Pre-Summer Sale Discount Flat 70% Offer - Ends in 0d 00h 00m 00s - Coupon code: 70diswrap

APICS CPIM-8.0 Dumps

Page: 1 / 61
Total 606 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Question 2

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Question 3

A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?

Options:

A.

ZigBee

B.

Radio-Frequency Identification (RFID)

C.

Long-Term Evolution (LTE)

D.

Bluetooth

Question 4

A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer ' s pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?

Options:

A.

Cross-Site Request Forgery (CSRF)

B.

On-path attack

C.

Cross-Site Scripting (XSS)

D.

Session hijacking

Question 5

Which of the following statements about demonstrated capacity Is true?

Options:

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Question 6

A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

Options:

A.

System centric

B.

Attacker centric

C.

Threat centric

D.

Asset centric

Question 7

Based on the above table, calculate the mean absolute deviation (MAD).

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Question 8

After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?

Options:

A.

Complete an inventory of who has access to systems.

B.

Create a Role-Based Access Control (RBAC) process to determine what a specific group of users can access.

C.

Create an Attribute-Based Access Control (ABAC) process to assign access to users based on their account attributes and characteristics.

D.

Conduct an assessment and remove all inactive accounts.

Question 9

A disadvantage of a capacity-lagging strategy may be:

Options:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Question 10

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 11

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 12

A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?

Options:

A.

Secure Shell (SSH)

B.

Trusted Platform Module (TPM)

C.

Virtual Private Network (VPN)

D.

Transport Layer Security (TLS)

Question 13

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 14

The security department was notified about vulnerabilities regarding users ' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

Options:

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Question 15

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 16

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Question 17

Which Internet of Things (IoT) process was developed specifically to support retail commerce?

Options:

A.

Automated storage/retrieval system (AS/RS)

B.

Electronic shelving of items

C.

Container tracking through the use of electronic tags

D.

Exchange of point-of-sale (POS) data

Question 18

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 19

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Question 20

Risk pooling would work best for items with:

Options:

A.

low demand uncertainty and short lead times.

B.

low demand uncertainty and long lead times.

C.

high demand uncertainty and short lead times.

D.

high demand uncertainty and long lead times.

Question 21

An advantage of applying ABC classification to a firm ' s replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Question 22

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Question 23

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Question 24

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

Options:

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Question 25

A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?

Options:

A.

Uselevel production planning and investigate subcontracting to meet the extra demand.

B.

Usechaseproduction planningand only take the orders that can be produced In the highdemand season.

C.

Usehybridproduction planningto save labor costs and inventory costs in the low demand season.

D.

Usehybridproduction planningand reduce the size of the customer base during the highdemand season.

Question 26

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 27

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

Options:

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Question 28

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

Options:

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Question 29

Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?

Options:

A.

Removal is authorized directly by executive management.

B.

Removal is authorized using a formal sign-out process.

C.

Removal is authorized when remote use is required for business.

D.

Removal is authorized if the asset has been disposed of.

Question 30

An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?

Options:

A.

Overwriting the hard disk drive of the computers

B.

Encrypting the hard disk drive of the computers

C.

Removing and physically destroying the hard disk drive of the computers

D.

Degaussing the hard disk drive of the computers

Question 31

The Data Loss Prevention (DLP) team in a major financial institution discovered network traffic that involved movement of sensitive material to a Cloud Service Provider (CSP). What action should be taken FIRST in this situation?

Options:

A.

Contact the CSP to validate data access controls in the cloud.

B.

Contact the network security team to block the traffic.

C.

Contact the Identity And Access Management (IAM) team to remove the user from the network.

D.

Contact the data owner to confirm the transfer was authorized.

Question 32

Which threat modeling methodology is focused on assessing risks from organizational assets?

Options:

A.

Process For Attack Simulation And Threat Analysis (PASTA)

B.

Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)

C.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

D.

