Pre-Summer Sale - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65percent

Welcome To DumpsPedia

CPIM-8.0 Sample Questions Answers

Questions 4

The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?

Options:

A.

Investigation

B.

Reconnaissance

C.

Fingerprinting

D.

Exploitation

Buy Now
Questions 5

An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?

Options:

A.

When the software is being released for testing

B.

When full system code is being merged

C.

When business analysis is being performed and systems requirements are being identified

D.

When system architecture is being defined and user interface is being designed

Buy Now
Questions 6

What are the FIRST two steps an organization should conduct to classify its assets?

Options:

A.

Define user requirements and collate existing inventories

B.

Categorize assets and set minimum security controls

C.

Conduct an inventory of assets and determine the owners

D.

Obtain senior management buy-in and conduct a risk assessment

Buy Now
Questions 7

A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):

Options:

A.

Assemble-to-order (ATO) environment

B.

Make-to-stock (MTS) environment

C.

Pull system

D.

Push system

Buy Now
Questions 8

An organizational policy requires that any data from organization-issued devices be securely destroyed before disposal. Which method provides the BEST assurance of data destruction?

Options:

A.

Incinerating

B.

Reformatting

C.

Degaussing

D.

Erasing

Buy Now
Questions 9

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?

Options:

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Buy Now
Questions 10

Which of the following is a system architecture in a data protection strategy?

Options:

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Buy Now
Questions 11

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Buy Now
Questions 12

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Buy Now
Questions 13

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

Options:

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Buy Now
Questions 14

A contractor hacked into an unencrypted session on an organization ' s wireless network. Which authentication configuration is MOST likely to have enabled this?

Options:

A.

Remote Authentication Dial-In User Service (RADIUS)

B.

Captive web portal

C.

Lightweight Directory Access Protocol (LDAP)

D.

Token authentication

Buy Now
Questions 15

An organization wants to establish an information security program and has assigned a security analyst to put it in place. What is the NEXT step?

Options:

A.

Develop and implement an information security standards manual.

B.

security control review.

C.

Perform a risk assessment to establish baseline security.

D.

Implement security access control software.

Buy Now
Questions 16

As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?

Options:

A.

The developer Inputs the user ' s account, the user ' s password, and a token.

B.

The developer uses the user ' s credentials stored within the web-based application.

C.

The developer uses Transport Layer Security (TLS) certificates and Open ID Connect (OIDC).

D.

The developer uses Open ID Connect (OIDC) and Open Authorization (OAuth).

Buy Now
Questions 17

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Buy Now
Questions 18

Which of the following techniques would a group use to prioritize problems?

Options:

A.

Critical path analysis

B.

Pareto analysis

C.

Scatter charts

D.

Cause-and-effect diagrams

Buy Now
Questions 19

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

Options:

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Buy Now
Questions 20

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Buy Now
Questions 21

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Buy Now
Questions 22

An attacker was able to identify an organization’s wireless network, collect proprietary network resource information, and capture several user credentials. The attacker then used that information to conduct a more sophisticated and impactful attack against the organization. Which method did the attacker MOST likely use to gather the initial information?

Options:

A.

Proxy manipulation and Man-in-the-Middle (MITM) attack

B.

Media Access Control (MAC) spoofing and proxy manipulation

C.

Rogue access point and Man-in-the-Middle (MITM) attack

D.

Media Access Control (MAC) spoofing and rogue access point

Buy Now
Questions 23

Which of the following methods is most often used to manage inventory planning variability across the supply chain?

Options:

A.

Buffer management

B.

Safety lead time

C.

Risk pooling

D.

Risk categorization

Buy Now
Questions 24

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Buy Now
Questions 25

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Buy Now
Questions 26

An order winner during the growth stage of a product ' s life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Buy Now
Questions 27

What is the MAIN purpose of risk and impact analysis?

Options:

A.

Calculate the cost of implementing effective countermeasures.

B.

Calculate the effort of implementing effective countermeasures.

C.

Identify countermeasures.

D.

Eliminate the risk of most threats.

Buy Now
Questions 28

A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer ' s pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?

Options:

A.

Cross-Site Request Forgery (CSRF)

B.

