Pre-Summer Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Page: 1 / 61
Total 606 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?

Options:

A.

Proxy manipulation and Man-in-the-Middle (MITM) attack

B.

Media Access Control (MAC) spoofing and proxy manipulation

C.

Rogue access point and Man-in-the-Middle (MITM) attack

D.

Media Access Control (MAC) spoofing and rogue access point

Question 2

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

Options:

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Question 3

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

Question # 3

Options:

A.

80

B.

120

C.

160

D.

200

Question 4

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

Options:

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Question 5

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

Options:

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

Question 6

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 7

Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?

Options:

A.

Offsite backup

B.

High availability

C.

Diverse routing

D.

System mirroring

Question 8

What does the Role-Based Access Control (RBAC) method define?

Options:

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

Question 9

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

Options:

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question 10

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Question 11

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 12

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

Options:

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user ' s ability to change device settings

D.

To limit web access to only approved sites

Question 13

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question 14

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 15

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Question 16

An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?

Options:

A.

Remote using a Trusted Platform Module (TPM) due to better protection of the keys

B.

Local using Trusted Platform Module (TPM) because low-level access software can be accessed

C.

Local using Trusted Platform Module (TPM) because of benefits from Segregation Of Duties (SoD)

D.

Remote using a scanning device because of benefits from Segregation Of Duties (SoD)

E.

Local using Mobile Device Management (MDM) because of device policy enforcement

Question 17

In a lean environment, the batch-size decision for planning " A " items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 18

Which of the following is a document that will be obtained at the end of an asset’s lifecycle?

Options:

A.

Asset registry

B.

Bill of lading

C.

Certificate of disposal

D.

Master data record

Question 19

In a make-to-order (MTO) production environment, fluctuations in sales volumes are managed by adjustments to the:

Options:

A.

Customer order backlog

B.

Finished goods inventory

C.

Minimum order quantity (MOQ)

D.

Process cycle time

Question 20

Up-to-date Information about production order status is required to do which of the following tasks?

Options:

A.

Calculate current takt time.

B.

Determine planned orders.

C.

Replenish kanban quantities.

D.

Calculate the cost of work in process (WIP).

Question 21

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

Options:

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Question 22

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization ' s databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 23

An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?

Options:

A.

Open Authorization (OAuth) 2.0

B.

Security Assertion Markup Language (SAML) 2.0

C.

Password Authentication Protocol (PAP)

D.

OpenID Connect (OIDC)

Question 24

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Question 25

What is the HIGHEST security concern on trans-border data?

Options:

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Question 26

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Question 27

An advertising agency is working on a campaign for a prospective client. Competitors are working on a similar campaign and are interested in knowing what the firm has designed. What should the advertising agency do to BEST ensure intellectual property does not leave the organization?

Options:

A.

Protect the information by installing a Data Loss Prevention (DLP) system

B.

Block all organizational email communication with the competitor

C.

Install an Intrusion Prevention System (IPS)

D.

Encrypt the data on the servers and distribute private-key information to authorized users

Question 28

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Question 29

When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

Options:

A.

any request for shipment prior to the planning time fence.

B.

any request for shipment prior to the demand time fence (DTF).

C.

requests only for shipment before the next master production schedule (MPS) receipt.

D.

requests only for shipment in the period of the receipt.

Question 30

An organization ' s security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

Options:

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Question 31

Which of the following statements is true about the meantime between failures (MTBF) measure?

Options:

A.

It is used for non-repairable products.

B.

An increase in MTBF is proportional to anincrease inquality.

C.

It is a useful measure of reliability.

D.

It is the same as operating life or service life.

Question 32

In times of monetary inflation, which of the following methods of inventory valuation results in the greatest cost of sales for the early years of a particular product?

Options:

A.

Moving average

B.

Last in, first out (LIFO)

C.

First in, first out (FIFO)

D.

Standard

Question 33

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Question 34

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Question 35

What should an organization do to prepare for Disaster Recovery (DR) efforts?

Options:

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Question 36

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

Options:

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Question 37

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Question 38

The question below is based on the following information:

Question # 38

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?

Options:

A.

50

B.

150

C.

