Summer Sale- Special Discount Limited Time 65% Offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Page: 1 / 55
Total 552 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Question 2

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Question 3

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

Options:

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Question 4

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

Options:

A.

74

B.

63

C.

61

D.

31

Question 5

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Question 6

An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.

Which of the following will BEST help remediate this issue?

Options:

A.

Provide access restrictions for resources stored in a low-volume network or subnetwork location.

B.

Provide access restrictions for resources stored on a network that uses a unique platform.

C.

Provide access restrictions for resources stored in a high-volume network or subnetwork location.

D.

Provide access restrictions for resources stored on a network or on a subnetwork.

Question 7

An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Internet layer

B.

Transport layer

C.

Application layer

D.

Network layer

Question 8

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Question 9

What is the total load requirement for this work center based on the following data?

Question # 9

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Question 10

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

Options:

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Question 11

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

Options:

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question 12

An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

Options:

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Question 13

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

Options:

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

Question 14

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

Options:

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Question 15

We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?

Options:

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Question 16

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 17

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Question 18

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

Options:

A.

Role-based

B.

Automated

C.

Rule-based

D.

Mandatory

Question 19

What is the FIRST element that must be evaluated in a security governance program?

Options:

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Question 20

In which of the following situations would you use an X-bar chart?

Options:

A.

Track the number of defects that are found in each unit.

B.

Measure the difference between the largest and the smallest in a sample.

C.

Determine the average value of a group of units.

D.

Estimate a subgroup variation.

Question 21

A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?

Options:

A.

Brewer-Nash

B.

Bell-LaPadula

C.

Biba Integrity

D.

Clark Wilson

Question 22

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

Options:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Question 23

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

Options:

A.

Signed assertion

B.

Federation authorities access list

C.

Manual registration

D.

Proxied federation

Question 24

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Question 25

Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?

Options:

A.

Supply disruptions

B.

Forecast inaccuracy

C.

Procurement problems

D.

Loss of intellectual property

Question 26

Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:

Options:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Question 27

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Question 28

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Question 29

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 30

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Question 31

When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?

Options:

A.

Opening of previously closed ports

B.

Adding administrator rights on servers

C.

Performing a Cross-Site Scripting (XSS) attack

D.

Creating a Denial-Of-Service (DoS) condition

Question 32

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

Options:

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Question 33

A financial organization is using an internally developed application.The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC).For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Online application assurance test

B.

Web application unit test

C.

Online application development test

D.

Web application penetration test

Question 34

Which of the following measurements indicates there may be bias In the forecast model?

Options:

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Question 35

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

Options:

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Question 36

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question 37

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 38

An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.

What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?

Options:

A.

Visibility and natural disasters

B.

Visibility and locale

C.

Visibility and hazardous sites

D.

Visibility and transportation

Question 39

A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?

Options:

A.

Uselevel production planning and investigate subcontracting to meet the extra demand.

B.

Usechaseproduction planningand only take the orders that can be produced In the highdemand season.

C.

Usehybridproduction planningto save labor costs and inventory costs in the low demand season.

D.

Usehybridproduction planningand reduce the size of the customer base during the highdemand season.

Question 40

Which of the following actions will result In lower inventory levels?

Options:

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Question 41

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Simplex

B.

Unicast

C.

Half-duplex

D.

Full-duplex

Question 42

Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:

Options:

A.

reject the request.

B.

accept the request.

C.

forward the request to senior management.

D.

check the availability of required material.

Question 43

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

Options:

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Question 44

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Question 45

Which of the following should recommendations from a Plan Of Action And Milestones (POA&M) be based on?

Options:

A.

Continuous monitoring

B.

Change Control Board (CCB) coordination

C.

Risk acceptance

D.

Root cause analysis

Question 46

The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

Options:

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Question 47

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Question 48

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Question 49

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Question 50

When implementing a data classification program, Which is MOST important for measuring businesss impact?

Options:

A.

Data classification program being rolled out in accordance with policies and procedures

B.

Measuring the size of the data set to understand scoping for compliance requirements

C.

The adverse effect of data leakage

D.

The early appointment of data custodians

Question 51

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

Question # 51

Options:

A.

80

B.

120

C.

160

D.

200

Question 52

The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:

Options:

A.

pipeline inventory.

B.

transportation costs.

C.

inventory turns.

D.

sales revenue.

Question 53

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

Options:

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Question 54

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Question 55

Which of the following is the MAIN element in achieving a successful security strategy?