On-path attack

C.

Cross-Site Scripting (XSS)

D.

Session hijacking

Buy Now
Questions 29

The question below is based on the following alternative schedules for a lot of 1,200.

A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.

Which of the following statements is correct?

Options:

A.

Operation overlapping results in reduced total setup costs.

B.

Operation overlapping results in reduced total span time.

C.

Lot splitting results in the shortest overall lead time.

D.

Lot splitting results in reduced total setup costs.

Buy Now
Questions 30

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

Options:

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Buy Now
Questions 31

The primary purpose for engaging in cycle count activities is to:

Options:

A.

eliminate the need for a traditional physical inventory count.

B.

more frequently reconcile the actual on-hand and system on-hand for items.

C.

smooth out the tasks of counting inventory throughout the fiscal year.

D.

improve material handling processes and reduce or eliminate errors.

Buy Now
Questions 32

Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Buy Now
Questions 33

An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?

Options:

A.

Standards review

B.

Static Application Security Testing (SAST)

C.

Design and requirements gathering

D.

Dynamic Application Security Testing (DAST)

Buy Now
Questions 34

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S & OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Buy Now
Questions 35

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Buy Now
Questions 36

The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?

Options:

A.

Reorder point(ROP)

B.

Safety stock

C.

Inventory investment

D.

Safety factor

Buy Now
Questions 37

Which of the following regarding authentication protocols is a PRIMARY consideration when designing an authentication and key management system?

Options:

A.

Refresh

B.

Visibility

C.

Authorization

D.

Integrity

Buy Now
Questions 38

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Buy Now
Questions 39

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Buy Now
Questions 40

Which Virtual Private Network (VPN) protocol provides a built-in encryption?

Options:

A.

Layer 2 Tunneling Protocol

B.

Point-to-Point Tunneling Protocol

C.

Layer 2 Forwarding Protocol

D.

Internet Protocol Security (IPsec)

Buy Now
Questions 41

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Buy Now
Questions 42

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

Options:

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Buy Now
Questions 43

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Buy Now
Questions 44

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product ' s life cycle?

Options:

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Buy Now
Questions 45

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

Options:

A.

To ensure complexity introduced by security design is addressed in the beginning stages.

B.

To reduce the overall cost of incorporating security in a system.

C.

To prevent the system from being tampered with in the future.

D.

To prevent the users from performing unauthorized actions during the testing or operational phases.

Buy Now
Questions 46

Which of the following factors Is considered a carrying cost?

Options:

A.

Setup

B.

Transportation

C.

Obsolescence

D.

Scrap rate

Buy Now
Questions 47

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Buy Now
Questions 48

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Buy Now
Questions 49

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Buy Now
Questions 50

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

Options:

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Buy Now
Questions 51

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Buy Now
Questions 52

A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?

Options:

A.

Access of system logs to authorized staff

B.

Accurate and prompt tagging of all business files

C.

Assurance of safe and clean handling of company property

D.

Adoption of environmental controls in the server room

Buy Now
Questions 53

An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?

Options:

A.

Spoofing

B.

Spear phishing

C.

Piggybacking

D.

Insider threat

Buy Now
Questions 54

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

Options:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Buy Now
Questions 55

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

Options:

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Buy Now
Questions 56

Which of the following is an information security management framework?

Options:

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Buy Now
Questions 57

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

Options:

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

Buy Now
Questions 58

Which of the following BEST describes the purpose of black hat testing during an assessment?

Options:

A.

Assess systems without the knowledge of end-users.

B.

Focus on identifying vulnerabilities.

C.

Examine the damage or impact an adversary can cause.

D.

Determine the risk associated with unknown vulnerabilities.

Buy Now
Questions 59

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Buy Now
Questions 60

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

Options:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Buy Now
Questions 61

The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:

Options:

A.

lead times to customers decrease.

B.

transportation costs decrease.

C.

the level of required safety stock is reduced.

D.

more efficient load consolidation occurs.

Buy Now
Questions 62

A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization ' s corporate cloud. What is the MAIN benefit of the organization ' s Federated Identity Management (FIM) system to address the need?

Options:

A.

