Summer Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: geek65

CPIM-8.0 Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Questions 4

Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.

What BEST describes the requirement changes that are happening?

Options:

A.

Volatility

B.

Stove-piped requirements

C.

Non-verifiable requirements

D.

Scope creep

Buy Now
Questions 5

Who is ultimately responsible for ensuring that specific data is protected?

Options:

A.

Custodian

B.

Data owner

C.

Data controller

D.

System owner

Buy Now
Questions 6

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Buy Now
Questions 7

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Buy Now
Questions 8

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Buy Now
Questions 9

Which of the following BEST describes the responsibility of an information System Security Officer?

Options:

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Buy Now
Questions 10

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

Options:

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Buy Now
Questions 11

One of the most useful tools for analyzing the sustainable footprint is:

Options:

A.

process mapping.

B.

lean six sigma.

C.

SWOT analysis.

D.

ISO 9000.

Buy Now
Questions 12

A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?

Options:

A.

Secure SQL service port with a Transport Layer Security (TLS) certificate.

B.

Use Multi-Factor Authentication (MFA) for all logins to the server.

C.

Secure SQL service port with a Secure Sockets Layer (SSL) certificate.

D.

Scan all connections to the server for malicious packets.

Buy Now
Questions 13

An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?

Options:

A.

Network

B.

Stateless

C.

Stateful

D.

Packet

Buy Now
Questions 14

Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?

Options:

A.

The initial cost of the setup is prohibitively high for small business.

B.

The token stored by the Identity Provider (IdP) may need to be renewed.

C.

The token generated by the Identity Provider (IdP) may be corrupted.

D.

The participating members in a federation may not adhere to the same rules of governance.

Buy Now
Questions 15

An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?

Options:

A.

Internet layer

B.

Transport layer

C.

Application layer

D.

Network layer

Buy Now
Questions 16

A security engineer is responsible for verifying software reliability prior to commercial deployment. Which of the following factor would BEST be verified to ensure that the software stays reliable?

Options:

A.

Monitoring

B.

Web Application Firewall (WAF)

C.

Content Delivery Network (CDN)

D.

Logging

Buy Now
Questions 17

The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?

Options:

A.

Having a public-facing website with Hypertext Markup Language (HTML) encoding enabled.

B.

Exposure of data stored in cloud repositories.

C.

Username and password are sent using a POST in plain text.

D.

Unsecured data storage elements or storage containers.

Buy Now
Questions 18

One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

Options:

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

Buy Now
Questions 19

In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?

Options:

A.

Half-duplex

B.

Simplex

C.

Unicast

D.

Full-duplex

Buy Now
Questions 20

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

Options:

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Buy Now
Questions 21

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Review logs of all user's social media activity.

B.

Review the organizational social media policy.

C.

Initiate the organization's incident response plan.

D.

Determine a list of information assets that contain PII.

Buy Now
Questions 22

Which of the below represents the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Supply chain failure

B.

Loss of business reputation due to co-tenant activities

C.

Loss of governance between the client and cloud provider

D.

Cloud service termination or failure

Buy Now
Questions 23

Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?

Options:

A.

Apply patches to endpoints across the enterprise.

B.

Use software configuration management for endpoints.

C.

Monitor endpoints by collecting software inventory and configuration settings.

D.

Enforce Two-Factor Authentication (2FA) on endpoints across the enterprise.

Buy Now
Questions 24

A healthcare organization’s new cloud-based customer-facing application is constantly receiving security events from dubious sources. What BEST describes a security event that compromises the confidentiality, integrity, or availability of the application and data?

Options:

A.

Attack

B.

Breach

C.

Failure

D.

Incident

Buy Now
Questions 25

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

Options:

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Buy Now
Questions 26

The security department was notified about vulnerabilities regarding users' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?

Options:

A.

Exposure of sensitive information

B.

Use of hard-coded passwords

C.

Trust boundary violation

D.

Improper authentication

Buy Now
Questions 27

How would blockchain technology support requirements for sharing audit information among a community of organizations?

Options:

A.

By creating a cryptographically signed event-specific audit block

B.

By creating a centralized audit aggregation service

C.

By creating a centralized digital ledger system

D.

By creating a decentralized digital ledger of cryptographically signed transactions

Buy Now
Questions 28

When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?

Options:

A.

Continuous Integration and Continuous Delivery (CI/CD)

B.

Common Vulnerabilities and Exposures (CVE)

C.

Security Content Automation Protocol (SCAP)

D.

Common Vulnerability Scoring System (CVSS)

Buy Now
Questions 29

Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?

Options:

A.

The cloud service provider is responsible for all security within the workload

B.

Allows a user to enable remote logins to running workloads

C.

Security testing is managed after image creation

D.

No longer have to bring system down to patch

Buy Now
Questions 30

An organization has been struggling to improve their security posture after a recent breach.

Where should the organization focus their efforts?

Options:

A.

Common configuration enumerations

B.

Business Continuity Plan (BCP)

C.

Service-Level Agreements (SLA)

D.

National vulnerability database

Buy Now
Questions 31

In a hospital, during a routine inspection performed by the computerized tomography device technical service, it is discovered that the values of radiation used in scans are one order of magnitude higher than the default setting. If the system has had an unauthorized access, which one of the following concepts BEST describes which core principle has been compromised?

Options:

A.

Confidentiality

B.

Availability

C.

Cybersecurity

D.

Integrity

Buy Now
Questions 32

An organization is migrating its access controls to a certificate-based authentication system.

What will need to be established to verify the identity of all users connecting to the network before rolling out the system?

Options:

A.

A biometric system needs to scan unique attributes of all users.

B.

A Certificate Authority (CA) needs to issue new passwords to all users.

C.

A Certificate Authority (CA) needs to issue the certificates to all users.

D.

A challenge response system needs to validate all user access.

Buy Now
Questions 33

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

Options:

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Buy Now
Questions 34

A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?

Options:

A.

Carrying

B.

Ordering

C.

Landed

D.

Product

Buy Now
Questions 35

Which compensating control is the MOST effective to prevent fraud within an organization?

Options:

A.

Separation of privilege

B.

Pre-employment background checks

C.

Principle of least privilege

D.

Log monitoring

Buy Now
Questions 36

For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components

previously received will have which of the following results?

Options:

A.

Higher cost of goods sold (COGS)

B.

Lower COGS

C.

No change to COGS

D.

A violation of FIFO rules

Buy Now
Questions 37

During the initiation phase of a project to acquire a customer relation management system, what is the FIRST step a project team will take for early integration of security?

Options:

A.

Develop a list of security requirements for the system.

B.

Conduct project planning and a feasibility assessment.

C.

Define system security classifications.

D.

Review relevant regulatory practices and standards.

Buy Now
Questions 38

When starting an external benchmarking study, a firm must first:

Options:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition's.

Buy Now
Questions 39

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

Options:

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Buy Now
Questions 40

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

Options:

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Buy Now
Questions 41

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Buy Now
Questions 42

Which of the following BEST describes an individual modifying something the individual is not supposed to?

Options:

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Buy Now
Questions 43

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

Options:

A.

80

B.

120

C.

160

D.

200

Buy Now
Questions 44

An organization intends to host an application on a multi-tenant Infrastructure as a Service (IaaS) platform. Which of the following measures are MOST important to ensure proper protection of sensitive information?

Options:

A.

Enforcement of logging and monitoring of all access to the application

B.

Enforcement of separation measures within the storage layer of the service

C.

Enforcement of perimeter security measures including the deployment of a virtual firewall

D.

Enforcement of endpoint security measures on the Virtual Machines (VM) deployed into the service

Buy Now
Questions 45

An example of an assignable cause of variation in process performance is:

Options:

A.

power fluctuation during machine operation.

B.

machine vibration during operation.

C.

incorrect setup of a machine by the operator.

D.

changes in temperature in the machine shop.

Buy Now
Questions 46

A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?

Options:

A.

Brewer-Nash

B.

Bell-LaPadula

C.

Biba Integrity

D.

Clark Wilson

Buy Now
Questions 47

What is the MAIN benefit of network segmentation?

Options:

A.

Limiting data transfer

B.

