Which if the following is the FIRST control step in provisioning user rights and privileges?
Material requirements planning (MRP) performance shows improvement when the total number of:
A reduction In purchased lot sizes will reduce which of the following items?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
A production manager completes a work order for an assembly item, and inventory records for the components are decreased. This is an example of:
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?
Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?
During the sales and operations planning (S & OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?
Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?
A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?
Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?
Which of the following is the BEST type of fire extinguisher for a data center environment?
An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?
Which of the following should be performed FIRST in the course of a digital forensics investigation?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?
Health information stored in paper form may be destroyed using which of the following methods?
Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S & OP) horizon for a product family that is
made to stock?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?
A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?
An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?
A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?
In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?
An appropriate performance measure for sales and operations planning (S & OP) would be the variance between:
A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?
An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?
Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?
An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?
A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?
An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?
A company has the following production conditions:
Batch size: 1,000 items
Processing time: 4 minutes per item
Setup time: 2 hours
Utilization: 80%
Efficiency: 80%
Which of the following actions would result in the work being done in the least amount of time?
A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?
A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?
Broadcast traffic is causing network performance degradation of sensitive equipment.
Which of the following methods is used to prevent the broadcast traffic from impacting availability?
The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?
Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?
How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?
In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
Which Internet of Things (IoT) process was developed specifically to support retail commerce?
Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?
Which of the physiological biometric scanning methods is considered the MOST invasive?
An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?
An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?
What is the FIRST element that must be evaluated in a security governance program?
What function prevents unauthorized devices from gaining access to a network?
An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?
We have observed the inventory system does not handle plastic parts well. " What should be added to the problem statement to make it more useful?
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?
A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?
Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
Which of the following planning modules considers the shortest-range planning goals?
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?
Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:
Which of the following tactics can be employed effectively to reduce appraisal quality costs?
A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?
Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?
An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?
Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?
Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?
Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
Small, independent demands for components and subassemblies typically arise from which of the following sources?
An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?
The horizon for forecasts that are input to the sales and operations planning (S & OP) process should be long enough that:
A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?
If a work center is already loaded to full capacity, which of the following actions would be best to take before releasing a new order?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
The security department was notified about vulnerabilities regarding users ' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?
What is the MOST important security benefit of comprehensive asset management?
Which of the following provides for continuous improvement of the change control process?
Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?
Which of the following should Business Impact Analysis (BIA) reports always include?
The question below is based on the following alternative schedules for a lot of 1,200.
A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.
Which of the following statements is correct?
According to best practice, at which step in the system lifecycle shall a security professional begin involvement?
Which of the following attributes describes a company with a global strategy?
The question below is based on the following information:
Beginning inventory = 43Week 1Week 2Week 3
Forecast202020
Customer orders221710
Projected on-hand
Master production schedule (MPS)80
Available-to-promise (ATP)
What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:
Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?
Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?
Which of the following measurements indicates there may be bias In the forecast model?
Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?
An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?
When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?
An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?
Which of the following data elements is required for a manufacturing routing?
A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.
Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?
MachineFixed CostVariable Cost per UnitAnnual Capacity
AS100.000$6 00800,000 units
B$200,000$5 501.000,000 units
C$250,000$5 001,200,000 units
D$1 000.000$4 501 400.000 units
What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
Which of the following benefits typically will be realized when switching from a functional to a cellular layout?
Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?
An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
Why would a network administrator monitor Internet of Things (IoT) security differently than the security of standards network devices?
An organization’s computer incident responses team PRIMARY responds to which type of control?
If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?
Which of the following categories of web services testing describes correctness testing of web service security functionality?
An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?
Which of the following is the MAIN element in achieving a successful security strategy?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?
The define, measure, analyze, improve, control (DMAIC) process is an effective method to understand and improve business processes because it begins with a:
A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?
An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization ' s resulting private network segment?
In which of the following environments is capable-to-promise (CTP) more appropriate than available-to-promise (ATP)?
What are the FIRST two steps an organization should conduct to classify its assets?
A warehouse manager assigns orders to warehouse personnel grouped by where the goods are stored. This type of picking is called a(n):
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
Which of the following statements is true about the meantime between failures (MTBF) measure?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?
The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?
An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?
Who is ultimately responsible for ensuring that specific data is protected?
What should an organization do to prepare for Disaster Recovery (DR) efforts?
Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?
An example of an assignable cause of variation in process performance is:
At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?
What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?
A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?
Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?
Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.
What BEST describes the requirement changes that are happening?
Which of the following MUST exist for an activity to be considered an audit?
One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:
An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?
Which of the following terms below BEST describes the measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces security policy?
The question below is based on the following standard and actual data of a production order

Which of the following statements about variances is true?
Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?
An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.
Why is the vendor ' s penetration test considered incomplete?
Which of the following is typically used to control physical access to highly secure facilities?
In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?
Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
An organization is migrating its access controls to a certificate-based authentication system.
What will need to be established to verify the identity of all users connecting to the network before rolling out the system?
A low-cost provider strategy works best when which of the following conditions are met?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?
In times of monetary inflation, which of the following methods of inventory valuation results in the greatest cost of sales for the early years of a particular product?
An organization’s computer incident response team PRIMARILY responds to which type of control?