Efficient access provisioning

B.

Increased robustness of authentication

C.

Greater flexibility of access control

D.

Reduced complexity of maintenance and changes

Buy Now
Questions 63

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Buy Now
Questions 64

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Buy Now
Questions 65

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Buy Now
Questions 66

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Buy Now
Questions 67

In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?

Options:

A.

Software As A Service (SaaS).

B.

Platform As A Service (PaaS).

C.

Desktop As A Service (DaaS).

D.

Infrastructure As A Service (IaaS).

Buy Now
Questions 68

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Buy Now
Questions 69

During the sales and operations planning (S & OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?

Options:

A.

Identifying reasons why the demand plan is not realistic

B.

Communicating when an event will prevent meeting the supply plan

C.

Ensuring that the functional objectives are considered when developing the plans

D.

Understanding how to use the plan to improve functional performance

Buy Now
Questions 70

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Buy Now
Questions 71

Pitfalls of a differentiation strategy include:

Options:

A.

Not recognizing opportunities for proprietary advantage

B.

Becoming too focused on cost reduction

C.

Overly aggressive cost cutting resulting in lower margins

D.

Failing to identify gaps in quality or service compared to rivals

Buy Now
Questions 72

An organization is having bandwidth utilization issues due to unauthorized devices on the network. Which action should be taken to solve the problem?

Options:

A.

Disable all unused ports.

B.

Implement a Network Access Control (NAC) solution.

C.

Rate limit on access ports.

D.

Restrict access with an Access Control List (ACL).

Buy Now
Questions 73

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Buy Now
Questions 74

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Buy Now
Questions 75

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Buy Now
Questions 76

Who is responsible for ensuring compliance when an organization uses a cloud provider to host its Virtual Machine (VM) instances?

Options:

A.

An independent auditor employed by the cloud provider is responsible for ensuring compliance.

B.

The cyber insurance carrier is responsible for ensuring compliance.

C.

The cloud provider may have a level of responsibility; however, the customer is ultimately responsible for ensuring compliance.

D.

Compliance is equally shared between the cloud provider, the customer, and third-party vendors that interact with the VM instances.

Buy Now
Questions 77

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

Options:

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Buy Now
Questions 78

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Buy Now
Questions 79

Which is the MOST valid statement around the relationship of security and privacy?

Options:

A.

A system designed with security provides individuals with data privacy by default.

B.

Nonrepudiation protects against unauthorized disclosure of private data.

C.

Privacy in the realm of physical security often entails trade-offs with security.

D.

Privacy and security are mutually exclusive.

Buy Now
Questions 80

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Buy Now
Questions 81

A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?

Options:

A.

Just-in-time

B.

Delegated

C.

Break-glass

D.

Automated

Buy Now
Questions 82

An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?

Options:

A.

Resource forecast

B.

Asset inventory

C.

Access to logs

D.

Software license agreements

Buy Now
Questions 83

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

Options:

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Buy Now
Questions 84

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization ' s software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Buy Now
Questions 85

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Buy Now
Questions 86

Which of the following can allow an attacker to bypass authentication?

Options:

A.

Response tampering

B.

Machine enumeration

C.

User agent manipulation

D.

Social engineering

Buy Now
Questions 87

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

Options:

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Buy Now
Questions 88

Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?

Options:

A.

History shows that the quality level has been stable from lot to lot.

B.

The company uses one of its qualified suppliers.

C.

Downstream operators encounter recurring defects.

D.

The percent of defects is expected to be greater than 5%.

Buy Now
Questions 89

If fixed costs are §200,000 and 20,000 units are produced, a unit ' s fixed cost is §10. This is an example of:

Options:

A.

variable costing.

B.

activity-based costing (ABC).

C.

absorption costing.

D.

overhead costing.

Buy Now
Questions 90

Which if the following is the FIRST control step in provisioning user rights and privileges?

Options:

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality

Buy Now
Questions 91

Which software development methodology is an iterative customer-value-centric approach which helps teams deliver value to their customers faster and with fewer problems?

Options:

A.

Agile model

B.

Cleanroom model

C.

Waterfall model

D.