Limiting cyberattack damage

C.

Limiting privilege access

D.

Limiting network addresses

Buy Now
Questions 48

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Buy Now
Questions 49

The question below is based on the following standard and actual data of a production order

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Buy Now
Questions 50

Broadcast traffic is causing network performance degradation of sensitive equipment.

Which of the following methods is used to prevent the broadcast traffic from impacting availability?

Options:

A.

Place the sensitive equipment behind a firewall to prevent the broadcast traffic from impacting the equipment.

B.

Implement Quality of Service (QoS) on network switches to throttle the sensitive equipment traffic.

C.

Move the sensitive equipment to a different switch port to prevent the broadcast traffic from impacting the equipment.

D.

Use Network Access Control (NAC) to prevent the broadcast traffic from broadcasting.

Buy Now
Questions 51

A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.

Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?

Options:

A.

Increase planned production for the next three periods.

B.

Defer the upgrade to a period beyond the planning time fence.

C.

Increase planned production from the fifth period on.

D.

Defer the upgrade to the period in which the highest stock level is planned.

Buy Now
Questions 52

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Buy Now
Questions 53

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization's policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization's policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Buy Now
Questions 54

An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

B.

National Institute Of Standards And Technology (NIST) and International Organization For Standardization (ISO) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

Buy Now
Questions 55

A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?

Options:

A.

Access of system logs to authorized staff

B.

Accurate and prompt tagging of all business files

C.

Assurance of safe and clean handling of company property

D.

Adoption of environmental controls in the server room

Buy Now
Questions 56

An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?

Options:

A.

Remote using a Trusted Platform Module (TPM) due to better protection of the keys

B.

Local using Trusted Platform Module (TPM) because low-level access software can be accessed

C.

Local using Trusted Platform Module (TPM) because of benefits from Segregation Of Duties (SoD)

D.

Remote using a scanning device because of benefits from Segregation Of Duties (SoD)

E.

Local using Mobile Device Management (MDM) because of device policy enforcement

Buy Now
Questions 57

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Buy Now
Questions 58

A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?

Options:

A.

System browsing

B.

Escalating privileges

C.

Gaining access

D.

Installing additional tools

Buy Now
Questions 59

Which of the following actions hinders the transition from a push system to a pull system?

Options:

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Buy Now
Questions 60

The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

Options:

A.

product manager to increase the selling price of the product.

B.

quality manager to add a new quality measurement to the operation.

C.

production supervisor to review and explain the overage.

D.

the engineering manager to evaluate the run time for the routing.

Buy Now
Questions 61

A security team is analyzing the management of data within the human resources systems, as well as, the intended use of the data, and with whom and how the data will be shared. Which type of assessment is the team MOST likely performing?

Options:

A.

Privacy Impact Assessment (PIA)

B.

Vulnerability assessment

C.

Sensitive data assessment

D.

Personally Identifiable Information (PII) risk assessment

Buy Now
Questions 62

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

Options:

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Buy Now
Questions 63

In the design and development of a manufacturing process, process engineers would most likely be responsible for decisions relating to:

Options:

A.

lead times.

B.

production capacity.

C.

product reliability.

D.

routing sequences.

Buy Now
Questions 64

What is the total load requirement for this work center based on the following data?

Options:

A.

1.326

B.

1.525

C.

1,533

D.

2,880

Buy Now
Questions 65

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Buy Now
Questions 66

The primary reason for tracing a component with scheduling problems to Its master production schedule (MPS) item is to:

Options:

A.

revise the rough-cut capacity plan.

B.

reschedule a related component on the shop floor.

C.

check the accuracy of the bills for the MPS items.

D.

determine if a customer order will be impacted.

Buy Now
Questions 67

Which of the following actions provides the BEST evidence for forensic analysis of powered-off device?

Options:

A.

Copy all potentially useful files from the system to a network drive.

B.

Image the entire hard disk on an external drive.

C.

Copy all system and application log files to an external drive.

D.

Collect the memory, running processes, and temporary files.

Buy Now
Questions 68

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Buy Now
Questions 69

A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?

Options:

A.

