Cyber Monday Sale - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65percent

Welcome To DumpsPedia

CPIM-8.0 Sample Questions Answers

Questions 4

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

Options:

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Buy Now
Questions 5

A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?

Options:

A.

ZigBee

B.

Radio-Frequency Identification (RFID)

C.

Long-Term Evolution (LTE)

D.

Bluetooth

Buy Now
Questions 6

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Buy Now
Questions 7

The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:

Options:

A.

lead times to customers decrease.

B.

transportation costs decrease.

C.

the level of required safety stock is reduced.

D.

more efficient load consolidation occurs.

Buy Now
Questions 8

Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?

Options:

A.

Offsite backup

B.

High availability

C.

Diverse routing

D.

System mirroring

Buy Now
Questions 9

The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:

Options:

A.

pipeline inventory.

B.

transportation costs.

C.

inventory turns.

D.

sales revenue.

Buy Now
Questions 10

An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?

Options:

A.

Findings by host, with associated vulnerabilities

B.

Findings by vulnerabilities, with associated hosts

C.

Appendix of definitions

D.

Executive summary

Buy Now
Questions 11

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

Options:

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Buy Now
Questions 12

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Buy Now
Questions 13

We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?

Options:

A.

Measurements that help describe the problem

B.

Guidance to which problem-solving tools should be used

C.

Criteria for selecting the improvement team

D.

Description of who is responsible for the problem

Buy Now
Questions 14

During a threat modeling exercise using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) framework, it was identified that a web server allocates a socket and forks each time it receives a request from a user without limiting the number of connections or requests.

Which of the following security objectives is MOST likely absent in the web server?

Options:

A.

Integrity

B.

Authenticity

C.

Availability

D.

Authorization

Buy Now
Questions 15

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Buy Now
Questions 16

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

Options:

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Buy Now
Questions 17

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

Options:

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Buy Now
Questions 18

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Buy Now
Questions 19

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual's transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization's sensitive business information

D.

The potential for unauthorized access to user attributes

Buy Now
Questions 20

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Buy Now
Questions 21

For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components

previously received will have which of the following results?

Options:

A.

Higher cost of goods sold (COGS)

B.

Lower COGS

C.

No change to COGS

D.

A violation of FIFO rules

Buy Now
Questions 22

Which of the following BEST defines whether an organization can consider an alternate location during a contingency?

Options:

A.

Verify the availability of an office location for the given size of the team

B.

Verify that there is a contractual obligation for location-providing services

C.

Verify the availability of cheap resources in the new location

D.

Verify that a memorandum of understanding (MOU) is in place for office equipment

Buy Now
Questions 23

An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?

Options:

A.

Publish and enforce enterprise policies that assign risk decisions to corporate officers.

B.

Publish and enforce enterprise policies that assign risk decisions to cybersecurity analysts.

C.

Publish and enforce enterprise policies that assign risk decisions to business unit managers.

D.

Publish and enforce enterprise policies that assign risk decisions to system administrators.

Buy Now
Questions 24

A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?

Options:

A.

Operating System (OS) virtualization

B.

Memory protection

C.

Cryptographic module

D.

Trusted Platform Module (TPM)

Buy Now
Questions 25

An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?

Options:

A.

Soft token

B.

Short Message Service (SMS)

C.

Personal Identification Number (PIN) code

D.

Hard token

Buy Now
Questions 26

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

Options:

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Buy Now
Questions 27

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Buy Now
Questions 28

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Buy Now
Questions 29

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

Options:

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Buy Now
Questions 30

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

Options:

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Buy Now
Questions 31

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Buy Now
Questions 32

Fishbone diagrams would help a service organization determine:

Options:

A.

the proper level of service for a customer segment.

B.

the source of a quality-of-service issue.

C.

differences in the performance of employees.

D.

the decomposition of customer return rates with seasonality.

Buy Now
Questions 33

A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?

Options:

A.

Produceto backorders

B.

Produceat a constant level

C.

Produceto the sales forecast

D.

Produceto demand

Buy Now
Questions 34

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Buy Now
Questions 35

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

Options:

A.

Security

B.

Data

C.

Application

D.

Control

Buy Now
Questions 36

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Buy Now
Questions 37

An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?

Options:

A.

Transmission encryption

B.

Multi-Factor Authentication (MFA)

C.

Single Sign-On (SSO)

D.