Damage, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

Question 33

An organization ' s security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 34

A cybersecurity analyst has recently been assigned to work with a product development team. The team has usually needed to perform a lot of rework late in the development cycle on past projects due to application security concerns. They would like to minimize the amount of rework necessary. Which would be the BEST option to enable secure code review early in the product development?

Options:

A.

Implement dynamic code analysis

B.

Perform manual code reviews

C.

Implement static code analysis

D.

Perform fuzz testing

Question 35

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 36

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Question 37

The master schedule is an Important tool in the sales and operations planning (S & OP) process because it:

Options:

A.

represents the forecast before changes are made in S & OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Question 38

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization ' s databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 39

An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?

Options:

A.

Tokenization

B.

Anonymization

C.

Obfuscation

D.

Destruction

Question 40

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 41

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization ' s regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 42

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Question 43

Which of the following inventory management techniques is most responsive to changes in demand levels?

Options:

A.

Two-bin system

B.

Periodic review system

C.

Cycle counting

D.

ABC classification

Question 44

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Question 45

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question 46

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

Options:

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Question 47

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Question 48

Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?

Options:

A.

Customer demand is known but seasonal.

B.

Items are purchased and/or produced continuously and not in batches.

C.

Order preparation costs and inventory-carrying costs are constant and known.

D.

Holding costs, as a percentage of the unit cost, are variable.

Question 49

A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?

Options:

A.

Establish a device recycle process.

B.

Establish a process preventing credential storage on devices.

C.

Establish a physical destruction process for the storage medium.

D.

Establish a process for check in and check out of devices.

Question 50

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Question 51

An organization undergoing acquisition merged IT departments and infrastructure. During server decommissioning, some servers still in use by customers were mistakenly removed, causing order processing failures. Which type of review would have BEST avoided this scenario?

Options:

A.

Disaster Recovery (DR)

B.

Change management

C.

Business Continuity (BC)

D.

Business impact assessment

Question 52

In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

Options:

A.

Implement a self-service password management capability

B.

Increase system administration personnel

C.

Implement an automated provisioning tool

D.

Increase authorization workflow steps

Question 53

The primary purpose for engaging in cycle count activities is to:

Options:

A.

eliminate the need for a traditional physical inventory count.

B.

more frequently reconcile the actual on-hand and system on-hand for items.

C.

smooth out the tasks of counting inventory throughout the fiscal year.

D.

improve material handling processes and reduce or eliminate errors.

Question 54

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Question 55

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

Options:

A.

Interview the candidates ' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates ' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question 56

An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.

Which of the following will BEST help remediate this issue?

Options:

A.

Provide access restrictions for resources stored in a low-volume network or subnetwork location.

B.

Provide access restrictions for resources stored on a network that uses a unique platform.

C.

Provide access restrictions for resources stored in a high-volume network or subnetwork location.

D.

Provide access restrictions for resources stored on a network or on a subnetwork.

Question 57

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Question 58

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Question 59

A company has the following production conditions:

    Batch size: 1,000 items

    Processing time: 4 minutes per item

    Setup time: 2 hours

    Utilization: 80%

    Efficiency: 80%

Which of the following actions would result in the work being done in the least amount of time?

Options:

A.

Reduce the processing time for each item to 3.5 minutes.

B.

Increase either utilization or efficiency to 100%.

C.

Increase both utilization and efficiency to 90%.

D.

Eliminate the need for a setup to process the batch.

Question 60

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Question 61

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Question 62

The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?

Options:

A.

Deploy the solution to a network terminal access point port.

B.

Deploy the solution and connect it to a Switched Port Analyzer (SPAN) port.

C.

Deploy the solution in line with the traffic flows.

D.

Deploy the solution on a separate Virtual Local Area Network (VLAN).

Question 63

Which of the following BEST describes the responsibility of an information System Security Officer?

Options:

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Question 64

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 65

A failure mode and effects analysis (FMEA) could be used for which of the following activities?

Options:

A.

Forecasting the estimated warranty costs for the annual budget cycle

B.

Calculating the lost productivity from unplanned equipment downtime

C.

