Pre-Summer Special Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: spcl70

Practice Free CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Questions Answers With Explanation

We at Crack4sure are committed to giving students who are preparing for the APICS CPIM-8.0 Exam the most current and reliable questions . To help people study, we've made some of our Certified in Planning and Inventory Management (CPIM 8.0) exam materials available for free to everyone. You can take the Free CPIM-8.0 Practice Test as many times as you want. The answers to the practice questions are given, and each answer is explained.

Question # 6

Which of the following is an access control method that organizations can use to prevent unauthorized access?

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Question # 7

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question # 8

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Question # 9

Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?

A.

The ERP system has business processes which both companies can adopt

B.

Company A wants to save on software licensing costs

C.

Each ERP package has unique and distinctive business processes

D.

Company A wishes to close Company B ' s data center

Question # 10

An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?

A.

Findings by host, with associated vulnerabilities

B.

Findings by vulnerabilities, with associated hosts

C.

Appendix of definitions

D.

Executive summary

Question # 11

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

A.

74

B.

63

C.

61

D.

31

Question # 12

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Question # 13

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Question # 14

A house of quality (HOQ) chart aligns which pair of functions?

A.

Customer requirements with costing

B.

Engineering with operations

C.

Customer purchasing with supplier shipping

D.

Competitive analysis with product design

Question # 15

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question # 16

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Question # 17

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Question # 18

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Question # 19

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question # 20

A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?

A.

Produceto backorders

B.

Produceat a constant level

C.

Produceto the sales forecast

D.

Produceto demand

Question # 21

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Question # 22

A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?

A.

Stakeholder identification

B.

Vision statement

C.

Operational efficiency

D.

Solution boundary

Question # 23

What is the FIRST element that must be evaluated in a security governance program?

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Question # 24

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Question # 25

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Question # 26

A manufacturer uses a low-cost strategy. It recently reviewed its components and realized it is using multiple versions of one screw. Reducing the variety of screws will contribute to its cost advantage by:

A.

Reducing the number of products offered

B.

Increasing economies of scale in purchasing

C.

Allowing outsourcing of value chain activities

D.

Allowing the production plant to operate at full capacity

Question # 27

The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?

A.

Reorder point(ROP)

B.

Safety stock

C.

Inventory investment

D.

Safety factor

Question # 28

Which of the following procedures should be defined when establishing information and asset handling requirements?

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Question # 29

At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?

A.

Layer 1

B.

Layer 2

C.

Layer 4

D.

Layer 3

Question # 30

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question # 31

A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?

A.

Proxy

B.

Firewall

C.

Router

D.

Switch

Question # 32

Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?

A.

Definition of anti-spam policies

B.

Removal of previous email servers

C.

Definition of key management policies

D.

Backup of email messages and folders

Question # 33

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Question # 34

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question # 35

Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?

A.

Boundary condition

B.

Buffer overflow

C.

Race condition

D.

Integer overflow

Question # 36

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization ' s BEST next step?

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Question # 37

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Question # 38

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Question # 39

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

A.

Suppliers of " A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question # 40

An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.

Which of the following will BEST help remediate this issue?

A.

Provide access restrictions for resources stored in a low-volume network or subnetwork location.

B.

Provide access restrictions for resources stored on a network that uses a unique platform.

C.

Provide access restrictions for resources stored in a high-volume network or subnetwork location.

D.

Provide access restrictions for resources stored on a network or on a subnetwork.

Question # 41

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Question # 42

Which of the following capabilities BEST distinguishes a Next-Generation Firewall (NGFW) from a traditional firewall?

A.

Ensures incoming and outgoing packets are inspected before they are allowed to pass through

B.

Offers features such as integrated intrusion prevention or application awareness and control

C.

Provides security when users traverse public networks such as the Internet

D.

Provides stateless and stateful inspection of incoming and outgoing network traffic

Question # 43

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Question # 44

A software organization is getting ready to launch a new application. A security engineer notices the application allows unrestricted access to files on the web server. Which of the following recommendations will BEST resolve this security issue?

A.

Eliminate all calls for file access requests.

B.

Eliminate illegitimate calls for file access requests.

C.

Whitelist files and folders for file access requests.

D.

Blacklist files and folders for file access requests.

Question # 45

Elements calculated in the master scheduling process include:

A.

Time fences

B.

Allocations

C.

Service-parts forecast

D.

Available-to-promise (ATP)

Question # 46

When developing information security policies, What is the PRIMARY concern?

A.

Alignment with business requirements

B.

Compliance with legal requirements

C.

Alignment with regulatory requirements

D.

