Summer Sale - Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpt65

CPIM-8.0 Questions and Answers

Question # 6

An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?

A.

Overwriting the hard disk drive of the computers

B.

Encrypting the hard disk drive of the computers

C.

Removing and physically destroying the hard disk drive of the computers

D.

Degaussing the hard disk drive of the computers

Full Access
Question # 7

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Full Access
Question # 8

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Full Access
Question # 9

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Full Access
Question # 10

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Full Access
Question # 11

Which compensating control is the MOST effective to prevent fraud within an organization?

A.

Principle of least privilege

B.

Log monitoring

C.

Separation of privilege

D.

Pre-employment background checks

Full Access
Question # 12

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Full Access
Question # 13

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Full Access
Question # 14

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Full Access
Question # 15

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

A.

74

B.

63

C.

61

D.

31

Full Access
Question # 16

An independent risk assessment determined that a hospital's existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Full Access
Question # 17

When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?

A.

Opening of previously closed ports

B.

Adding administrator rights on servers

C.

Performing a Cross-Site Scripting (XSS) attack

D.

Creating a Denial-Of-Service (DoS) condition

Full Access
Question # 18

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization's BEST next step?

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Full Access
Question # 19

An example of a cradle-to-cradle sustainability model would be:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Full Access
Question # 20

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

A.

Design

B.

Requirements

C.

Maintenance

D.

Testing

Full Access
Question # 21

Which of the following is the BEST reason to conduct a penetration test?

A.

To verify compliance with organizational patching policies.

B.

To document that all relevant patches have been installed.

C.

To identify technical vulnerabilities.

D.

To determine if weaknesses can be exploited.

Full Access
Question # 22

Which of the following provides for continuous improvement of the change control process?

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Full Access
Question # 23

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Full Access
Question # 24

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Full Access
Question # 25

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Full Access
Question # 26

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Full Access
Question # 27

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Full Access
Question # 28

Which of the following roles is the BEST choice for classifying sensitive data?

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Full Access
Question # 29

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Full Access
Question # 30

An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?

A.

Cease routing traffic over the Internet exchange point and use the transit provider exclusively.

B.

Ask the peers who route the traffic to sign a Non-Disclosure Agreement (NDA).

C.

Use Internet Protocol Security (IPsec) between the border gateways at either site.

D.

Nothing needs to be done because applications are already required to encrypt and authenticate network traffic.

Full Access
Question # 31

What is the HIGHEST security concern on trans-border data?

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Full Access
Question # 32

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

A.

Review logs of all user's social media activity.

B.

Review the organizational social media policy.

C.

Initiate the organization's incident response plan.

D.

Determine a list of information assets that contain PII.

Full Access
Question # 33

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Full Access
Question # 34

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Full Access
Question # 35

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Full Access
Question # 36

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Full Access
Question # 37

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Full Access
Question # 38

Database security includes which of the following requirements?

A.

Physical database integrity, logical database integrity, and ownership integrity

B.

Availability, auditability, and screening

C.

Physical database integrity, logical database integrity, and element integrity

D.

User authentication, availability, and accountability

Full Access
Question # 39

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Full Access
Question # 40

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Full Access
Question # 41

The primary purpose for engaging in cycle count activities is to:

A.

eliminate the need for a traditional physical inventory count.

B.

more frequently reconcile the actual on-hand and system on-hand for items.

C.

smooth out the tasks of counting inventory throughout the fiscal year.

D.

improve material handling processes and reduce or eliminate errors.

Full Access
Question # 42

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Full Access
Question # 43

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

A.

Between the policy engine and the trust engine, because it enforces security policies

B.

As close to the workload as possible, because it impacts authorization decisions

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the data stores and the trust engine, because it improves security policies

Full Access
Question # 44

Maintaining software asset security is MOST dependent on what information?

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Full Access
Question # 45

The production plan defines which of the following targets?

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Full Access
Question # 46

Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Full Access
Question # 47

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Full Access
Question # 48

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Full Access
Question # 49

Which of the following MUST be checked during the validation of software verification capabilities?

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Full Access
Question # 50

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Full Access
Question # 51

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

A.

