Halloween Special Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: spcl70

CPIM-8.0 PDF

$33

$109.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

CPIM-8.0 PDF + Testing Engine

$52.8

$175.99

3 Months Free Update

  • Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
  • Last Update: Oct 30, 2025
  • Questions and Answers: 565
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

CPIM-8.0 Engine

$39.6

$131.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included

CPIM-8.0 Practice Exam Questions with Answers Certified in Planning and Inventory Management (CPIM 8.0) Certification

Question # 6

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Full Access
Question # 7

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Full Access
Question # 8

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user's ability to change device settings

D.

To limit web access to only approved sites

Full Access
Question # 9

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Full Access
Question # 10

The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:

A.

represents the forecast before changes are made in S&OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Full Access
Question # 11

Price negotiation is most appropriate when purchasing which of the following product categories?

A.

Commodities

B.

Standard products

C.

Items of small value

D.

Made-to-order (MTO) items

Full Access
Question # 12

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Full Access
Question # 13

An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?

A.

Require that the user supplies their credential to access confidential documents.

B.

Require a Virtual Private Network (VPN) connection to the organization's network to access confidential documents.

C.

Implement Security Assertion Markup Language (SAML) to validate the identity of the user requesting access to confidential documents.

D.

Implement Open Authorization (OAuth) 2.0 to require the users to request permission to access confidential documents.

Full Access
Question # 14

Which of the following BEST describes web service security conformance testing as it relates to web services security testing?

A.

Generally includes threat modeling, requirements risk analysis, and security modeling

B.

Focused on ensuring that the security functionally performed by a web service meets its stated requirements

C.

Ensure individual protocol implementations adhere to the relevant published standards

D.

Focused on the smallest unit of the web service application, apart from the rest of the application

Full Access
Question # 15

Disaster Recovery Plan (DRP) training can be considered complete when the participants

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Full Access
Question # 16

Maintaining software asset security is MOST dependent on what information?

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Full Access
Question # 17

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Full Access
Question # 18

Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?

A.

Customer demand is known but seasonal.

B.

Items are purchased and/or produced continuously and not in batches.

C.

Order preparation costs and inventory-carrying costs are constant and known.

D.

Holding costs, as a percentage of the unit cost, are variable.

Full Access
Question # 19

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Full Access
Question # 20

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Full Access
Question # 21

Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Full Access
Question # 22

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Full Access
Question # 23

What document MOST likely states an organization’s values?

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Full Access
Question # 24

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Full Access
Question # 25

When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

A.

any request for shipment prior to the planning time fence.

B.

any request for shipment prior to the demand time fence (DTF).

C.

requests only for shipment before the next master production schedule (MPS) receipt.

D.

requests only for shipment in the period of the receipt.

Full Access
Question # 26

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Full Access
Question # 27

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Full Access
Question # 28

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

A.

Simplex

B.

Unicast

C.

Half-duplex

D.

Full-duplex

Full Access
Question # 29

Which of the following statements about demonstrated capacity Is true?

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Full Access
Question # 30

A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling

technique called?

A.

Mixed-model

B.

Matrix

C.

Synchronized

D.

Line balancing

Full Access
Question # 31

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Full Access
Question # 32

Network Access Control (NAC) is used to perform what function for computers joining the network?

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Full Access
Question # 33

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Full Access
Question # 34

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Full Access
Question # 35

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Full Access
Question # 36

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Full Access
Question # 37

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Full Access
Question # 38

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Full Access
Question # 39

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Full Access
Question # 40

When starting an external benchmarking study, a firm must first:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition's.

Full Access
Question # 41

The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

A.

product manager to increase the selling price of the product.

B.

quality manager to add a new quality measurement to the operation.

C.

production supervisor to review and explain the overage.

D.

the engineering manager to evaluate the run time for the routing.

Full Access
Question # 42

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Full Access
Question # 43

Which of the following MUST exist for an activity to be considered an audit?

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Full Access
Question # 44

Which of the following MUST be checked during the validation of software verification capabilities?