Compliance with international standards

Question # 47

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Question # 48

Which of the following is the BEST type of fire extinguisher for a data center environment?

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Question # 49

Network Access Control (NAC) is used to perform what function for computers joining the network?

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Question # 50

Which of the following is a methodology for threat modeling in application?

A.

Disaster, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE)

C.

Pretend, Allow, Crash, Modify, Ascertain, Name

D.

Confidentiality, Authentication, Integrity, Nonrepudiation, Availability

Question # 51

Which of the physiological biometric scanning methods is considered the MOST invasive?

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Question # 52

A low-cost provider strategy works best when which of the following conditions are met?

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Question # 53

What is the BEST preventive measure against employees abusing access privileges?

A.

Move abusers to other positions

B.

Establish a solid security awareness training program

C.

Terminate abusers

D.

Require frequent password changes

Question # 54

Asymmetric cryptography uses which type of key to encrypt data?

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Question # 55

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

A.

To prevent the users from performing unauthorized actions during the testing or operational phases

B.

To ensure complexity introduced by security design is addressed in the beginning stages

C.

To reduce the overall cost of incorporating security in a system

D.

To prevent the system from being tampered with in the future

Question # 56

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question # 57

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Question # 58

When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?

A.

Using someone else ' s account

B.

Distributed Denial-Of-Service (DDoS)

C.

SQL Injection (SQLi)

D.

Modifying a file

Question # 59

Which is the MOST valid statement around the relationship of security and privacy?

A.

A system designed with security provides individuals with data privacy by default.

B.

Nonrepudiation protects against unauthorized disclosure of private data.

C.

Privacy in the realm of physical security often entails trade-offs with security.

D.

Privacy and security are mutually exclusive.

Question # 60

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Question # 61

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

A.

Interview the candidates ' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates ' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question # 62

Which of the following planning modules considers the shortest-range planning goals?

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question # 63

The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?

A.

Confidentiality, integrity, availability

B.

Physical security, access control, asset protection

C.

Intent, capability, opportunity

D.

Threat level, network security, information disposal

Question # 64

In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?

A.

Deduplication conserves storage.

B.

Regulatory guidance requires compliance.

C.

Digital media can degrade.

D.

Hierarchical storage facilitates access.

Question # 65

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question # 66

Privacy requirements across national boundaries MOST often require protection of which data types?

A.

Contact information for elected officials and local and national government web content

B.

Contact information related to minors, medical records, and Personally Identifiable Information (PII)

C.

Contact information for board members, proprietary trade secrets, and income statements

D.

Contact information related to medical doctors, Protected Health Information (PHI), and Personally Identifiable Information (PII)

Question # 67

The most effective way to manage demand uncertainty and improve customer service is to reduce:

A.

Backlogs

B.

Lead times

C.

Safety stock

D.

Product options

Question # 68

Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?

A.

Cameras in the trading room

B.

Two-Factor Authentication (2FA)

C.

Separation of Duties (SoD)

D.

Least privilege

Question # 69

A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?

A.

They are proprietary and incompatible between vendors.

B.

They can be complex to configure.

C.

They do not provide any authentication or encryption protection.

D.

They are unreliable due to high protocol overhead.

Question # 70

A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?

A.

Operating System (OS) virtualization

B.

Memory protection

C.

Cryptographic module

D.

Trusted Platform Module (TPM)

Question # 71

Which of the following measurements indicates there may be bias In the forecast model?

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Question # 72

An information security professional is enhancing the organization ' s existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?

A.

In a secure room inside the office

B.

Beside the copy machine

C.

Outside the office

D.

In the human resources area

Question # 73

Improvements in an Input/output control (I/O control) system will most likely lead to:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Question # 74

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question # 75

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question # 76

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Question # 77

An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?

A.

Internal audit manager

B.

Information Security Manager (ISM)

C.

Data custodian

D.

Data owner

Question # 78

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Question # 79

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Question # 80

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Question # 81

An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?

A.

Conduct an integrated audit against the most stringent security controls.

B.

Combine the systems into a single audit and implement security controls per applicable standard.

C.

Combine the systems into a single audit against all of the associated security controls.

D.

Audit each system individually and implement the applicable standard specific security controls.

Question # 82

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Question # 83

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm ' s balance sheet?

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Question # 84

Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?

A.

Have administrators sign appropriate access agreements.

B.

Define the Acceptable Use Policy (AUP) for administrators.

C.

Have administrators accept a Non-Disclosure Agreement.

D.

Perform extensive background checks on administrators.

