Big Halloween Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

APICS CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Exam Practice Test

Page: 1 / 57
Total 565 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Question 2

Which of the following is the BEST reason to conduct a penetration test?

Options:

A.

To verify compliance with organizational patching policies.

B.

To document that all relevant patches have been installed.

C.

To identify technical vulnerabilities.

D.

To determine if weaknesses can be exploited.

Question 3

A company's primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Question 4

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Question 5

During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?

APerform drills on a recurring basis.

B.Harden all critical facilities.

C.Outsource to an external organization.

D.Allocate 100% of required funds.

Options:

Question 6

Which of the following measurements indicates there may be bias In the forecast model?

Options:

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Question 7

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Question 8

Which of the following combines multiple software programming tools into one package?

Options:

A.

Program language compilers

B.

Integrated development environments

C.

Dynamic Link Libraries (DLL)

D.

Software development kit

Question 9

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Question 10

Which of the following product design approaches are likely to reduce time to market for a global supply chain?

Options:

A.

Concurrent engineering

B.

Design for manufacture

C.

Design for logistics

D.

Quality function deployment (QFD)

Question 11

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Question 12

An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.

Which approach will MOST likely have been easier to execute?

Options:

A.

System-centric approach

B.

Attacker-centric approach

C.

Asset-centric approach

D.

Developer-centric approach

Question 13

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

Options:

A.

Rule-based

B.

Mandatory

C.

Role-based

D.

Automated

Question 14

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

Options:

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Question 15

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

Options:

A.

Organization's security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Question 16

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 17

Which of the following tools is used to evaluate the impact that a production plan has on capacity?

Options:

A.

Demand time fence (DTF)

B.

Bill of resources

C.

Product routing

D.

Safety capacity

Question 18

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

Options:

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Question 19

An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?

Options:

A.

Ensure that the call agents are using an additional authentication method.

B.

Implement a Network Access Control (NAC) solution.

C.

Ensure that the voice media is using Secure Real-Time Transport Protocol.

D.

Segment the voice network and add Next-Generation Firewalls (NGFW).

Question 20

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 21

Which threat modeling methodology is focused on assessing risks from organizational assets?

Options:

A.

Process For Attack Simulation And Threat Analysis (PASTA)

B.

Operationally Critical Threat, Asset, And Vulnerability Evaluation (OCTAVE)

C.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

D.

Damage, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

Question 22

To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?

Options:

A.

Cold Site

B.

Mobile Site

C.

Hot Site

D.

Warm Sit

Question 23

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Question 24

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

Options:

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question 25

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Question 26

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

Between the policy engine and the trust engine, because it enforces security policies

B.

As close to the workload as possible, because it impacts authorization decisions

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the data stores and the trust engine, because it improves security policies

Question 27

Which of the following inventory management techniques is most responsive to changes in demand levels?

Options:

A.

Two-bin system

B.

Periodic review system

C.

Cycle counting

D.

ABC classification

Question 28

An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?

Options:

A.

Provide travel security training.

B.

Provide specific pre-travel intelligence briefing.

C.

Complete a travel risk assessment.

D.

Refresh the corporate travel policy.

Question 29

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 30

A statistical safety stock calculation would be appropriate for:

Options:

A.

components used in multiple end items.

B.

new products at time of introduction.

C.

end items with stable demand.

D.

supply-constrained raw materials.

Question 31

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

Options:

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Question 32

Which of the following is an access control method that organizations can use to prevent unauthorized access?

Options:

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Question 33

The primary purpose for engaging in cycle count activities is to:

Options:

A.

eliminate the need for a traditional physical inventory count.

B.

more frequently reconcile the actual on-hand and system on-hand for items.

C.

smooth out the tasks of counting inventory throughout the fiscal year.

D.

improve material handling processes and reduce or eliminate errors.

Question 34

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

Options:

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Question 35

Corporate fraud has historically been difficult to detect. Which of the following methods has been the MOST helpful in unmasking embezzlement?

Options:

A.

Accidental discovery

B.

Management review

C.

Anonymous tip lines

D.

Internal audit

Question 36

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

Options:

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Question 37

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Question 38

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

Options:

A.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

B.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

C.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

D.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

Question 39

For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?

Options:

A.

Conduct a Pareto analysis

B.

Plan-do-check-action (PDCA)

C.

Plot histograms

D.

Monitor control charts

Question 40

A life cycle assessment (LCA) would be used to determine:

Options:

A.

the length of a long-term agreement.

B.

how an Item should be scheduled.

C.

environmental aspects and impacts.

D.

If risk pooling would reduce inventory investment.

Question 41

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 42

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

Options:

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Question 43

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

Options:

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Question 44

Given the following data, calculate the appropriate takt time:

Options:

A.

