Big 11.11 Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Page: 1 / 59
Total 585 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Question 2

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 3

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Question 4

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

Options:

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Question 5

An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

Options:

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Question 6

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

Options:

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Question 7

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?

Options:

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Question 8

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Question 9

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Question 10

A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?

Options:

A.

Just-in-time

B.

Delegated

C.

Break-glass

D.

Automated

Question 11

If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?

Options:

A.

Symmetric cryptography

B.

Public Key Infrastructure (PKI) with asymmetric keys

C.

Password encryption using hashing (with salt and pepper)

D.

Message Authentication Code (MAC) using hashing

Question 12

A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?

Options:

A.

Privacy Impact Assessment (PIA)

B.

Vulnerability assessment

C.

Sensitive data assessment

D.

Personally Identifiable Information (PII) risk assessment

Question 13

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Question 14

In which of the following situations would you use an X-bar chart?

Options:

A.

Track the number of defects that are found in each unit.

B.

Measure the difference between the largest and the smallest in a sample.

C.

Determine the average value of a group of units.

D.

Estimate a subgroup variation.

Question 15

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Question 16

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Question 17

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

Options:

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Question 18

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Question 19

An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?

Options:

A.

The organization can implement both mandatory and dynamic access controls, except where they would be in conflict.

B.

The organization can clone roles, saving time and granting broad access to persons within the same department.

C.

The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.

D.

The organization can implement both static and dynamic access controls, adjusting them to fit any individual’s access needs.

Question 20

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question 21

When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?

Options:

A.

Using someone else's account

B.

Distributed Denial-Of-Service (DDoS)

C.

SQL Injection (SQLi)

D.

Modifying a file

Question 22

Which of the following statements is true about the meantime between failures (MTBF) measure?

Options:

A.

It is used for non-repairable products.

B.

An increase in MTBF is proportional to anincrease inquality.

C.

It is a useful measure of reliability.

D.

It is the same as operating life or service life.

Question 23

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

Options:

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Question 24

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 25

A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?

Options:

A.

Multi-Factor Authentication (MFA)

B.

Cybersecurity training

C.

Password management software

D.

Role-Based Access Control (RBAC)

Question 26

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

Options:

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Question 27

What should an organization do to prepare for Disaster Recovery (DR) efforts?

Options:

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Question 28

Which of the following situations is most likely to occur when using a push system?

Options:

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Question 29

Which of the following BEST describes the purpose of black hat testing during an assessment?

Options:

A.

Assess systems without the knowledge of end-users.

B.

Focus on identifying vulnerabilities.

C.

Examine the damage or impact an adversary can cause.

D.

Determine the risk associated with unknown vulnerabilities.

Question 30

Which of the following is an information security management framework?

Options:

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Question 31

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 32

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Question 33

A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?

Options:

A.

Logical access control against symmetric key

B.

Cryptanalysis against symmetric key

C.

Cryptanalysis against private key

D.

Logical access control against private key

Question 34

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

Options:

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Question 35

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 36

An organization’s security team is looking at ways to minimize the security risk of the container infrastructure. The lead engineer needs to select a suite of remediation actions to minimize risks. Which programmatic approach will result in preventing, detecting , and responding to the GREATEST number of threats aimed at container operations?

Options:

A.

Use of hardware-based countermeasures to provide a basis for trusted computing

B.

Use of container-aware runtime defense tools

C.

Grouping containers with the same sensitivity level on a single host

D.

Adoption of container-specific vulnerability management tools

Question 37

Health information stored in paper form may be destroyed using which of the following methods?

Options:

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Question 38

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Question 39

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Question 40

Disaster Recovery Plan (DRP) training can be considered complete when the participants

Options:

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Question 41

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

Options:

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question 42

Which of the following statements about demonstrated capacity Is true?

Options:

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Question 43

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

Options:

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Question 44

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Question 45

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Question 46

Which activity follows the discovery phase of vulnerability management?

Options:

A.

Vulnerability detection

B.

Vulnerability evaluation

C.

Vulnerability identification

D.

Vulnerability governance

Question 47

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Question 48

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Question 49

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

Options:

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 50

As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?

Options:

A.

The developer Inputs the user's account, the user's password, and a token.

B.

The developer uses the user's credentials stored within the web-based application.

C.

The developer uses Transport Layer Security (TLS) certificates and Open ID Connect (OIDC).