Question # 85

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Question # 86

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Question # 87

Labor3 people

Work hours10 hours per day

Days4 days per week

Meetings with work area employees1/2 hour per day

Work area efficiency85%

Given the information above, what is the weekly theoretical capacity of this work area in hours?

A.

97

B.

102

C.

114

D.

120

Question # 88

Database security includes which of the following requirements?

A.

Physical database integrity, logical database integrity, and ownership integrity

B.

Availability, auditability, and screening

C.

Physical database integrity, logical database integrity, and element integrity

D.

User authentication, availability, and accountability

Question # 89

The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?

A.

Having a public-facing website with Hypertext Markup Language (HTML) encoding enabled.

B.

Exposure of data stored in cloud repositories.

C.

Username and password are sent using a POST in plain text.

D.

Unsecured data storage elements or storage containers.

Question # 90

When implementing a data classification program, Which is MOST important for measuring businesss impact?

A.

Data classification program being rolled out in accordance with policies and procedures

B.

Measuring the size of the data set to understand scoping for compliance requirements

C.

The adverse effect of data leakage

D.

The early appointment of data custodians

Question # 91

Which of the following is the MAIN element in achieving a successful security strategy?

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Question # 92

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Question # 93

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Question # 94

Which of the following statements is true about total productive maintenance (TPM)?

A.

It uses statistical tools.

B.

It is part of the business strategy.

C.

It influences the product design process.

D.

It minimizes unscheduled breakdowns.

Question # 95

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question # 96

An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?

A.

ReuseAllow

B.

History

C.

Iteration

D.

ReuseDeny

Question # 97

The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:

A.

a supply chain community.

B.

interplant demand.

C.

a bill of distribution.

D.

logistics data interchange (LDI).

Question # 98

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Question # 99

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question # 100

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Question # 101

A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

A.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and Domain Name Server (DNS) queries to blocked sites.

B.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and Domain Name Server (DNS) queries to blocked sites.

C.

An increase in reported changes in click percentage that aligns with a decrease in the number of phishes and incidents reported.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question # 102

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question # 103

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Question # 104

Which of the following statements characterizes a pull system In distribution management?

A.

Each warehouse makes its own replenishment decisions.

B.

It uses distribution requirements planning(DRP).

C.

It uses uniform performance measures.

D.

It uses fair-share allocation.

Question # 105

When starting an external benchmarking study, a firm must first:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition ' s.

Question # 106

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Question # 107

A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?

A.

An increased number of receipts and issues for subassemblies

B.

An increased number of production order feedback transactions

C.

A reduced number of production orders planned by MRP

D.

An inability to process orders for replacement drawers

Question # 108

Risk pooling would work best for items with:

A.

low demand uncertainty and short lead times.

B.

low demand uncertainty and long lead times.

C.

high demand uncertainty and short lead times.

D.

high demand uncertainty and long lead times.

Question # 109

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization ' s regulatory compliance policy?

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question # 110

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question # 111

Return on investment (ROI) is decreased by which of the following activities?

A.

Increasing prices

B.

Increasing sales volume

C.

Increasing cost of sales

D.

Reducing inventory levels

Question # 112

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question # 113

When considering Defense in Depth (DiD) as part of a network’s architectural design, what is the FIRST layer in a multi-layered defensive strategy?

A.

Distributed Denial-of-Service (DDoS)

B.

Managed Domain Name System (DNS)

C.

Reverse proxies

D.

Edge routers

Question # 114

Which of the following statements is true about the meantime between failures (MTBF) measure?

A.

It is used for non-repairable products.

B.

An increase in MTBF is proportional to anincrease inquality.

C.

It is a useful measure of reliability.

D.

It is the same as operating life or service life.

Question # 115

The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?

A.

The user ' s certificate was compromised by the public key of the user.

B.

The public key of the Certificate Authority (CA) is known to attackers.

C.

The user ' s certificate was absent from the Certificate Revocation List (CRL).

D.

The user ' s certificate has expired and needs to be renewed.

Question # 116

Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?

A.

History shows that the quality level has been stable from lot to lot.

B.

The company uses one of its qualified suppliers.

C.

Downstream operators encounter recurring defects.

D.

The percent of defects is expected to be greater than 5%.

Question # 117

Which of the following statements correctly describes the relationship between the strategic plan and the business plan?

A.

These are two names for the same plan.

B.

The strategic plan constrains the business plan.

C.

The two plans are developed independently.

D.

The two plans are the output of a single process.

Question # 118

An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?

A.

Endpoint security

B.

Network security

C.

Cyber physical security

D.

Cloud security

Question # 119

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Question # 120

A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?

A.