1.250

D.

3.750

Question 39

Privacy requirements across national boundaries MOST often require protection of which data types?

Options:

A.

Contact information for elected officials and local and national government web content

B.

Contact information related to minors, medical records, and Personally Identifiable Information (PII)

C.

Contact information for board members, proprietary trade secrets, and income statements

D.

Contact information related to medical doctors, Protected Health Information (PHI), and Personally Identifiable Information (PII)

Question 40

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

Options:

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Question 41

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

Options:

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Question 42

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

Options:

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Question 43

A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.

B.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and Domain Name Server (DNS) queries to blocked sites.

C.

An increase in reported changes in click percentage that aligns with a decrease in the number of phishes and incidents reported.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 44

Which if the following is the FIRST control step in provisioning user rights and privileges?

Options:

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Question 45

A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

Options:

A.

System centric

B.

Attacker centric

C.

Threat centric

D.

Asset centric

Question 46

What is the total load requirement for this work center based on the following data?

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Question 47

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Question 48

An organization’s computer incident response team PRIMARILY responds to which type of control?

Options:

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Question 49

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

Options:

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Question 50

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

Options:

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Question 51

A health care organization ' s new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?

Options:

A.

Failure

B.

Incident

C.

Attack

D.

Breach

Question 52

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 53

Which of the following actions hinders the transition from a push system to a pull system?

Options:

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Question 54

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

Options:

A.

One of the requests does not have a valid token issuer ' s identifier.

B.

The requests have the same ' auth_time ' parameter.

C.

The requests have the same ' nonce ' parameter.

D.

One of the requests does not have a valid audience token.

Question 55

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

Options:

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Question 56

An organization provides customer call center operations for major financial service organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

B.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

National Institute Of Standards And Technology and International Organization For Standardization (ISO) frameworks

Question 57

A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?

Options:

A.

Brewer-Nash

B.

Bell-LaPadula

C.

Biba Integrity

D.

Clark Wilson

Question 58

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Side-channel

B.

Fault injection

C.

Man-In-The-Middle (MITM)

D.

Frequency analysis

Question 59

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

Options:

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Question 60

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 61

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

Options:

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Question 62

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

Options:

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Question 63

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

Options:

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Question 64

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

Options:

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Question 65

An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.

Which of the following topics will MOST likely be on the agenda?

Options:

A.

Results of the preliminary cost-benefit studies

B.

Design of the application system and database processes

C.

Communication of procedures and reporting requirements

D.

Identification of inter-application dependencies

Question 66

A house of quality (HOQ) chart aligns which pair of functions?

Options:

A.

Customer requirements with costing

B.

Engineering with operations

C.

Customer purchasing with supplier shipping

D.

Competitive analysis with product design

Question 67

Which of the following data is needed to determine gross requirements when conducting distribution requirements planning (DRP)?

Options:

A.

Order value

B.

Location points

C.

Shipping schedules

D.

Interplant demand

Question 68

The question below is based on the following standard and actual data of a production order

Question # 68

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Question 69

What is the MAIN purpose of risk and impact analysis?

Options:

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Question 70

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Question 71

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

Options:

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Question 72

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Question 73

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 74

Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?

Options:

A.

Removal is authorized directly by executive management.

B.

Removal is authorized using a formal sign-out process.

C.

Removal is authorized when remote use is required for business.

D.

Removal is authorized if the asset has been disposed of.

Question 75

A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?

Options:

A.

Configure internal firewalls to accept and pass all scanner traffic and responses

B.

Execute a vulnerability scan to determine the current organization security posture

C.

Select two different vulnerability scanners to get comprehensive reporting

D.

Obtain support from the computing systems ' stakeholders

Question 76

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 77

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 78

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization ' s software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 79

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 80

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 81

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Question 82

When considering Defense in Depth (DiD) as part of a network’s architectural design, what is the FIRST layer in a multi-layered defensive strategy?

Options:

A.

Distributed Denial-of-Service (DDoS)

B.

Managed Domain Name System (DNS)

C.

Reverse proxies

D.

Edge routers

Question 83

In pyramid forecasting, the " roll up " process begins with:

Options:

A.

combining individual product item forecasts into forecasts for product families.

B.

combining forecasts for product families into a total business forecast.

C.

allocating total business forecast changes to product families.

D.

allocating product family forecast changes to individual products.

Question 84

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 85

A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):

Options:

A.

Assemble-to-order (ATO) environment

B.

Make-to-stock (MTS) environment

C.

Pull system

D.

Push system

Question 86

In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?

Options:

A.

Deduplication conserves storage.

B.

Regulatory guidance requires compliance.

C.

Digital media can degrade.

D.

Hierarchical storage facilitates access.

Question 87

An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?

Options:

A.

Forensic audit

B.

Third-party audit

C.

Location audit

D.

Internal audit

Question 88

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

Options:

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Question 89

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 90

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

Options:

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question 91

A disadvantage of a capacity-lagging strategy may be:

Options:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Question 92

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

Options:

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Question 93

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

Options:

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Question 94

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 95

Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?

Options:

A.

Switched Port Analyzer (SPAN)

B.

Representational State Transfer (REST)

C.

Remote Desktop Protocol (RDP)

D.

Virtual Private Network (VPN)

Question 96

Based on the above table, calculate the mean absolute deviation (MAD).

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Question 97

A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?

Options:

A.

Privacy Impact Assessment (PIA)

B.

Vulnerability assessment

C.

Sensitive data assessment

D.

Personally Identifiable Information (PII) risk assessment

Question 98

Which of the following situations is most likely to occur when using a push system?

Options:

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Question 99

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

Options:

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Question 100

A regular remote user executed an application that allowed the execution of commands with elevated permissions. It was allowed to create new users, start and stop services, and view critical log files. Which exploit type did the application use in this scenario?

Options:

A.

Side-channel

B.

Fault injection

C.

Privilege escalation

D.

Buffer overflow

Question 101

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

Options:

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Question 102

Return on investment (ROI) is decreased by which of the following activities?

Options:

A.

Increasing prices

B.

Increasing sales volume

C.

Increasing cost of sales

D.

Reducing inventory levels

Question 103

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Question 104

Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?

Options:

A.

Supply disruptions

B.

Forecast inaccuracy

C.

Procurement problems

D.

Loss of intellectual property

Question 105

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Question 106

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Question 107

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to " nervousness " in the schedule.

D.

The schedule does not support demand.

Question 108

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

Options:

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Question 109

Which is the MOST valid statement around the relationship of security and privacy?

Options:

A.

A system designed with security provides individuals with data privacy by default.

B.

Nonrepudiation protects against unauthorized disclosure of private data.

C.

Privacy in the realm of physical security often entails trade-offs with security.

D.

Privacy and security are mutually exclusive.

Question 110

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Question 111

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Question 112

Long lead-time items with stable demand would best be supported by a supply chain:

Options:

A.

using a pull system.

B.

linked through an enterprise resources planning (ERP) system.

C.

designed to be responsive.

D.

positioning inventory close to the consumer.

Question 113

Which of the following threats MUST be included while conducting threat modeling for a Cloud Service Provider (CSP)?

Options:

A.

Risks of data breaches that can result from inadequate encryption of tenant data in transit and at rest

B.

Potential legal actions from third parties due to tenants’ activities on the CSP’s platform

C.

Vulnerabilities in shared resources that can be exploited by attackers to affect multiple tenants

D.

Threats originating from the CSP’s tenants that can impact the infrastructure and other tenants

Question 114

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S & OP) meeting.

Question 115

Which of the following capabilities BEST distinguishes a Next-Generation Firewall (NGFW) from a traditional firewall?

Options:

A.

Ensures incoming and outgoing packets are inspected before they are allowed to pass through

B.

Offers features such as integrated intrusion prevention or application awareness and control

C.

Provides security when users traverse public networks such as the Internet

D.

Provides stateless and stateful inspection of incoming and outgoing network traffic

Question 116

Health information stored in paper form may be destroyed using which of the following methods?

Options:

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Question 117

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Question 118

Which software development methodology is an iterative customer-value-centric approach which helps teams deliver value to their customers faster and with fewer problems?

Options:

A.

