Big Cyber Monday Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium APICS CPIM-8.0 Dumps Questions Answers

Page: 1 / 44
Total 585 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

Which of the following terms below BEST describes the measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces security policy?

Options:

A.

Risk tolerance

B.

Residual risk

C.

Security architecture

D.

Security assurance

Buy Now
Question 2

An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.

Which of the following topics will MOST likely be on the agenda?

Options:

A.

Results of the preliminary cost-benefit studies

B.

Design of the application system and database processes

C.

Communication of procedures and reporting requirements

D.

Identification of inter-application dependencies

Question 3

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

Options:

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Question 4

An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?

Options:

A.

Next-generation firewall

B.

Host-Based Intrusion Detection System (HIDS)

C.

Micro-segmentation

D.

Network Intrusion Detection System (NIDS)

Question 5

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

Options:

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Question 6

Which of the following tools shows process changes and random variation over time?

Options:

A.

Check sheet

B.

Control chart

C.

Histogram

D.

Pareto analysis

Question 7

To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?

Options:

A.

Administrative detective

B.

Physical preventive

C.

Physical detective

D.

Administrative preventive

Question 8

One advantage of adopting a supply network perspective Is that it:

Options:

A.

protects global markets.

B.

enhances understanding of competitive and cooperative forces.

C.

defines the market relationships and partnerships.

D.

encourages rivals to collaborate.

Question 9

What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?

Options:

A.

To prevent the users from performing unauthorized actions during the testing or operational phases

B.

To ensure complexity introduced by security design is addressed in the beginning stages

C.

To reduce the overall cost of incorporating security in a system

D.

To prevent the system from being tampered with in the future

Question 10

Which software development methodology is an iterative customer-value-centric approach which helps teams deliver value to their customers faster and with fewer problems?

Options:

A.

Agile model

B.

Cleanroom model

C.

Waterfall model

D.

Incremental model

Question 11

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 12

A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?

Options:

A.

Select, install, and implement EDI software.

B.

Use current third-party logistics provider (3PL) to handle the EDI transactions.

C.

Claim hardship and ask the automotive manufacturer for a waiver.

D.

Negotiate using email as an alternative with the customer.

Question 13

Which of the common vulnerabilities below can be mitigated by using indexes rather than actual portions of file names?

Options:

A.

Open redirect

B.

Cross-Site Request Forgery (CSRF)

C.

Path traversal

D.

Classic buffer overflow

Question 14

Management should support investments in new process technologies that:

Options:

A.

require minimal changes in existing systems, procedures, and skills.

B.

have been recommended by technical experts and equipment suppliers.

C.

provide significant cost-reduction opportunities for the company's current products.

D.

provide long-term competitive advantage with acceptable financial risk.

Question 15

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization's BEST next step?

Options:

A.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

B.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

C.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Question 16

In the sales and operations planning (S&OP) process, the demand management function provides:

Options:

A.

Information not included in the forecast

B.

A measurement of forecast accuracy

C.

A correction of forecast errors

D.

A more detailed forecast

Question 17

Reducing distribution network inventory days of supply will have which of the following Impacts?

Options:

A.

Increase turnovers and increase cash-to-cash cycle time.

B.

Increase turnovers and reduce cash-to-cash cycle time.

C.

Decrease turnovers and reduce cash-to-cash cycle time.

D.

Decrease turnovers and increase cash-to-cash cycle time.

Question 18

The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:

Options:

A.

product manager to increase the selling price of the product.

B.

quality manager to add a new quality measurement to the operation.

C.

production supervisor to review and explain the overage.

D.

the engineering manager to evaluate the run time for the routing.

Question 19

Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?

Options:

A.

Preponderance of evidence

B.

Beyond a reasonable doubt

C.

Some credible evidence

D.

Clear and convincing

Question 20

A statistical safety stock calculation would be appropriate for:

Options:

A.

components used in multiple end items.

B.

new products at time of introduction.

C.

end items with stable demand.

D.

supply-constrained raw materials.

Question 21

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

Options:

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

Question 22

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 23

A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?

Options:

A.

Statement of Auditing Standards (SAS) 70

B.

System ad Organization Controls (SOC) 1

C.

System ad Organization Controls (SOC) 2

D.

System ad Organization Controls (SOC) 3

Question 24

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 25

An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?

Options:

A.

Soft token

B.

Short Message Service (SMS)

C.

Personal Identification Number (PIN) code

D.

Hard token

Question 26

What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?

Options:

A.

Inventory use cases, categorize threats, evaluate business impact

B.

Understand attack front, identify trust levels, decompose application

C.

Inventory countermeasures, identify threats, implement mitigations

D.

Establish monitoring, identify risks, implement countermeasures

Question 27

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

Options:

A.

Interview the candidates' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question 28

Asymmetric cryptography uses which type of key to encrypt data?

Options:

A.

Private key

B.

Permanent key

C.

Parent key

D.

Public key

Question 29

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Question 30

Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?

Options:

A.

Malware on the sensor

B.

Denial-Of-Service (DoS)

C.

Wardriving attack

D.

Radio Frequency (RF) interference

Question 31

A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?

Options:

A.

Stakeholder identification

B.

Vision statement

C.

Operational efficiency

D.

Solution boundary

Question 32

Which of the following is a methodology for threat modeling in application?

Options:

A.

Disaster, Reproducibility, Exploitability, Affected Users, And Discoverability (DREAD)

B.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE)

C.

