Pre-Summer Sale - Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70dumps

CPIM-8.0 Questions and Answers

Question # 6

Which if the following is the FIRST control step in provisioning user rights and privileges?

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Full Access
Question # 7

Material requirements planning (MRP) performance shows improvement when the total number of:

A.

Expedite messages increase.

B.

De-expedite messages increase.

C.

Due-for-release messages decrease.

D.

Action messages decrease.

Full Access
Question # 8

A reduction In purchased lot sizes will reduce which of the following items?

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Full Access
Question # 9

When implementing a data classification program, Which is MOST important for measuring businesss impact?

A.

Data classification program being rolled out in accordance with policies and procedures

B.

Measuring the size of the data set to understand scoping for compliance requirements

C.

The adverse effect of data leakage

D.

The early appointment of data custodians

Full Access
Question # 10

A production manager completes a work order for an assembly item, and inventory records for the components are decreased. This is an example of:

A.

Issuing component inventory

B.

Backflushing inventory

C.

Backward scheduling

D.

Exploding requirements

Full Access
Question # 11

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Full Access
Question # 12

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Full Access
Question # 13

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Full Access
Question # 14

During the sales and operations planning (S & OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?

A.

Identifying reasons why the demand plan is not realistic

B.

Communicating when an event will prevent meeting the supply plan

C.

Ensuring that the functional objectives are considered when developing the plans

D.

Understanding how to use the plan to improve functional performance

Full Access
Question # 15

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Full Access
Question # 16

A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?

A.

Proxy

B.

Firewall

C.

Router

D.

Switch

Full Access
Question # 17

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Full Access
Question # 18

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Full Access
Question # 19

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Full Access
Question # 20

Which of the following is the BEST type of fire extinguisher for a data center environment?

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Full Access
Question # 21

An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?

A.

Findings by host, with associated vulnerabilities

B.

Findings by vulnerabilities, with associated hosts

C.

Appendix of definitions

D.

Executive summary

Full Access
Question # 22

Which of the following should be performed FIRST in the course of a digital forensics investigation?

A.

Undelete files and investigate their content.

B.

Search through unallocated space.

C.

Shut down the system.

D.

Identify any data that needs to be obtained.

Full Access
Question # 23

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Full Access
Question # 24

An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?

A.

Open Authorization (OAuth) 2.0

B.

Security Assertion Markup Language (SAML) 2.0

C.

Password Authentication Protocol (PAP)

D.

OpenID Connect (OIDC)

Full Access
Question # 25

Health information stored in paper form may be destroyed using which of the following methods?

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Full Access
Question # 26

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S & OP) horizon for a product family that is

made to stock?

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Full Access
Question # 27

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Full Access
Question # 28

A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?

A.

Uselevel production planning and investigate subcontracting to meet the extra demand.

B.

Usechaseproduction planningand only take the orders that can be produced In the highdemand season.

C.

Usehybridproduction planningto save labor costs and inventory costs in the low demand season.

D.

Usehybridproduction planningand reduce the size of the customer base during the highdemand season.

Full Access
Question # 29

A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?

A.

An increased number of receipts and issues for subassemblies

B.

An increased number of production order feedback transactions

C.

A reduced number of production orders planned by MRP

D.

An inability to process orders for replacement drawers

Full Access
Question # 30

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Full Access
Question # 31

Risk pooling would work best for items with:

A.

low demand uncertainty and short lead times.

B.

low demand uncertainty and long lead times.

C.

high demand uncertainty and short lead times.

D.

high demand uncertainty and long lead times.

Full Access
Question # 32

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Full Access
Question # 33

In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

A.

Implement a self-service password management capability

B.

Increase system administration personnel

C.

Implement an automated provisioning tool

D.

Increase authorization workflow steps

Full Access
Question # 34

An appropriate performance measure for sales and operations planning (S & OP) would be the variance between:

A.

The forecasted and actual demand

B.

The actual and planned raw material level

C.

The demand plan and the production plan

D.

The production plan and the master production schedule (MPS)

Full Access
Question # 35

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Full Access
Question # 36

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Full Access
Question # 37

Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?

A.

Discretionary Access Control (DAC)

B.

Principle of least privilege

C.

Need to know

D.

Role-Based Access Control (RBAC)

Full Access
Question # 38

An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?