Agile model

B.

Cleanroom model

C.

Waterfall model

D.

Incremental model

Question 119

Which of the following tactics can be employed effectively to reduce appraisal quality costs?

Options:

A.

Investing in prevention

B.

Conducting quality audits

C.

Loosening product specifications

D.

Implementing house of quality (HOQ)

Question 120

Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?

Options:

A.

Cameras in the trading room

B.

Two-Factor Authentication (2FA)

C.

Separation of Duties (SoD)

D.

Least privilege

Question 121

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 122

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question 123

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

Options:

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Question 124

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations.

B.

The need to develop alternative hosting strategies for applications deployed to the cloud.

C.

Most cloud services offerings are unique to each provider and may not be easily portable.

D.

Integrity and confidentiality are not ensured properly on the most cloud service offerings.

Question 125

Which of the below represents the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Supply chain failure

B.

Loss of business reputation due to co-tenant activities

C.

Loss of governance between the client and cloud provider

D.

Cloud service termination or failure

Question 126

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

Options:

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Question 127

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The clouds service provider is responsible for all security within the workload

B.

Security testing is managed after image creation

C.

No longer have to bring system down to patch

D.

Allows a user to enable remote logins to running workloads

Question 128

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

Options:

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Question 129

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 130

An example of an assignable cause of variation in process performance is:

Options:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Question 131

The master schedule is an Important tool in the sales and operations planning (S & OP) process because it:

Options:

A.

represents the forecast before changes are made in S & OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Question 132

An organization is having bandwidth utilization issues due to unauthorized devices on the network. Which action should be taken to solve the problem?

Options:

A.

Disable all unused ports.

B.

Implement a Network Access Control (NAC) solution.

C.

Rate limit on access ports.

D.

Restrict access with an Access Control List (ACL).

Question 133

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Question 134

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization ' s regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 135

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Question 136

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Question 137

Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?

Options:

A.

Authentication Header (AH)

B.

Generic Routing Encapsulation (GRE)

C.

Encapsulation Security Payload

D.

Internet Key Exchange (IKE)

Question 138

Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?

Options:

A.

Econometric models

B.

Computer simulation

C.

Time series decomposition

D.

Weighted moving average

Question 139

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

Options:

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Question 140

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

Options:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Question 141

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 142

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

Options:

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Question 143

Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?

Options:

A.

It coordinates between the client and multiple logistics suppliers.

B.

It focuses primarily on last-mile delivery.

C.

It allows the client to concentrate on operating its own warehouse.

D.

It provides a logistics specialist who manages some of the logistics operation.

Question 144

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 145

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question 146

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 147

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Question 148

The most relevant measure of customer service performance Is:

Options:

A.

service perceived by the customer against service expected by the customer.

B.

service promised to the customer against service measured by the supplier.

C.

customer complaints received as a percentage of orders shipped.

D.

positive customer feedback as a percentage of customer feedback.

Question 149

Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?

Options:

A.

Intrusion Detection System (IDS)

B.

Internet Protocol Security (IPSec)

C.

Virtual Private Network (VPN)

D.

Network Access Control (NAC)

Question 150

An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?

Options:

A.

TPM will use the Operating System (OS) for full disk encryption key protection.

B.

TPM will protect the full disk encryption keys.

C.

TPM will handle the allocation of the hardware storage drives for full disk encryption.

D.

TPM will provide full disk encryption automatically.

Question 151

A stockout of dependent-demand item X occurred during the holiday season. To understand the root cause of the stockout, the planner should check if:

Options:

A.

There was high customer demand for X.

B.

There was a wrong seasonal index applied to X.

C.

There was an inventory inaccuracy for X.

D.

There was a low forecast for X.

Question 152

A manufacturer uses a low-cost strategy. It recently reviewed its components and realized it is using multiple versions of one screw. Reducing the variety of screws will contribute to its cost advantage by:

Options:

A.

Reducing the number of products offered

B.

Increasing economies of scale in purchasing

C.

Allowing outsourcing of value chain activities

D.

Allowing the production plant to operate at full capacity

Question 153

Which of the following criteria is used to determine safety stock in a distribution center (DC)?