Maintenance

B.

Design

C.

Testing

D.

Requirements

Buy Now
Questions 70

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Buy Now
Questions 71

An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?

Options:

A.

Accepting risk

B.

Avoiding risk

C.

Mitigating risk

D.

Transferring risk

Buy Now
Questions 72

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

Options:

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Buy Now
Questions 73

A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?

Options:

A.

Conduct a detailed data analysis on the security impacts using historical data.

B.

Prioritize assessment activities and strategically asses each application

C.

Identify a sponsor from within the organization to prioritize the activities

D.

Perform a risk analysis and determine which applications must be assessed

Buy Now
Questions 74

The question below is based on the following information:

Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?

Options:

A.

50

B.

150

C.

1.250

D.

3.750

Buy Now
Questions 75

A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?

Options:

A.

Web application unit test

B.

Online application development test

C.

Web application penetration test

D.

Online application assurance test

Buy Now
Questions 76

In a Discretionary Access Control (DAC) model, how is access to resources managed?

Options:

A.

By the subject’s ability to perform the function

B.

By the discretion of a system administrator

C.

By the subject’s rank and/or title within the security organization

D.

By the identity of subjects and/or groups to which they belong

Buy Now
Questions 77

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

Options:

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

Buy Now
Questions 78

Which of the following is a component of the Clark-Wilson model?

Options:

A.

Enforcement rules

B.

Transformation procedures

C.

Data classifications

D.

Integrity labels

Buy Now
Questions 79

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Buy Now
Questions 80

When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?

Options:

A.

Opening of previously closed ports

B.

Adding administrator rights on servers

C.

Performing a Cross-Site Scripting (XSS) attack

D.

Creating a Denial-Of-Service (DoS) condition

Buy Now
Questions 81

An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?

Options:

A.

A turnstile

B.

A security guard

C.

A mantrap

D.

A locking door

Buy Now
Questions 82

An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?

Options:

A.

Provide travel security training.

B.

Provide specific pre-travel intelligence briefing.

C.

Complete a travel risk assessment.

D.

Refresh the corporate travel policy.

Buy Now
Questions 83

While conducting penetration testing, one of the testers noticed evidence of additional penetration activities not part of the test. Which of the following is the NEXT course of action for the lead penetration tester?

Options:

A.

Continue testing and report the event at the end of the day.

B.

Stop testing and monitor activity.

C.

Stop testing and report the event.

D.

Complete the test and report the event at the end of the test.

Buy Now
Questions 84

When a third-party needs to receive privileged information, which of the following would be the BEST to

transport the data?

Options:

A.

Layer 2 Tunneling Protocol

B.

Encrypted at rest

C.

Virtual Private Network (VPN)

D.

Encrypted in transit

Buy Now
Questions 85

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Buy Now
Questions 86

The primary benefit that results from the cross-training of employees is:

Options:

A.

improved flexibility.

B.

improved capacity.

C.

shortened lead time.

D.

effective problem-solving.

Buy Now
Questions 87

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Buy Now
Questions 88

Which of the following is a system architecture in a data protection strategy?

Options:

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Buy Now
Questions 89

Which of the following techniques would a group use to prioritize problems?

Options:

A.

Critical path analysis

B.

Pareto analysis

C.

Scatter charts

D.

Cause-and-effect diagrams

Buy Now
Questions 90

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Buy Now
Questions 91

Which of the following factors Is considered a carrying cost?

Options:

A.

Setup

B.

Transportation

C.

Obsolescence

D.

Scrap rate

Buy Now
Questions 92

Which of the following is PRIMARILY responsible for deciding the classification of data in an organization?

Options:

A.

Data owner/steward

B.

Authorizing Official (AO)

C.

Chief Information Security Officer (CISO)

D.

Data custodian

Buy Now
Questions 93

An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?

Options:

A.

Intrusion Detection System (IDS)

B.

Domain Name System (DNS)

C.

Network Address Translation (NAT)

D.

Virtual Private Network (VPN)

Buy Now
Questions 94

Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?

Options:

A.

Conducting a facility tour for a supplier

B.

Sharing of demand data with a supplier

C.

Sending the supplier an annual forecast for materials

D.

Conducting a qualification meeting with the supplier of a new material

Buy Now
Questions 95

Which security concept states that a subject (user, application, or asset) be given only the access needed to complete a task?

Options:

A.

Discretionary Access Control (DAC)

B.

Principle of least privilege

C.

Need to know

D.

Role-Based Access Control (RBAC)

Buy Now
Questions 96

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Buy Now
Questions 97

An information security professional is enhancing the organization's existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?

Options:

A.

In a secure room inside the office

B.

Beside the copy machine

C.

Outside the office

D.

In the human resources area

Buy Now
Questions 98

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

Options:

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

Buy Now
Questions 99

When developing information security policies, What is the PRIMARY concern?

Options:

A.

Alignment with business requirements

B.

Compliance with legal requirements

C.

Alignment with regulatory requirements

D.

Compliance with international standards

Buy Now
Questions 100

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

Options:

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Buy Now
Questions 101

Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?

Options:

A.

Transmission Control Protocol (TCP)

B.

Voice Over Internet Protocol (VoIP)

C.

User Datagram Protocol (UDP)

D.

HyperText Transfer Protocol Secure (HTTPS)

Buy Now
Questions 102

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Buy Now
Questions 103

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Buy Now
Questions 104

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

Options:

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Buy Now
Questions 105

Which of the following BEST effective when protecting against insider threats?

Options:

A.

Implement Two-Factor Authentication (2FA).

B.

Segment data repositories by business rules.

C.

Develop recovery and restoration procedures.

D.

Address security in third-party agreements.

Buy Now
Questions 106

Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Buy Now
Questions 107

What is the MOST efficient system for managing a centralized access control process that performs account creation, disables access, grants privileges, and preserves audit trails?

Options:

A.

Role-based

B.

Automated

C.

Rule-based

D.

Mandatory

Buy Now
Questions 108

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

Options:

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

Buy Now
Questions 109

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

Options:

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Buy Now
Questions 110

Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?

Options:

A.

Implementing automated methods for data collection and reporting where possible

B.

Updating security plans, security assessment reports, hardware, and software inventories

C.

Defining specific methods for monitoring that will maintain or improve security posture

D.

Collecting risk metrics from teams, such as business, testing, QA, development, and operations with security controls

Buy Now
Questions 111

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Buy Now
Questions 112

Which of the following is an access control method that organizations can use to prevent unauthorized access?

Options:

A.

Bring Your Own Device (BYOD)

B.

Man-in-the-Middle (MITM)

C.

Token-based authentication

D.

Digital verification

Buy Now
Questions 113

Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?

Options:

A.

History shows that the quality level has been stable from lot to lot.

B.

The company uses one of its qualified suppliers.

C.

Downstream operators encounter recurring defects.

D.

The percent of defects is expected to be greater than 5%.

Buy Now
Questions 114

In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?

Options:

A.

Deduplication conserves storage.

B.

Regulatory guidance requires compliance.

C.

Digital media can degrade.

D.

Hierarchical storage facilitates access.

Buy Now
Questions 115

Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?

Options:

A.

Ability to use weak hashing algorithms for peer authentication

B.

Ability to perform unauthenticated peering across autonomous systems

C.

Failure to validate legitimacy of received route advertisements

D.

Failure to encrypt route announcement across autonomous systems

Buy Now
Questions 116

Which of the following combines multiple software programming tools into one package?

Options:

A.

Integrated development environments

B.

Software development kit

C.

Dynamic Link Libraries (DLL)

D.

Program language compilers

Buy Now
Questions 117

Which of the following ports needs to be open for Kerberos Key Distribution Center (KDC) to function properly?

Options:

A.

88

B.

389

C.

443

D.

3268

Buy Now
Questions 118

An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?

Options:

A.

The organization can implement both mandatory and dynamic access controls, except where they would be in conflict.

B.

The organization can clone roles, saving time and granting broad access to persons within the same department.

C.

The organization can give a person holding multiple roles the appropriate levels of access to specific data for each role.

D.

The organization can implement both static and dynamic access controls, adjusting them to fit any individual’s access needs.

Buy Now
Questions 119

An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?

Options:

A.

Ensure that the call agents are using an additional authentication method.

B.

Implement a Network Access Control (NAC) solution.

C.

Ensure that the voice media is using Secure Real-Time Transport Protocol.

D.

Segment the voice network and add Next-Generation Firewalls (NGFW).

Buy Now
Questions 120

What is the MOST important security benefit of comprehensive asset management?

Options:

A.

Enforces information security policies

B.

Supports understanding of enterprise security posture

C.

Supports locating security components at end of life

D.

Enforces network security access controls

Buy Now
Questions 121

Which of the following should Business Impact Analysis (BIA) reports always include?

Options:

A.

Security assessment report

B.

Recovery time objectives

C.

Plan of action and milestones

D.

Disaster Recovery Plans (DRP)

Buy Now
Questions 122

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Buy Now
Questions 123

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

Options:

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Buy Now
Questions 124

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

As close to the workload as possible, because it impacts authorization decisions

B.

Between the data stores and the trust engine, because it improves security policies

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the policy engine and the trust engine, because it enforces security policies

Buy Now
Questions 125

An organization has to conduct quarterly reviews of user authorization access to its primary financial application. Which position is responsible for performing these reviews?

Options:

A.

Internal audit manager

B.

Information Security Manager (ISM)

C.

Data custodian

D.

Data owner

Buy Now
Questions 126

An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?

Options:

A.

Employ password masking, obfuscation, and tokenization and automate account updates based on human resources reporting.

B.

Implementing Multi-Factor Authentication (MFA) and account lookout controls.

C.

Create and enforce a strong password policy and implementing security awareness training for all users.

D.

Control physical access to the IAM system and implementing Data Loss Prevention (DPL) for credentials.

Buy Now
Questions 127

The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?

Options:

A.

Signed assertion

B.

Federation authorities access list

C.

Manual registration

D.

Proxied federation

Buy Now
Questions 128

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Buy Now
Questions 129

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Buy Now
Questions 130

Which of the following MUST be checked during the validation of software verification capabilities?

Options:

A.

Security

B.

Completeness

C.

Vulnerabilities

D.

Logic

Buy Now
Questions 131

Moving average forecasting methods are best when demand shows:

Options:

A.

a clear trend.

B.

high random variation.

C.

consistent seasonality.

D.

a cyclical pattern.

Buy Now
Questions 132

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

Options:

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Buy Now
Questions 133

Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?

Options:

A.

Basically Available, Soft-State, Eventual-Consistency (BASE)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation Of Privilege (STRIDE)

C.

Control Objectives For Information And Related Technology (COBIT)

D.

Security, Trust, Assurance And Risk (STAR)

Buy Now
Questions 134

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Buy Now
Questions 135

An organization is concerned that if an employee’s mobile device is lost or stolen and does not reconnect to the carrier network, the data on the device may still be at risk. Consequently, the organization has implemented a control on all mobile devices to require an eight-character passcode for unlock and login. What should happen after multiple incorrect passcode attempts?

Options:

A.

The device should be restarted.

B.

The device should be wiped.

C.

The device should be turned off.

D.

The device passcode should be reset.

Buy Now
Questions 136

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Buy Now
Questions 137

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Buy Now
Questions 138

Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?

Options:

A.

Intrusion Detection System (IDS)

B.

Internet Protocol Security (IPSec)

C.

Virtual Private Network (VPN)

D.

Network Access Control (NAC)

Buy Now
Questions 139

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Buy Now
Questions 140

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Buy Now
Questions 141

In a Zero Trust (ZT) model, where should the enforcement component be placed and why?

Options:

A.

Between the policy engine and the trust engine, because it enforces security policies

B.

As close to the workload as possible, because it impacts authorization decisions

C.

As close to the workload as possible, because it impacts authentication decisions

D.

Between the data stores and the trust engine, because it improves security policies

Buy Now
Questions 142

Which of the following factors is used to determine safety stock?

Options:

A.

Number of customers

B.

Available capacity

C.

Forecast error distribution

D.