Determining the critical-to-quality (CTQ) characteristics for a new product design

D.

Assessing the supply chain risk for a single-sourced raw material

Question 66

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

Options:

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Question 67

A company ' s primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Question 68

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

Options:

A.

One of the requests does not have a valid token issuer ' s identifier.

B.

The requests have the same ' auth_time ' parameter.

C.

The requests have the same ' nonce ' parameter.

D.

One of the requests does not have a valid audience token.

Question 69

Check sheets can be used to:

Options:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question 70

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Question 71

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Question 72

A company uses planning bills of material (BOMs) in its planning process extensively. Which of the following scenarios would present the biggest challenge to this planning process?

Options:

A.

High variation in supplier delivery

B.

Low variation in the demand mix

C.

High new product introductions

D.

High manufacturing scrap rates

Question 73

Management should support investments in new process technologies that:

Options:

A.

require minimal changes in existing systems, procedures, and skills.

B.

have been recommended by technical experts and equipment suppliers.

C.

provide significant cost-reduction opportunities for the company ' s current products.

D.

provide long-term competitive advantage with acceptable financial risk.

Question 74

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations.

B.

The need to develop alternative hosting strategies for applications deployed to the cloud.

C.

Most cloud services offerings are unique to each provider and may not be easily portable.

D.

Integrity and confidentiality are not ensured properly on the most cloud service offerings.

Question 75

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

Options:

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Question 76

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

Options:

A.

To ensure complexity introduced by security design is addressed in the beginning stages.

B.

To reduce the overall cost of incorporating security in a system.

C.

To prevent the system from being tampered with in the future.

D.

To prevent the users from performing unauthorized actions during the testing or operational phases.

Question 77

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

Options:

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question 78

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Question 79

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Question 80

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

Options:

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Question 81

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Question 82

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Question 83

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 84

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Question 85

Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?

Options:

A.

It coordinates between the client and multiple logistics suppliers.

B.

It focuses primarily on last-mile delivery.

C.

It allows the client to concentrate on operating its own warehouse.

D.

It provides a logistics specialist who manages some of the logistics operation.

Question 86

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

Options:

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Question 87

Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?

Options:

A.

Signed Non-Disclosure Agreement (NDA)

B.

Signed Acceptable Use Policy (AUP)

C.

ISC2 Code of Ethics

D.

Suspicious that a crime is being committed

Question 88

An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization ' s security staff can make to prevent a compromise?

Options:

A.

Cease routing traffic over the Internet exchange point and use the transit provider exclusively.

B.

Ask the peers who route the traffic to sign a Non-Disclosure Agreement (NDA).

C.

Use Internet Protocol Security (IPsec) between the border gateways at either site.

D.

Nothing needs to be done because applications are already required to encrypt and authenticate network traffic.

Question 89

A production manager completes a work order for an assembly item, and inventory records for the components are decreased. This is an example of:

Options:

A.

Issuing component inventory

B.

Backflushing inventory

C.

Backward scheduling

D.

Exploding requirements

Question 90

An order winner during the growth stage of a product ' s life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 91

An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?

Options:

A.

By priority as defined by the critical assets list

B.

The latest Continuity Of Operations Plan (COOP)

C.

Senior management assessment and approval

D.

The latest Business Impact Analysis (BIA)

Question 92

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Question 93

A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.

B.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.

C.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 94

While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user ' s hash from being cached, what is the MOST appropriate policy to mandate?

Options:

A.

Add privileged user to the domain admin group.

B.

Add privileged users to the protected users group.

C.

Enable security options for each privileged user.

D.

Place each privileged user in a separate Kerberos policy.

Question 95

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Question 96

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

Options:

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Question 97

Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?

Options:

A.

Switched Port Analyzer (SPAN)

B.

Representational State Transfer (REST)

C.

Remote Desktop Protocol (RDP)

D.

Virtual Private Network (VPN)

Question 98

When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

Options:

A.

The vendor provides documented safeguards in handling confidential data.

B.

