Summer Special Sale - Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 575363r9

Welcome To DumpsPedia

CPIM-8.0 Sample Questions Answers

Questions 4

When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?

Options:

A.

Opening of previously closed ports

B.

Adding administrator rights on servers

C.

Performing a Cross-Site Scripting (XSS) attack

D.

Creating a Denial-Of-Service (DoS) condition

Buy Now
Questions 5

A company implementing a localized multi-country strategy to increase market share should engage in which of the following actions?

Options:

A.

Sell different product versions in different countries under different brand names.

B.

Sell the same products under the same brand name worldwide.

C.

Locate plants on the basis of maximum location advantage.

D.

Use the best suppliers regardless of geographic location.

Buy Now
Questions 6

What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?

Options:

A.

Advanced Threat Protection (ATP)

B.

Address Space Layout Randomization (ASLR)

C.

Structured exception handling overwrite protection

D.

Export address table filtering

Buy Now
Questions 7

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

Options:

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Buy Now
Questions 8

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Side-channel

B.

Fault injection

C.

Man-In-The-Middle (MITM)

D.

Frequency analysis

Buy Now
Questions 9

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Buy Now
Questions 10

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Buy Now
Questions 11

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

Options:

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Buy Now
Questions 12

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Buy Now
Questions 13

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations.

B.

The need to develop alternative hosting strategies for applications deployed to the cloud.

C.

Most cloud services offerings are unique to each provider and may not be easily portable.

D.

Integrity and confidentiality are not ensured properly on the most cloud service offerings.

Buy Now
Questions 14

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Buy Now
Questions 15

Which specification enables organizations to ensure penetration test results are documented using open, machine-readable standards?

Options:

A.

Security Content Automation Protocol (SCAP)

B.

Security Orchestration, Automation And Response (SOAR)

C.

Common Weakness Enumeration (CWE)

D.

Common Vulnerability Reporting Framework (CVRF)

Buy Now
Questions 16

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Buy Now
Questions 17

An advantage of applying ABC classification to a firm's replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Buy Now
Questions 18

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Buy Now
Questions 19

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Buy Now
Questions 20

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Buy Now
Questions 21

An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?

Options:

A.

Ciphertext only

B.

Chosen ciphertext

C.

Brute force

D.

Known plaintext

Buy Now
Questions 22

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

Options:

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Buy Now
Questions 23

An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?

Options:

A.

Delete all the files.

B.

Purge the hard drive.

C.

Encrypt the hard drive.

D.

Degauss the hard drive.

Buy Now
Questions 24

An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Internet layer

B.

Transport layer

C.

Application layer

D.

Network layer

Buy Now
Questions 25

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Buy Now
Questions 26

Based on the above table, calculate the mean absolute deviation (MAD).

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Buy Now
Questions 27

How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?

Options:

A.

The MPS is used to plan subassemblies and components; end items are only scheduled when a customer order is received.

B.

Subassemblies are scheduled in the MPS when the customer order is received, and production can start.

C.

Typically, the MPS is not used in companies using an ATO manufacturing strategy.

D.

Often In an ATO environment, the MPS is created once a year and only revised if a product is discontinued.

Buy Now
Questions 28

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Buy Now
Questions 29

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Buy Now
Questions 30

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Buy Now
Questions 31

A statistical safety stock calculation would be appropriate for:

Options:

A.

components used in multiple end items.

B.

new products at time of introduction.

C.

end items with stable demand.

D.

supply-constrained raw materials.

Buy Now
Questions 32

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Buy Now
Questions 33

Which of the following factors is used to determine safety stock?

Options:

A.

Number of customers

B.

Available capacity

C.

Forecast error distribution

D.

Time between customer orders

Buy Now
Questions 34

Which of the following is the BEST reason to conduct a penetration test?

Options:

A.

To verify compliance with organizational patching policies.

B.

To document that all relevant patches have been installed.

C.

To identify technical vulnerabilities.

D.

To determine if weaknesses can be exploited.

Buy Now
Questions 35

Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

Options:

A.

Requiring Multi-Factor Authentication (MFA)

B.

Using public key-based authentication method

C.

Restricting authentication by Internet Protocol (IP) address

D.

Implementing access credentials management tools

Buy Now
Questions 36

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Buy Now
Questions 37

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Buy Now
Questions 38

Which of the following combines multiple software programming tools into one package?

Options:

A.

Integrated development environments

B.

Software development kit

C.

Dynamic Link Libraries (DLL)

D.

Program language compilers

Buy Now
Questions 39

For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components

previously received will have which of the following results?

Options:

A.

Higher cost of goods sold (COGS)

B.