Options:

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Question 56

The most relevant measure of customer service performance Is:

Options:

A.

service perceived by the customer against service expected by the customer.

B.

service promised to the customer against service measured by the supplier.

C.

customer complaints received as a percentage of orders shipped.

D.

positive customer feedback as a percentage of customer feedback.

Question 57

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Question 58

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

Options:

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Question 59

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Question 60

According to quality function deployment (QFD), customer needs are gathered through:

Options:

A.

employee suggestions.

B.

technical specifications.

C.

surveys.

D.

historical data.

Question 61

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Question 62

An organizational policy requires that any data from organization-issued devices be securely destroyed before disposal. Which method provides the BEST assurance of data destruction?

Options:

A.

Incinerating

B.

Reformatting

C.

Degaussing

D.

Erasing

Question 63

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

Options:

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Question 64

When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

Options:

A.

The vendor provides documented safeguards in handling confidential data.

B.

The vendor provides a copy of their externally performed risk assessment.

C.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

D.

The vendor has a signed contract in place before work with data begins.

Question 65

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Question 66

An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?

Options:

A.

Soft token

B.

Short Message Service (SMS)

C.

Personal Identification Number (PIN) code

D.

Hard token

Question 67

An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?

Options:

A.

Cease routing traffic over the Internet exchange point and use the transit provider exclusively.

B.

Ask the peers who route the traffic to sign a Non-Disclosure Agreement (NDA).

C.

Use Internet Protocol Security (IPsec) between the border gateways at either site.

D.

Nothing needs to be done because applications are already required to encrypt and authenticate network traffic.

Question 68

A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?

Options:

A.

Multi-Factor Authentication (MFA)

B.

Cybersecurity training

C.

Password management software

D.

Role-Based Access Control (RBAC)

Question 69

Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?

Options:

A.

Discretionary Access Control (DAC)

B.

Principle of least privilege

C.

Need to know

D.

Role-Based Access Control (RBAC)

Question 70

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

Options:

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Question 71

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Question 72

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 73

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

Options:

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Question 74

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 75

What MUST be completed before developing physical security controls?

Options:

A.

Develop a comprehensive security policy

B.

Provide the annual security awareness training

C.

Contract for licensed and bonded security force

D.

Perform a physical security audit

Question 76

The primary purpose for engaging in cycle count activities is to:

Options:

A.

eliminate the need for a traditional physical inventory count.

B.

more frequently reconcile the actual on-hand and system on-hand for items.

C.

smooth out the tasks of counting inventory throughout the fiscal year.

D.

improve material handling processes and reduce or eliminate errors.

Question 77

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

Options:

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Question 78

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network's Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Question 79

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

Options:

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Question 80

A low-cost provider strategy works best when which of the following conditions are met?

Options:

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Question 81

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 82

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Question 83

Labor3 people

Work hours10 hours per day

Days4 days per week

Meetings with work area employees1/2 hour per day

Work area efficiency85%

Given the information above, what is the weekly theoretical capacity of this work area in hours?

Options:

A.

97

B.

102

C.

114

D.

120

Question 84

An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?

Options:

A.

Transmission encryption

B.

Multi-Factor Authentication (MFA)

C.

Single Sign-On (SSO)

D.

Transmission authentication

Question 85

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

Options:

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Question 86

Check sheets can be used to:

Options:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question 87

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

Options:

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Question 88

An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?

Options:

A.

Unavailability of access logs

B.

Integrity of authentication mechanism

C.

Compromise of service

D.

Deletion of federated tokens

Question 89

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 90

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Question 91

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Question 92

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Question 93

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Question 94

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

Options:

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Question 95

An advantage of applying ABC classification to a firm's replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Question 96

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Question 97

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 98

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question 99

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

Options:

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Question 100

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 101

In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

Options:

A.

Implement a self-service password management capability

B.

Increase system administration personnel

C.

Implement an automated provisioning tool

D.

Increase authorization workflow steps

Question 102

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 103

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Options:

Question 104

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 105

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

Options:

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Question 106

The production plan relates to a firm's financial planning because it is used to:

Options:

A.

calculate standard product costs.

B.

determine variable costs.

C.

project payroll costs.

D.

identify future cash needs.

Question 107

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

Options:

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Question 108

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

Options:

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Question 109

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

Options:

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Question 110

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Question 111

Which activity follows the discovery phase of vulnerability management?

