An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?
A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?
During the sales and operations planning (S & OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?
A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?
An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?
Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?
What is the MAIN privacy risk raised by federated identity solutions?
A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?
Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?
What is the MAIN benefit of network segmentation?
Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to
We have observed the inventory system does not handle plastic parts well. " What should be added to the problem statement to make it more useful?
A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
Broadcast traffic is causing network performance degradation of sensitive equipment.
Which of the following methods is used to prevent the broadcast traffic from impacting availability?
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
Which of the below represent the GREATEST cloud-specific policy and organizational risk?
A disadvantage of a capacity-lagging strategy may be:
An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?
Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?
In a make-to-stock (MTS) environment, the master production schedule (MPS) Is usually a schedule of which of the following types of items?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
Which of the following regarding authentication protocols is a PRIMARY consideration when designing an authentication and key management system?
An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?
A life cycle assessment (LCA) would be used to determine:
An organization is having bandwidth utilization issues due to unauthorized devices on the network. Which action should be taken to solve the problem?
A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?
Maintaining software asset security is MOST dependent on what information?
In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?
Given the following data, calculate the appropriate takt time:

Which of the following is MOST accurate when comparing patch management and vulnerability management?
Which is the MOST valid statement around the relationship of security and privacy?
Organization A provides scalable Information Technology (IT) infrastructure while Organization B provides security services to customers via Software as a Service (SaaS) model. Which document is used to express a set of intended actions between the organizations with respect to meeting the customers’ needs?
Which of the following is the BEST way to identify the various types of software installed on an endpoint?
In which of the following phases of the product life cycle is product price most effective in influencing demand?
An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?
Elements calculated in the master scheduling process include:
Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?
Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?
An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?
Which of the following presents the GREATEST benefit to an organization ' s security posture when a change management process is implemented?
Which of the following sampling techniques is BEST suited for comprehensive risk assessments?
Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?
An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?
What document MOST likely states an organization’s values?
An order winner during the growth stage of a product ' s life cycle is:
An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?
A contractor hacked into an unencrypted session on an organization ' s wireless network. Which authentication configuration is MOST likely to have enabled this?
The most effective way to manage demand uncertainty and improve customer service is to reduce:
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?
Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?
A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?
Pitfalls of a differentiation strategy include:
A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?
The production plan defines which of the following targets?
Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?
An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?
An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
Which Internet of Things (IoT) process was developed specifically to support retail commerce?
Which of the following MUST be in place for security to be effective in an organization?
Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?
An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?
Which of the following is typically used to control physical access to highly secure facilities?
Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?
What should an organization do to prepare for Disaster Recovery (DR) efforts?
The horizon for forecasts that are input to the sales and operations planning (S & OP) process should be long enough that:
In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?
An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.
Which of the following topics will MOST likely be on the agenda?
Which of the following statements about demonstrated capacity Is true?
The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
An example of a flexibility metric for an organization Is:
Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?
A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?
A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
Which of the following is the workflow of the identity and access provisioning lifecycle?
How would blockchain technology support requirements for sharing audit information among a community of organizations?
What is the MAIN purpose of risk and impact analysis?
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
Which of the following statements best characterizes enterprise resources planning (ERP) systems?
A company that has experienced steady growth for seasonal products in the last several years currently is reevaluating its production planning approach. The chase production plan initially requires 150 employees, then increases to 440 employees, and then decreases to 165 employees. Which of the following factors would be most relevant when evaluating the cost of this production planning approach?
Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?
Which of the following capacity planning methods uses the master production schedule (MPS) as its primary input?
A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?
Which of the following product design approaches are likely to reduce time to market for a global supply chain?
A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?
If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
Which of the following is a disadvantage of using federated identity?
A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
An organizational policy requires that any data from organization-issued devices be securely destroyed before disposal. Which method provides the BEST assurance of data destruction?
Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?
During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?
What priority control technique is most appropriate for a firm using a cellular production system?
Reducing distribution network inventory days of supply will have which of the following Impacts?
A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?
Which of the following is the BEST type of fire extinguisher for a data center environment?
A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?
A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization ' s BEST next step?
Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?
An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?
A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?
A large volume of outbound Transmission Control Protocol (TCP) connections from the same source Internet Protocol (IP) address was observed at a satellite office firewall. Which of the following is the MOST likely explanation?
An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?
A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?
An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer ' s engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?
An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?
Up-to-date Information about production order status is required to do which of the following tasks?
What is the MOST beneficial principle of threat modeling?
Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:
A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.
What is the organization ' s BEST next step?
Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?
After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?
During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?
APerform drills on a recurring basis.
B.Harden all critical facilities.
C.Outsource to an external organization.
D.Allocate 100% of required funds.
Which of the following should be performed FIRST in the course of a digital forensics investigation?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?
A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?
What does the Role-Based Access Control (RBAC) method define?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user ' s hash from being cached, what is the MOST appropriate policy to mandate?
Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.
What is the BEST objective metric for the effectiveness of a security awareness training?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?
In an ABC analysis, “A” items generally represent about 20% of the:
An organization wants to establish an information security program and has assigned a security analyst to put it in place. What is the NEXT step?
The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?
Which of the following should Business Impact Analysis (BIA) reports always include?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
Disaster Recovery (DR) training plan outcomes should have which KEY quality?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
Which of the following production activity control (PAC) techniques focuses on optimizing output?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
Which of the following methods is most often used to manage inventory planning variability across the supply chain?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
Which of the following outcomes Is a benefit of mixed-model scheduling?
Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
The Data Loss Prevention (DLP) team in a major financial institution discovered network traffic that involved movement of sensitive material to a Cloud Service Provider (CSP). What action should be taken FIRST in this situation?
Which if the following is the FIRST control step in provisioning user rights and privileges?
One of the findings in the recent security assessment of a web application reads: " It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process. " Which of these choices would BEST remediate this security finding?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?
An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
Risk pooling would work best for items with:
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?
Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?
Which of the following roles is the BEST choice for classifying sensitive data?
Who is ultimately responsible for ensuring that specific data is protected?
Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?
Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
In the sales and operations planning (S & OP) process, the demand management function provides:
An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?
A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
Which of the physiological biometric scanning methods is considered the MOST invasive?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?
If a work center is already loaded to full capacity, which of the following actions would be best to take before releasing a new order?
Which of the following statements characterizes a pull system In distribution management?
The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?