An increase in reported changes in click percentages that aligns with a decrease in the number of phishes and incidents reported.

B.

A decrease in reported suspicious activity that aligns with an increase in detection of malware and DNS queries to blocked sites.

C.

An increase in reported suspicious activity that aligns with a decrease in detection of malware and DNS queries to blocked sites.

D.

A decrease in reported changes in click percentages that aligns with an increase in the number of phishes and incidents reported.

Question # 121

Which of the following factors Is considered a carrying cost?

A.

Setup

B.

Transportation

C.

Obsolescence

D.

Scrap rate

Question # 122

A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?

A.

Use prepared statements with parameterized queries

B.

Do allow or use Structured Query Language (SQL) within GET methods.

C.

Use substitution variables for all Structure Query Language (SQL) statements.

D.

Do not allow quote characters to be entered.

Question # 123

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Question # 124

The define, measure, analyze, improve, control (DMAIC) process is an effective method to understand and improve business processes because it begins with a:

A.

Problem that is data driven.

B.

Decision about a course of action.

C.

Graphical depiction of the problem.

D.

Discussion among impacted team members.

Question # 125

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question # 126

Which of the following concepts MOST accurately refers to an organization ' s ability to fully understand the health of the data in its system at every stage of the lifecycle?

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question # 127

Which of the following describes the 3 MAIN roles of the identity-delegation model?

A.

Application server, web server, and delegate

B.

Application server, proxy server, and delegate

C.

Delegator, delegate, and service provider

D.

Delegator, application server, and service provider

Question # 128

A bill of resources typically contains information about a product’s:

A.

Complete list of components

B.

Production schedule

C.

Inventory balances

D.

Key work centers

Question # 129

Which of the following should be performed FIRST in the course of a digital forensics investigation?

A.

Undelete files and investigate their content.

B.

Search through unallocated space.

C.

Shut down the system.

D.

Identify any data that needs to be obtained.

Question # 130

An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?

A.

When the software is being released for testing

B.

When full system code is being merged

C.

When business analysis is being performed and systems requirements are being identified

D.

When system architecture is being defined and user interface is being designed

Question # 131

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Question # 132

A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization ' s corporate cloud. What is the MAIN benefit of the organization ' s Federated Identity Management (FIM) system to address the need?

A.

Efficient access provisioning

B.

Increased robustness of authentication

C.

Greater flexibility of access control

D.

Reduced complexity of maintenance and changes

Question # 133

Pitfalls of a differentiation strategy include:

A.

Not recognizing opportunities for proprietary advantage

B.

Becoming too focused on cost reduction

C.

Overly aggressive cost cutting resulting in lower margins

D.

Failing to identify gaps in quality or service compared to rivals

Question # 134

A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?

A.

Uselevel production planning and investigate subcontracting to meet the extra demand.

B.

Usechaseproduction planningand only take the orders that can be produced In the highdemand season.

C.

Usehybridproduction planningto save labor costs and inventory costs in the low demand season.

D.

Usehybridproduction planningand reduce the size of the customer base during the highdemand season.

Question # 135

What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?

A.

Threat modeling

B.

Asset management

C.

Risk management

D.

Asset modeling

Question # 136

Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?

A.

It coordinates between the client and multiple logistics suppliers.

B.

It focuses primarily on last-mile delivery.

C.

It allows the client to concentrate on operating its own warehouse.

D.

It provides a logistics specialist who manages some of the logistics operation.

Question # 137

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Question # 138

A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?

A.

Configure internal firewalls to accept and pass all scanner traffic and responses

B.

Execute a vulnerability scan to determine the current organization security posture

C.

Select two different vulnerability scanners to get comprehensive reporting

D.

Obtain support from the computing systems ' stakeholders

Question # 139

A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?

A.

Conduct a detailed data analysis on the security impacts using historical data.

B.

Prioritize assessment activities and strategically asses each application

C.

Identify a sponsor from within the organization to prioritize the activities

D.

Perform a risk analysis and determine which applications must be assessed

Question # 140

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Question # 141

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Question # 142

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question # 143

An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?

A.

Ensure that the call agents are using an additional authentication method.

B.

Implement a Network Access Control (NAC) solution.

C.

Ensure that the voice media is using Secure Real-Time Transport Protocol.

D.

Segment the voice network and add Next-Generation Firewalls (NGFW).

Question # 144

Organization A provides scalable Information Technology (IT) infrastructure while Organization B provides security services to customers via Software as a Service (SaaS) model. Which document is used to express a set of intended actions between the organizations with respect to meeting the customers’ needs?

A.