Transmission authentication

Buy Now
Questions 38

Which of the following is a document that will be obtained at the end of an asset’s lifecycle?

Options:

A.

Asset registry

B.

Bill of lading

C.

Certificate of disposal

D.

Master data record

Buy Now
Questions 39

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Review logs of all user's social media activity.

B.

Review the organizational social media policy.

C.

Initiate the organization's incident response plan.

D.

Determine a list of information assets that contain PII.

Buy Now
Questions 40

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Buy Now
Questions 41

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Buy Now
Questions 42

Why would a network administrator monitor Internet of Things (IoT) security differently than the security of standards network devices?

Options:

A.

IoT devices are not developed with cybersecurity in mind.

B.

IoT devices are unencrypted.

C.

IoT devices require Power over Ethernet.

D.

IoT devices are wireless.

Buy Now
Questions 43

An example of an assignable cause of variation in process performance is:

Options:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Buy Now
Questions 44

Which of the following actions will result In lower inventory levels?

Options:

A.

Level load the master production schedule (MPS).

B.

Reduce replenishment lead times.

C.

Increase customer service level.

D.

Decentralize inventory locations.

Buy Now
Questions 45

What is the FIRST element that must be evaluated in a security governance program?

Options:

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Buy Now
Questions 46

Price negotiation is most appropriate when purchasing which of the following product categories?

Options:

A.

Commodities

B.

Standard products

C.

Items of small value

D.

Made-to-order (MTO) items

Buy Now
Questions 47

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

Options:

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Buy Now
Questions 48

What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?

Options:

A.

Threat modeling

B.

Asset management

C.

Risk management

D.

Asset modeling

Buy Now
Questions 49

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

Options:

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Buy Now
Questions 50

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Buy Now
Questions 51

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

Options:

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Buy Now
Questions 52

An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?

Options:

A.

Dictionary

B.

Hybrid

C.

Inference

D.

Rainbow table

Buy Now
Questions 53

A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

Options:

A.

Determine the acceptable level of loss exposure at which the organization is comfortable operating.

B.

Conduct a gap assessment and produce a risk rating report for the executive leadership.

C.

Engage consultants to audit the organization against best practices and provide a risk report.

D.

Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.

Buy Now
Questions 54

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Buy Now
Questions 55

An organization's penetration test engineer noticed that traffic is being modified between 2 nodes and suspects an eavesdropping attack. On which networking plane is this attack occurring?

Options:

A.

Data

B.

Control

C.

Management

D.

Configuration

Buy Now
Questions 56

Based on the above table, calculate the mean absolute deviation (MAD).

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Buy Now
Questions 57

In preparing for a facility location decision, proximity to suppliers would be classified as which kind of criteria?

Options:

A.

Service level requirements

B.

Future flexibility factors

C.

Access to transportation

D.

Cost factors

Buy Now
Questions 58

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

Options:

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Buy Now
Questions 59

Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?

Options:

A.

Econometric models

B.

Computer simulation

C.

Time series decomposition

D.

Weighted moving average

Buy Now
Questions 60

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Buy Now
Questions 61

In which of the following situations would you use an X-bar chart?

Options:

A.

Track the number of defects that are found in each unit.

B.

Measure the difference between the largest and the smallest in a sample.

C.

Determine the average value of a group of units.

D.

Estimate a subgroup variation.

Buy Now
Questions 62

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Buy Now
Questions 63

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

Options:

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Buy Now
Questions 64

When developing information security policies, What is the PRIMARY concern?

Options:

A.

Alignment with business requirements

B.

Compliance with legal requirements

C.

Alignment with regulatory requirements

D.

Compliance with international standards

Buy Now
Questions 65

An organization has received the results of their network security risk assessment. What is the BEST course of action for the organization to take in response to the analyzed report findings?

Options:

A.

Hire a security consulting firm with specialized expertise to fix all the issues on the report and ensure the organization’s system are secure.

B.

Work with the organization’s legal team to ensure their cyber liability insurance policy will fully cover the costs of any breach related to the network risk assessment findings.

C.

Create an organizational risk response team and assign them the task of remediating all the issues or identifying and implementing compensating controls.

D.

Accept the risk of the issues within the organization’s risk tolerance and identify responses for the remainder of the issues.

Buy Now
Questions 66

Which of the following factors is used to determine safety stock?

Options:

A.

Number of customers

B.

Available capacity

C.

Forecast error distribution

D.

