An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?
In a Zero Trust (ZT) model, where should the enforcement component be placed and why?
Which of the following factors typically would distort a sales forecast that is based solely on shipment history?
When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?
Long lead-time items with stable demand would best be supported by a supply chain:
Which of the following situations is most likely to occur when using a push system?
An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?
Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
Which of the following documents is the BEST reference to describe application functionality?
Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?
A low-cost provider strategy works best when which of the following conditions are met?
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?
In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?
An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?
The question below is based on the following information:

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?
Who is ultimately responsible for ensuring that specific data is protected?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.
Why is the vendor's penetration test considered incomplete?
Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
Which of the following statements is true about the meantime between failures (MTBF) measure?
Network Access Control (NAC) is used to perform what function for computers joining the network?
An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?
Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?
A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?
When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
An organization’s computer incident responses team PRIMARY responds to which type of control?
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?
In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:
Which of the following statements is true about total productive maintenance (TPM)?
Which of the following is a methodology for threat modeling in application?
Which of the following should Business Impact Analysis (BIA) reports always include?
Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?
Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?
Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?
Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is
made to stock?
Which of the following benefits typically will be realized when switching from a functional to a cellular layout?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
Which of the following is the workflow of the identity and access provisioning lifecycle?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
What function prevents unauthorized devices from gaining access to a network?
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?
An organization provides customer call center operations for major financial service organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?
Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
In a lean environment, the batch-size decision for planning "A" items would be done by:
An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?
What should an organization do to prepare for Disaster Recovery (DR) efforts?
Based on the values reported in the table below, what is the inventory turnover?

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?
In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?
After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization's IAM solution?
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?
Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
Which of the following techniques would a group use to prioritize problems?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
Health information stored in paper form may be destroyed using which of the following methods?
Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?
Cost CategoryCost
Custom fees$125
Freight$700
Warehouse rent$200
Matenal cost$500
The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?
A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?
An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?
Privacy requirements across national boundaries MOST often require protection of which data types?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?
APerform drills on a recurring basis.
B.Harden all critical facilities.
C.Outsource to an external organization.
D.Allocate 100% of required funds.
A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?
In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
During an onsite audit, an assessor inspected an organization’s asset decommission practice. Which of the following would MOST likely be a finding from a security point of view?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
Which of the following BEST describes an individual modifying something the individual is not supposed to?
When a third-party needs to receive privileged information, which of the following would be the BEST to
transport the data?
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
A health care organization's new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?
Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?
An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?
Which of the following actions provides the BEST evidence for forensic analysis of powered-off device?
It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours. One modeler finished 5 models a day, and the other finished 1 model a day. What was the demonstrated capacity last week?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?
An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?
An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?
Which of the following actions hinders the transition from a push system to a pull system?
When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?
Which of the following planning modules considers the shortest-range planning goals?
When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?
An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?
A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?
A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?
Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?
An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?