D.

The developer uses Open ID Connect (OIDC) and Open Authorization (OAuth).

Question 51

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 52

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for unauthorized access to user attributes

B.

The potential for tracking and profiling an individual's transactions

C.

The potential for exposing an organization's sensitive business information

D.

The potential to break the chain of trust between identity brokers

Question 53

Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?

Question # 53

Options:

A.

Accounts receivable

B.

Inventory value

C.

Accounts payable

D.

Cost of capital

Question 54

An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?

Options:

A.

Endpoint security

B.

Network security

C.

Cyber physical security

D.

Cloud security

Question 55

Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?

Options:

A.

Improved threat detection

B.

Flexible firewall configuration

C.

Network availability

D.

Improved threat prevention

Question 56

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

Options:

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Question 57

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 58

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Question 59

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Question 60

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Question 61

According to quality function deployment (QFD), customer needs are gathered through:

Options:

A.

employee suggestions.

B.

technical specifications.

C.

surveys.

D.

historical data.

Question 62

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

Options:

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Question 63

Which of the following combines multiple software programming tools into one package?

Options:

A.

Program language compilers

B.

Integrated development environments

C.

Dynamic Link Libraries (DLL)

D.

Software development kit

Question 64

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 65

Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?

Options:

A.

Min-max system

B.

Fixed order quantity

C.

Periodic review

D.

Available-to-promlse (ATP)

Question 66

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Question 67

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 68

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 69

Which of the following situations is most likely to occur when using a push system?

Options:

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Question 70

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

Options:

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Question 71

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

Options:

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Question 72

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

Options:

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Question 73

A life cycle assessment (LCA) would be used to determine:

Options:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Question 74

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Question 75

An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.

Why is the vendor's penetration test considered incomplete?

Options:

A.

The vendor should have attempted to exploit the identified vulnerabilities.

B.

The vendor should also provide a guide to remediate the identified vulnerabilities.

C.

The vendor should have provided a risk report of vulnerabilities found.

D.

The vendor should have worked closely with network engineers to understand the network infrastructure better.

Question 76

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Question 77

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 78

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?

Options:

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Question 79

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

Options:

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Question 80

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 81

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 82

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Question 83

What is the FIRST element that must be evaluated in a security governance program?

Options:

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Question 84

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Question 85

What is the MAIN purpose of risk and impact analysis?

Options:

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Question 86

Network Access Control (NAC) is used to perform what function for computers joining the network?

Options:

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Question 87

Which of the following actions will result In lower inventory levels?

Options:

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Question 88

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 89

An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?

Options:

A.

Cease routing traffic over the Internet exchange point and use the transit provider exclusively.

B.

Ask the peers who route the traffic to sign a Non-Disclosure Agreement (NDA).

C.

Use Internet Protocol Security (IPsec) between the border gateways at either site.

D.

Nothing needs to be done because applications are already required to encrypt and authenticate network traffic.

Question 90

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 91

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 92

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 93

Exhibit:

Question # 93

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Question 94

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

Options:

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Question 95

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

Options:

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Question 96

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 97

Which of the following measurements indicates there may be bias In the forecast model?

Options:

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Question 98

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 99

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Question 100

What does the Role-Based Access Control (RBAC) method define?

Options:

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

Question 101

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Question 102

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Question 103

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 104

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Question 105

An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?

Options:

A.

TPM will use the Operating System (OS) for full disk encryption key protection.

B.

TPM will protect the full disk encryption keys.

C.

TPM will handle the allocation of the hardware storage drives for full disk encryption.

D.

TPM will provide full disk encryption automatically.

Question 106

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

Options:

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Question 107

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Question 108

We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?

Options:

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Question 109

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 110

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

Options:

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Question 111

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

Options:

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Question 112

One way to mitigate liability risk in the supply chain is to:

Options:

A.

negotiate lower component cost.

B.

require traceability for components.

C.

push inventory to supplier locations.

D.

use less-than-truckload (LTL) shipments more frequently.

Question 113

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Side-channel

B.

Fault injection

C.

Man-In-The-Middle (MITM)

D.

Frequency analysis

Question 114

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

Options:

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Question 115

Long lead-time items with stable demand would best be supported by a supply chain:

Options:

A.

using a pull system.

B.

linked through an enterprise resources planning (ERP) system.