To prevent the users from performing unauthorized actions during the testing or operational phases

B.

To ensure complexity introduced by security design is addressed in the beginning stages

C.

To reduce the overall cost of incorporating security in a system

D.

To prevent the system from being tampered with in the future

Full Access
Question # 52

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Full Access
Question # 53

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Full Access
Question # 54

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Full Access
Question # 55

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Full Access
Question # 56

A life cycle assessment (LCA) would be used to determine:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Full Access
Question # 57

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Full Access
Question # 58

Moving average forecasting methods are best when demand shows:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Full Access
Question # 59

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Full Access
Question # 60

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Full Access
Question # 61

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Full Access
Question # 62

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Full Access
Question # 63

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

A.

Organization's security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Full Access
Question # 64

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Full Access
Question # 65

If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?

A.

Symmetric cryptography

B.

Public Key Infrastructure (PKI) with asymmetric keys

C.

Password encryption using hashing (with salt and pepper)

D.

Message Authentication Code (MAC) using hashing

Full Access
Question # 66

The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:

A.

a supply chain community.

B.

interplant demand.

C.

a bill of distribution.

D.

logistics data interchange (LDI).

Full Access
Question # 67

An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?

A.

Employ password masking, obfuscation, and tokenization and automate account updates based on human resources reporting.

B.

Implementing Multi-Factor Authentication (MFA) and account lookout controls.

C.

Create and enforce a strong password policy and implementing security awareness training for all users.

D.

Control physical access to the IAM system and implementing Data Loss Prevention (DPL) for credentials.

Full Access
Question # 68

How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?

A.

The MPS is used to plan subassemblies and components; end items are only scheduled when a customer order is received.

B.

Subassemblies are scheduled in the MPS when the customer order is received, and production can start.

C.

Typically, the MPS is not used in companies using an ATO manufacturing strategy.

D.

Often In an ATO environment, the MPS is created once a year and only revised if a product is discontinued.

Full Access
Question # 69

An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?

A.

Publish and enforce enterprise policies that assign risk decisions to corporate officers.

B.

Publish and enforce enterprise policies that assign risk decisions to cybersecurity analysts.

C.

Publish and enforce enterprise policies that assign risk decisions to business unit managers.

D.

Publish and enforce enterprise policies that assign risk decisions to system administrators.

Full Access
Question # 70

Which of the following BEST describes the purpose of black hat testing during an assessment?

A.

Assess systems without the knowledge of end-users.

B.

Focus on identifying vulnerabilities.

C.

Examine the damage or impact an adversary can cause.

D.

Determine the risk associated with unknown vulnerabilities.

Full Access
Question # 71

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Full Access
Question # 72

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Full Access
Question # 73

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Full Access
Question # 74

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Full Access
Question # 75

Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?

A.

Definition of anti-spam policies

B.

Removal of previous email servers

C.

Definition of key management policies

D.

Backup of email messages and folders

Full Access
Question # 76

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Full Access
Question # 77

Which of the following statements about demonstrated capacity Is true?

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Full Access
Question # 78

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

A.

Role-based

B.

Automated

C.

Rule-based

D.

Mandatory

Full Access
Question # 79

What is the MOST beneficial principle of threat modeling?

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Full Access
Question # 80

A disadvantage of a capacity-lagging strategy may be:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Full Access
Question # 81

An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?

A.

Conduct an integrated audit against the most stringent security controls.

B.

Combine the systems into a single audit and implement security controls per applicable standard.

C.

Combine the systems into a single audit against all of the associated security controls.

D.

Audit each system individually and implement the applicable standard specific security controls.

Full Access
Question # 82

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

A.

80

B.

120

C.

160

D.

200

Full Access
Question # 83

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Full Access
Question # 84

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Full Access
Question # 85

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Full Access
Question # 86

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

A.

Signed assertion

B.

Federation authorities access list

C.

Manual registration

D.

Proxied federation

Full Access
Question # 87

Which of the following are steps involved in the identity and access provisioning lifecycle?

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Full Access
Question # 88

A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

A.

Tandem testing

B.

Blind testing

C.

Double-gray testing

D.