Business partnership agreement

B.

Interconnection Security Agreement (ISA)

C.

Framework partnership agreement

D.

Memorandum of Understanding (MOU)

Question # 145

Check sheets can be used to:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question # 146

Which of the following can allow an attacker to bypass authentication?

A.

Response tampering

B.

Machine enumeration

C.

User agent manipulation

D.

Social engineering

Question # 147

A regular remote user executed an application that allowed the execution of commands with elevated permissions. It was allowed to create new users, start and stop services, and view critical log files. Which exploit type did the application use in this scenario?

A.

Side-channel

B.

Fault injection

C.

Privilege escalation

D.

Buffer overflow

Question # 148

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Question # 149

Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?

A.

Continuous monitoring

B.

Change Control Board (CCB) coordination

C.

Risk acceptance

D.

Root cause analysis

Question # 150

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Question # 151

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Question # 152

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Question # 153

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Question # 154

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Question # 155

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Question # 156

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question # 157

An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?

A.

Dictionary

B.

Hybrid

C.

Inference

D.

Rainbow table

Question # 158

One of the most useful tools for analyzing the sustainable footprint is:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Question # 159

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Question # 160

Reducing distribution network inventory days of supply will have which of the following Impacts?

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Question # 161

A failure mode and effects analysis (FMEA) could be used for which of the following activities?

A.

Forecasting the estimated warranty costs for the annual budget cycle

B.

Calculating the lost productivity from unplanned equipment downtime

C.

Determining the critical-to-quality (CTQ) characteristics for a new product design

D.

Assessing the supply chain risk for a single-sourced raw material

Question # 162

An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?

A.

International Organization For Standardization (ISO) 27001

B.

International Organization For standardization (ISO) 27002

C.

International Technology Infrastructure Library (ITIL)

D.

Capability Maturity Model (CMM)

Question # 163

Which of the following presents the GREATEST benefit to an organization ' s security posture when a change management process is implemented?

A.

Accuracy of Key Risk Indicators (KRI) reported to senior management

B.

Ensure the integrity of the organization ' s assets

C.

Backups being completed in a timely manner

D.

Accuracy of Key Performance Indicators (KPI) reported to senior management

Question # 164

Which of the following categories of web services testing describes correctness testing of web service security functionality?

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question # 165

An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?

A.

Open Authorization (OAuth) 2.0

B.

Security Assertion Markup Language (SAML) 2.0

C.

Password Authentication Protocol (PAP)

D.

OpenID Connect (OIDC)

Question # 166

Which of the following is a document that will be obtained at the end of an asset’s lifecycle?

A.

Asset registry

B.

Bill of lading

C.

Certificate of disposal

D.

Master data record

Question # 167

Which of the following MUST be in place for security to be effective in an organization?

A.

Security objectives are documented and in line with the organization’s mission and goals.

B.

Security policies are in line with international standards.

C.

Technology strategy decisions have the involvement and approval of the security organization.

D.

Risk assessments on business plans include security issues as part of the analysis.

Question # 168

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Question # 169

Who is ultimately responsible for ensuring that specific data is protected?

A.

Custodian

B.

Data owner

C.

Data controller

D.

System owner

Question # 170

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Question # 171

An example of a flexibility metric for an organization Is:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question # 172

What is the HIGHEST security concern on trans-border data?

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Question # 173

Price negotiation is most appropriate when purchasing which of the following product categories?

A.

Commodities

B.

Standard products

C.

Items of small value

D.

Made-to-order (MTO) items

Question # 174

Moving average forecasting methods are best when demand shows:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Question # 175

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Question # 176

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question # 177

In the sales and operations planning (S & OP) process, the demand management function provides:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Question # 178

A company uses planning bills of material (BOMs) in its planning process extensively. Which of the following scenarios would present the biggest challenge to this planning process?

A.

High variation in supplier delivery

B.

Low variation in the demand mix

C.

High new product introductions

D.

High manufacturing scrap rates

Question # 179

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question # 180

What is the MAIN privacy risk raised by federated identity solutions?

A.

The potential for tracking and profiling an individual ' s transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization ' s sensitive business information

D.

The potential for unauthorized access to user attributes

Question # 181

What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?

A.

Legitimate data collection

B.

Limitation of use

C.

Collection Categorization

D.

Collection limitation

CPIM-8.0 PDF

$33

$109.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

CPIM-8.0 PDF + Testing Engine

$52.8

$175.99

3 Months Free Update

  • Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
  • Last Update: May 20, 2026
  • Questions and Answers: 606
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

CPIM-8.0 Engine

$39.6

$131.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included