Incremental model

Buy Now
Questions 92

What is the HIGHEST security concern on trans-border data?

Options:

A.

Organizations that are not in highly regulated industries do not have the resources to achieve compliance.

B.

Cyber transactions occur in an ever-changing legal and regulatory landscape without fixed borders.

C.

Information security practitioners are not Subject Matter Experts (SME) for all legal and compliance requirements.

D.

Organizations must follow all laws and regulations related to the use of the Internet.

Buy Now
Questions 93

In the sales and operations planning (S & OP) process, the demand management function provides:

Options:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Buy Now
Questions 94

Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?

Options:

A.

Data

B.

Physical

C.

Network

D.

Transport

Buy Now
Questions 95

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual ' s transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization ' s sensitive business information

D.

The potential for unauthorized access to user attributes

Buy Now
Questions 96

A reduction In purchased lot sizes will reduce which of the following items?

Options:

A.

Inventory levels

B.

Frequency of orders

C.

Reorder points (ROPs)

D.

Setuptimes

Buy Now
Questions 97

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

Options:

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Buy Now
Questions 98

Which threat modeling methodology is focused on assessing risks from organizational assets?

Options:

A.

Process For Attack Simulation And Threat Analysis (PASTA)

B.

Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)

C.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

D.

Damage, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

Buy Now
Questions 99

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Buy Now
Questions 100

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization ' s ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Buy Now
Questions 101

An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?

Options:

A.

Next-generation firewall

B.

Host-Based Intrusion Detection System (HIDS)

C.

Micro-segmentation

D.

Network Intrusion Detection System (NIDS)

Buy Now
Questions 102

Disaster Recovery Plan (DRP) training can be considered complete when the participants

Options:

A.

understand the rationale behind why a specific Disaster Recovery Plan (DRP) strategy was chosen.

B.

receive a complete, accurate, and detailed explanation of the Disaster Recovery Plan (DRP).

C.

understand their roles and interactions with other roles.

D.

have demonstrated their understanding during an actual disaster.

Buy Now
Questions 103

When developing information security policies, What is the PRIMARY concern?

Options:

A.

Alignment with business requirements

B.

Compliance with legal requirements

C.

Alignment with regulatory requirements

D.

Compliance with international standards

Buy Now
Questions 104

What MUST be completed before developing physical security controls?

Options:

A.

Develop a comprehensive security policy

B.

Provide the annual security awareness training

C.

Contract for licensed and bonded security force

D.

Perform a physical security audit

Buy Now
Questions 105

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization ' s BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor ' s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Buy Now
Questions 106

A company that has experienced steady growth for seasonal products in the last several years currently is reevaluating its production planning approach. The chase production plan initially requires 150 employees, then increases to 440 employees, and then decreases to 165 employees. Which of the following factors would be most relevant when evaluating the cost of this production planning approach?

Options:

A.

Inventory carrying cost

B.

Material cost

C.

Overhead cost

D.

Labor-related cost

Buy Now
Questions 107

An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?

Options:

A.

Transmission encryption

B.

Multi-Factor Authentication (MFA)

C.

Single Sign-On (SSO)

D.

Transmission authentication

Buy Now
Questions 108

During a threat modeling exercise using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) framework, it was identified that a web server allocates a socket and forks each time it receives a request from a user without limiting the number of connections or requests.

Which of the following security objectives is MOST likely absent in the web server?

Options:

A.

Integrity

B.

Authenticity

C.

Availability

D.

Authorization

Buy Now
Questions 109

A low-cost provider strategy works best when which of the following conditions are met?

Options:

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Buy Now
Questions 110

A potentially life-threatening vulnerability is found in vendor software that is used to manage critical systems. Which of the following is generally considered the BEST method to disclose the vulnerability from an ethical hacking perspective?

Options:

A.

Coordinated disclosure because it compels the vendor to act within a certain time frame

B.

Bug bounty disclosure programs because the researcher should get paid for finding the vulnerability

C.

Full public disclosure because the vulnerability is serious and the organizations using the software need to know quickly

D.