Double-blind testing

Full Access
Question # 89

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Full Access
Question # 90

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Full Access
Question # 91

A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?

A.

Authorization controls

B.

Two-Factor Authentication (2FA)

C.

Non-repudiation controls

D.

Access audit

Full Access
Question # 92

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Full Access
Question # 93

Which of the following outcomes Is a benefit of mixed-model scheduling?

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Full Access
Question # 94

During an onsite audit, an assessor inspected an organization’s asset decommission practice. Which of the following would MOST likely be a finding from a security point of view?

A.

Solid State Drives (SSD) were degaussed along with hard drives.

B.

The Non-Disclosure Agreement (NDA) between the organization and its data disposal service was more than 3 years old.

C.

Hard drives from older assets replaced defective hard drives from current assets of similar classification levels.

D.

Data classifications were not clearly identified.

Full Access
Question # 95

An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?

A.

Next-generation firewall

B.

Host-Based Intrusion Detection System (HIDS)

C.

Micro-segmentation

D.

Network Intrusion Detection System (NIDS)

Full Access
Question # 96

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Full Access
Question # 97

A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

A.

Determine the acceptable level of loss exposure at which the organization is comfortable operating.

B.

Conduct a gap assessment and produce a risk rating report for the executive leadership.

C.

Engage consultants to audit the organization against best practices and provide a risk report.

D.

Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.

Full Access
Question # 98

Which if the following is the FIRST control step in provisioning user rights and privileges?

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Full Access
Question # 99

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Full Access
Question # 100

Health information stored in paper form may be destroyed using which of the following methods?

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Full Access
Question # 101

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Full Access
Question # 102

An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

A.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

B.

National Institute Of Standards And Technology (NIST) and International Organization For Standardization (ISO) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

Full Access
Question # 103

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Full Access
Question # 104

The production plan relates to a firm's financial planning because it is used to:

A.

calculate standard product costs.

B.

determine variable costs.

C.

project payroll costs.

D.

identify future cash needs.

Full Access
Question # 105

Privacy requirements across national boundaries MOST often require protection of which data types?

A.

Contact information for elected officials and local and national government web content

B.

Contact information related to minors, medical records, and Personally Identifiable Information (PII)

C.

Contact information for board members, proprietary trade secrets, and income statements

D.

Contact information related to medical doctors, Protected Health Information (PHI), and Personally Identifiable Information (PII)

Full Access
Question # 106

What activity is a useful element in the change process?

A.

Creating short-term wins

B.

Calculating a break-even point

C.

Performing a SWOT analysis

D.

Developing key performance indicators (KPIs)

Full Access
Question # 107

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Full Access
Question # 108

Forecast error typically triggers forecast revision when it is:

A.

used in computing the tracking signal.

B.

associated with the Introduction stage of the product life cycle.

C.

continually increasing.

D.

caused by random variation.

Full Access
Question # 109

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Full Access
Question # 110

An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?

A.

Physical access control

B.

Natural disaster insurance

C.

Natural surveillance

D.

Territorial reinforcement

Full Access
Question # 111

An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?

A.

End of Life (EOL)

B.

End of Maintenance

C.

End of Service Life (EOSL)

D.

End of Repair

Full Access
Question # 112

Which of the following should Business Impact Analysis (BIA) reports always include?

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Full Access
Question # 113

One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

Full Access
Question # 114

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Full Access
Question # 115

What does the Role-Based Access Control (RBAC) method define?

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

Full Access
Question # 116

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Full Access
Question # 117

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?

A.

A

B.

B

C.

C

D.

E

Full Access
Question # 118

Which of the following is the MAIN element in achieving a successful security strategy?

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Full Access
Question # 119

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization's resulting private network segment?

A.

A

B.

B

C.

C

D.

E

Full Access
Question # 120

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Full Access
Question # 121

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Full Access
Question # 122

In preparing for a facility location decision, proximity to suppliers would be classified as which kind of criteria?

A.

Service level requirements

B.

Future flexibility factors

C.

Access to transportation

D.

Cost factors

Full Access
Question # 123

A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?

A.

ZigBee

B.

Radio-Frequency Identification (RFID)

C.

Long-Term Evolution (LTE)

D.