Lower COGS

C.

No change to COGS

D.

A violation of FIFO rules

Buy Now
Questions 40

Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the methods meet the International organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27001.

B.

If the data on the device exceeds what cryptographic erasure can safely process.

C.

If the device was encrypted prior using cipher block chaining.

D.

If the security policies allow for cryptographic erasure based on the data stored on the device.

Buy Now
Questions 41

Which of the following threats MUST be included while conducting threat modeling for a Cloud Service Provider (CSP)?

Options:

A.

Risks of data breaches that can result from inadequate encryption of tenant data in transit and at rest

B.

Potential legal actions from third parties due to tenants’ activities on the CSP’s platform

C.

Vulnerabilities in shared resources that can be exploited by attackers to affect multiple tenants

D.

Threats originating from the CSP’s tenants that can impact the infrastructure and other tenants

Buy Now
Questions 42

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Enforcement rules

B.

Transformation procedures

C.

Data classifications

D.

Integrity labels

Buy Now
Questions 43

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Buy Now
Questions 44

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Buy Now
Questions 45

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

Options:

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Buy Now
Questions 46

An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?

Options:

A.

Spoofing

B.

Spear phishing

C.

Piggybacking

D.

Insider threat

Buy Now
Questions 47

An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?

Options:

A.

Transmission encryption

B.

Multi-Factor Authentication (MFA)

C.

Single Sign-On (SSO)

D.

Transmission authentication

Buy Now
Questions 48

A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?

Options:

A.

Discuss the Non-Disclosure Agreement (NDA) with the affected staff before revoking access.

B.

Revoke the user certificates and add them to the Certificate Revocation List (CRL).

C.

Revoke user access at the time of informing them.

D.

Ask human resources to conduct exit interviews before revoking access.

Buy Now
Questions 49

What is the total load requirement for this work center based on the following data?

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Buy Now
Questions 50

An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?

Options:

A.

When the software is being released for testing

B.

When full system code is being merged

C.

When business analysis is being performed and systems requirements are being identified

D.

When system architecture is being defined and user interface is being designed

Buy Now
Questions 51

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Buy Now
Questions 52

Which of the following is the workflow of the identity and access provisioning lifecycle?

Options:

A.

Creation, Assessment, Deletion

B.

Assessment, Creation, Deletion

C.

Provision, Review, Revocation

D.

Review, Provision, Revocation

Buy Now
Questions 53

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Buy Now
Questions 54

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Buy Now
Questions 55

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?

Options:

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Buy Now
Questions 56

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

Options:

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Buy Now
Questions 57

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Buy Now
Questions 58

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Buy Now
Questions 59

The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:

Options:

A.

revise the rough-cut capacity plan.

B.

reschedule a related component on the shop floor.

C.

check the accuracy of the bills for the MPS items.

D.

determine if a customer order will be impacted.

Buy Now
Questions 60

An example of a cradle-to-cradle sustainability model would be:

Options:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Buy Now
Questions 61

The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Buy Now
Questions 62

A disadvantage of a capacity-lagging strategy may be:

Options:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Buy Now
Questions 63

Which of the following inventory management techniques is most responsive to changes in demand levels?

Options:

A.

Two-bin system

B.

Periodic review system

C.

Cycle counting

D.

ABC classification

Buy Now
Questions 64

An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?

Options:

A.

Sensitive

B.

Confidential

C.

Internal Use Only

D.

Public

Buy Now
Questions 65

In Company XYZ, transaction-costing capability has been Integrated into the shop floor reporting system. A batch of 20 units was started in production. At the fourth operation, 20 units are reported as complete. At the fifth operation, 25 units are reported as complete. When all operations are complete, 20 units are checked into the stockroom. If the error at the fifth operation is undetected, which of the following conditions will be true?

Options:

A.

Stockroom inventory balance will be incorrect.

B.

Operator efficiency for the fifth operation will be overstated.

C.

Units in process will be understated.

D.

Work-in-process (WIP) cost will be understated.

Buy Now
Questions 66

Price negotiation is most appropriate when purchasing which of the following product categories?

Options:

A.

Commodities

B.

Standard products

C.

Items of small value

D.

Made-to-order (MTO) items

Buy Now
Questions 67

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Buy Now
Questions 68

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Buy Now
Questions 69

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

Options:

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Buy Now
Questions 70

An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.

What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?

Options:

A.

Visibility and natural disasters

B.

Visibility and locale

C.

Visibility and hazardous sites

D.

Visibility and transportation

Buy Now
Questions 71

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Buy Now
Questions 72

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Buy Now
Questions 73

A low-cost provider strategy works best when which of the following conditions are met?