Options:

A.

Vulnerability detection

B.

Vulnerability evaluation

C.

Vulnerability identification

D.

Vulnerability governance

Question 112

An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?

Options:

A.

Provide travel security training.

B.

Provide specific pre-travel intelligence briefing.

C.

Complete a travel risk assessment.

D.

Refresh the corporate travel policy.

Question 113

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Question 114

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

Options:

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Question 115

Forecast error typically triggers forecast revision when it is:

Options:

A.

used in computing the tracking signal.

B.

associated with the Introduction stage of the product life cycle.

C.

continually increasing.

D.

caused by random variation.

Question 116

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?

Options:

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Question 117

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 118

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question 119

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Transformation procedures

B.

Enforcement rules

C.

Data classifications

D.

Integrity labels

Question 120

A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

Options:

A.

System centric

B.

Attacker centric

C.

Threat centric

D.

Asset centric

Question 121

An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?

Options:

A.

End of Life (EOL)

B.

End of Maintenance

C.

End of Service Life (EOSL)

D.

End of Repair

Question 122

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

Options:

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Question 123

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 124

An organization starts to develop a drone inspection and defect detection system includes different subsystems running at different clouds from different service providers. During the architectural design phase, which security architecture principle should be the MOST important for the security engineer to apply?

Options:

A.

Security by design

B.

Default deny

C.

Security by default

D.

Security before design

Question 125

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Question 126

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

Options:

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Question 127

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Question 128

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

Options:

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Question 129

Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?

Options:

A.

Software security team

B.

Product management

C.

Third-party reviews

D.

Senior management

Question 130

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Question 131

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Question 132

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Question 133

Which of the following is the BEST type of fire extinguisher for a data center environment?

Options:

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Question 134

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

Options:

A.

Design

B.

Requirements

C.

Maintenance

D.

Testing

Question 135

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

Options:

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Question 136

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Question 137

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Question 138

Which of the following is the BEST reason to conduct a penetration test?

Options:

A.

To verify compliance with organizational patching policies.

B.

To document that all relevant patches have been installed.

C.

To identify technical vulnerabilities.

D.

To determine if weaknesses can be exploited.

Question 139

What is the MOST important security benefit of comprehensive asset management?

Options:

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Question 140

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Question 141

The primary benefit that results from the cross-training of employees is:

Options:

A.

improved flexibility.

B.

improved capacity.

C.

shortened lead time.

D.

effective problem-solving.

Question 142

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

Options:

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Question 143

Network Access Control (NAC) is used to perform what function for computers joining the network?

Options:

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Question 144

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Review logs of all user's social media activity.

B.

Review the organizational social media policy.

C.

Initiate the organization's incident response plan.

D.

Determine a list of information assets that contain PII.

Question 145

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

Options:

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Question 146

Which if the following is the FIRST control step in provisioning user rights and privileges?

Options:

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Question 147

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

Options:

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Question 148

As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?

Options:

A.

The developer Inputs the user's account, the user's password, and a token.

B.

The developer uses the user's credentials stored within the web-based application.

C.

The developer uses Transport Layer Security (TLS) certificates and Open ID Connect (OIDC).

D.

The developer uses Open ID Connect (OIDC) and Open Authorization (OAuth).

Question 149

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

Options:

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Question 150

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

Options:

A.

One of the requests does not have a valid token issuer's identifier.

B.

The requests have the same 'auth_time' parameter.

C.

The requests have the same 'nonce' parameter.

D.

One of the requests does not have a valid audience token.

Question 151

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

Options:

A.

Organization's security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Question 152

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

Options:

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Question 153

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 154

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 155

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Question 156

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Question 157

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 158

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Question 159

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 160

An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?

Options:

A.

Conduct an integrated audit against the most stringent security controls.

B.

Combine the systems into a single audit and implement security controls per applicable standard.

C.

Combine the systems into a single audit against all of the associated security controls.

D.

Audit each system individually and implement the applicable standard specific security controls.

Question 161

Which of the following outcomes Is a benefit of mixed-model scheduling?

Options:

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Question 162

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization's BEST next step?

Options:

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Question 163

A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?

Options:

A.

Access of system logs to authorized staff

B.

Accurate and prompt tagging of all business files

C.

Assurance of safe and clean handling of company property

D.

Adoption of environmental controls in the server room

Question 164

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 165

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Page: 1 / 55
Total 552 questions