Winter Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dumps65

APICS CPIM-8.0 Dumps

Page: 1 / 59
Total 585 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

Options:

A.

Generally includes threat modeling, requirements risk analysis, and security modeling

B.

Focused on ensuring that the security functionally performed by a web service meets its stated requirements

C.

Ensure individual protocol implementations adhere to the relevant published standards

D.

Focused on the smallest unit of the web service application, apart from the rest of the application

Question 2

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

Options:

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 3

An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?

Options:

A.

Transmission encryption

B.

Multi-Factor Authentication (MFA)

C.

Single Sign-On (SSO)

D.

Transmission authentication

Question 4

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Question 5

Which of the following is a system architecture in a data protection strategy?

Options:

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Question 6

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Question 7

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 8

The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?

Options:

A.

Reorder point(ROP)

B.

Safety stock

C.

Inventory investment

D.

Safety factor

Question 9

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Question 10

Up-to-date Information about production order status is required to do which of the following tasks?

Options:

A.

Calculate current takt time.

B.

Determine planned orders.

C.

Replenish kanban quantities.

D.

Calculate the cost of work in process (WIP).

Question 11

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 12

One of the most useful tools for analyzing the sustainable footprint is:

Options:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Question 13

An example of an assignable cause of variation in process performance is:

Options:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Question 14

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 15

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

Options:

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Question 16

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

Options:

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Question 17

A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?

Options:

A.

Privacy Impact Assessment (PIA)

B.

Vulnerability assessment

C.

Sensitive data assessment

D.

Personally Identifiable Information (PII) risk assessment

Question 18

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

Options:

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Question 19

A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?

Options:

A.

They are proprietary and incompatible between vendors.

B.

They can be complex to configure.

C.

They do not provide any authentication or encryption protection.

D.

They are unreliable due to high protocol overhead.

Question 20

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

Options:

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Question 21

In a make-to-order (MTO) production environment, fluctuations in sales volumes are managed by adjustments to the:

Options:

A.

Customer order backlog

B.

Finished goods inventory

C.

Minimum order quantity (MOQ)

D.

Process cycle time

Question 22

After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization's IAM solution?

Options:

A.

Enhanced background checks

B.

Mobile Multi-Factor Authentication (MFA) application

C.

Biometric system

D.

Personal Identification Number (PIN) code

Question 23

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

Options:

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Question 24

Health information stored in paper form may be destroyed using which of the following methods?

Options:

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Question 25

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Question 26

Improving the performance of a constraint in a job shop environment will:

Options:

A.

Reduce work-in-process (WIP) inventory

B.

Adjust the load of non-bottleneck operations

C.

Increase the cycle time

D.

Increase production throughput

Question 27

After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?

Options:

A.

Complete an inventory of who has access to systems.

B.

Create a Role-Based Access Control (RBAC) process to determine what a specific group of users can access.

C.

Create an Attribute-Based Access Control (ABAC) process to assign access to users based on their account attributes and characteristics.

D.

Conduct an assessment and remove all inactive accounts.

Question 28

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Question 29

Which of the following factors is used to determine safety stock?

Options:

A.

Number of customers

B.

Available capacity

C.

Forecast error distribution

D.

Time between customer orders

Question 30

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

Options:

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Question 31

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

Options:

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Question 32

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 33

Which of the following methods is most often used to manage inventory planning variability across the supply chain?

Options:

A.

Buffer management

B.

Safety lead time

C.

Risk pooling

D.

Risk categorization

Question 34

How much data an organization can afford to lose is determined by the:

Options:

A.

Service-Level Agreement (SLA)

B.

Business Continuity Plan (BCP)

C.

Recovery Time Objective (RTO)

D.

Recovery Point Objective (RPO)

Question 35

A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?

Options:

A.

Annualized loss reduction measured over time

B.

Assessment of magnitude based on risk analyses

C.

Added economic value

D.

Total cost of ownership

Question 36

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

Options:

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Question 37

A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?

Options:

A.

Brewer-Nash

B.

Bell-LaPadula

C.

Biba Integrity

D.

Clark Wilson

Question 38

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

Options:

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Question 39

The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Question 40

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

Options:

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Question 41

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Question 42

Small, independent demands for components and subassemblies typically arise from which of the following sources?

Options:

A.