Options:

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Buy Now
Questions 74

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Transformation procedures

B.

Enforcement rules

C.

Data classifications

D.

Integrity labels

Buy Now
Questions 75

Which of the following describes the 3 MAIN roles of the identity-delegation model?

Options:

A.

Application server, web server, and delegate

B.

Application server, proxy server, and delegate

C.

Delegator, delegate, and service provider

D.

Delegator, application server, and service provider

Buy Now
Questions 76

Under which of the following conditions is excess capacity most likely a good substitute for safety stock?

Options:

A.

The cost of excess capacity is less than the cost of an additional unit of safety stock in the same period.

B.

The cost to maintain one unit in inventory for a year is less than the direct labor cost.

C.

The service level with safety stock is more than the service level with excess capacity.

D.

Lead time for the product is longer than customers are willing to wait.

Buy Now
Questions 77

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for tracking and profiling an individual's transactions

B.

The potential to break the chain of trust between identity brokers

C.

The potential for exposing an organization's sensitive business information

D.

The potential for unauthorized access to user attributes

Buy Now
Questions 78

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Buy Now
Questions 79

Forecast error typically triggers forecast revision when it is:

Options:

A.

used in computing the tracking signal.

B.

associated with the Introduction stage of the product life cycle.

C.

continually increasing.

D.

caused by random variation.

Buy Now
Questions 80

An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?

Options:

A.

End of Life (EOL)

B.

End of Maintenance

C.

End of Service Life (EOSL)

D.

End of Repair

Buy Now
Questions 81

An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?

Options:

A.

Physical access control

B.

Natural disaster insurance

C.

Natural surveillance

D.

Territorial reinforcement

Buy Now
Questions 82

An organization identified a Distributed Denial-of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Transport layer

B.

Application layer

C.

Internet layer

D.

Network layer

Buy Now
Questions 83

An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?

Options:

A.

Business Continuity Plan (BCP)

B.

Service-Level Agreements (SLA)

C.

Common configuration enumerations

D.

National vulnerabilities database

Buy Now
Questions 84

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Buy Now
Questions 85

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Buy Now
Questions 86

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Buy Now
Questions 87

The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?

Options:

A.

Having a public-facing website with Hypertext Markup Language (HTML) encoding enabled.

B.

Exposure of data stored in cloud repositories.

C.

Username and password are sent using a POST in plain text.

D.

Unsecured data storage elements or storage containers.

Buy Now
Questions 88

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Buy Now
Questions 89

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

Options:

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Buy Now
Questions 90

A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?

Options:

A.

Authorization controls

B.

Two-Factor Authentication (2FA)

C.

Non-repudiation controls

D.

Access audit

Buy Now
Questions 91

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Buy Now
Questions 92

An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?

Options:

A.

International Organization For Standardization (ISO) 27001

B.

International Organization For standardization (ISO) 27002

C.

International Technology Infrastructure Library (ITIL)

D.

Capability Maturity Model (CMM)

Buy Now
Questions 93

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Buy Now
Questions 94

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Buy Now
Questions 95

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Buy Now
Questions 96

A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?

Options:

A.

Establish a device recycle process.

B.

Establish a process preventing credential storage on devices.

C.

Establish a physical destruction process for the storage medium.

D.

Establish a process for check in and check out of devices.

Buy Now
Questions 97

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

Options:

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Buy Now
Questions 98

Which compensating control is the MOST effective to prevent fraud within an organization?

Options:

A.

Separation of privilege

B.

Pre-employment background checks

C.

Principle of least privilege

D.

Log monitoring

Buy Now
Questions 99

Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?

Options:

A.

Customer demand is known but seasonal.

B.

Items are purchased and/or produced continuously and not in batches.

C.

Order preparation costs and inventory-carrying costs are constant and known.

D.

Holding costs, as a percentage of the unit cost, are variable.

Buy Now
Questions 100

Which compensating control is the MOST effective to prevent fraud within an organization?

Options:

A.

Principle of least privilege

B.

Log monitoring

C.

Separation of privilege

D.

Pre-employment background checks

Buy Now
Questions 101

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Buy Now
Questions 102

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Buy Now
Questions 103

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

Options:

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Buy Now
Questions 104

A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?

Options:

A.

Stakeholder identification

B.

Vision statement

C.

Operational efficiency

D.

Solution boundary

Buy Now
Questions 105

Substituting capital equipment in place of direct labor can be economically Justified for which of the following scenarios?

Options:

A.

Volumes are forecasted to increase

B.

Material prices are forecasted to increase

C.

Implementing a pull system in production

D.