Full vendor disclosure because it is the vendor’s responsibility to disclose vulnerabilities to its customers

Buy Now
Questions 111

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

Options:

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Buy Now
Questions 112

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

Options:

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Buy Now
Questions 113

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

Options:

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Buy Now
Questions 114

In a lean environment, the batch-size decision for planning " A " items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Buy Now
Questions 115

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

Options:

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Buy Now
Questions 116

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

Options:

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Buy Now
Questions 117

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

Options:

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Buy Now
Questions 118

The question below is based on the following standard and actual data of a production order

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Buy Now
Questions 119

A company ' s primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Buy Now
Questions 120

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Buy Now
Questions 121

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Buy Now
Questions 122

The production plan defines which of the following targets?

Options:

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Buy Now
Questions 123

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Buy Now
Questions 124

An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?

Options:

A.

Physical access control

B.

Natural disaster insurance

C.

Natural surveillance

D.

Territorial reinforcement

Buy Now
Questions 125

A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?

Options:

A.

An increased number of receipts and issues for subassemblies

B.

An increased number of production order feedback transactions

C.

A reduced number of production orders planned by MRP

D.

An inability to process orders for replacement drawers

Buy Now
Questions 126

An example of an assignable cause of variation in process performance is:

Options:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Buy Now
Questions 127

Which of the following attributes describes a company with a global strategy?

Options:

A.

Ituses the same basic competitive style worldwide and focuses efforts on building global brands.

B.

Itcustomizes the basic competitive style to fit markets but focuses efforts on building global brands.

C.

Itcoordinates major strategic decisions worldwide but gives country managers wide strategy-making latitude.

D.

Itoperates plants in many host countries and uses decentralized distribution.

Buy Now
Questions 128

Based on the values reported in the table below, what is the inventory turnover?

Options:

A.

0.50

B.

0.58

C.

1.73

D.

2.60

Buy Now
Questions 129

Which of the following is a methodology for threat modeling in application?

Options:

A.

Disaster, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE)

C.

Pretend, Allow, Crash, Modify, Ascertain, Name

D.

Confidentiality, Authentication, Integrity, Nonrepudiation, Availability

Buy Now
Questions 130

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

Options:

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Buy Now
Questions 131

Which of the following sampling techniques is BEST suited for comprehensive risk assessments?

Options:

A.

Convenience sampling

B.

Snowball sampling

C.

Judgement sampling

D.

Systematic sampling

Buy Now
Questions 132

A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?

Options:

A.

Determine local requirements.

B.

Determine federal requirements.

C.

Ensure that all data has been classified.

D.

Designate a person of authority.

Buy Now
Questions 133

An appropriate performance measure for sales and operations planning (S & OP) would be the variance between:

Options:

A.

The forecasted and actual demand

B.

The actual and planned raw material level

C.

The demand plan and the production plan

D.

The production plan and the master production schedule (MPS)

Buy Now
Questions 134

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Buy Now
Questions 135

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Buy Now
Questions 136

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Buy Now
Questions 137

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

Options:

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

Buy Now
Questions 138

A regular remote user executed an application that allowed the execution of commands with elevated permissions. It was allowed to create new users, start and stop services, and view critical log files. Which exploit type did the application use in this scenario?

Options:

A.

Side-channel

B.

Fault injection

C.

Privilege escalation

D.

Buffer overflow

Buy Now
Questions 139

Which of the following inventory management techniques is most responsive to changes in demand levels?

Options:

A.

Two-bin system

B.

Periodic review system

C.

Cycle counting

D.

ABC classification

Buy Now
Questions 140

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Buy Now
Questions 141

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

Options:

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Buy Now
Questions 142

What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?

Options:

A.

Advanced Threat Protection (ATP)

B.

Address Space Layout Randomization (ASLR)

C.

Structured exception handling overwrite protection

D.

Export address table filtering

Buy Now
Questions 143

An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?

Options:

A.

Open Authorization (OAuth) 2.0

B.

Security Assertion Markup Language (SAML) 2.0

C.

Password Authentication Protocol (PAP)

D.