A.

Employ password masking, obfuscation, and tokenization and automate account updates based on human resources reporting.

B.

Implementing Multi-Factor Authentication (MFA) and account lookout controls.

C.

Create and enforce a strong password policy and implementing security awareness training for all users.

D.

Control physical access to the IAM system and implementing Data Loss Prevention (DPL) for credentials.

Full Access
Question # 39

A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?

A.

Annualized loss reduction measured over time

B.

Assessment of magnitude based on risk analyses

C.

Added economic value

D.

Total cost of ownership

Full Access
Question # 40

An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?

A.

Resource forecast

B.

Asset inventory

C.

Access to logs

D.

Software license agreements

Full Access
Question # 41

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Full Access
Question # 42

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S & OP) meeting.

Full Access
Question # 43

A company has the following production conditions:

    Batch size: 1,000 items

    Processing time: 4 minutes per item

    Setup time: 2 hours

    Utilization: 80%

    Efficiency: 80%

Which of the following actions would result in the work being done in the least amount of time?

A.

Reduce the processing time for each item to 3.5 minutes.

B.

Increase either utilization or efficiency to 100%.

C.

Increase both utilization and efficiency to 90%.

D.

Eliminate the need for a setup to process the batch.

Full Access
Question # 44

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Full Access
Question # 45

A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?

A.

6

B.

3

C.

2

D.

1

Full Access
Question # 46

Broadcast traffic is causing network performance degradation of sensitive equipment.

Which of the following methods is used to prevent the broadcast traffic from impacting availability?

A.

Place the sensitive equipment behind a firewall to prevent the broadcast traffic from impacting the equipment.

B.

Implement Quality of Service (QoS) on network switches to throttle the sensitive equipment traffic.

C.

Move the sensitive equipment to a different switch port to prevent the broadcast traffic from impacting the equipment.

D.

Use Network Access Control (NAC) to prevent the broadcast traffic from broadcasting.

Full Access
Question # 47

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

A.

Organization ' s security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Full Access
Question # 48

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Full Access
Question # 49

How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?

A.

The MPS is used to plan subassemblies and components; end items are only scheduled when a customer order is received.

B.

Subassemblies are scheduled in the MPS when the customer order is received, and production can start.

C.

Typically, the MPS is not used in companies using an ATO manufacturing strategy.

D.

Often In an ATO environment, the MPS is created once a year and only revised if a product is discontinued.

Full Access
Question # 50

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user ' s ability to change device settings

D.

To limit web access to only approved sites

Full Access
Question # 51

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Full Access
Question # 52

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Full Access
Question # 53

Which Internet of Things (IoT) process was developed specifically to support retail commerce?

A.

Automated storage/retrieval system (AS/RS)

B.

Electronic shelving of items

C.

Container tracking through the use of electronic tags

D.

Exchange of point-of-sale (POS) data

Full Access
Question # 54

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Full Access
Question # 55

Which of the physiological biometric scanning methods is considered the MOST invasive?

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Full Access
Question # 56

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Full Access
Question # 57

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Full Access
Question # 58

What is the FIRST element that must be evaluated in a security governance program?

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Full Access
Question # 59

What function prevents unauthorized devices from gaining access to a network?

A.

Network Access Control (NAC)

B.

Storage Area Network (SAN)

C.

Network Address Translation (NAT)

D.

Software-Defined Network (SDN)

Full Access
Question # 60

An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?

A.

Overwriting the hard disk drive of the computers

B.

Encrypting the hard disk drive of the computers

C.

Removing and physically destroying the hard disk drive of the computers

D.

Degaussing the hard disk drive of the computers

Full Access
Question # 61

We have observed the inventory system does not handle plastic parts well. " What should be added to the problem statement to make it more useful?

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Full Access
Question # 62

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Full Access
Question # 63

Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?

A.

Continuous monitoring

B.

Change Control Board (CCB) coordination

C.

Risk acceptance

D.

Root cause analysis

Full Access
Question # 64

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Full Access
Question # 65

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Full Access
Question # 66

A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?

A.

Ensuring compliance with international data protection and privacy laws for email communication

B.

Implementing strong encryption algorithms to ensure the confidentiality of the emails

C.

Developing a robust user authentication system to prevent unauthorized access to the software

D.