Functional layouts are being utilized

Buy Now
Questions 106

Which of the below represents the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Supply chain failure

B.

Loss of business reputation due to co-tenant activities

C.

Loss of governance between the client and cloud provider

D.

Cloud service termination or failure

Buy Now
Questions 107

Which assessing whether real-world threats to the security of an application have been mitigated, what is MOST effective source to confirm that sufficient security controls are in place for both end users and customers?

Options:

A.

Software security team

B.

Product management

C.

Third-party reviews

D.

Senior management

Buy Now
Questions 108

Network Access Control (NAC) is used to perform what function for computers joining the network?

Options:

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Buy Now
Questions 109

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Buy Now
Questions 110

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Buy Now
Questions 111

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Buy Now
Questions 112

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Buy Now
Questions 113

A security engineer needs to perform threat modeling on a microprocessor design for an Internet of Things (IoT) application. Using the MITRE Common Weakness Enumeration (CWE) catalog for hardware, a risk analysis is performed. What kind of threat modeling approach would be BEST to identify entry points into the system based on motivation?

Options:

A.

System centric

B.

Attacker centric

C.

Threat centric

D.

Asset centric

Buy Now
Questions 114

When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?

Options:

A.

Maintain the privacy and confidentiality of information obtained.

B.

Advance and protect the profession.

C.

Act honorably, honestly, justly, responsibly, and legally.

D.

Maintain competency in their respective fields.

Buy Now
Questions 115

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

Options:

A.

One of the requests does not have a valid token issuer's identifier.

B.

The requests have the same 'auth_time' parameter.

C.

The requests have the same 'nonce' parameter.

D.

One of the requests does not have a valid audience token.

Buy Now
Questions 116

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

Options:

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Buy Now
Questions 117

An organization recently completed an acquisition of another entity and staff members are complaining about the excessive number of credentials they need to remember as each application requires separate logins. This is negatively affecting collaboration efficiency and increasing the risk of human errors. What will the organization consider implementing as part of the solution to improve the situation?

Options:

A.

Open Authorization (OAuth) 2.0

B.

Security Assertion Markup Language (SAML) 2.0

C.

Password Authentication Protocol (PAP)

D.

OpenID Connect (OIDC)

Buy Now
Questions 118

An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?

Options:

A.

Security awareness training

B.

Role-Based Access Control (RBAC)

C.

User behavior analytics solution

D.

File integrity monitoring

Buy Now
Questions 119

Which of the following MUST exist for an activity to be considered an audit?

Options:

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

Buy Now
Questions 120

A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Web application unit test

B.

Online application development test

C.

Web application penetration test

D.

Online application assurance test

Buy Now
Questions 121

A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?

Options:

A.

Logical access control against symmetric key

B.

Cryptanalysis against symmetric key

C.

Cryptanalysis against private key

D.

Logical access control against private key

Buy Now
Questions 122

Which of the following is an information security management framework?

Options:

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Buy Now
Questions 123

A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:

Options:

A.

each unique tool.

B.

percentage of total for each tool.

C.

raw material requirements.

D.

specific kit configurations.

Buy Now
Questions 124

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

Options:

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Buy Now
Questions 125

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

Options:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Buy Now
Questions 126

An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?

Options:

A.

TPM will use the Operating System (OS) for full disk encryption key protection.

B.

TPM will protect the full disk encryption keys.

C.

TPM will handle the allocation of the hardware storage drives for full disk encryption.

D.

TPM will provide full disk encryption automatically.

Buy Now
Questions 127

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Buy Now
Questions 128

An organization’s security team is looking at ways to minimize the security risk of the container infrastructure. The lead engineer needs to select a suite of remediation actions to minimize risks. Which programmatic approach will result in preventing, detecting , and responding to the GREATEST number of threats aimed at container operations?

Options:

A.

Use of hardware-based countermeasures to provide a basis for trusted computing

B.

Use of container-aware runtime defense tools

C.

Grouping containers with the same sensitivity level on a single host

D.

Adoption of container-specific vulnerability management tools

Buy Now
Questions 129

In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?

Options:

A.

Head of human capital

B.

Head of compliance

C.

Chief Information Security Officer (CISO)

D.

Chief Information Officer (CIO)

Buy Now
Questions 130

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Buy Now
Questions 131

It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours. One modeler finished 5 models a day, and the other finished 1 model a day. What was the demonstrated capacity last week?

Options:

A.

25models

B.

15models

C.

10models

D.

30models

Buy Now
Questions 132

What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?

Options:

A.

Legitimate data collection

B.

Limitation of use

C.

Collection Categorization

D.

Collection limitation

Buy Now
Questions 133

After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?

Options:

A.