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Full Access
Question # 45

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

A.

Federation authorities access list

B.

Manual registration

C.

Proxied federation

D.

Signed assertion

Full Access
Question # 46

The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?

A.

Reorder point(ROP)

B.

Safety stock

C.

Inventory investment

D.

Safety factor

Full Access
Question # 47

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

A.

Circumstances may force a cloud provider to discontinue operations.

B.

The need to develop alternative hosting strategies for applications deployed to the cloud.

C.

Most cloud services offerings are unique to each provider and may not be easily portable.

D.

Integrity and confidentiality are not ensured properly on the most cloud service offerings.

Full Access
Question # 48

Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?

A.

Improved threat detection

B.

Flexible firewall configuration

C.

Network availability

D.

Improved threat prevention

Full Access
Question # 49

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Full Access
Question # 50

Check sheets can be used to:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Full Access
Question # 51

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Full Access
Question # 52

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Full Access
Question # 53

Which of the physiological biometric scanning methods is considered the MOST invasive?

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Full Access
Question # 54

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Full Access
Question # 55

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Full Access
Question # 56

Based on the values reported in the table below, what is the inventory turnover?

CPIM-8.0 question answer

A.

0.50

B.

0.58

C.

1.73

D.

2.60

Full Access
Question # 57

Which of the following outcomes Is a benefit of mixed-model scheduling?

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Full Access
Question # 58

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Full Access
Question # 59

The production plan defines which of the following targets?

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Full Access
Question # 60

If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?

A.

Symmetric cryptography

B.

Public Key Infrastructure (PKI) with asymmetric keys

C.

Password encryption using hashing (with salt and pepper)

D.

Message Authentication Code (MAC) using hashing

Full Access
Question # 61

Which of the following is PRIMARILY responsible for deciding the classification of data in an organization?

A.

Data owner/steward

B.

Authorizing Official (AO)

C.

Chief Information Security Officer (CISO)

D.

Data custodian

Full Access
Question # 62

Which of the following is typically used to control physical access to highly secure facilities?

A.

Surveillance

B.

Mantrap

C.

Dual control

D.

Door locks

Full Access
Question # 63

Which of the following is a system architecture in a data protection strategy?

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Full Access
Question # 64

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Full Access
Question # 65

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Full Access
Question # 66

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Full Access
Question # 67

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Full Access
Question # 68

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Full Access
Question # 69

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Full Access
Question # 70

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Full Access
Question # 71

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Full Access
Question # 72

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Full Access
Question # 73

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Full Access
Question # 74

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Full Access
Question # 75

A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?

A.

6

B.

3

C.

2

D.

1

Full Access
Question # 76

An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?

A.

By priority as defined by the critical assets list

B.

The latest Continuity Of Operations Plan (COOP)

C.

Senior management assessment and approval

D.

The latest Business Impact Analysis (BIA)

Full Access
Question # 77

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Full Access
Question # 78

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Full Access
Question # 79

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Full Access
Question # 80

What is the MAIN benefit of network segmentation?

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Full Access
Question # 81

Health information stored in paper form may be destroyed using which of the following methods?

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Full Access
Question # 82

What is the MOST important security benefit of comprehensive asset management?

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Full Access
Question # 83

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Full Access
Question # 84

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Full Access
Question # 85

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Full Access
Question # 86

In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:

A.

reduced forecast variability.

B.

fewer customer order changes.

C.

fewer customer defections.

D.

earlier Identification of shifts Incustomer preferences.

Full Access
Question # 87

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Full Access
Question # 88

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Full Access
Question # 89

Which of the following procedures should be defined when establishing information and asset handling requirements?

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Full Access
Question # 90

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Full Access
Question # 91

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Full Access
Question # 92

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Full Access
Question # 93

A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

A.

System centric

B.

Attacker centric

C.

Threat centric

D.

Asset centric

Full Access
Question # 94

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Full Access
Question # 95

Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?

A.

Discretionary.

B.

Attribute-based.

C.

Mandatory.

D.

Role-based.