Warehouse orders

B.

Repair and service requirements

C.

Original equipment manufacturers

D.

Scrap allowance

Question 43

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 44

What does the Role-Based Access Control (RBAC) method define?

Options:

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

Question 45

A software organization is getting ready to launch a new application. A security engineer notices the application allows unrestricted access to files on the web server. Which of the following recommendations will BEST resolve this security issue?

Options:

A.

Eliminate all calls for file access requests.

B.

Eliminate illegitimate calls for file access requests.

C.

Whitelist files and folders for file access requests.

D.

Blacklist files and folders for file access requests.

Question 46

Which of the following tactics can be employed effectively to reduce appraisal quality costs?

Options:

A.

Investing in prevention

B.

Conducting quality audits

C.

Loosening product specifications

D.

Implementing house of quality (HOQ)

Question 47

The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?

Options:

A.

Investigation

B.

Reconnaissance

C.

Fingerprinting

D.

Exploitation

Question 48

An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?

Options:

A.

Soft token

B.

Short Message Service (SMS)

C.

Personal Identification Number (PIN) code

D.

Hard token

Question 49

A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?

Options:

A.

Quality Assurance (QA) testing

B.

Integration technique

C.

User Acceptance Testing

D.

Fuzzing technique

Question 50

Which of the following is the MAIN element in achieving a successful security strategy?

Options:

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Question 51

A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?

Options:

A.

Authorization controls

B.

Two-Factor Authentication (2FA)

C.

Non-repudiation controls

D.

Access audit

Question 52

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 53

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

Options:

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Question 54

A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.

B.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and Domain Name Server (DNS) queries to blocked sites.

C.

An increase in reported changes in click percentage that aligns with a decrease in the number of phishes and incidents reported.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 55

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Question 56

A potentially life-threatening vulnerability is found in vendor software that is used to manage critical systems. Which of the following is generally considered the BEST method to disclose the vulnerability from an ethical hacking perspective?

Options:

A.

Coordinated disclosure because it compels the vendor to act within a certain time frame

B.

Bug bounty disclosure programs because the researcher should get paid for finding the vulnerability

C.

Full public disclosure because the vulnerability is serious and the organizations using the software need to know quickly

D.

Full vendor disclosure because it is the vendor’s responsibility to disclose vulnerabilities to its customers

Question 57

The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:

Options:

A.

a supply chain community.

B.

interplant demand.

C.

a bill of distribution.

D.

logistics data interchange (LDI).

Question 58

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Question 59

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Question 60

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

Options:

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Question 61

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 62

Which of the following capacity planning methods uses the master production schedule (MPS) as its primary input?

Options:

A.

Resource planning

B.

Rough-cut capacity planning (RCCP)

C.

Finite loading

D.

Input/output analysis

Question 63

A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):

Options:

A.

Assemble-to-order (ATO) environment

B.

Make-to-stock (MTS) environment

C.

Pull system

D.

Push system

Question 64

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Options:

Question 65

Which of the following terms below BEST describes the measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces security policy?

Options:

A.

Risk tolerance

B.

Residual risk

C.

Security architecture

D.

Security assurance

Question 66

For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components

previously received will have which of the following results?

Options:

A.

Higher cost of goods sold (COGS)

B.

Lower COGS

C.

No change to COGS

D.

A violation of FIFO rules

Question 67

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

Options:

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Question 68

Which of the following actions hinders the transition from a push system to a pull system?

Options:

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Question 69

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Question 70

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

Options:

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Question 71

Which of the following is the BEST reason to conduct a penetration test?

Options:

A.

To verify compliance with organizational patching policies.

B.

To document that all relevant patches have been installed.

C.

To identify technical vulnerabilities.

D.

To determine if weaknesses can be exploited.

Question 72

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S&OP) meeting.

Question 73

An example of a cradle-to-cradle sustainability model would be:

Options:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Question 74

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 75

Which of the following is a methodology for threat modeling in application?

Options:

A.

Disaster, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE)

C.

Pretend, Allow, Crash, Modify, Ascertain, Name

D.

Confidentiality, Authentication, Integrity, Nonrepudiation, Availability

Question 76

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

Options:

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Question 77

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Question 78

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 79

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 80

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

Options:

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question 81

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Question 82

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Question 83

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Question 84

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Question 85

A company's primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Question 86

In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?

