When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
Which of the following statements best characterizes enterprise resources planning (ERP) systems?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
Which of the following is the BEST way to identify the various types of software installed on an endpoint?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
Which of the following production activity control (PAC) techniques focuses on optimizing output?
Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
An advantage of applying ABC classification to a firm's replenishment items is that:
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?
An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?
An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?
An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?
A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?
How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?
A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?
Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?
A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?
Which of the following combines multiple software programming tools into one package?
For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components
previously received will have which of the following results?
Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?
Which of the following threats MUST be included while conducting threat modeling for a Cloud Service Provider (CSP)?
During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.
Which of the following security controls would BEST prevent this type of incident in the future?
An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?
An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?
A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?
What is the total load requirement for this work center based on the following data?
An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?
Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?
Which of the following is the workflow of the identity and access provisioning lifecycle?
In which of the following phases of the product life cycle is product price most effective in influencing demand?
Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?
Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?
The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:
The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:
Which of the following inventory management techniques is most responsive to changes in demand levels?
An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?
In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?
Price negotiation is most appropriate when purchasing which of the following product categories?
Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
Which of the following MUST be checked during the validation of software verification capabilities?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
A low-cost provider strategy works best when which of the following conditions are met?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
Under which of the following conditions is excess capacity most likely a good substitute for safety stock?
A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?
An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?
An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?
An organization identified a Distributed Denial-of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?
An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?
An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?
Which of the following should Business Impact Analysis (BIA) reports always include?
Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is
made to stock?
The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?
A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?
Which of the following MUST be checked during the validation of software verification capabilities?
An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?
How would blockchain technology support requirements for sharing audit information among a community of organizations?
An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?
A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
Which compensating control is the MOST effective to prevent fraud within an organization?
Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?
Which compensating control is the MOST effective to prevent fraud within an organization?
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
Which of the following are steps involved in the identity and access provisioning lifecycle?
Which of the following benefits typically will be realized when switching from a functional to a cellular layout?
A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?
Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?
Network Access Control (NAC) is used to perform what function for computers joining the network?
In a lean environment, the batch-size decision for planning "A" items would be done by:
Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?
Reducing distribution network inventory days of supply will have which of the following Impacts?
The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:
A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?
When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?
An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?
A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?
An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?
An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?
A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?
A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?
A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:
An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
An organization’s security team is looking at ways to minimize the security risk of the container infrastructure. The lead engineer needs to select a suite of remediation actions to minimize risks. Which programmatic approach will result in preventing, detecting , and responding to the GREATEST number of threats aimed at container operations?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?
It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours. One modeler finished 5 models a day, and the other finished 1 model a day. What was the demonstrated capacity last week?
What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?
After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?
A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?
Which of the following is the BEST type of fire extinguisher for a data center environment?
A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?
Which of the following tools shows process changes and random variation over time?
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?
Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?
APerform drills on a recurring basis.
B.Harden all critical facilities.
C.Outsource to an external organization.
D.Allocate 100% of required funds.
Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?
An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?
What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?
When designing a production cell, which of the following items would be the most important consideration?
Which of the following MUST be checked during the validation of software verification capabilities?
An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?
In a Zero Trust (ZT) model, where should the enforcement component be placed and why?
Long lead-time items with stable demand would best be supported by a supply chain:
Improvements in an Input/output control (I/O control) system will most likely lead to: