Summer Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: wrap60

APICS CPIM-8.0 Dumps

Page: 1 / 55
Total 552 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Question 2

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 3

An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?

Options:

A.

Overwriting the hard disk drive of the computers

B.

Encrypting the hard disk drive of the computers

C.

Removing and physically destroying the hard disk drive of the computers

D.

Degaussing the hard disk drive of the computers

Question 4

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Question 5

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Question 6

Which compensating control is the MOST effective to prevent fraud within an organization?

Options:

A.

Separation of privilege

B.

Pre-employment background checks

C.

Principle of least privilege

D.

Log monitoring

Question 7

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Question 8

Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?

Options:

A.

Have administrators sign appropriate access agreements.

B.

Define the Acceptable Use Policy (AUP) for administrators.

C.

Have administrators accept a Non-Disclosure Agreement.

D.

Perform extensive background checks on administrators.

Question 9

Which if the following is the FIRST control step in provisioning user rights and privileges?

Options:

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Question 10

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 11

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 12

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for unauthorized access to user attributes

B.

The potential for tracking and profiling an individual's transactions

C.

The potential for exposing an organization's sensitive business information

D.

The potential to break the chain of trust between identity brokers

Question 13

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

Options:

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question 14

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 15

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

Options:

A.

Federation authorities access list

B.

Manual registration

C.

Proxied federation

D.

Signed assertion

Question 16

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

Options:

A.

74

B.

63

C.

61

D.

31

Question 17

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 18

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Question 19

The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:

Options:

A.

lead times to customers decrease.

B.

transportation costs decrease.

C.

the level of required safety stock is reduced.

D.

more efficient load consolidation occurs.

Question 20

What should an organization do to prepare for Disaster Recovery (DR) efforts?

Options:

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Question 21

Which of the following actions provides the BEST evidence for forensic analysis of powered-off device?

Options:

A.

Copy all potentially useful files from the system to a network drive.

B.

Image the entire hard disk on an external drive.

C.

Copy all system and application log files to an external drive.

D.

Collect the memory, running processes, and temporary files.

Question 22

Which threat modeling methodology is focused on assessing risks from organizational assets?

Options:

A.

Process For Attack Simulation And Threat Analysis (PASTA)

B.

Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)

C.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

D.

Damage, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

Question 23

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 24

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Transformation procedures

B.

Enforcement rules

C.

Data classifications

D.

Integrity labels

Question 25

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 26

An organization identified a Distributed Denial-of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Transport layer

B.

Application layer

C.

Internet layer

D.

Network layer

Question 27

Forecast error typically triggers forecast revision when it is:

Options:

A.

used in computing the tracking signal.

B.

associated with the Introduction stage of the product life cycle.

C.

continually increasing.

D.

caused by random variation.

Question 28

Which of the following statements characterizes a pull system In distribution management?

Options:

A.

Each warehouse makes its own replenishment decisions.

B.

It uses distribution requirements planning(DRP).

C.

It uses uniform performance measures.

D.

It uses fair-share allocation.

Question 29

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

Options:

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Question 30

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

Options:

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Question 31

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Simplex

B.

Unicast

C.

Half-duplex

D.

Full-duplex

Question 32

Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:

Options:

A.

reject the request.

B.

accept the request.

C.

forward the request to senior management.

D.

check the availability of required material.

Question 33

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 34

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

Options:

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Question 35

Which of the following procedures should be defined when establishing information and asset handling requirements?

Options:

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Question 36

An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?

Options:

A.

Endpoint security

B.

Network security

C.

Cyber physical security

D.

Cloud security

Question 37

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

Options:

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Question 38

What is the MOST important security benefit of comprehensive asset management?

Options:

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Question 39

Which of the following is an access control method that organizations can use to prevent unauthorized access?

Options:

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Question 40

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

Options:

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Question 41

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 42

An example of a cradle-to-cradle sustainability model would be:

Options:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Question 43

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Side-channel

B.

Fault injection

C.

Man-In-The-Middle (MITM)

D.

Frequency analysis

Question 44

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

Options:

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Question 45

What is the MAIN benefit of network segmentation?

Options:

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Question 46

In a make-to-stock (MTS) environment, the master production schedule (MPS) Is usually a schedule of which of the following types of items?

Options:

A.

Phantom items

B.

Finished goods items

C.

Component/subassembly items

D.

Raw material items

Question 47

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Question 48

An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?

Options:

A.

Unavailability of access logs

B.

Integrity of authentication mechanism

C.

Compromise of service

D.

Deletion of federated tokens

Question 49

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 50

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

Options:

A.