Time between customer orders

Buy Now
Questions 143

Which of the following is the BEST way to identify the various types of software installed on an endpoint?

Options:

A.

Active network scanning

B.

Passive network scanning

C.

Authenticated scanning

D.

Port scanning

Buy Now
Questions 144

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Buy Now
Questions 145

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Buy Now
Questions 146

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

Options:

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Buy Now
Questions 147

Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?

Options:

A.

Non-repudiation

B.

Identification

C.

Authorization

D.

Authentication

Buy Now
Questions 148

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Buy Now
Questions 149

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

Options:

A.

74

B.

63

C.

61

D.

31

Buy Now
Questions 150

A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?

Options:

A.

Application blacklisting

B.

Application inventory

C.

Application digital signature

D.

Controlled app store

Buy Now
Questions 151

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Buy Now
Questions 152

Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to

Options:

A.

Ensure that the technology chosen for implementation meets all of the requirements.

B.

Provide resources and support for the development and testing of the plan.

C.

Predetermine spending for development and implantation of the plan.

D.

Specify the solution and options around which the plans will be developed.

Buy Now
Questions 153

Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?

Options:

A.

Excessive privileges

B.

Need to know access

C.

Training access

D.

Least access principle

Buy Now
Questions 154

Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?

Options:

A.

Customer demand is known but seasonal.

B.

Items are purchased and/or produced continuously and not in batches.

C.

Order preparation costs and inventory-carrying costs are constant and known.

D.

Holding costs, as a percentage of the unit cost, are variable.

Buy Now
Questions 155

An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?

Options:

A.

Detective control

B.

Device control

C.

Recovery control

D.

Network control

Buy Now
Questions 156

Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?

Options:

A.

Boundary condition

B.

Buffer overflow

C.

Race condition

D.

Integer overflow

Buy Now
Questions 157

When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?

Options:

A.

Security training

B.

Orientation

C.

User provisioning

D.

Background check

Buy Now
Questions 158

A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

Options:

A.

Determine the acceptable level of loss exposure at which the organization is comfortable operating.

B.

Conduct a gap assessment and produce a risk rating report for the executive leadership.

C.

Engage consultants to audit the organization against best practices and provide a risk report.

D.

Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.

Buy Now
Questions 159

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network's Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Buy Now
Questions 160

A company decided not to pursue a business opportunity In a foreign market due to political Instability and currency fluctuations. Which risk control strategy did this business utilize?

Options:

A.

Mitigation

B.

Prevention

C.

Recovery

D.

Wait and see

Buy Now
Questions 161

A house of quality (HOQ) chart aligns which pair of functions?

Options:

A.

Customer requirements with costing

B.

Engineering with operations

C.

Customer purchasing with supplier shipping

D.

Competitive analysis with product design

Buy Now
Questions 162

A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?

Options:

A.

Operating System (OS) virtualization

B.

Memory protection

C.

Cryptographic module

D.

Trusted Platform Module (TPM)

Buy Now
Questions 163

Management should support investments in new process technologies that:

Options:

A.

require minimal changes in existing systems, procedures, and skills.

B.

have been recommended by technical experts and equipment suppliers.

C.

provide significant cost-reduction opportunities for the company's current products.

D.

provide long-term competitive advantage with acceptable financial risk.

Buy Now
Questions 164

What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?

Options:

A.

The respondent may file an appeal with the Ethics Committee

B.

None; the decision made by the Board of Directors are final

C.

The respondent may file an appeal with the Board of Director

D.

The respondent has 30 days to provide additional evidence for consideration

Buy Now
Questions 165

A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?

Options:

A.

Tandem testing

B.

Blind testing

C.

Double-gray testing

D.

Double-blind testing

Buy Now
Exam Code: CPIM-8.0
Exam Name: Certified in Planning and Inventory Management (CPIM 8.0)
Last Update: Oct 3, 2025
Questions: 552
CPIM-8.0 pdf

CPIM-8.0 PDF

$29.75  $84.99
CPIM-8.0 Engine

CPIM-8.0 Testing Engine

$35  $99.99
CPIM-8.0 PDF + Engine

CPIM-8.0 PDF + Testing Engine

$47.25  $134.99