0.25 minutes

B.

1 minute

C.

2 minutes

D.

4 minutes

Question 45

An advantage of applying ABC classification to a firm's replenishment items is that:

Options:

A.

it distinguishes independent demand from dependent demand.

B.

it allows planners to focus on critical products.

C.

it provides better order quantities than the economic order quantity (EOQ).

D.

it allows the firm to utilize time-phased order point (TPOP).

Question 46

Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is

made to stock?

Options:

A.

An increase in the customer service level is planned for the product family.

B.

New models are being added to the product family.

C.

Planned ending inventory for the product family is less than the beginning inventory.

D.

There is a long-term upward trend in demand for the product family.

Question 47

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

Options:

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Question 48

What function prevents unauthorized devices from gaining access to a network?

Options:

A.

Network Access Control (NAC)

B.

Storage Area Network (SAN)

C.

Network Address Translation (NAT)

D.

Software-Defined Network (SDN)

Question 49

A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?

Options:

A.

Encryption in transit

B.

Layer 7 filtering

C.

Encryption at rest

D.

Password hashing

Question 50

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

Options:

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Question 51

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 52

What is the MAIN benefit of network segmentation?

Options:

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Question 53

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question 54

Which of the following roles is the BEST choice for classifying sensitive data?

Options:

A.

Information system owner

B.

Information system security manager

C.

Information owner

D.

Information system security officer

Question 55

In a lean environment, the batch-size decision for planning "A" items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 56

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

Options:

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Question 57

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

Options:

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question 58

A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.

Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?

Options:

A.

Increase planned production for the next three periods.

B.

Defer the upgrade to a period beyond the planning time fence.

C.

Increase planned production from the fifth period on.

D.

Defer the upgrade to the period in which the highest stock level is planned.

Question 59

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

Options:

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Question 60

One of the benefits of Integrating a poka-yoke into the production process is that it can be used to:

Options:

A.

facilitate mixed-model scheduling.

B.

prevent defects.

C.

Improve machine utilization.

D.

enable one-piece flow.

Question 61

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

Options:

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Question 62

The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?

Options:

A.

Remediation

B.

Administration

C.

Authorization

D.

Enumeration

Question 63

Which of the following planning modules considers the shortest-range planning goals?

Options:

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question 64

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

Options:

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Question 65

Information regarding a major new customer is received from sales. The company's most appropriate initial response would be to adjust the:

Options:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Question 66

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Question 67

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

Options:

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Question 68

A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?

Options:

A.

Produceto backorders

B.

Produceat a constant level

C.

Produceto the sales forecast

D.

Produceto demand

Question 69

As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?

Options:

A.

Data steward

B.

Data processor

C.

Data controller

D.

Data custodian

Question 70

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Question 71

The production plan relates to a firm's financial planning because it is used to:

Options:

A.

calculate standard product costs.

B.

determine variable costs.

C.

project payroll costs.

D.

identify future cash needs.

Question 72

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Question 73

The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Question 74

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Question 75

Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?

Options:

A.

Inventory write-off

B.

Backflushing

C.

Cycle count

D.

Kanban

Question 76

What is the FIRST element that must be evaluated in a security governance program?

Options:

A.

An organization’s business objectives and strategy

B.

Review of Information Technology (IT) and technical controls

C.

Review of organization’s Information Technology (IT) security policies

D.

An organization’s utilization of resources

Question 77

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Question 78

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Question 79

An independent risk assessment determined that a hospital's existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

Options:

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Question 80

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 81

The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:

Options:

A.

represents the forecast before changes are made in S&OP.

B.

represents the forecast with less detail.

C.

balances supply and demand at the product mix level.

D.

balances supply and demand at the sales volume level.

Question 82

An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?

Options:

A.

By priority as defined by the critical assets list

B.

The latest Continuity Of Operations Plan (COOP)

C.

Senior management assessment and approval

D.

The latest Business Impact Analysis (BIA)

Question 83

When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?

Options:

A.

Assessing the possible impact from unauthorized access on the organization's cyber insurance policies

B.

Developing a contingency roadmap that will provide processes for each identified and documented risk element

C.

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system

D.

Defining which systems are maintained by third parties and whether their control processes have been included as part of the risk assessment

Question 84

Which of the following statements is true about total productive maintenance (TPM)?

Options:

A.

It uses statistical tools.

B.

It is part of the business strategy.

C.

It influences the product design process.

D.

It minimizes unscheduled breakdowns.

Question 85

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 86

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

Options:

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Question 87

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

Options:

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Question 88

An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.

Why is the vendor's penetration test considered incomplete?

Options:

A.

The vendor should have attempted to exploit the identified vulnerabilities.