The vendor provides a copy of their externally performed risk assessment.

C.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

D.

The vendor has a signed contract in place before work with data begins.

Question 99

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

Options:

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Question 100

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Question 101

Network Access Control (NAC) is used to perform what function for computers joining the network?

Options:

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Question 102

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 103

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

Options:

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Question 104

An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?

Options:

A.

Forensic audit

B.

Third-party audit

C.

Location audit

D.

Internal audit

Question 105

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

Options:

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 106

The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?

Options:

A.

Confidentiality, integrity, availability

B.

Physical security, access control, asset protection

C.

Intent, capability, opportunity

D.

Threat level, network security, information disposal

Question 107

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 108

The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?

Options:

A.

Modified base metrics

B.

Remediation level

C.

Integrity requirements

D.

Attack complexity

Question 109

Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?

Options:

A.

Discretionary Access Control (DAC)

B.

Principle of least privilege

C.

Need to know

D.

Role-Based Access Control (RBAC)

Question 110

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 111

Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?

Options:

A.

Boundary condition

B.

Buffer overflow

C.

Race condition

D.

Integer overflow

Question 112

The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?

Cost CategoryCost

Custom fees$125

Freight$700

Warehouse rent$200

Matenal cost$500

Options:

A.

$825

B.

$1,325

C.

$1,400

D.

$1,525

Question 113

Which of the following BEST describes the purpose of black hat testing during an assessment?

Options:

A.

Assess systems without the knowledge of end-users.

B.

Focus on identifying vulnerabilities.

C.

Examine the damage or impact an adversary can cause.

D.

Determine the risk associated with unknown vulnerabilities.

Question 114

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

Options:

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Question 115

An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

B.

National Institute Of Standards And Technology (NIST) and International Organization For Standardization (ISO) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

Question 116

The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:

Options:

A.

a supply chain community.

B.

interplant demand.

C.

a bill of distribution.

D.

logistics data interchange (LDI).

Question 117

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?

Options:

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Question 118

Which of the following actions will result In lower inventory levels?

Options:

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Question 119

When considering Defense in Depth (DiD) as part of a network’s architectural design, what is the FIRST layer in a multi-layered defensive strategy?

Options:

A.

Distributed Denial-of-Service (DDoS)

B.

Managed Domain Name System (DNS)

C.

Reverse proxies

D.

Edge routers

Question 120

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Question 121

One of the findings in the recent security assessment of a web application reads: " It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process. " Which of these choices would BEST remediate this security finding?

Options:

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

Question 122

Exhibit:

as

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Question 123

Which of the following actions hinders the transition from a push system to a pull system?

Options:

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Question 124

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Question 125

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

Options:

A.

Organization ' s security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Question 126

A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?

Options:

A.

An increased number of receipts and issues for subassemblies

B.

An increased number of production order feedback transactions

C.

A reduced number of production orders planned by MRP

D.

An inability to process orders for replacement drawers

Question 127

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Question 128

Which of the following factors Is considered a carrying cost?

Options:

A.

Setup

B.

Transportation

C.

Obsolescence

D.

Scrap rate

Question 129

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

Options:

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Question 130

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 131

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Question 132

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 133

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

Options:

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Question 134

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Question 135

An independent risk assessment determined that a hospital ' s existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

Options:

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Question 136

Which of the following prioritization rules will have the greatest impact In reducing the number of orders In queue?

Options:

A.

Critical ratio

B.

Shortest processing time

C.

Fewest operations remaining

D.

First come, first served

Question 137

Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?

Options:

A.

Production cost and lot size quantity

B.

Purchase cost and shrinkage rates

C.

Transportation cost and delivery time

D.

Customer price and order quantity

Question 138

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Question 139

An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?

Options:

A.

Unavailability of access logs

B.

Integrity of authentication mechanism

C.

Compromise of service

D.

Deletion of federated tokens

Question 140

A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?

Options:

A.

Ensuring compliance with international data protection and privacy laws for email communication

B.

