A warehouse manager assigns orders to warehouse personnel grouped by where the goods are stored. This type of picking is called a(n):
An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).
Which of the following is the INITIAL step?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
The question below is based on the following information:
Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?
Reducing distribution network inventory days of supply will have which of the following Impacts?
Which of the following is the BEST type of fire extinguisher for a data center environment?
In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?
Which of the following statements is true about the meantime between failures (MTBF) measure?
An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?
Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?
An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?
Which if the following is the FIRST control step in provisioning user rights and privileges?
The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?
Disaster Recovery (DR) training plan outcomes should have which KEY quality?
A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?
An organization is migrating some of its applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the accuracy of the reports showing which application should be migrated and how many applications reside on each server. As a result, the CISO is looking to establish asset management requirements. Which of these elements should be considered part of asset management requirements?
Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?
A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):
Health information stored in paper form may be destroyed using which of the following methods?
The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:
An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?
Which of the following should be performed FIRST in the course of a digital forensics investigation?
A distribution requirements planning (DRP) system has which of the following characteristics?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:
What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?
During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?
An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?
Which of the following BEST describes an individual modifying something the individual is not supposed to?
Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?
Which of the below represent the GREATEST cloud-specific policy and organizational risk?
An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?
A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?
Which is the MOST valid statement around the relationship of security and privacy?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?
Which of the following sampling techniques is BEST suited for comprehensive risk assessments?
A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?
In an organization that develops aircrafts for military usage, where will the security team focus its efforts to ensure the organization’s data remains confidential?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
What are the FIRST two steps an organization should conduct to classify its assets?
When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?
A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?
Which of the following BEST defines whether an organization can consider an alternate location during a contingency?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?
Which of the following should Business Impact Analysis (BIA) reports always include?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
What is the FIRST element that must be evaluated in a security governance program?
An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?
An external audit is conducted on an organization's cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
Network Access Control (NAC) is used to perform what function for computers joining the network?
Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?
A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?
An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?
Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?
Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?
Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?
Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?
A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?
Which of the following production activity control (PAC) techniques focuses on optimizing output?
Which of the following capacity planning methods uses the master production schedule (MPS) as its primary input?
Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?
Under which of the following conditions is excess capacity most likely a good substitute for safety stock?
When designing a production cell, which of the following items would be the most important consideration?
Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?
The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?
Improvements in an Input/output control (I/O control) system will most likely lead to:
An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?
What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?
Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?
A reduction In purchased lot sizes will reduce which of the following items?
An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?
An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
Which of the following procedures should be defined when establishing information and asset handling requirements?
An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?
Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?
Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?
Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?
In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?
A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?
When a third-party needs to receive privileged information, which of the following would be the BEST to
transport the data?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
Which of the following statements characterizes a pull system In distribution management?
A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
Exhibit:
A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?
An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?
A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?
A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:
What is the BEST preventive measure against employees abusing access privileges?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?
An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?
What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?
The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?
A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?
If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?
A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?
A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?
Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
In a Discretionary Access Control (DAC) model, how is access to resources managed?
An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.
Which of the following topics will MOST likely be on the agenda?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
Which of the following is the BEST way to identify the various types of software installed on an endpoint?
Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?
Which of the following situations is most likely to occur when using a push system?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer's pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?
What is the BEST item to consider when designing security for information systems?
Which of the following MUST be checked during the validation of software verification capabilities?
Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?
An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?
An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?
Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?
The question below is based on the following standard and actual data of a production order
Which of the following statements about variances is true?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:
An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?