Full Access
Question # 96

Which of the following BEST describes an individual modifying something the individual is not supposed to?

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Full Access
Question # 97

During the sales and operations planning (S&OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?

A.

Identifying reasons why the demand plan is not realistic

B.

Communicating when an event will prevent meeting the supply plan

C.

Ensuring that the functional objectives are considered when developing the plans

D.

Understanding how to use the plan to improve functional performance

Full Access
Question # 98

Which of the following is an information security management framework?

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Full Access
Question # 99

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Full Access
Question # 100

The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?

A.

Update the security baseline and continue with the next project task.

B.

Proceed with the next project task to meet the project deadlines.

C.

Obtain approval from the project steering, committee to revise the system security baseline.

D.

Create a change request for the system baseline revision.

Full Access
Question # 101

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Full Access
Question # 102

When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?

A.

Opening of previously closed ports

B.

Adding administrator rights on servers

C.

Performing a Cross-Site Scripting (XSS) attack

D.

Creating a Denial-Of-Service (DoS) condition

Full Access
Question # 103

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

A.

Security

B.

Data

C.

Application

D.

Control

Full Access
Question # 104

Which is the MOST valid statement around the relationship of security and privacy?

A.

A system designed with security provides individuals with data privacy by default.

B.

Nonrepudiation protects against unauthorized disclosure of private data.

C.

Privacy in the realm of physical security often entails trade-offs with security.

D.

Privacy and security are mutually exclusive.

Full Access
Question # 105

If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?

A.

1,818.2

B.

59.99945

C.

1.98

D.

0.99945

Full Access
Question # 106

When designing a production cell, which of the following items would be the most important consideration?

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Full Access
Question # 107

A health care organization's new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?

A.

Failure

B.

Incident

C.

Attack

D.

Breach

Full Access
Question # 108

Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

A.

Excessive privileges

B.

Need to know access

C.

Training access

D.

Least access principle

Full Access
Question # 109

Which of the following actions hinders the transition from a push system to a pull system?

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Full Access
Question # 110

During an onsite audit, an assessor inspected an organization’s asset decommission practice. Which of the following would MOST likely be a finding from a security point of view?

A.

Solid State Drives (SSD) were degaussed along with hard drives.

B.

The Non-Disclosure Agreement (NDA) between the organization and its data disposal service was more than 3 years old.

C.

Hard drives from older assets replaced defective hard drives from current assets of similar classification levels.

D.

Data classifications were not clearly identified.

Full Access
Question # 111

An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.

Which of the following topics will MOST likely be on the agenda?

A.

Results of the preliminary cost-benefit studies

B.

Design of the application system and database processes

C.

Communication of procedures and reporting requirements

D.

Identification of inter-application dependencies

Full Access
Question # 112

A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?

A.

Multi-Factor Authentication (MFA)

B.

Cybersecurity training

C.

Password management software

D.

Role-Based Access Control (RBAC)

Full Access
Question # 113

The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Full Access
Question # 114

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Full Access
Question # 115

An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?

A.

Employ password masking, obfuscation, and tokenization and automate account updates based on human resources reporting.

B.

Implementing Multi-Factor Authentication (MFA) and account lookout controls.

C.

Create and enforce a strong password policy and implementing security awareness training for all users.

D.

Control physical access to the IAM system and implementing Data Loss Prevention (DPL) for credentials.

Full Access
Question # 116

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Full Access
Question # 117

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Full Access
Question # 118

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

A.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

B.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

C.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

D.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

Full Access
Question # 119

One way to mitigate liability risk in the supply chain is to:

A.

negotiate lower component cost.

B.

require traceability for components.

C.

push inventory to supplier locations.

D.

use less-than-truckload (LTL) shipments more frequently.

Full Access
Question # 120

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Full Access
Question # 121

A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?

A.

Just-in-time

B.

Delegated

C.

Break-glass

D.

Automated

Full Access
Question # 122

What should an organization do to prepare for Disaster Recovery (DR) efforts?