Security

B.

Data

C.

Application

D.

Control

Question 51

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 52

An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?

Options:

A.

Internal audit manager

B.

Information Security Manager (ISM)

C.

Data custodian

D.

Data owner

Question 53

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Question 54

An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.

Which of the following will BEST help remediate this issue?

Options:

A.

Provide access restrictions for resources stored in a low-volume network or subnetwork location.

B.

Provide access restrictions for resources stored on a network that uses a unique platform.

C.

Provide access restrictions for resources stored in a high-volume network or subnetwork location.

D.

Provide access restrictions for resources stored on a network or on a subnetwork.

Question 55

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Question 56

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

Options:

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Question 57

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 58

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Question 59

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Question 60

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

Options:

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question 61

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 62

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Question 63

Maintaining software asset security is MOST dependent on what information?

Options:

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Question 64

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Question 65

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 66

Which of the following combines multiple software programming tools into one package?

Options:

A.

Integrated development environments

B.

Software development kit

C.

Dynamic Link Libraries (DLL)

D.

Program language compilers

Question 67

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

Options:

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Question 68

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Question 69

The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?

Options:

A.

Update the security baseline and continue with the next project task.

B.

Proceed with the next project task to meet the project deadlines.

C.

Obtain approval from the project steering, committee to revise the system security baseline.

D.

Create a change request for the system baseline revision.

Question 70

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Question 71

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Question 72

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

Options:

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Question 73

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Question 74

When starting an external benchmarking study, a firm must first:

Options:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition's.

Question 75

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

Options:

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Question 76

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Question 77

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

Options:

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Question 78

Price negotiation is most appropriate when purchasing which of the following product categories?

Options:

A.

Commodities

B.

Standard products

C.

Items of small value

D.

Made-to-order (MTO) items

Question 79

During the sales and operations planning (S&OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?

Options:

A.

Identifying reasons why the demand plan is not realistic

B.

Communicating when an event will prevent meeting the supply plan

C.

Ensuring that the functional objectives are considered when developing the plans

D.

Understanding how to use the plan to improve functional performance

Question 80

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

Options:

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Question 81

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

Options:

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Question 82

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 83

Which of the following is the MAIN element in achieving a successful security strategy?

Options:

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Question 84

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Question 85

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

Options:

A.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

B.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

C.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

D.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

Question 86

The question below is based on the following information:

as

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?

Options:

A.

50

B.

150

C.

1.250

D.

3.750

Question 87

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

Options:

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Question 88

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

Options:

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Question 89

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Question 90

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 91

A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?

Options:

A.

Secure Shell (SSH)

B.

Trusted Platform Module (TPM)

C.

Virtual Private Network (VPN)

D.

Transport Layer Security (TLS)

Question 92

An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?

Options:

A.

Publish and enforce enterprise policies that assign risk decisions to corporate officers.

B.

Publish and enforce enterprise policies that assign risk decisions to cybersecurity analysts.

C.

Publish and enforce enterprise policies that assign risk decisions to business unit managers.

D.

Publish and enforce enterprise policies that assign risk decisions to system administrators.

Question 93

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

Options:

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Question 94

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

Options:

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Question 95

Which activity follows the discovery phase of vulnerability management?

Options:

A.

Vulnerability governance

B.

Vulnerability identification

C.

Vulnerability detection

D.

Vulnerability evaluation

Question 96

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

Options:

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Question 97

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 98

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Question 99

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Question 100

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Question 101

Which of the following combines multiple software programming tools into one package?

Options:

A.

Program language compilers

B.

Integrated development environments

C.

Dynamic Link Libraries (DLL)

D.

Software development kit

Question 102

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

Options:

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Question 103

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Question 104

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Question 105

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question 106

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

Options:

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Question 107

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 108

An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?

Options:

A.

Provide travel security training.

B.

Provide specific pre-travel intelligence briefing.

C.

Complete a travel risk assessment.

D.

Refresh the corporate travel policy.

Question 109

Based on the above table, calculate the mean absolute deviation (MAD).

as

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Question 110

A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?

Options:

A.

6

B.

3

C.

2

D.

1

Question 111

When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?

Options:

A.

Using someone else's account

B.

Distributed Denial-Of-Service (DDoS)

C.

SQL Injection (SQLi)

D.

Modifying a file

Question 112

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Question 113

Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?

Options:

A.

Software security team

B.

Product management

C.

Third-party reviews

D.

Senior management

Question 114

What is the total load requirement for this work center based on the following data?

as

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Question 115

The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?

Options:

A.

Remediation

B.