Defining clear software requirements for security and identifying potential threats and risks to the software

Full Access
Question # 67

Which of the following planning modules considers the shortest-range planning goals?

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Full Access
Question # 68

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Full Access
Question # 69

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Full Access
Question # 70

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Full Access
Question # 71

Which of the following tactics can be employed effectively to reduce appraisal quality costs?

A.

Investing in prevention

B.

Conducting quality audits

C.

Loosening product specifications

D.

Implementing house of quality (HOQ)

Full Access
Question # 72

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Full Access
Question # 73

One of the most useful tools for analyzing the sustainable footprint is:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Full Access
Question # 74

Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?

A.

Min-max system

B.

Fixed order quantity

C.

Periodic review

D.

Available-to-promlse (ATP)

Full Access
Question # 75

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Full Access
Question # 76

Exhibit:

Question # 76

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Full Access
Question # 77

Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?

A.

Removal is authorized directly by executive management.

B.

Removal is authorized using a formal sign-out process.

C.

Removal is authorized when remote use is required for business.

D.

Removal is authorized if the asset has been disposed of.

Full Access
Question # 78

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Full Access
Question # 79

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Full Access
Question # 80

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Full Access
Question # 81

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Full Access
Question # 82

A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?

A.

Chief Information Security Officer (CISO) of the MSP

B.

Information Technology (IT) director of the client

C.

Chief Information Security Officer (CISO) of the client organization

D.

Information Technology (IT) director of the MSP

Full Access
Question # 83

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Full Access
Question # 84

Small, independent demands for components and subassemblies typically arise from which of the following sources?

A.

Warehouse orders

B.

Repair and service requirements

C.

Original equipment manufacturers

D.

Scrap allowance

Full Access
Question # 85

The most relevant measure of customer service performance Is:

A.

service perceived by the customer against service expected by the customer.

B.

service promised to the customer against service measured by the supplier.

C.

customer complaints received as a percentage of orders shipped.

D.

positive customer feedback as a percentage of customer feedback.

Full Access
Question # 86

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Full Access
Question # 87

What is the MAIN purpose of risk and impact analysis?

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Full Access
Question # 88

The horizon for forecasts that are input to the sales and operations planning (S & OP) process should be long enough that:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Full Access
Question # 89

A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?

A.

Use prepared statements with parameterized queries

B.

Do allow or use Structured Query Language (SQL) within GET methods.

C.

Use substitution variables for all Structure Query Language (SQL) statements.

D.

Do not allow quote characters to be entered.

Full Access
Question # 90

A life cycle assessment (LCA) would be used to determine:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Full Access
Question # 91

If a work center is already loaded to full capacity, which of the following actions would be best to take before releasing a new order?

A.

Changing the date of the order

B.

Adjusting the master schedule

C.

Choosing a feasible alternate routing

D.

Releasing the order and trying to produce on time

Full Access
Question # 92

The production plan defines which of the following targets?

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Full Access
Question # 93

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Full Access
Question # 94

The security department was notified about vulnerabilities regarding users ' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Full Access
Question # 95

What is the MOST important security benefit of comprehensive asset management?

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Full Access
Question # 96

Which of the following provides for continuous improvement of the change control process?

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Full Access
Question # 97

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Full Access
Question # 98

Which of the following should Business Impact Analysis (BIA) reports always include?

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Full Access
Question # 99

The question below is based on the following alternative schedules for a lot of 1,200.

A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.

Which of the following statements is correct?

A.

Operation overlapping results in reduced total setup costs.

B.

Operation overlapping results in reduced total span time.

C.

Lot splitting results in the shortest overall lead time.

D.

Lot splitting results in reduced total setup costs.

Full Access
Question # 100

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Full Access
Question # 101

Which of the following attributes describes a company with a global strategy?

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Full Access
Question # 102

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

A.

74

B.

63

C.

61

D.

31

Full Access
Question # 103

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

A.

Review logs of all user ' s social media activity.

B.

Review the organizational social media policy.

C.

Initiate the organization ' s incident response plan.

D.

Determine a list of information assets that contain PII.

Full Access
Question # 104

The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:

A.

pipeline inventory.

B.

transportation costs.

C.

inventory turns.

D.

sales revenue.

Full Access
Question # 105

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Full Access
Question # 106

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Full Access
Question # 107

Which of the following measurements indicates there may be bias In the forecast model?