Time between customer orders

Buy Now
Questions 67

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Buy Now
Questions 68

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Buy Now
Questions 69

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Buy Now
Questions 70

A company uses planning bills of material (BOMs) in its planning process extensively. Which of the following scenarios would present the biggest challenge to this planning process?

Options:

A.

High variation in supplier delivery

B.

Low variation in the demand mix

C.

High new product introductions

D.

High manufacturing scrap rates

Buy Now
Questions 71

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Buy Now
Questions 72

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Buy Now
Questions 73

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Buy Now
Questions 74

A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?

Options:

A.

Brewer-Nash

B.

Bell-LaPadula

C.

Biba Integrity

D.

Clark Wilson

Buy Now
Questions 75

Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?

Options:

A.

Customer demand is known but seasonal.

B.

Items are purchased and/or produced continuously and not in batches.

C.

Order preparation costs and inventory-carrying costs are constant and known.

D.

Holding costs, as a percentage of the unit cost, are variable.

Buy Now
Questions 76

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Buy Now
Questions 77

During the initiation phase of a project to acquire a customer relation management system, what is the FIRST step a project team will take for early integration of security?

Options:

A.

Develop a list of security requirements for the system.

B.

Conduct project planning and a feasibility assessment.

C.

Define system security classifications.

D.

Review relevant regulatory practices and standards.

Buy Now
Questions 78

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Buy Now
Questions 79

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

Options:

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Buy Now
Questions 80

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Buy Now
Questions 81

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The clouds service provider is responsible for all security within the workload

B.

Security testing is managed after image creation

C.

No longer have to bring system down to patch

D.

Allows a user to enable remote logins to running workloads

Buy Now
Questions 82

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Buy Now
Questions 83

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

Options:

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Buy Now
Questions 84

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Buy Now
Questions 85

The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:

Options:

A.

revise the rough-cut capacity plan.

B.

reschedule a related component on the shop floor.

C.

check the accuracy of the bills for the MPS items.

D.

determine if a customer order will be impacted.

Buy Now
Questions 86

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Buy Now
Questions 87

An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?

Options:

A.

Provide travel security training.

B.

Provide specific pre-travel intelligence briefing.

C.

Complete a travel risk assessment.

D.

Refresh the corporate travel policy.

Buy Now
Questions 88

The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

Options:

A.

product manager to increase the selling price of the product.

B.

quality manager to add a new quality measurement to the operation.

C.

production supervisor to review and explain the overage.

D.

the engineering manager to evaluate the run time for the routing.

Buy Now
Questions 89

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Buy Now
Questions 90

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

Options:

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Buy Now
Questions 91

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Buy Now
Questions 92

Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?

Options:

A.

Have administrators sign appropriate access agreements.

B.

Define the Acceptable Use Policy (AUP) for administrators.

C.

Have administrators accept a Non-Disclosure Agreement.

D.

Perform extensive background checks on administrators.

Buy Now
Questions 93

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Buy Now
Questions 94

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Buy Now
Questions 95

An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?

Options:

A.

The organization can implement both mandatory and dynamic access controls, except where they would be in conflict.

B.

The organization can clone roles, saving time and granting broad access to persons within the same department.

C.

The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.

D.

The organization can implement both static and dynamic access controls, adjusting them to fit any individual’s access needs.

Buy Now
Questions 96

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

Options:

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Buy Now
Questions 97

An independent risk assessment determined that a hospital's existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

Options:

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Buy Now
Questions 98

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Buy Now
Questions 99

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Buy Now
Questions 100

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Buy Now
Questions 101

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Buy Now
Questions 102

Which of the following outcomes Is a benefit of mixed-model scheduling?

Options:

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Buy Now
Questions 103

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Buy Now
Questions 104

Asymmetric cryptography uses which type of key to encrypt data?

Options:

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Buy Now
Questions 105

An external audit is conducted on an organization's cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?

Options:

A.

Resource forecast

B.

Asset inventory

C.

Access to logs

D.

Software license agreements

Buy Now
Questions 106

Which of the following statements is an advantage of a fourth-party logistics (4PL) provider?

Options:

A.

It coordinates between the client and multiple logistics suppliers.

B.

It focuses primarily on last-mile delivery.

C.

It allows the client to concentrate on operating its own warehouse.

D.

It provides a logistics specialist who manages some of the logistics operation.

Buy Now
Questions 107

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Buy Now
Questions 108

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Buy Now
Questions 109

While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?

