Winter Sale - Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpt65

CPIM-8.0 Questions and Answers

Question # 6

A warehouse manager assigns orders to warehouse personnel grouped by where the goods are stored. This type of picking is called a(n):

A.

Zone system

B.

Area system

C.

Multi-order system

D.

Pull system

Full Access
Question # 7

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

Full Access
Question # 8

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Full Access
Question # 9

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Full Access
Question # 10

The question below is based on the following information:

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?

A.

50

B.

150

C.

1.250

D.

3.750

Full Access
Question # 11

Reducing distribution network inventory days of supply will have which of the following Impacts?

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Full Access
Question # 12

Which of the following is the BEST type of fire extinguisher for a data center environment?

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Full Access
Question # 13

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Full Access
Question # 14

Which of the following statements is true about the meantime between failures (MTBF) measure?

A.

It is used for non-repairable products.

B.

An increase in MTBF is proportional to anincrease inquality.

C.

It is a useful measure of reliability.

D.

It is the same as operating life or service life.

Full Access
Question # 15

An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?

A.

Implement Attribute-Based Access Control (ABAC) process for sensitive applications.

B.

Determine authoritative identity sources.

C.

Understand connectivity to target applications.

D.

Implement Role-Based Access Control (RBAC) process for web-based applications.

Full Access
Question # 16

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Full Access
Question # 17

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

Full Access
Question # 18

Which if the following is the FIRST control step in provisioning user rights and privileges?

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Full Access
Question # 19

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

A.

Organization's security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Full Access
Question # 20

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Full Access
Question # 21

Which of the following statements about demonstrated capacity Is true?

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Full Access
Question # 22

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Full Access
Question # 23

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Full Access
Question # 24

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Full Access
Question # 25

The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?

A.

Deploy the solution to a network terminal access point port.

B.

Deploy the solution and connect it to a Switched Port Analyzer (SPAN) port.

C.

Deploy the solution in line with the traffic flows.

D.

Deploy the solution on a separate Virtual Local Area Network (VLAN).

Full Access
Question # 26

An organization is migrating some of its applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the accuracy of the reports showing which application should be migrated and how many applications reside on each server. As a result, the CISO is looking to establish asset management requirements. Which of these elements should be considered part of asset management requirements?

A.

Threat modelling and discovery

B.

Configuration Management (CM) database

C.

Risk management framework

D.

Integration testing program

Full Access
Question # 27

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Full Access
Question # 28

A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):

A.

Assemble-to-order (ATO) environment

B.

Make-to-stock (MTS) environment

C.

Pull system

D.

Push system

Full Access
Question # 29

Health information stored in paper form may be destroyed using which of the following methods?

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Full Access
Question # 30

The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

A.

product manager to increase the selling price of the product.

B.

quality manager to add a new quality measurement to the operation.

C.

production supervisor to review and explain the overage.

D.

the engineering manager to evaluate the run time for the routing.

Full Access
Question # 31

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

A.

One of the requests does not have a valid token issuer's identifier.

B.

The requests have the same 'auth_time' parameter.

C.

The requests have the same 'nonce' parameter.

D.

One of the requests does not have a valid audience token.

Full Access
Question # 32

Which of the following should be performed FIRST in the course of a digital forensics investigation?

A.

Undelete files and investigate their content.

B.

Search through unallocated space.

C.

Shut down the system.

D.

Identify any data that needs to be obtained.

Full Access
Question # 33

A distribution requirements planning (DRP) system has which of the following characteristics?

A.

It treats items in distribution centers (DCs) as dependent demand.

B.

It facilitates the use of pull systems.

C.

It uses standard material requirements planning (MRP) logic.

D.

It uses statistical order point techniques to plan inventory replenishment.

Full Access
Question # 34

Which of the below represents the GREATEST cloud-specific policy and organizational risk?

A.

Supply chain failure

B.

Loss of business reputation due to co-tenant activities

C.

Loss of governance between the client and cloud provider

D.

Cloud service termination or failure

Full Access
Question # 35

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Full Access
Question # 36

Moving average forecasting methods are best when demand shows:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Full Access
Question # 37

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Full Access
Question # 38

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Full Access
Question # 39

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Full Access
Question # 40

Which of the following outcomes Is a benefit of mixed-model scheduling?

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Full Access
Question # 41

Which of the following BEST describes an individual modifying something the individual is not supposed to?

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Full Access
Question # 42

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

A.

The clouds service provider is responsible for all security within the workload

B.

Security testing is managed after image creation

C.

No longer have to bring system down to patch

D.

Allows a user to enable remote logins to running workloads

Full Access
Question # 43

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Full Access
Question # 44

An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?

A.

Spoofing

B.

Spear phishing

C.

Piggybacking

D.

Insider threat

Full Access
Question # 45

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Full Access
Question # 46

A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?

A.

Multi-Factor Authentication (MFA)

B.

Cybersecurity training

C.

Password management software

D.

Role-Based Access Control (RBAC)

Full Access
Question # 47

A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?

A.

Quality Assurance (QA) testing

B.

Integration technique

C.

User Acceptance Testing

D.

Fuzzing technique

Full Access
Question # 48

Which is the MOST valid statement around the relationship of security and privacy?

A.

A system designed with security provides individuals with data privacy by default.

B.

Nonrepudiation protects against unauthorized disclosure of private data.

C.

Privacy in the realm of physical security often entails trade-offs with security.

D.

Privacy and security are mutually exclusive.

Full Access
Question # 49

Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?

A.

Improved threat detection

B.

Flexible firewall configuration

C.

Network availability

D.

Improved threat prevention

Full Access
Question # 50

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Full Access
Question # 51

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Full Access
Question # 52

A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?

A.

Establish a device recycle process.

B.

Establish a process preventing credential storage on devices.

C.

Establish a physical destruction process for the storage medium.

D.

Establish a process for check in and check out of devices.

Full Access
Question # 53

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Full Access
Question # 54

In an organization that develops aircrafts for military usage, where will the security team focus its efforts to ensure the organization’s data remains confidential?

A.

Technology to monitor the use and transfer of sensitive data

B.

User awareness training

C.

De-identification and sanitization of sensitive data

D.

Data breach insurance

Full Access
Question # 55

In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?

A.

Software As A Service (SaaS).

B.

Platform As A Service (PaaS).

C.

Desktop As A Service (DaaS).

D.

Infrastructure As A Service (IaaS).

Full Access
Question # 56

What are the FIRST two steps an organization should conduct to classify its assets?

A.

Define user requirements and collate existing inventories

B.

Categorize assets and set minimum security controls

C.

Conduct an inventory of assets and determine the owners

D.

Obtain senior management buy-in and conduct a risk assessment

Full Access
Question # 57

Based on the above table, calculate the mean absolute deviation (MAD).

A.

-25

B.

6.25

C.

18.75

D.

20

Full Access
Question # 58

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Full Access
Question # 59

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Full Access
Question # 60

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Full Access
Question # 61

A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?

A.

Annualized loss reduction measured over time

B.

Assessment of magnitude based on risk analyses

C.

Added economic value

D.

Total cost of ownership

Full Access
Question # 62

Which of the following BEST defines whether an organization can consider an alternate location during a contingency?

A.

Verify the availability of an office location for the given size of the team

B.

Verify that there is a contractual obligation for location-providing services

C.

Verify the availability of cheap resources in the new location

D.

Verify that a memorandum of understanding (MOU) is in place for office equipment

Full Access
Question # 63

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Full Access
Question # 64

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Full Access
Question # 65

Which of the following should Business Impact Analysis (BIA) reports always include?

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Full Access
Question # 66

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Full Access
Question # 67

What is the FIRST element that must be evaluated in a security governance program?

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Full Access
Question # 68

What BEST describes the end goal of a Disaster Recovery (DR) program?

A.

Review the status of mission-critical applications.

B.

Prevent business interruption.

C.

Continue business operations during a contingency.

D.

Restore normal business operations.

Full Access
Question # 69

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Full Access
Question # 70

An external audit is conducted on an organization's cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?

A.

Resource forecast

B.

Asset inventory

C.

Access to logs

D.

Software license agreements

Full Access
Question # 71

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Full Access
Question # 72

Network Access Control (NAC) is used to perform what function for computers joining the network?

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Full Access
Question # 73

Given the following data, calculate the appropriate takt time:

A.

0.25 minutes

B.

1 minute

C.

2 minutes

D.

4 minutes

Full Access
Question # 74

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Full Access
Question # 75

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Full Access
Question # 76

Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?

A.

Accuracy of Key Risk Indicators (KRI) reported to senior management

B.

Ensure the integrity of the organization's assets

C.

Backups being completed in a timely manner

D.

Accuracy of Key Performance Indicators (KPI) reported to senior management

Full Access
Question # 77

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Full Access
Question # 78

An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?

A.

Proxy manipulation and Man-in-the-Middle (MITM) attack

B.

Media Access Control (MAC) spoofing and proxy manipulation

C.

Rogue access point and Man-in-the-Middle (MITM) attack

D.