Options:

A.

Economic order quantity(EOQ)

B.

Seasonal index value

C.

Alpha factor level

D.

Probability of stocking out

Question 154

A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.

B.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.

C.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 155

Which of the following can allow an attacker to bypass authentication?

Options:

A.

Response tampering

B.

Machine enumeration

C.

User agent manipulation

D.

Social engineering

Question 156

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 157

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 158

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

Options:

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Question 159

A reduction In purchased lot sizes will reduce which of the following items?

Options:

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Question 160

What function prevents unauthorized devices from gaining access to a network?

Options:

A.

Network Access Control (NAC)

B.

Storage Area Network (SAN)

C.

Network Address Translation (NAT)

D.

Software-Defined Network (SDN)

Question 161

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

Options:

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Question 162

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

Options:

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Question 163

In the sales and operations planning (S & OP) process, the demand management function provides:

Options:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Question 164

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

Options:

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Question 165

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Question 166

In order for an organization to mature their data governance processes to ensure compliance, they have created a data classification matrix.

What are the next BEST activities to build on this completed work?

Options:

A.

Ensure the data owners agree with the classification of their data and then socialize the matrix with employees handling data.

B.

Ensure the internal legal team approves the data classification matrix then perform a Business Impact Analysis (BIA) to understand the impact of applying the classifications.

C.

Complete a Privacy Impact Assessment (PIA) and use the results to identify improvements to the data classification matrix.

D.

Document the handling procedures for each classification of data in the matrix and schedule data handling educational sessions with employees.

Question 167

The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?

Options:

A.

Having a public-facing website with Hypertext Markup Language (HTML) encoding enabled.

B.

Exposure of data stored in cloud repositories.

C.

Username and password are sent using a POST in plain text.

D.

Unsecured data storage elements or storage containers.

Question 168

The horizon for forecasts that are input to the sales and operations planning (S & OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Question 169

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

Options:

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Question 170

Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?

Options:

A.

Improved threat detection

B.

Flexible firewall configuration

C.

Network availability

D.

Improved threat prevention

Question 171

An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?

Options:

A.

By priority as defined by the critical assets list

B.

The latest Continuity Of Operations Plan (COOP)

C.

Senior management assessment and approval

D.

The latest Business Impact Analysis (BIA)

Question 172

Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

Options:

A.

Generally includes threat modeling, requirements risk analysis, and security modeling

B.

Focused on ensuring that the security functionally performed by a web service meets its stated requirements

C.

Ensure individual protocol implementations adhere to the relevant published standards

D.

Focused on the smallest unit of the web service application, apart from the rest of the application

Question 173

A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?

Options:

A.

They are proprietary and incompatible between vendors.

B.

They can be complex to configure.

C.

They do not provide any authentication or encryption protection.

D.

They are unreliable due to high protocol overhead.

Question 174

Which of the following BEST effective when protecting against insider threats?

Options:

A.

Implement Two-Factor Authentication (2FA).

B.

Segment data repositories by business rules.

C.

Develop recovery and restoration procedures.

D.

Address security in third-party agreements.

Question 175

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Question 176

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question 177

In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:

Options:

A.

reduced forecast variability.

B.

fewer customer order changes.

C.

fewer customer defections.

D.

earlier Identification of shifts Incustomer preferences.

Question 178

What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?

Options:

A.

Inventory use cases, categorize threats, evaluate business impact

B.

Understand attack front, identify trust levels, decompose application

C.

Inventory countermeasures, identify threats, implement mitigations

D.

Establish monitoring, identify risks, implement countermeasures

Question 179

An organization’s security team is looking at ways to minimize the security risk of the container infrastructure. The lead engineer needs to select a suite of remediation actions to minimize risks. Which programmatic approach will result in preventing, detecting , and responding to the GREATEST number of threats aimed at container operations?

Options:

A.

Use of hardware-based countermeasures to provide a basis for trusted computing

B.

Use of container-aware runtime defense tools

C.

Grouping containers with the same sensitivity level on a single host

D.

Adoption of container-specific vulnerability management tools

Question 180

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

Options:

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Question 181

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Page: 1 / 61
Total 606 questions