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Full Access
Question # 108

Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?

A.

Transmission Control Protocol (TCP)

B.

Voice Over Internet Protocol (VoIP)

C.

User Datagram Protocol (UDP)

D.

HyperText Transfer Protocol Secure (HTTPS)

Full Access
Question # 109

An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?

A.

Proxy manipulation and Man-in-the-Middle (MITM) attack

B.

Media Access Control (MAC) spoofing and proxy manipulation

C.

Rogue access point and Man-in-the-Middle (MITM) attack

D.

Media Access Control (MAC) spoofing and rogue access point

Full Access
Question # 110

When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

A.

The vendor provides documented safeguards in handling confidential data.

B.

The vendor provides a copy of their externally performed risk assessment.

C.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

D.

The vendor has a signed contract in place before work with data begins.

Full Access
Question # 111

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Full Access
Question # 112

What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?

A.

Advanced Threat Protection (ATP)

B.

Address Space Layout Randomization (ASLR)

C.

Structured exception handling overwrite protection

D.

Export address table filtering

Full Access
Question # 113

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Full Access
Question # 114

Which of the below represents the GREATEST cloud-specific policy and organizational risk?

A.

Supply chain failure

B.

Loss of business reputation due to co-tenant activities

C.

Loss of governance between the client and cloud provider

D.

Cloud service termination or failure

Full Access
Question # 115

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Full Access
Question # 116

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Full Access
Question # 117

Which of the following data elements is required for a manufacturing routing?

A.

Queue time

B.

Work center

C.

Order quantity

D.

Efficiency factor

Full Access
Question # 118

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Full Access
Question # 119

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Full Access
Question # 120

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Full Access
Question # 121

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Full Access
Question # 122

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Full Access
Question # 123

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Full Access
Question # 124

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Full Access
Question # 125

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Full Access
Question # 126

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Full Access
Question # 127

Why would a network administrator monitor Internet of Things (IoT) security differently than the security of standards network devices?

A.

IoT devices are not developed with cybersecurity in mind.

B.

IoT devices are unencrypted.

C.

IoT devices require Power over Ethernet.

D.

IoT devices are wireless.

Full Access
Question # 128

An organization’s computer incident responses team PRIMARY responds to which type of control?

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Full Access
Question # 129

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Full Access
Question # 130

Which of the following actions will result In lower inventory levels?

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Full Access
Question # 131

Which of the following categories of web services testing describes correctness testing of web service security functionality?

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Full Access
Question # 132

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Full Access
Question # 133

Which of the following is the MAIN element in achieving a successful security strategy?

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Full Access
Question # 134

Disaster Recovery Plan (DRP) training can be considered complete when the participants

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Full Access
Question # 135

What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?

A.

Inventory use cases, categorize threats, evaluate business impact

B.

Understand attack front, identify trust levels, decompose application

C.

Inventory countermeasures, identify threats, implement mitigations

D.

Establish monitoring, identify risks, implement countermeasures

Full Access
Question # 136

The define, measure, analyze, improve, control (DMAIC) process is an effective method to understand and improve business processes because it begins with a:

A.

Problem that is data driven.

B.

Decision about a course of action.

C.

Graphical depiction of the problem.

D.

Discussion among impacted team members.

Full Access
Question # 137

A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?

A.

Quality Assurance (QA) testing

B.

Integration technique

C.

User Acceptance Testing

D.

Fuzzing technique

Full Access
Question # 138

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization ' s resulting private network segment?

A.

A

B.

B

C.

C

D.

E

Full Access
Question # 139

In which of the following environments is capable-to-promise (CTP) more appropriate than available-to-promise (ATP)?

A.

Consumer electronics sold through local retailers

B.

Industrial supplies shipped from regional distribution centers (DCs)

C.

Packaged foods sold in grocery stores

D.

Specialty chemicals packaged and shipped to order

Full Access
Question # 140

What are the FIRST two steps an organization should conduct to classify its assets?

A.

Define user requirements and collate existing inventories

B.

Categorize assets and set minimum security controls

C.

Conduct an inventory of assets and determine the owners

D.

Obtain senior management buy-in and conduct a risk assessment

Full Access
Question # 141

A warehouse manager assigns orders to warehouse personnel grouped by where the goods are stored. This type of picking is called a(n):

A.