Media Access Control (MAC) spoofing and rogue access point

Full Access
Question # 79

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Full Access
Question # 80

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Full Access
Question # 81

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Full Access
Question # 82

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Full Access
Question # 83

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Full Access
Question # 84

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Full Access
Question # 85

Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?

A.

Supply disruptions

B.

Forecast inaccuracy

C.

Procurement problems

D.

Loss of intellectual property

Full Access
Question # 86

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Full Access
Question # 87

An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?

A.

Dictionary

B.

Hybrid

C.

Inference

D.

Rainbow table

Full Access
Question # 88

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Full Access
Question # 89

Which of the following production activity control (PAC) techniques focuses on optimizing output?

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Full Access
Question # 90

Which of the following capacity planning methods uses the master production schedule (MPS) as its primary input?

A.

Resource planning

B.

Rough-cut capacity planning (RCCP)

C.

Finite loading

D.

Input/output analysis

Full Access
Question # 91

Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?

A.

History shows that the quality level has been stable from lot to lot.

B.

The company uses one of its qualified suppliers.

C.

Downstream operators encounter recurring defects.

D.

The percent of defects is expected to be greater than 5%.

Full Access
Question # 92

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Full Access
Question # 93

When designing a production cell, which of the following items would be the most important consideration?

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Full Access
Question # 94

Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?

A.

Authentication Header (AH)

B.

Generic Routing Encapsulation (GRE)

C.

Encapsulation Security Payload

D.

Internet Key Exchange (IKE)

Full Access
Question # 95

The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?

A.

Modified base metrics

B.

Remediation level

C.

Integrity requirements

D.

Attack complexity

Full Access
Question # 96

Improvements in an Input/output control (I/O control) system will most likely lead to:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Full Access
Question # 97

An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?

A.

Forensic audit

B.

Third-party audit

C.

Location audit

D.

Internal audit

Full Access
Question # 98

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Full Access
Question # 99

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Full Access
Question # 100

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Full Access
Question # 101

A reduction In purchased lot sizes will reduce which of the following items?

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Full Access
Question # 102

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Full Access
Question # 103

An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Full Access
Question # 104

A life cycle assessment (LCA) would be used to determine:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Full Access
Question # 105

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Full Access
Question # 106

A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?

A.

Use prepared statements with parameterized queries

B.

Do allow or use Structured Query Language (SQL) within GET methods.

C.

Use substitution variables for all Structure Query Language (SQL) statements.

D.

Do not allow quote characters to be entered.

Full Access
Question # 107

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Full Access
Question # 108

Which of the following procedures should be defined when establishing information and asset handling requirements?

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Full Access
Question # 109

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Full Access
Question # 110

Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

A.

Excessive privileges

B.

Need to know access

C.

Training access

D.

Least access principle

Full Access
Question # 111

Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?

A.

Have administrators sign appropriate access agreements.

B.

Define the Acceptable Use Policy (AUP) for administrators.

C.

Have administrators accept a Non-Disclosure Agreement.

D.

Perform extensive background checks on administrators.

Full Access
Question # 112

Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?

A.

Offsite backup

B.

High availability

C.

Diverse routing

D.

System mirroring

Full Access
Question # 113

In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?

A.

Stockroom inventory balance will be incorrect.

B.

Operator efficiency for the fifth operation will be overstated.

C.

Units in process will be understated.

D.

Work-in-process (WIP) cost will be understated.

Full Access
Question # 114

An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.

What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?

A.

Visibility and natural disasters

B.

Visibility and locale

C.

Visibility and hazardous sites

D.

Visibility and transportation

Full Access
Question # 115

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Full Access
Question # 116

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Full Access
Question # 117

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Full Access
Question # 118

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Full Access
Question # 119

Which of the following statements characterizes a pull system In distribution management?

A.

Each warehouse makes its own replenishment decisions.

B.

It uses distribution requirements planning(DRP).

C.

It uses uniform performance measures.

D.

It uses fair-share allocation.

Full Access
Question # 120

A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?

A.

Chief Information Security Officer (CISO) of the MSP

B.

Information Technology (IT) director of the client

C.

Chief Information Security Officer (CISO) of the client organization

D.

Information Technology (IT) director of the MSP

Full Access
Question # 121

What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?

A.

Advanced Threat Protection (ATP)

B.

Address Space Layout Randomization (ASLR)

C.

Structured exception handling overwrite protection

D.

Export address table filtering

Full Access
Question # 122

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Full Access
Question # 123

Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Full Access
Question # 124

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Full Access
Question # 125

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

A.

Security

B.

Data

C.