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Full Access
Question # 123

An organization’s computer incident responses team PRIMARY responds to which type of control?

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Full Access
Question # 124

An organization’s computer incident responses team PRIMARY responds to which type of control?

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Full Access
Question # 125

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Full Access
Question # 126

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

A.

Simplex

B.

Unicast

C.

Half-duplex

D.

Full-duplex

Full Access
Question # 127

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Full Access
Question # 128

Which of the following measurements indicates there may be bias In the forecast model?

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Full Access
Question # 129

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Full Access
Question # 130

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Full Access
Question # 131

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Full Access
Question # 132

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Full Access
Question # 133

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Full Access
Question # 134

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Full Access
Question # 135

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

A.

Between the policy engine and the trust engine, because it enforces security policies

B.

As close to the workload as possible, because it impacts authorization decisions

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the data stores and the trust engine, because it improves security policies

Full Access
Question # 136

An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?

A.

Install a firewall.

B.

Implement Internet Protocol (IP) Access Control Lists (ACL).

C.

Implement 802.1X.

D.

Install an Intrusion Prevention System (IPS).

Full Access
Question # 137

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Full Access
Question # 138

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Full Access
Question # 139

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Full Access
Question # 140

An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?

A.

Endpoint security

B.

Network security

C.

Cyber physical security

D.

Cloud security

Full Access
Question # 141

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Full Access
Question # 142

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Full Access
Question # 143

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Full Access
Question # 144

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Full Access
Question # 145

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Full Access
Question # 146

If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?

A.

Symmetric cryptography

B.

Public Key Infrastructure (PKI) with asymmetric keys

C.

Password encryption using hashing (with salt and pepper)

D.

Message Authentication Code (MAC) using hashing

Full Access
Question # 147

A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?

A.

Determine local requirements.

B.

Determine federal requirements.

C.

Ensure that all data has been classified.

D.

Designate a person of authority.

Full Access
Question # 148

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Full Access
Question # 149

As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?

A.

The developer Inputs the user's account, the user's password, and a token.

B.

The developer uses the user's credentials stored within the web-based application.

C.

The developer uses Transport Layer Security (TLS) certificates and Open ID Connect (OIDC).

D.

The developer uses Open ID Connect (OIDC) and Open Authorization (OAuth).

Full Access
Question # 150

An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?

A.

Implement Attribute-Based Access Control (ABAC) process for sensitive applications.

B.

Determine authoritative identity sources.

C.

Understand connectivity to target applications.

D.

Implement Role-Based Access Control (RBAC) process for web-based applications.

Full Access
Question # 151

A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?

A.

Security Information And Event Management (SIEM)

B.

Network Intrusion Detection System (NIDS)

C.

Vulnerability scan

D.

Penetration test

Full Access
Question # 152

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Full Access
Question # 153

In which of the following situations would you use an X-bar chart?

A.

Track the number of defects that are found in each unit.

B.

Measure the difference between the largest and the smallest in a sample.

C.

Determine the average value of a group of units.

D.

Estimate a subgroup variation.

Full Access
Question # 154

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Full Access
Question # 155

What is the FIRST element that must be evaluated in a security governance program?

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Full Access
Question # 156

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Full Access
Question # 157

Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?

A.

Signed Non-Disclosure Agreement (NDA)

B.

Signed Acceptable Use Policy (AUP)

C.

ISC2 Code of Ethics

D.

Suspicious that a crime is being committed

Full Access
Question # 158

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Full Access
Question # 159

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Full Access
Question # 160

Who is ultimately responsible for ensuring that specific data is protected?

A.

Custodian

B.

Data owner

C.

Data controller

D.

System owner

Full Access
Question # 161

What is the FIRST element that must be evaluated in a security governance program?

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Full Access
Question # 162

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Full Access
Question # 163

Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?

A.

Production cost and lot size quantity

B.

Purchase cost and shrinkage rates

C.

Transportation cost and delivery time

D.

Customer price and order quantity

Full Access
Question # 164

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Full Access
Question # 165

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Full Access