Options:

A.

Add privileged user to the domain admin group.

B.

Add privileged users to the protected users group.

C.

Enable security options for each privileged user.

D.

Place each privileged user in a separate Kerberos policy.

Buy Now
Questions 110

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Buy Now
Questions 111

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

Options:

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Buy Now
Questions 112

The production plan defines which of the following targets?

Options:

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Buy Now
Questions 113

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Buy Now
Questions 114

In a make-to-stock (MTS) environment, the master production schedule (MPS) Is usually a schedule of which of the following types of items?

Options:

A.

Phantom items

B.

Finished goods items

C.

Component/subassembly items

D.

Raw material items

Buy Now
Questions 115

The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Buy Now
Questions 116

Which of the following procedures should be defined when establishing information and asset handling requirements?

Options:

A.

Asset retention procedures

B.

Software patching procedures

C.

Media disposal procedures

D.

User access procedures

Buy Now
Questions 117

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S&OP) meeting.

Buy Now
Questions 118

Which of the following BEST effective when protecting against insider threats?

Options:

A.

Implement Two-Factor Authentication (2FA).

B.

Segment data repositories by business rules.

C.

Develop recovery and restoration procedures.

D.

Address security in third-party agreements.

Buy Now
Questions 119

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

Options:

A.

To prevent the users from performing unauthorized actions during the testing or operational phases

B.

To ensure complexity introduced by security design is addressed in the beginning stages

C.

To reduce the overall cost of incorporating security in a system

D.

To prevent the system from being tampered with in the future

Buy Now
Questions 120

A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?

Options:

A.

Conduct a detailed data analysis on the security impacts using historical data.

B.

Prioritize assessment activities and strategically asses each application

C.

Identify a sponsor from within the organization to prioritize the activities

D.

Perform a risk analysis and determine which applications must be assessed

Buy Now
Questions 121

An advantage of applying ABC classification to a firm's replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Buy Now
Questions 122

What activity is a useful element in the change process?

Options:

A.

Creating short-term wins

B.

Calculating a break-even point

C.

Performing a SWOT analysis

D.

Developing key performance indicators (KPIs)

Buy Now
Questions 123

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

Options:

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Buy Now
Questions 124

Which of the following should recommendations from a Plan Of Action And Milestones (POA&M) be based on?

Options:

A.

Continuous monitoring

B.

Change Control Board (CCB) coordination

C.

Risk acceptance

D.

Root cause analysis

Buy Now
Questions 125

An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?

Options:

A.

ReuseAllow

B.

History

C.

Iteration

D.

ReuseDeny

Buy Now
Questions 126

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

Options:

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Buy Now
Questions 127

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Buy Now
Questions 128

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

Options:

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Buy Now
Questions 129

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

Options:

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Buy Now
Questions 130

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

Options:

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

Buy Now
Questions 131

Management should support investments in new process technologies that:

Options:

A.

require minimal changes in existing systems, procedures, and skills.

B.

have been recommended by technical experts and equipment suppliers.

C.

provide significant cost-reduction opportunities for the company's current products.

D.

provide long-term competitive advantage with acceptable financial risk.

Buy Now
Questions 132

An example of a cradle-to-cradle sustainability model would be:

Options:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Buy Now
Questions 133

The primary benefit that results from the cross-training of employees is:

Options:

A.

improved flexibility.

B.

improved capacity.

C.

shortened lead time.

D.

effective problem-solving.

Buy Now
Questions 134

Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?

Options:

A.

Allowing only one person to enter at a time

B.

Auditing access logs annually

C.

Limiting access to regular business hours only

D.

Establishing entry points from public areas only

Buy Now
Questions 135

In the sales and operations planning (S&OP) process, the demand management function provides:

Options:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Buy Now
Questions 136

Which of the physiological biometric scanning methods is considered the MOST invasive?

Options:

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Buy Now
Questions 137

Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Buy Now
Questions 138

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

Options:

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Buy Now
Questions 139

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

Options:

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Buy Now
Questions 140

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Buy Now
Questions 141

Company A has acquired Company B. Company A has decided to start a project to convert Company B's enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?

Options:

A.

The ERP system has business processes which both companies can adopt

B.

Company A wants to save on software licensing costs

C.

Each ERP package has unique and distinctive business processes

D.