OpenID Connect (OIDC)

Buy Now
Questions 144

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

Options:

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Buy Now
Questions 145

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Buy Now
Questions 146

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Buy Now
Questions 147

The master schedule is an Important tool in the sales and operations planning (S & OP) process because it:

Options:

A.

represents the forecast before changes are made in S & OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Buy Now
Questions 148

Which of the following concepts MOST accurately refers to an organization ' s ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Buy Now
Questions 149

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Buy Now
Questions 150

Which of the following documents is the BEST reference to describe application functionality?

Options:

A.

Disaster Recovery Plan (DRP)

B.

System security plan

C.

Business Impact Analysis (BIA) report

D.

Vulnerability assessment report

Buy Now
Questions 151

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Buy Now
Questions 152

A bill of resources typically contains information about a product’s:

Options:

A.

Complete list of components

B.

Production schedule

C.

Inventory balances

D.

Key work centers

Buy Now
Questions 153

An advantage of applying ABC classification to a firm ' s replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Buy Now
Questions 154

Which of the following is the BEST type of fire extinguisher for a data center environment?

Options:

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Buy Now
Questions 155

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

Options:

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Buy Now
Questions 156

What is most likely to be the effect of developing a current-state value stream map?

Options:

A.

Identification of non-value-added activities

B.

Reduction in manufacturing lead time

C.

Increased component standardization

D.

Elimination of waste

Buy Now
Questions 157

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

Options:

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user ' s ability to change device settings

D.

To limit web access to only approved sites

Buy Now
Questions 158

Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?

Options:

A.

Accounts receivable

B.

Inventory value

C.

Accounts payable

D.

Cost of capital

Buy Now
Questions 159

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Buy Now
Questions 160

A stockout of dependent-demand item X occurred during the holiday season. To understand the root cause of the stockout, the planner should check if:

Options:

A.

There was high customer demand for X.

B.

There was a wrong seasonal index applied to X.

C.

There was an inventory inaccuracy for X.

D.

There was a low forecast for X.

Buy Now
Questions 161

In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?

Options:

A.

Stockroom inventory balance will be incorrect.

B.

Operator efficiency for the fifth operation will be overstated.

C.

Units in process will be understated.

D.

Work-in-process (WIP) cost will be understated.

Buy Now
Questions 162

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Buy Now
Questions 163

Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?

Options:

A.

Honeypots

B.

Adding listening devices

C.

Adding noise

D.

Acoustic cryptanalysis

Buy Now
Questions 164

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Buy Now
Questions 165

Which of the following BEST effective when protecting against insider threats?

Options:

A.

Implement Two-Factor Authentication (2FA).

B.

Segment data repositories by business rules.

C.

Develop recovery and restoration procedures.

D.

Address security in third-party agreements.

Buy Now
Questions 166

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

Options:

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Buy Now
Questions 167

Database security includes which of the following requirements?

Options:

A.

Physical database integrity, logical database integrity, and ownership integrity

B.

Availability, auditability, and screening

C.

Physical database integrity, logical database integrity, and element integrity

D.

User authentication, availability, and accountability

Buy Now
Questions 168

A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?

Options:

A.

Proxy

B.

Firewall

C.

Router

D.

Switch

Buy Now
Questions 169

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Buy Now
Questions 170

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Buy Now
Questions 171

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network ' s Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Buy Now
Questions 172

A production manager completes a work order for an assembly item, and inventory records for the components are decreased. This is an example of:

Options:

A.

Issuing component inventory

B.

Backflushing inventory

C.

Backward scheduling

D.

Exploding requirements

Buy Now
Questions 173

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Buy Now
Questions 174

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Buy Now
Questions 175

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization ' s databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Buy Now
Questions 176

Return on investment (ROI) is decreased by which of the following activities?

Options:

A.

Increasing prices

B.

Increasing sales volume

C.

Increasing cost of sales

D.

Reducing inventory levels

Buy Now
Questions 177

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Buy Now
Questions 178

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

Options:

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Buy Now
Questions 179

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Buy Now
Questions 180

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

Options:

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Buy Now
Questions 181

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Buy Now
Exam Code: CPIM-8.0
Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
Last Update: May 29, 2026
Questions: 606
$64.4  $183.99
$49.35  $140.99
$44.8  $127.99
buy now CPIM-8.0