Application

D.

Control

Full Access
Question # 126

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Full Access
Question # 127

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Full Access
Question # 128

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Full Access
Question # 129

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Full Access
Question # 130

What is the BEST preventive measure against employees abusing access privileges?

A.

Move abusers to other positions

B.

Establish a solid security awareness training program

C.

Terminate abusers

D.

Require frequent password changes

Full Access
Question # 131

If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?

A.

Symmetric cryptography

B.

Public Key Infrastructure (PKI) with asymmetric keys

C.

Password encryption using hashing (with salt and pepper)

D.

Message Authentication Code (MAC) using hashing

Full Access
Question # 132

Which of the following is an information security management framework?

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Full Access
Question # 133

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Full Access
Question # 134

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Full Access
Question # 135

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Full Access
Question # 136

The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?

A.

The user's certificate was compromised by the public key of the user.

B.

The public key of the Certificate Authority (CA) is known to attackers.

C.

The user's certificate was absent from the Certificate Revocation List (CRL).

D.

The user's certificate has expired and needs to be renewed.

Full Access
Question # 137

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S&OP) meeting.

Full Access
Question # 138

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Full Access
Question # 139

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Full Access
Question # 140

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Full Access
Question # 141

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Full Access
Question # 142

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Full Access
Question # 143

In a Discretionary Access Control (DAC) model, how is access to resources managed?

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Full Access
Question # 144

An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.

Which of the following topics will MOST likely be on the agenda?

A.

Results of the preliminary cost-benefit studies

B.

Design of the application system and database processes

C.

Communication of procedures and reporting requirements

D.

Identification of inter-application dependencies

Full Access
Question # 145

Disaster Recovery Plan (DRP) training can be considered complete when the participants

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Full Access
Question # 146

Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?

A.

Accounts receivable

B.

Inventory value

C.

Accounts payable

D.

Cost of capital

Full Access
Question # 147

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Full Access
Question # 148

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Full Access
Question # 149

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Full Access
Question # 150

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Full Access
Question # 151

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Full Access
Question # 152

The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?

A.

Remediation

B.

Administration

C.

Authorization

D.

Enumeration

Full Access
Question # 153

Which of the following situations is most likely to occur when using a push system?

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Full Access
Question # 154

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Full Access
Question # 155

A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer's pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?

A.

Cross-Site Request Forgery (CSRF)

B.

On-path attack

C.

Cross-Site Scripting (XSS)

D.

Session hijacking

Full Access
Question # 156

What is the BEST item to consider when designing security for information systems?

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Full Access
Question # 157

Which of the following MUST be checked during the validation of software verification capabilities?

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Full Access
Question # 158

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Full Access
Question # 159

While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?

A.

Add privileged user to the domain admin group.

B.

Add privileged users to the protected users group.

C.

Enable security options for each privileged user.

D.

Place each privileged user in a separate Kerberos policy.

Full Access
Question # 160

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Full Access
Question # 161

What is the HIGHEST security concern on trans-border data?

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Full Access
Question # 162

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Full Access
Question # 163

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Full Access
Question # 164

Which of the following is a disadvantage of using federated identity?

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Full Access
Question # 165

An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?

A.

Next-generation firewall

B.

Host-Based Intrusion Detection System (HIDS)

C.

Micro-segmentation

D.

Network Intrusion Detection System (NIDS)

Full Access
Question # 166

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Full Access
Question # 167

When implementing a data classification program, Which is MOST important for measuring businesss impact?

A.

Data classification program being rolled out in accordance with policies and procedures

B.

Measuring the size of the data set to understand scoping for compliance requirements

C.

The adverse effect of data leakage

D.

The early appointment of data custodians

Full Access
Question # 168

We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Full Access
Question # 169

A disadvantage of a capacity-lagging strategy may be:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Full Access
Question # 170

The question below is based on the following standard and actual data of a production order

Which of the following statements about variances is true?

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Full Access
Question # 171

A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?

A.

Ensuring compliance with international data protection and privacy laws for email communication

B.

Implementing strong encryption algorithms to ensure the confidentiality of the emails

C.

Developing a robust user authentication system to prevent unauthorized access to the software

D.

Defining clear software requirements for security and identifying potential threats and risks to the software

Full Access
Question # 172

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Full Access
Question # 173

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Full Access
Question # 174

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Full Access
Question # 175

An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?

A.

Overwriting the hard disk drive of the computers

B.

Encrypting the hard disk drive of the computers

C.

Removing and physically destroying the hard disk drive of the computers

D.

Degaussing the hard disk drive of the computers

Full Access