3 Months Free Update
3 Months Free Update
3 Months Free Update
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?
In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?
Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?
The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:
Price negotiation is most appropriate when purchasing which of the following product categories?
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
Maintaining software asset security is MOST dependent on what information?
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?
Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
Network Access Control (NAC) is used to perform what function for computers joining the network?
What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?
What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:
Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?
Which of the following MUST exist for an activity to be considered an audit?
Which of the following MUST be checked during the validation of software verification capabilities?
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
Which of the physiological biometric scanning methods is considered the MOST invasive?
A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
Based on the values reported in the table below, what is the inventory turnover?

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
Which of the following is PRIMARILY responsible for deciding the classification of data in an organization?
Which of the following is typically used to control physical access to highly secure facilities?
Which of the following is a system architecture in a data protection strategy?
Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer's engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?
When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?
An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?
An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?
Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?
A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?
An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?
A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?
Which of the following product design approaches are likely to reduce time to market for a global supply chain?
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
Health information stored in paper form may be destroyed using which of the following methods?
What is the MOST important security benefit of comprehensive asset management?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?
In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?
Which of the following procedures should be defined when establishing information and asset handling requirements?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?
An effective approach to projecting requirements for materials with long lead times Includes which of the following options?
Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?
Which of the following BEST describes an individual modifying something the individual is not supposed to?
During the sales and operations planning (S&OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?
A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?
The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?
Which is the MOST valid statement around the relationship of security and privacy?
If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?
When designing a production cell, which of the following items would be the most important consideration?
A health care organization's new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity or availability of the application and data?
Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?
Which of the following actions hinders the transition from a push system to a pull system?
During an onsite audit, an assessor inspected an organization’s asset decommission practice. Which of the following would MOST likely be a finding from a security point of view?
An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.
Which of the following topics will MOST likely be on the agenda?
A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?
The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?
A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?
Disaster Recovery (DR) training plan outcomes should have which KEY quality?
When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?
An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?
A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?
What should an organization do to prepare for Disaster Recovery (DR) efforts?
An organization’s computer incident responses team PRIMARY responds to which type of control?
An organization’s computer incident responses team PRIMARY responds to which type of control?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?
Which of the following measurements indicates there may be bias In the forecast model?
An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?
After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?
Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?
Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
In a Zero Trust (ZT) model, where should the enforcement component be placed and why?
An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?
Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?
What can help a security professional assess and mitigate vulnerabilities of an embedded device?
Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?
An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?
A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:
What is the FIRST element that must be evaluated in a security governance program?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
Who is ultimately responsible for ensuring that specific data is protected?
What is the FIRST element that must be evaluated in a security governance program?
An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?
Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?
Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?