Bluetooth

Full Access
Question # 124

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Full Access
Question # 125

Which of the physiological biometric scanning methods is considered the MOST invasive?

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Full Access
Question # 126

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

A.

As close to the workload as possible, because it impacts authorization decisions

B.

Between the data stores and the trust engine, because it improves security policies

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the policy engine and the trust engine, because it enforces security policies

Full Access
Question # 127

An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?

A.

TPM will use the Operating System (OS) for full disk encryption key protection.

B.

TPM will protect the full disk encryption keys.

C.

TPM will handle the allocation of the hardware storage drives for full disk encryption.

D.

TPM will provide full disk encryption automatically.

Full Access
Question # 128

Which of the following planning modules considers the shortest-range planning goals?

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Full Access
Question # 129

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Full Access
Question # 130

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Full Access
Question # 131

The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?

A.

Remediation

B.

Administration

C.

Authorization

D.

Enumeration

Full Access
Question # 132

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user's ability to change device settings

D.

To limit web access to only approved sites

Full Access
Question # 133

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Full Access
Question # 134

During the initiation phase of a project to acquire a customer relation management system, what is the FIRST step a project team will take for early integration of security?

A.

Develop a list of security requirements for the system.

B.

Conduct project planning and a feasibility assessment.

C.

Define system security classifications.

D.

Review relevant regulatory practices and standards.

Full Access
Question # 135

A healthcare organization’s new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity, or availability of the application and data?

A.

Attack

B.

Breach

C.

Failure

D.

Incident

Full Access
Question # 136

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Full Access
Question # 137

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Full Access
Question # 138

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Full Access
Question # 139

When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

A.

any request for shipment prior to the planning time fence.

B.

any request for shipment prior to the demand time fence (DTF).

C.

requests only for shipment before the next master production schedule (MPS) receipt.

D.

requests only for shipment in the period of the receipt.

Full Access
Question # 140

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Full Access
Question # 141

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Full Access
Question # 142

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Full Access
Question # 143

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Full Access
Question # 144

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Full Access
Question # 145

Which of the following is a system architecture in a data protection strategy?

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Full Access
Question # 146

Which of the following BEST describes the responsibility of an information System Security Officer?

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Full Access
Question # 147

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Full Access
Question # 148

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Full Access
Question # 149

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Full Access
Question # 150

In a Discretionary Access Control (DAC) model, how is access to resources managed?

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Full Access
Question # 151

How would blockchain technology support requirements for sharing audit information among a community of organizations?

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Full Access
Question # 152

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

A.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

B.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

C.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

D.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

Full Access
Question # 153

Long lead-time items with stable demand would best be supported by a supply chain:

A.

using a pull system.

B.

linked through an enterprise resources planning (ERP) system.

C.

designed to be responsive.

D.

positioning inventory close to the consumer.

Full Access
Question # 154

A health care organization’s new cloud-based customer-facing application is constantly receiving security events from dubious sources.

What BEST describes a security event that compromises the confidentiality, integrity, or availability of the application and data?

A.

Attack

B.

Breach

C.

Failure

D.

Incident

Full Access
Question # 155

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Full Access
Question # 156

A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

A.

Web application unit test

B.

Online application development test

C.

Web application penetration test

D.

Online application assurance test

Full Access
Question # 157

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Full Access
Question # 158

Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?

A.

Switched Port Analyzer (SPAN)

B.

Representational State Transfer (REST)

C.

Remote Desktop Protocol (RDP)

D.

Virtual Private Network (VPN)

Full Access
Question # 159

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

A.

Federation authorities access list

B.

Manual registration

C.

Proxied federation

D.

Signed assertion

Full Access
Question # 160

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Full Access
Question # 161

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Full Access
Question # 162

Improvements in an Input/output control (I/O control) system will most likely lead to:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Full Access
Question # 163

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Full Access
Question # 164

The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:

A.

revise the rough-cut capacity plan.

B.

reschedule a related component on the shop floor.

C.

check the accuracy of the bills for the MPS items.

D.

determine if a customer order will be impacted.

Full Access
Question # 165

What is the MAIN purpose of risk and impact analysis?

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Full Access