B.

The vendor should also provide a guide to remediate the identified vulnerabilities.

C.

The vendor should have provided a risk report of vulnerabilities found.

D.

The vendor should have worked closely with network engineers to understand the network infrastructure better.

Question 89

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

Options:

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Question 90

A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?

Options:

A.

Configure internal firewalls to accept and pass all scanner traffic and responses

B.

Execute a vulnerability scan to determine the current organization security posture

C.

Select two different vulnerability scanners to get comprehensive reporting

D.

Obtain support from the computing systems' stakeholders

Question 91

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

Options:

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Question 92

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 93

What is the MAIN privacy risk raised by federated identity solutions?

Options:

A.

The potential for unauthorized access to user attributes

B.

The potential for tracking and profiling an individual's transactions

C.

The potential for exposing an organization's sensitive business information

D.

The potential to break the chain of trust between identity brokers

Question 94

Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?

Options:

A.

Definition of anti-spam policies

B.

Removal of previous email servers

C.

Definition of key management policies

D.

Backup of email messages and folders

Question 95

A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

Options:

A.

Determine the acceptable level of loss exposure at which the organization is comfortable operating.

B.

Conduct a gap assessment and produce a risk rating report for the executive leadership.

C.

Engage consultants to audit the organization against best practices and provide a risk report.

D.

Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.

Question 96

What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?

Options:

A.

Employee badge with a picture and video surveillance

B.

Keyed locks and Closed-Circuit Television (CCTV) at entrances

C.

Combination lock and a gate that prevents piggybacking

D.

Proximity badge requiring a Personal Identification Number (PIN) entry at entrances

Question 97

Maintaining software asset security is MOST dependent on what information?

Options:

A.

Software licensing

B.

Asset ownership

C.

Inventory of software

D.

Classification level

Question 98

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 99

After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization's IAM solution?

Options:

A.

Enhanced background checks

B.

Mobile Multi-Factor Authentication (MFA) application

C.

Biometric system

D.

Personal Identification Number (PIN) code

Question 100

What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?

Options:

A.

Ease of use

B.

Limitation of Infrastructure

C.

Adapter compatibility concerns

D.

Cost concerns

Question 101

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

Options:

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Question 102

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Question 103

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

Options:

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Question 104

An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?

Options:

A.

Do nothing; the loss validates the ARO.

B.

DO nothing; the loss validates the exposure factor.

C.

Recalculate the value of the safeguard.

D.

Recalculate the cost of the countermeasure.

Question 105

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

Options:

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

Question 106

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

Options:

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Question 107

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

Options:

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Question 108

According to quality function deployment (QFD), customer needs are gathered through:

Options:

A.

employee suggestions.

B.

technical specifications.

C.

surveys.

D.

historical data.

Question 109

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 110

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 111

A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization's corporate cloud. What is the MAIN benefit of the organization's Federated Identity Management (FIM) system to address the need?

Options:

A.

Efficient access provisioning

B.

Increased robustness of authentication

C.

Greater flexibility of access control

D.

Reduced complexity of maintenance and changes

Question 112

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Question 113

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Question 114

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

Options:

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question 115

The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

B.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

C.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

D.

Request a software demo with permission to have a third-party penetration test completed on it.

Question 116

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

Options:

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Question 117

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Question 118

A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.

Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?

MachineFixed CostVariable Cost per UnitAnnual Capacity

AS100.000$6 00800,000 units

B$200,000$5 501.000,000 units

C$250,000$5 001,200,000 units

D$1 000.000$4 501 400.000 units

Options:

A.

Machine A

B.

Machine B

C.

Machine C

D.

Machine D

Question 119

Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?

Options:

A.

Accuracy of Key Risk Indicators (KRI) reported to senior management

B.

Ensure the integrity of the organization's assets

C.

Backups being completed in a timely manner

D.

Accuracy of Key Performance Indicators (KPI) reported to senior management

Question 120

What BEST describes the end goal of a Disaster Recovery (DR) program?

Options:

A.

Review the status of mission-critical applications.

B.

Prevent business interruption.

C.

Continue business operations during a contingency.

D.

Restore normal business operations.

Question 121

In the design and development of a manufacturing process, process engineers would most likely be responsible for decisions relating to:

Options:

A.

lead times.

B.

production capacity.

C.

product reliability.

D.

routing sequences.

Question 122

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network's Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Question 123

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 124

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 125

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?

Options:

A.

A

B.

B

C.

C

D.

E

Question 126

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Question 127

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Question 128

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

B.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

C.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

D.

Security-focused CM surpasses existing security requirements of the organization.

Question 129

A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?

Options:

A.

Fewer product design changes

B.

An increase in obsolete inventory

C.