Administration

C.

Authorization

D.

Enumeration

Question 116

Which of the following planning modules considers the shortest-range planning goals?

Options:

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question 117

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Options:

Question 118

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Question 119

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

Options:

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Question 120

What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?

Options:

A.

Legitimate data collection

B.

Limitation of use

C.

Collection Categorization

D.

Collection limitation

Question 121

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question 122

During a threat modeling exercise using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) framework, it was identified that a web server allocates a socket and forks each time it receives a request from a user without limiting the number of connections or requests.

Which of the following security objectives is MOST likely absent in the web server?

Options:

A.

Integrity

B.

Authenticity

C.

Availability

D.

Authorization

Question 123

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 124

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Question 125

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question 126

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Question 127

Which of the following statements about demonstrated capacity Is true?

Options:

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Question 128

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Question 129

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Question 130

An organization starts to develop a drone inspection and defect detection system includes different subsystems running at different clouds from different service providers. During the architectural design phase, which security architecture principle should be the MOST important for the security engineer to apply?

Options:

A.

Security by design

B.

Default deny

C.

Security by default

D.

Security before design

Question 131

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Question 132

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 133

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 134

Exhibit:

as

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Question 135

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

Options:

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Question 136

A life cycle assessment (LCA) would be used to determine:

Options:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Question 137

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

Options:

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Question 138

What is the FIRST element that must be evaluated in a security governance program?

Options:

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Question 139

Database security includes which of the following requirements?

Options:

A.

Physical database integrity, logical database integrity, and ownership integrity

B.

Availability, auditability, and screening

C.

Physical database integrity, logical database integrity, and element integrity

D.

User authentication, availability, and accountability

Question 140

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

Options:

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Question 141

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

Options:

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Question 142

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 143

One of the most useful tools for analyzing the sustainable footprint is:

Options:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Question 144

Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?

Options:

A.

Authentication Header (AH)

B.

Generic Routing Encapsulation (GRE)

C.

Encapsulation Security Payload

D.

Internet Key Exchange (IKE)

Question 145

The question below is based on the following standard and actual data of a production order

as

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Question 146

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Question 147

One way to mitigate liability risk in the supply chain is to:

Options:

A.

negotiate lower component cost.

B.

require traceability for components.

C.

push inventory to supplier locations.

D.

use less-than-truckload (LTL) shipments more frequently.

Question 148

During the initiation phase of a project to acquire a customer relation management system, what is the FIRST step a project team will take for early integration of security?

Options:

A.

Develop a list of security requirements for the system.

B.

Conduct project planning and a feasibility assessment.

C.

Define system security classifications.

D.

Review relevant regulatory practices and standards.

Question 149

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Question 150

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

Options:

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Question 151

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

Options:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Question 152

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

Options:

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Question 153

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

Options:

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question 154

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

Options:

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Question 155

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

Options:

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Question 156

Risk pooling would work best for items with:

Options:

A.

low demand uncertainty and short lead times.

B.

low demand uncertainty and long lead times.

C.

high demand uncertainty and short lead times.

D.

high demand uncertainty and long lead times.

Question 157

An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?

Options:

A.

End of Life (EOL)

B.

End of Maintenance

C.

End of Service Life (EOSL)

D.

End of Repair

Question 158

A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?

Options:

A.

Maximum Tolerable Downtime (MTD)

B.

Recovery Point Objective (RPO)

C.

Recovery Time Objective (RTO)

D.

Mean Time to Recovery (MTTR)

Question 159

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Question 160

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

As close to the workload as possible, because it impacts authorization decisions

B.

Between the data stores and the trust engine, because it improves security policies

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the policy engine and the trust engine, because it enforces security policies

Question 161

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Question 162

As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?

Options:

A.

The developer Inputs the user's account, the user's password, and a token.

B.

The developer uses the user's credentials stored within the web-based application.

C.

The developer uses Transport Layer Security (TLS) certificates and Open ID Connect (OIDC).

D.

The developer uses Open ID Connect (OIDC) and Open Authorization (OAuth).

Question 163

Which of the following prioritization rules will have the greatest impact In reducing the number of orders In queue?

Options:

A.

Critical ratio

B.

Shortest processing time

C.

Fewest operations remaining

D.

First come, first served

Question 164

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Question 165

A health care organization’s new cloud-based customer-facing application is constantly receiving security events from dubious sources.

What BEST describes a security event that compromises the confidentiality, integrity, or availability of the application and data?

Options:

A.

Attack

B.

Breach

C.

Failure

D.

Incident

Page: 1 / 55
Total 552 questions