Options:

A.

Stockroom inventory balance will be incorrect.

B.

Operator efficiency for the fifth operation will be overstated.

C.

Units in process will be understated.

D.

Work-in-process (WIP) cost will be understated.

Question 87

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?

Options:

A.

A

B.

B

C.

C

D.

E

Question 88

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 89

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

Options:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Question 90

An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?

Options:

A.

Tokenization

B.

Anonymization

C.

Obfuscation

D.

Destruction

Question 91

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 92

Which of the following statements correctly describes the relationship between the strategic plan and the business plan?

Options:

A.

These are two names for the same plan.

B.

The strategic plan constrains the business plan.

C.

The two plans are developed independently.

D.

The two plans are the output of a single process.

Question 93

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Question 94

What should an organization do to prepare for Disaster Recovery (DR) efforts?

Options:

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Question 95

Given the following data, calculate the appropriate takt time:

as

Options:

A.

0.25 minutes

B.

1 minute

C.

2 minutes

D.

4 minutes

Question 96

Labor3 people

Work hours10 hours per day

Days4 days per week

Meetings with work area employees1/2 hour per day

Work area efficiency85%

Given the information above, what is the weekly theoretical capacity of this work area in hours?

Options:

A.

97

B.

102

C.

114

D.

120

Question 97

Fishbone diagrams would help a service organization determine:

Options:

A.

the proper level of service for a customer segment.

B.

the source of a quality-of-service issue.

C.

differences in the performance of employees.

D.

the decomposition of customer return rates with seasonality.

Question 98

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

Options:

A.

Interview the candidates' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question 99

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Question 100

An organization is migrating some of its applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the accuracy of the reports showing which application should be migrated and how many applications reside on each server. As a result, the CISO is looking to establish asset management requirements. Which of these elements should be considered part of asset management requirements?

Options:

A.

Threat modelling and discovery

B.

Configuration Management (CM) database

C.

Risk management framework

D.

Integration testing program

Question 101

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 102

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 103

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Question 104

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Question 105

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

Options:

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question 106

Why would a network administrator monitor Internet of Things (IoT) security differently than the security of standards network devices?

Options:

A.

IoT devices are not developed with cybersecurity in mind.

B.

IoT devices are unencrypted.

C.

IoT devices require Power over Ethernet.

D.

IoT devices are wireless.

Question 107

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 108

Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?

Options:

A.

Boundary condition

B.

Buffer overflow

C.

Race condition

D.

Integer overflow

Question 109

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question 110

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization's BEST next step?

Options:

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Question 111

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 112

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

Options:

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Question 113

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question 114

A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.

Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?

Options:

A.

Increase planned production for the next three periods.

B.

Defer the upgrade to a period beyond the planning time fence.

C.

Increase planned production from the fifth period on.

D.

Defer the upgrade to the period in which the highest stock level is planned.

Question 115

Which of the following threats MUST be included while conducting threat modeling for a Cloud Service Provider (CSP)?

Options:

A.

Risks of data breaches that can result from inadequate encryption of tenant data in transit and at rest

B.

Potential legal actions from third parties due to tenants’ activities on the CSP’s platform

C.

Vulnerabilities in shared resources that can be exploited by attackers to affect multiple tenants

D.

Threats originating from the CSP’s tenants that can impact the infrastructure and other tenants

Question 116

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Question 117

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 118

Organization A provides scalable Information Technology (IT) infrastructure while Organization B provides security services to customers via Software as a Service (SaaS) model. Which document is used to express a set of intended actions between the organizations with respect to meeting the customers’ needs?

Options:

A.

Business partnership agreement

B.

Interconnection Security Agreement (ISA)

C.

Framework partnership agreement

D.

Memorandum of Understanding (MOU)

Question 119

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

Options:

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Question 120

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Question 121

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Question 122

Which of the following statements characterizes a pull system In distribution management?

Options:

A.

Each warehouse makes its own replenishment decisions.

B.

It uses distribution requirements planning(DRP).

C.

It uses uniform performance measures.

D.

It uses fair-share allocation.

Question 123

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Question 124

What is the MAIN purpose of risk and impact analysis?