Implementing strong encryption algorithms to ensure the confidentiality of the emails

C.

Developing a robust user authentication system to prevent unauthorized access to the software

D.

Defining clear software requirements for security and identifying potential threats and risks to the software

Question 141

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

Options:

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Question 142

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 143

Return on investment (ROI) is decreased by which of the following activities?

Options:

A.

Increasing prices

B.

Increasing sales volume

C.

Increasing cost of sales

D.

Reducing inventory levels

Question 144

Which Virtual Private Network (VPN) protocol provides a built-in encryption?

Options:

A.

Layer 2 Tunneling Protocol

B.

Point-to-Point Tunneling Protocol

C.

Layer 2 Forwarding Protocol

D.

Internet Protocol Security (IPsec)

Question 145

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

Options:

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Question 146

What is the BEST preventive measure against employees abusing access privileges?

Options:

A.

Move abusers to other positions

B.

Establish a solid security awareness training program

C.

Terminate abusers

D.

Require frequent password changes

Question 147

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S & OP) meeting.

Question 148

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Question 149

Which of the following MUST be in place for security to be effective in an organization?

Options:

A.

Security objectives are documented and in line with the organization’s mission and goals.

B.

Security policies are in line with international standards.

C.

Technology strategy decisions have the involvement and approval of the security organization.

D.

Risk assessments on business plans include security issues as part of the analysis.

Question 150

What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?

Options:

A.

Threat modeling

B.

Asset management

C.

Risk management

D.

Asset modeling

Question 151

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Question 152

During the sales and operations planning (S & OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?

Options:

A.

Identifying reasons why the demand plan is not realistic

B.

Communicating when an event will prevent meeting the supply plan

C.

Ensuring that the functional objectives are considered when developing the plans

D.

Understanding how to use the plan to improve functional performance

Question 153

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization ' s software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 154

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

Options:

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Question 155

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Question 156

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Question 157

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Question 158

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 159

The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?

Options:

A.

The user ' s certificate was compromised by the public key of the user.

B.

The public key of the Certificate Authority (CA) is known to attackers.

C.

The user ' s certificate was absent from the Certificate Revocation List (CRL).

D.

The user ' s certificate has expired and needs to be renewed.

Question 160

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Question 161

An organization’s computer incident response team PRIMARILY responds to which type of control?

Options:

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Question 162

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 163

One advantage of adopting a supply network perspective Is that it:

Options:

A.

protects global markets.

B.

enhances understanding of competitive and cooperative forces.

C.

defines the market relationships and partnerships.

D.

encourages rivals to collaborate.

Question 164

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

Options:

A.

Security

B.

Data

C.

Application

D.

Control

Question 165

Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?

Options:

A.

The ERP system has business processes which both companies can adopt

B.

Company A wants to save on software licensing costs

C.

Each ERP package has unique and distinctive business processes

D.

Company A wishes to close Company B ' s data center

Question 166

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

Options:

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Question 167

Which of the following methods is most often used to manage inventory planning variability across the supply chain?

Options:

A.

Buffer management

B.

Safety lead time

C.

Risk pooling

D.

Risk categorization

Question 168

What activity is a useful element in the change process?

Options:

A.

Creating short-term wins

B.

Calculating a break-even point

C.

Performing a SWOT analysis

D.

Developing key performance indicators (KPIs)

Question 169

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

Options:

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Question 170

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

Options:

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Question 171

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Question 172

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual ' s transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization ' s sensitive business information

D.

The potential for unauthorized access to user attributes

Question 173

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

Options:

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Question 174

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 175

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Question 176

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

Options:

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question 177

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 178

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Question 179

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 180

Based on the values reported in the table below, what is the inventory turnover?

as

Options:

A.

0.50

B.

0.58

C.

1.73

D.

2.60

Question 181

Which of the following ports needs to be open for Kerberos Key Distribution Center (KDC) to function properly?

Options:

A.

88

B.

389

C.

443

D.

3268

Page: 1 / 61
Total 606 questions