Eliminated

B.

Mitigated

C.

Transferred

D.

Accepted

Buy Now
Questions 134

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Buy Now
Questions 135

What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?

Options:

A.

Inventory use cases, categorize threats, evaluate business impact

B.

Understand attack front, identify trust levels, decompose application

C.

Inventory countermeasures, identify threats, implement mitigations

D.

Establish monitoring, identify risks, implement countermeasures

Buy Now
Questions 136

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Buy Now
Questions 137

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

Options:

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Buy Now
Questions 138

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

Options:

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

Buy Now
Questions 139

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Buy Now
Questions 140

A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?

Options:

A.

Separating internal wireless users from guests

B.

Media Access control (MAC) address filtering

C.

Multi-Factor Authentication (MFA)

D.

Deploy mutual authentication between the client and the network

Buy Now
Questions 141

In a large organization, the average time for a new user to receive access is seven days. Which of the following is the BEST enabler to shorten this time?

Options:

A.

Implement a self-service password management capability

B.

Increase system administration personnel

C.

Implement an automated provisioning tool

D.

Increase authorization workflow steps

Buy Now
Questions 142

Which of the following is the BEST type of fire extinguisher for a data center environment?

Options:

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Buy Now
Questions 143

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Buy Now
Questions 144

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Buy Now
Questions 145

The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?

Options:

A.

Confidentiality, integrity, availability

B.

Physical security, access control, asset protection

C.

Intent, capability, opportunity

D.

Threat level, network security, information disposal

Buy Now
Questions 146

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Buy Now
Questions 147

Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?

Options:

A.

Allowing only one person to enter at a time

B.

Auditing access logs annually

C.

Limiting access to regular business hours only

D.

Establishing entry points from public areas only

Buy Now
Questions 148

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

Options:

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Buy Now
Questions 149

A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?

Options:

A.

Maximum Tolerable Downtime (MTD)

B.

Recovery Point Objective (RPO)

C.

Recovery Time Objective (RTO)

D.

Mean Time to Recovery (MTTR)

Buy Now
Questions 150

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Buy Now
Questions 151

Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?

Options:

A.

Facilitates development of organization-wide security metrics

B.

Allows management to assess which organizational elements have the best security practices

C.

Provides the organization a wider view of systemic weaknesses and deficiencies in their information systems

D.

Identifies areas that require additional training emphasis in each organizational element

Buy Now
Questions 152

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Options:

Buy Now
Questions 153

Which authentication method is used by an email server to verify that a sender’s Internet Protocol (IP) address is authorized to send messages by the sending domain?

Options:

A.

DomainKeys Identified Mail (DKIM)

B.

Sender policy framework

C.

Pointer record

D.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Buy Now
Questions 154

An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?

Options:

A.

To identify any residual vulnerabilities prior to release in the production environment

B.

To identify and remediate any residual vulnerabilities prior to the end of the user acceptance testing

C.

To identify any residual vulnerabilities prior to the end of the trial run of the software

D.

To identify and remediate any residual vulnerabilities prior to release in the production environment

Buy Now
Questions 155

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Buy Now
Questions 156

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Buy Now
Questions 157

Maintaining software asset security is MOST dependent on what information?

Options:

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Buy Now
Questions 158

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

Options:

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Buy Now
Questions 159

When designing a production cell, which of the following items would be the most important consideration?

Options:

A.

Theunit per hour requirement for the production cell to meet the sales forecast

B.

Theflow of materials into the cell and sequencing of operations to minimize total cycle time

C.

Theoutput rate for the first operation and move time after the last workstation

D.

Thetakt time requirement for each operator to meet the monthly production goals of the plant

Buy Now
Questions 160

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Completeness

B.

Vulnerabilities

C.

Security

D.

Logic

Buy Now
Questions 161

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?

Options:

A.

A

B.

B

C.

C

D.

E

Buy Now
Questions 162

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

As close to the workload as possible, because it impacts authorization decisions

B.

Between the data stores and the trust engine, because it improves security policies

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the policy engine and the trust engine, because it enforces security policies

Buy Now
Questions 163

One of the most useful tools for analyzing the sustainable footprint is:

Options:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Buy Now
Questions 164

Long lead-time items with stable demand would best be supported by a supply chain:

Options:

A.

using a pull system.

B.

linked through an enterprise resources planning (ERP) system.

C.

designed to be responsive.

D.

positioning inventory close to the consumer.

Buy Now
Questions 165

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Buy Now
Exam Code: CPIM-8.0
Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
Last Update: Oct 15, 2025
Questions: 552
$66  $164.99
$50  $124.99
$42  $104.99
buy now CPIM-8.0