Options:

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Question 125

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

Options:

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Question 126

An organization provides customer call center operations for major financial service organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

B.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

National Institute Of Standards And Technology and International Organization For Standardization (ISO) frameworks

Question 127

An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?

Options:

A.

Proxy manipulation and Man-in-the-Middle (MITM) attack

B.

Media Access Control (MAC) spoofing and proxy manipulation

C.

Rogue access point and Man-in-the-Middle (MITM) attack

D.

Media Access Control (MAC) spoofing and rogue access point

Question 128

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question 129

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Question 130

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Question 131

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

Options:

A.

74

B.

63

C.

61

D.

31

Question 132

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 133

In the sales and operations planning (S&OP) process, the demand management function provides:

Options:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Question 134

A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?

Options:

A.

Maximum Tolerable Downtime (MTD)

B.

Recovery Point Objective (RPO)

C.

Recovery Time Objective (RTO)

D.

Mean Time to Recovery (MTTR)

Question 135

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

Options:

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Question 136

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Question 137

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 138

A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?

Options:

A.

Use prepared statements with parameterized queries

B.

Do allow or use Structured Query Language (SQL) within GET methods.

C.

Use substitution variables for all Structure Query Language (SQL) statements.

D.

Do not allow quote characters to be entered.

Question 139

A health care organization's new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?

Options:

A.

Failure

B.

Incident

C.

Attack

D.

Breach

Question 140

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Question 141

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Question 142

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

Options:

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Question 143

A reduction In purchased lot sizes will reduce which of the following items?

Options:

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Question 144

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question 145

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 146

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 147

An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?

Options:

A.

Require that the user supplies their credential to access confidential documents.

B.

Require a Virtual Private Network (VPN) connection to the organization's network to access confidential documents.

C.

Implement Security Assertion Markup Language (SAML) to validate the identity of the user requesting access to confidential documents.

D.

Implement Open Authorization (OAuth) 2.0 to require the users to request permission to access confidential documents.

Question 148

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Question 149

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

Options:

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Question 150

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question 151

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 152

Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?

Options:

A.

Removal is authorized directly by executive management.

B.

Removal is authorized using a formal sign-out process.

C.

Removal is authorized when remote use is required for business.

D.

Removal is authorized if the asset has been disposed of.

Question 153

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Question 154

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 155

An organization undergoing acquisition merged IT departments and infrastructure. During server decommissioning, some servers still in use by customers were mistakenly removed, causing order processing failures. Which type of review would have BEST avoided this scenario?

Options:

A.

Disaster Recovery (DR)

B.

Change management

C.

Business Continuity (BC)

D.

Business impact assessment

Question 156

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 157

At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?

Options:

A.

Layer 1

B.

Layer 2

C.

Layer 4

D.

Layer 3

Question 158

Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

Options:

A.

Excessive privileges

B.

Need to know access

C.

Training access

D.

Least access principle

Question 159

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

Options:

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Question 160

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Question 161

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

Options:

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Question 162

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

Options:

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Question 163

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 164

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

Options:

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Question 165

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Question 166

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Question 167

In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

Options:

A.

Implement a self-service password management capability

B.

Increase system administration personnel

C.

Implement an automated provisioning tool

D.

Increase authorization workflow steps

Question 168

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

Options:

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Question 169

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 170

Which of the following techniques would a group use to prioritize problems?

Options:

A.

Critical path analysis

B.

Pareto analysis

C.

Scatter charts

D.

Cause-and-effect diagrams

Question 171

The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

Options:

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Question 172

A company has the following production conditions:

    Batch size: 1,000 items

    Processing time: 4 minutes per item

    Setup time: 2 hours

    Utilization: 80%

    Efficiency: 80%

Which of the following actions would result in the work being done in the least amount of time?

Options:

A.

Reduce the processing time for each item to 3.5 minutes.

B.

Increase either utilization or efficiency to 100%.

C.

Increase both utilization and efficiency to 90%.

D.

Eliminate the need for a setup to process the batch.

Question 173

A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.

B.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.

C.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 174

One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

Options:

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

Question 175

A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?

Options:

A.

Access of system logs to authorized staff

B.

Accurate and prompt tagging of all business files

C.

Assurance of safe and clean handling of company property

D.

Adoption of environmental controls in the server room

Page: 1 / 59
Total 585 questions