We at Crack4sure are committed to giving students who are preparing for the APICS CPIM-8.0 Exam the most current and reliable questions . To help people study, we've made some of our Certified in Planning and Inventory Management (CPIM 8.0) exam materials available for free to everyone. You can take the Free CPIM-8.0 Practice Test as many times as you want. The answers to the practice questions are given, and each answer is explained.
Which of the following is an access control method that organizations can use to prevent unauthorized access?
Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?
An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?
The question below is based on the following information:
Beginning inventory = 43Week 1Week 2Week 3
Forecast202020
Customer orders221710
Projected on-hand
Master production schedule (MPS)80
Available-to-promise (ATP)
What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?
To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?
Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?
A house of quality (HOQ) chart aligns which pair of functions?
In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?
A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?
An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?
What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?
Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?
A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?
What is the FIRST element that must be evaluated in a security governance program?
A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
A manufacturer uses a low-cost strategy. It recently reviewed its components and realized it is using multiple versions of one screw. Reducing the variety of screws will contribute to its cost advantage by:
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
Which of the following procedures should be defined when establishing information and asset handling requirements?
At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?
Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?
A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?
Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.
What is the organization ' s BEST next step?
Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?
A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.
Which of the following will BEST help remediate this issue?
Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?
Which of the following capabilities BEST distinguishes a Next-Generation Firewall (NGFW) from a traditional firewall?
A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?
A software organization is getting ready to launch a new application. A security engineer notices the application allows unrestricted access to files on the web server. Which of the following recommendations will BEST resolve this security issue?
Elements calculated in the master scheduling process include:
When developing information security policies, What is the PRIMARY concern?
An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?
Which of the following is the BEST type of fire extinguisher for a data center environment?
Network Access Control (NAC) is used to perform what function for computers joining the network?
Which of the following is a methodology for threat modeling in application?
Which of the physiological biometric scanning methods is considered the MOST invasive?
A low-cost provider strategy works best when which of the following conditions are met?
What is the BEST preventive measure against employees abusing access privileges?
Asymmetric cryptography uses which type of key to encrypt data?
What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?
Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?
Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?
When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?
Which is the MOST valid statement around the relationship of security and privacy?
Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?
Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?
Which of the following planning modules considers the shortest-range planning goals?
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?
A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?
Privacy requirements across national boundaries MOST often require protection of which data types?
The most effective way to manage demand uncertainty and improve customer service is to reduce:
Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?
A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?
A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?
Which of the following measurements indicates there may be bias In the forecast model?
An information security professional is enhancing the organization ' s existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?
Improvements in an Input/output control (I/O control) system will most likely lead to:
An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?
A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.
What is the BEST action the engineer can take to ensure secure operations?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?
An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?
Which of the below represent the GREATEST cloud-specific policy and organizational risk?
An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm ' s balance sheet?
Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
Labor3 people
Work hours10 hours per day
Days4 days per week
Meetings with work area employees1/2 hour per day
Work area efficiency85%
Given the information above, what is the weekly theoretical capacity of this work area in hours?
Database security includes which of the following requirements?
The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
Which of the following is the MAIN element in achieving a successful security strategy?
What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?
What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?
Which of the following statements is true about total productive maintenance (TPM)?
What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?
An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?
The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?
What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?
Which of the following statements characterizes a pull system In distribution management?
When starting an external benchmarking study, a firm must first:
A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:
A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?
Risk pooling would work best for items with:
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization ' s regulatory compliance policy?
An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?
Return on investment (ROI) is decreased by which of the following activities?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
When considering Defense in Depth (DiD) as part of a network’s architectural design, what is the FIRST layer in a multi-layered defensive strategy?
Which of the following statements is true about the meantime between failures (MTBF) measure?
The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?
Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?
Which of the following statements correctly describes the relationship between the strategic plan and the business plan?
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
Which of the following factors Is considered a carrying cost?
A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?
A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?
The define, measure, analyze, improve, control (DMAIC) process is an effective method to understand and improve business processes because it begins with a:
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
Which of the following concepts MOST accurately refers to an organization ' s ability to fully understand the health of the data in its system at every stage of the lifecycle?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
A bill of resources typically contains information about a product’s:
Which of the following should be performed FIRST in the course of a digital forensics investigation?
An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?
An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?
A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization ' s corporate cloud. What is the MAIN benefit of the organization ' s Federated Identity Management (FIM) system to address the need?
Pitfalls of a differentiation strategy include:
A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?
What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?
Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?
Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?
A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?
A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?
What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?
Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?
Organization A provides scalable Information Technology (IT) infrastructure while Organization B provides security services to customers via Software as a Service (SaaS) model. Which document is used to express a set of intended actions between the organizations with respect to meeting the customers’ needs?
Check sheets can be used to:
Which of the following can allow an attacker to bypass authentication?
A regular remote user executed an application that allowed the execution of commands with elevated permissions. It was allowed to create new users, start and stop services, and view critical log files. Which exploit type did the application use in this scenario?
An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?
Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?
Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?
In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?
A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?
An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?
One of the most useful tools for analyzing the sustainable footprint is:
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
Reducing distribution network inventory days of supply will have which of the following Impacts?
A failure mode and effects analysis (FMEA) could be used for which of the following activities?
An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?
Which of the following presents the GREATEST benefit to an organization ' s security posture when a change management process is implemented?
Which of the following categories of web services testing describes correctness testing of web service security functionality?
An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?
Which of the following is a document that will be obtained at the end of an asset’s lifecycle?
Which of the following MUST be in place for security to be effective in an organization?
What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?
Who is ultimately responsible for ensuring that specific data is protected?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
An example of a flexibility metric for an organization Is:
What is the HIGHEST security concern on trans-border data?
Price negotiation is most appropriate when purchasing which of the following product categories?
Moving average forecasting methods are best when demand shows:
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
In the sales and operations planning (S & OP) process, the demand management function provides:
A company uses planning bills of material (BOMs) in its planning process extensively. Which of the following scenarios would present the biggest challenge to this planning process?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
What is the MAIN privacy risk raised by federated identity solutions?
What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?
3 Months Free Update
3 Months Free Update
3 Months Free Update