Company A wishes to close Company B's data center

Buy Now
Questions 142

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Buy Now
Questions 143

What is the total load requirement for this work center based on the following data?

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Buy Now
Questions 144

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Buy Now
Questions 145

A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?

Options:

A.

Determine local requirements.

B.

Determine federal requirements.

C.

Ensure that all data has been classified.

D.

Designate a person of authority.

Buy Now
Questions 146

An information security professional is enhancing the organization's existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?

Options:

A.

In a secure room inside the office

B.

Beside the copy machine

C.

Outside the office

D.

In the human resources area

Buy Now
Questions 147

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

Options:

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Buy Now
Questions 148

Which of the following situations is most likely to occur when using a push system?

Options:

A.

Work centers receive work even if capacity is not available.

B.

Work centers are scheduled using finite capacity planning.

C.

Work centers operate using decentralized control.

D.

Work centers signal previous work centers when they are ready for more work.

Buy Now
Questions 149

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Buy Now
Questions 150

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Buy Now
Questions 151

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

Options:

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Buy Now
Questions 152

Which of the following is the workflow of the identity and access provisioning lifecycle?

Options:

A.

Creation, Assessment, Deletion

B.

Assessment, Creation, Deletion

C.

Provision, Review, Revocation

D.

Review, Provision, Revocation

Buy Now
Questions 153

An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?

Options:

A.

International Organization For Standardization (ISO) 27001

B.

International Organization For standardization (ISO) 27002

C.

International Technology Infrastructure Library (ITIL)

D.

Capability Maturity Model (CMM)

Buy Now
Questions 154

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Buy Now
Questions 155

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Buy Now
Questions 156

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

Options:

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Buy Now
Questions 157

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

Options:

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Buy Now
Questions 158

Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?

Options:

A.

Intrusion Detection System (IDS)

B.

Internet Protocol Security (IPSec)

C.

Virtual Private Network (VPN)

D.

Network Access Control (NAC)

Buy Now
Questions 159

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

Options:

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Buy Now
Questions 160

An organization undergoing acquisition merged IT departments and infrastructure. During server decommissioning, some servers still in use by customers were mistakenly removed, causing order processing failures. Which type of review would have BEST avoided this scenario?

Options:

A.

Disaster Recovery (DR)

B.

Change management

C.

Business Continuity (BC)

D.

Business impact assessment

Buy Now
Questions 161

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Buy Now
Questions 162

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Buy Now
Questions 163

A traffic analysis on an organization's network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?

Options:

A.

Proxy

B.

Firewall

C.

Router

D.

Switch

Buy Now
Questions 164

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Buy Now
Questions 165

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Buy Now
Questions 166

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Buy Now
Questions 167

Which of the following statements correctly describes the relationship between the strategic plan and the business plan?

Options:

A.

These are two names for the same plan.

B.

The strategic plan constrains the business plan.

C.

The two plans are developed independently.

D.

The two plans are the output of a single process.

Buy Now
Questions 168

Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?

Options:

A.

Definition of anti-spam policies

B.

Removal of previous email servers

C.

Definition of key management policies

D.

Backup of email messages and folders

Buy Now
Questions 169

What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?

Options:

A.

Legitimate data collection

B.

Limitation of use

C.

Collection Categorization

D.

Collection limitation

Buy Now
Questions 170

Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?

Options:

A.

Software security team

B.

Product management

C.

Third-party reviews

D.

Senior management

Buy Now
Questions 171

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

Options:

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Buy Now
Questions 172

Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

Options:

A.

Excessive privileges

B.

Need to know access

C.

Training access

D.

Least access principle

Buy Now
Questions 173

An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?

Options:

A.

Employ password masking, obfuscation, and tokenization and automate account updates based on human resources reporting.

B.

Implementing Multi-Factor Authentication (MFA) and account lookout controls.

C.

Create and enforce a strong password policy and implementing security awareness training for all users.

D.

Control physical access to the IAM system and implementing Data Loss Prevention (DPL) for credentials.

Buy Now
Questions 174

Which of the following is the MAIN element in achieving a successful security strategy?

Options:

A.

Senior management commitment

B.

Security standards adoption

C.

Effective training and education

D.

Effective cost/benefit analysis

Buy Now
Questions 175

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Buy Now
Exam Code: CPIM-8.0
Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
Last Update: Dec 7, 2025
Questions: 585
$57.75  $164.99
$43.75  $124.99
$36.75  $104.99
buy now CPIM-8.0