Zone system

B.

Area system

C.

Multi-order system

D.

Pull system

Full Access
Question # 142

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Full Access
Question # 143

Which of the following statements is true about the meantime between failures (MTBF) measure?

A.

It is used for non-repairable products.

B.

An increase in MTBF is proportional to anincrease inquality.

C.

It is a useful measure of reliability.

D.

It is the same as operating life or service life.

Full Access
Question # 144

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

A.

Suppliers of " A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Full Access
Question # 145

A bill of resources typically contains information about a product’s:

A.

Complete list of components

B.

Production schedule

C.

Inventory balances

D.

Key work centers

Full Access
Question # 146

Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?

A.

The ERP system has business processes which both companies can adopt

B.

Company A wants to save on software licensing costs

C.

Each ERP package has unique and distinctive business processes

D.

Company A wishes to close Company B ' s data center

Full Access
Question # 147

The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?

A.

Investigation

B.

Reconnaissance

C.

Fingerprinting

D.

Exploitation

Full Access
Question # 148

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Full Access
Question # 149

Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?

A.

Allowing only one person to enter at a time

B.

Auditing access logs annually

C.

Limiting access to regular business hours only

D.

Establishing entry points from public areas only

Full Access
Question # 150

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Full Access
Question # 151

Who is ultimately responsible for ensuring that specific data is protected?

A.

Custodian

B.

Data owner

C.

Data controller

D.

System owner

Full Access
Question # 152

What should an organization do to prepare for Disaster Recovery (DR) efforts?

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Full Access
Question # 153

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Full Access
Question # 154

What is the HIGHEST security concern on trans-border data?

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Full Access
Question # 155

An example of an assignable cause of variation in process performance is:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Full Access
Question # 156

At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?

A.

Layer 1

B.

Layer 2

C.

Layer 4

D.

Layer 3

Full Access
Question # 157

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Full Access
Question # 158

A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?

A.

They are proprietary and incompatible between vendors.

B.

They can be complex to configure.

C.

They do not provide any authentication or encryption protection.

D.

They are unreliable due to high protocol overhead.

Full Access
Question # 159

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Full Access
Question # 160

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Full Access
Question # 161

Which of the following MUST exist for an activity to be considered an audit?

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Full Access
Question # 162

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Full Access
Question # 163

An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?

A.

ReuseAllow

B.

History

C.

Iteration

D.

ReuseDeny

Full Access
Question # 164

Which of the following terms below BEST describes the measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces security policy?

A.

Risk tolerance

B.

Residual risk

C.

Security architecture

D.

Security assurance

Full Access
Question # 165

The question below is based on the following standard and actual data of a production order

Question # 165

Which of the following statements about variances is true?

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Full Access
Question # 166

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Full Access
Question # 167

An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.

Why is the vendor ' s penetration test considered incomplete?

A.

The vendor should have attempted to exploit the identified vulnerabilities.

B.

The vendor should also provide a guide to remediate the identified vulnerabilities.

C.

The vendor should have provided a risk report of vulnerabilities found.

D.

The vendor should have worked closely with network engineers to understand the network infrastructure better.

Full Access
Question # 168

Which of the following is typically used to control physical access to highly secure facilities?

A.

Surveillance

B.

Mantrap

C.

Dual control

D.

Door locks

Full Access
Question # 169

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Full Access
Question # 170

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Full Access
Question # 171

The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:

A.

lead times to customers decrease.

B.

transportation costs decrease.

C.

the level of required safety stock is reduced.

D.

more efficient load consolidation occurs.

Full Access
Question # 172

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Full Access
Question # 173

A low-cost provider strategy works best when which of the following conditions are met?

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Full Access
Question # 174

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Full Access
Question # 175

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Full Access
Question # 176

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Full Access
Question # 177

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Full Access
Question # 178

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Full Access
Question # 179

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Full Access
Question # 180

In times of monetary inflation, which of the following methods of inventory valuation results in the greatest cost of sales for the early years of a particular product?

A.

Moving average

B.

Last in, first out (LIFO)

C.

First in, first out (FIFO)

D.

Standard

Full Access
Question # 181

An organization’s computer incident response team PRIMARILY responds to which type of control?

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Full Access