More accurate forecasting

D.

Conflicts between purchasing and engineering

Question 130

Health information stored in paper form may be destroyed using which of the following methods?

Options:

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Question 131

Asymmetric cryptography uses which type of key to encrypt data?

Options:

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Question 132

An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?

Options:

A.

Publish and enforce enterprise policies that assign risk decisions to corporate officers.

B.

Publish and enforce enterprise policies that assign risk decisions to cybersecurity analysts.

C.

Publish and enforce enterprise policies that assign risk decisions to business unit managers.

D.

Publish and enforce enterprise policies that assign risk decisions to system administrators.

Question 133

A financial organization is using an internally developed application.The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC).For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Online application assurance test

B.

Web application unit test

C.

Online application development test

D.

Web application penetration test

Question 134

A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?

Options:

A.

6 hours

B.

8 hours

C.

18 hours

D.

24 hours

Question 135

The primary benefit that results from the cross-training of employees is:

Options:

A.

improved flexibility.

B.

improved capacity.

C.

shortened lead time.

D.

effective problem-solving.

Question 136

Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?

Options:

A.

Transmission Control Protocol (TCP)

B.

Voice Over Internet Protocol (VoIP)

C.

User Datagram Protocol (UDP)

D.

HyperText Transfer Protocol Secure (HTTPS)

Question 137

A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

Options:

A.

Tandem testing

B.

Blind testing

C.

Double-gray testing

D.

Double-blind testing

Question 138

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 139

The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?

Cost CategoryCost

Custom fees$125

Freight$700

Warehouse rent$200

Matenal cost$500

Options:

A.

$825

B.

$1,325

C.

$1,400

D.

$1,525

Question 140

A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?

Options:

A.

Security Information And Event Management (SIEM)

B.

Network Intrusion Detection System (NIDS)

C.

Vulnerability scan

D.

Penetration test

Question 141

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Question 142

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

Options:

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Question 143

Network Access Control (NAC) is used to perform what function for computers joining the network?

Options:

A.

Ensure all networking components communicate with each other.

B.

Ensure that all approved devices can join the network.

C.

Restrict access to the network based on Media Access Control (MAC) address or Internet Protocol (IP) address.

D.

Restrict the time and date that computers are allowed to connect to the organization’s network.

Question 144

Which of the physiological biometric scanning methods is considered the MOST invasive?

Options:

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Question 145

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Question 146

Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?

Options:

A.

Private cloud

B.

Multicloud

C.

Public cloud

D.

Hybrid cloud

Question 147

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

Options:

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Question 148

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Question 149

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 150

Which of the following is the workflow of the identity and access provisioning lifecycle?

Options:

A.

Creation, Assessment, Deletion

B.

Assessment, Creation, Deletion

C.

Provision, Review, Revocation

D.

Review, Provision, Revocation

Question 151

Which of the following is the fundamental difference between finite loading and other capacity planning approaches?

Options:

A.

It is highly dependent on advanced computer software to function effectively.

B.

It is only managed by shop floor supervisors.

C.

It can use historical information to drive decision-making processes.

D.

It considers adjustments to plans based on planned capacity utilization.

Question 152

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Question 153

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Question 154

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Question 155

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Question 156

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Question 157

Long lead-time items with stable demand would best be supported by a supply chain:

Options:

A.

using a pull system.

B.

linked through an enterprise resources planning (ERP) system.

C.

designed to be responsive.

D.

positioning inventory close to the consumer.

Question 158

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 159

Which of the following production activity control (PAC) techniques focuses on optimizing output?

Options:

A.

Gantt chart

B.

Priority sequencing rules

C.

Theory of constraints (TOC) scheduling

D.

Critical path management (CPM)

Question 160

An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?

Options:

A.

Conduct an integrated audit against the most stringent security controls.

B.

Combine the systems into a single audit and implement security controls per applicable standard.

C.

Combine the systems into a single audit against all of the associated security controls.

D.

Audit each system individually and implement the applicable standard specific security controls.

Question 161

If fixed costs are §200,000 and 20,000 units are produced, a unit's fixed cost is §10. This is an example of:

Options:

A.

variable costing.

B.

activity-based costing (ABC).

C.

absorption costing.

D.

overhead costing.

Question 162

An organization's security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 163

Which of the following techniques would a group use to prioritize problems?

Options:

A.

Critical path analysis

B.

Pareto analysis

C.

Scatter charts

D.

Cause-and-effect diagrams

Question 164

A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?

Options:

A.

Secure Shell (SSH)

B.

Trusted Platform Module (TPM)

C.

Virtual Private Network (VPN)

D.

Transport Layer Security (TLS)

Question 165

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Page: 1 / 57
Total 565 questions