross-Site Scripting (XSS)

D.

Session hijacking

Question 87

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

Options:

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Question 88

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 89

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Question 90

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Question 91

Which of the following provides for continuous improvement of the change control process?

Options:

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Question 92

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

Options:

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Question 93

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

Options:

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Question 94

A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?

Options:

A.

Stakeholder identification

B.

Vision statement

C.

Operational efficiency

D.

Solution boundary

Question 95

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

Options:

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Question 96

An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?

Options:

A.

Findings by host, with associated vulnerabilities

B.

Findings by vulnerabilities, with associated hosts

C.

Appendix of definitions

D.

Executive summary

Question 97

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Question 98

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question 99

Which of the following is an access control method that organizations can use to prevent unauthorized access?

Options:

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Question 100

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Side-channel

B.

Fault injection

C.

Man-In-The-Middle (MITM)

D.

Frequency analysis

Question 101

Disaster Recovery Plan (DRP) training can be considered complete when the participants

Options:

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Question 102

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Question 103

An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?

Options:

A.

Next-generation firewall

B.

Host-Based Intrusion Detection System (HIDS)

C.

Micro-segmentation

D.

Network Intrusion Detection System (NIDS)

Question 104

Which of the following ports needs to be open for Kerberos Key Distribution Center (KDC) to function properly?

Options:

A.

88

B.

389

C.

443

D.

3268

Question 105

How much data an organization can afford to lose is determined by the:

Options:

A.

Service-Level Agreement (SLA)

B.

Business Continuity Plan (BCP)

C.

Recovery Time Objective (RTO)

D.

Recovery Point Objective (RPO)

Question 106

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Question 107

A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.

B.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and Domain Name Server (DNS) queries to blocked sites.

C.

An increase in reported changes in click percentage that aligns with a decrease in the number of phishes and incidents reported.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 108

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 109

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Question 110

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 111

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

Options:

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Question 112

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

Options:

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Question 113

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 114

Which of the following is a system architecture in a data protection strategy?

Options:

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Question 115

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

Options:

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Question 116

The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

Options:

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Question 117

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 118

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 119

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question 120

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 121

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Question 122

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

Options:

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Question 123

During an onsite audit, an assessor inspected an organization’s asset decommission practice. Which of the following would MOST likely be a finding from a security point of view?

Options:

A.

Solid State Drives (SSD) were degaussed along with hard drives.

B.

The Non-Disclosure Agreement (NDA) between the organization and its data disposal service was more than 3 years old.

C.

Hard drives from older assets replaced defective hard drives from current assets of similar classification levels.

D.

Data classifications were not clearly identified.

Question 124

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

Options:

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Question 125

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Question 126

When starting an external benchmarking study, a firm must first:

Options:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition's.

Question 127

The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?

Options:

A.

Having a public-facing website with Hypertext Markup Language (HTML) encoding enabled.

B.

Exposure of data stored in cloud repositories.

C.

Username and password are sent using a POST in plain text.

D.

Unsecured data storage elements or storage containers.

Question 128

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

Options:

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Question 129

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 130

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Question 131

A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

Options:

A.

Tandem testing

B.

Blind testing

C.

Double-gray testing

D.

Double-blind testing

Question 132

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

Options:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Question 133

A house of quality (HOQ) chart aligns which pair of functions?

Options:

A.

Customer requirements with costing

B.

Engineering with operations

C.

Customer purchasing with supplier shipping

D.

Competitive analysis with product design

Question 134

We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?

Options:

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Question 135

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Question 136

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual's transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization's sensitive business information

D.

The potential for unauthorized access to user attributes

Question 137

According to quality function deployment (QFD), customer needs are gathered through:

Options:

A.

employee suggestions.

B.

technical specifications.

C.

surveys.

D.

historical data.

Question 138

Check sheets can be used to:

Options:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question 139

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 140

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Question 141

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

Options:

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Question 142

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Question 143

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

Options:

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Question 144

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

Options:

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Question 145

Which of the following procedures should be defined when establishing information and asset handling requirements?

Options:

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Question 146

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Question 147

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

Options:

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Question 148

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

Options:

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Question 149

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Question 150

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 151

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

Options:

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Question 152

During a manual source code review, an organization discovered a dependency with an open-source library that has a history of being exploited. Which action should the organization take FIRST to assess the risk of depending on the open-source library?

Options:

A.

Identify the specific version of the open-source library that is implemented

B.

Request a penetration test that will attempt to exploit the open-source library

C.

Deploy the latest compatible version of the open-source library

D.

Submit a change request to remove software dependencies with the open-source library

Question 153

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Question 154

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Question 155

A statistical safety stock calculation would be appropriate for:

Options:

A.

components used in multiple end items.

B.

new products at time of introduction.

C.

end items with stable demand.

D.

supply-constrained raw materials.

Question 156

What is the MAIN benefit of network segmentation?

Options:

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Question 157

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

Options:

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Question 158

Which of the following situations is most likely to occur when using a push system?

Options:

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Question 159

Which of the following BEST describes an individual modifying something the individual is not supposed to?

Options:

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Question 160

In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?

Options:

A.

Deduplication conserves storage.

B.

Regulatory guidance requires compliance.

C.

Digital media can degrade.

D.

Hierarchical storage facilitates access.

Question 161

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

Options:

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Question 162

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

Options:

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Question 163

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 164

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 165

Which of the following planning modules considers the shortest-range planning goals?

Options:

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question 166

Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?

Options:

A.

Have administrators sign appropriate access agreements.

B.

Define the Acceptable Use Policy (AUP) for administrators.

C.

Have administrators accept a Non-Disclosure Agreement.

D.

Perform extensive background checks on administrators.

Question 167

What activity is a useful element in the change process?

Options:

A.

Creating short-term wins

B.

Calculating a break-even point

C.

Performing a SWOT analysis

D.

Developing key performance indicators (KPIs)

Question 168

In a make-to-order (MTO) production environment, fluctuations in sales volumes are managed by adjustments to the:

Options:

A.

Customer order backlog

B.

Finished goods inventory

C.

Minimum order quantity (MOQ)

D.

Process cycle time

Question 169

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question 170

A large volume of outbound Transmission Control Protocol (TCP) connections from the same source Internet Protocol (IP) address was observed at a satellite office firewall. Which of the following is the MOST likely explanation?

Options:

A.

There is only one managed switch port device on the satellite network.

B.

The command and control server has shut down all but one host.

C.

The network hosts are behind a Network Address Translation (NAT) device.

D.

The malware has shut down all but one host used for command and control.

Question 171

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 172

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 173

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Question 174

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

Options:

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Question 175

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

Options:

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Demo: 175 questions
Total 585 questions