C.

designed to be responsive.

D.

positioning inventory close to the consumer.

Question 116

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Question 117

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

Options:

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Question 118

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 119

An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?

Options:

A.

Soft token

B.

Short Message Service (SMS)

C.

Personal Identification Number (PIN) code

D.

Hard token

Question 120

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 121

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

Options:

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Question 122

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

Options:

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Question 123

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 124

A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization's corporate cloud. What is the MAIN benefit of the organization's Federated Identity Management (FIM) system to address the need?

Options:

A.

Efficient access provisioning

B.

Increased robustness of authentication

C.

Greater flexibility of access control

D.

Reduced complexity of maintenance and changes

Question 125

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

Options:

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Question 126

The question below is based on the following standard and actual data of a production order

Question # 126

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Question 127

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Question 128

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

Options:

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Question 129

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

Options:

A.

Rule-based

B.

Mandatory

C.

Role-based

D.

Automated

Question 130

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

Options:

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Question 131

Which of the following can allow an attacker to bypass authentication?

Options:

A.

Response tampering

B.

Machine enumeration

C.

User agent manipulation

D.

Social engineering

Question 132

Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:

Options:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Question 133

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

Options:

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Question 134

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Question 135

Which of the following procedures should be defined when establishing information and asset handling requirements?

Options:

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Question 136

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 137

While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?

Options:

A.

Add privileged user to the domain admin group.

B.

Add privileged users to the protected users group.

C.

Enable security options for each privileged user.

D.

Place each privileged user in a separate Kerberos policy.

Question 138

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 139

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 140

Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

Options:

A.

Generally includes threat modeling, requirements risk analysis, and security modeling

B.

Focused on ensuring that the security functionally performed by a web service meets its stated requirements

C.

Ensure individual protocol implementations adhere to the relevant published standards

D.

Focused on the smallest unit of the web service application, apart from the rest of the application

Question 141

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

Options:

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

Question 142

A contractor hacked into an unencrypted session on an organization's wireless network. Which authentication configuration is MOST likely to have enabled this?

Options:

A.

Remote Authentication Dial-In User Service (RADIUS)

B.

Captive web portal

C.

Lightweight Directory Access Protocol (LDAP)

D.

Token authentication

Question 143

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

Options:

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Question 144

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

Options:

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Question 145

The question below is based on the following information:

Question # 145

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?

Options:

A.

50

B.

150

C.

1.250

D.

3.750

Question 146

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

Options:

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Question 147

An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?

Options:

A.

Ensure that the call agents are using an additional authentication method.

B.

Implement a Network Access Control (NAC) solution.

C.

Ensure that the voice media is using Secure Real-Time Transport Protocol.

D.

Segment the voice network and add Next-Generation Firewalls (NGFW).

Question 148

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

Options:

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Question 149

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Question 150

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Question 151

Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?

Options:

A.

Production cost and lot size quantity

B.

Purchase cost and shrinkage rates

C.

Transportation cost and delivery time

D.

Customer price and order quantity

Question 152

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

Between the policy engine and the trust engine, because it enforces security policies

B.

As close to the workload as possible, because it impacts authorization decisions

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the data stores and the trust engine, because it improves security policies

Question 153

A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

Options:

A.

An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.

B.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.

C.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question 154

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Question 155

Which of the following is typically used to control physical access to highly secure facilities?

Options:

A.

Surveillance

B.

Mantrap

C.

Dual control

D.

Door locks

Question 156

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Question 157

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Question 158

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

Options:

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Question 159

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question 160

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Question 161

Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?

Options:

A.

Min-max system

B.

Fixed order quantity

C.

Periodic review

D.

Available-to-promlse (ATP)

Question 162

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 163

A traffic analysis on an organization's network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?

Options:

A.

Proxy

B.

Firewall

C.

Router

D.

Switch

Question 164

An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?

Options:

A.

Cease routing traffic over the Internet exchange point and use the transit provider exclusively.

B.

Ask the peers who route the traffic to sign a Non-Disclosure Agreement (NDA).

C.

Use Internet Protocol Security (IPsec) between the border gateways at either site.

D.

Nothing needs to be done because applications are already required to encrypt and authenticate network traffic.

Question 165

A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Web application unit test

B.

Online application development test

C.

Web application penetration test

D.

Online application assurance test

Page: 1 / 59
Total 585 questions