Pretend, Allow, Crash, Modify, Ascertain, Name

D.

Confidentiality, Authentication, Integrity, Nonrepudiation, Availability

Question 33

A large volume of outbound Transmission Control Protocol (TCP) connections from the same source Internet Protocol (IP) address was observed at a satellite office firewall. Which of the following is the MOST likely explanation?

Options:

A.

There is only one managed switch port device on the satellite network.

B.

The command and control server has shut down all but one host.

C.

The network hosts are behind a Network Address Translation (NAT) device.

D.

The malware has shut down all but one host used for command and control.

Question 34

An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?

Options:

A.

Allows tailored techniques

B.

Executes code to detect issues

C.

Allows for earlier vulnerability detection

D.

Simulates attacker patterns

Question 35

In times of monetary inflation, which of the following methods of inventory valuation results in the greatest cost of sales for the early years of a particular product?

Options:

A.

Moving average

B.

Last in, first out (LIFO)

C.

First in, first out (FIFO)

D.

Standard

Question 36

Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?

Options:

A.

Authentication Header (AH)

B.

Generic Routing Encapsulation (GRE)

C.

Encapsulation Security Payload

D.

Internet Key Exchange (IKE)

Question 37

Which of the following can allow an attacker to bypass authentication?

Options:

A.

Response tampering

B.

Machine enumeration

C.

User agent manipulation

D.

Social engineering

Question 38

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 39

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 40

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question 41

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 42

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization’s resulting private network segment?

Options:

A.

A

B.

B

C.

C

D.

E

Question 43

Which of the following is a system architecture in a data protection strategy?

Options:

A.

Logical isolation

B.

Network segmentation

C.

Distributed network

D.

Access enforcement

Question 44

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

Options:

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Question 45

An advertising agency is working on a campaign for a prospective client. Competitors are working on a similar campaign and are interested in knowing what the firm has designed. What should the advertising agency do to BEST ensure intellectual property does not leave the organization?

Options:

A.

Protect the information by installing a Data Loss Prevention (DLP) system

B.

Block all organizational email communication with the competitor

C.

Install an Intrusion Prevention System (IPS)

D.

Encrypt the data on the servers and distribute private-key information to authorized users

Question 46

A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?

Options:

A.

Open Authorization (OAuth) 2.0

B.

OpenID Connect (OIDC)

C.

Security Assertion Markup Language (SAML)

D.

Secure Lightweight Directory Access Protocol (LDAP)

Question 47

What document MOST likely states an organization’s values?

Options:

A.

Union labor agreement

B.

Information protection policy

C.

Code of conduct

D.

Management standards

Question 48

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Question 49

The most relevant measure of customer service performance Is:

Options:

A.

service perceived by the customer against service expected by the customer.

B.

service promised to the customer against service measured by the supplier.

C.

customer complaints received as a percentage of orders shipped.

D.

positive customer feedback as a percentage of customer feedback.

Question 50

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 51

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

Options:

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Question 52

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

Options:

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

Question 53

Which of the following factors typically would distort a sales forecast that is based solely on shipment history?

Options:

A.

Material shortages

B.

Labor rate changes

C.

Currency exchange rates

D.

Customer demands

Question 54

An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?

Options:

A.

One of the requests does not have a valid token issuer's identifier.

B.

The requests have the same 'auth_time' parameter.

C.

The requests have the same 'nonce' parameter.

D.

One of the requests does not have a valid audience token.

Question 55

An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?

Options:

A.

Estimate the probability of the scenario ever occurring and use that percentage.

B.

Replace the qualitative scale’s thresholds with point percentages (e.g., low = 25%; medium = 50%; high = 75%) and use those percentages.

C.

Replace the qualitative scale’s thresholds with ranges of percentages (e.g., low = 1–33%; medium = 34–66%; high = 67–99%) and use those percentages.

D.

Estimate the probability of the scenario occurring within the following year and use that percentage.

Question 56

The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:

Options:

A.

order quantity.

B.

stockout costs.

C.

carrying costs.

D.

shelf life.

Question 57

Which of the following actions provides the BEST evidence for forensic analysis of powered-off device?

Options:

A.

Copy all potentially useful files from the system to a network drive.

B.

Image the entire hard disk on an external drive.

C.

Copy all system and application log files to an external drive.

D.

Collect the memory, running processes, and temporary files.

Question 58

An organization recently created a new accounting department, and that department is critical in the event of a disaster for the operations to continue. Which steps should the organization take to create a Business Continuity Plan (BCP)?

Options:

A.

Test, maintain, implement, deliver, and execute

B.

Plan, implement, execute, deliver, and document

C.

Understand, plan, deliver, implement, and execute

D.

Understand, plan, deliver, test, and maintain

Question 59

What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?

Options:

A.

Modify access permissions on media at appropriate classification level.

B.

Modify access logging on media at appropriate classification level.

C.

Sanitize media using appropriate data destruction procedure.

D.

Mark the media with less sensitive classification label.

Question 60

Which of the following capacity planning methods uses the master production schedule (MPS) as its primary input?

Options:

A.

Resource planning

B.

Rough-cut capacity planning (RCCP)

C.

Finite loading

D.

Input/output analysis

Question 61

A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?

Options:

A.

Logging the data leak protection status of the IT asset

B.

Tracking the market value of the IT asset

C.

Receiving or transferring an IT asset

D.

Recording the bandwidth and data usage of the IT asset

Question 62

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization's software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 63

An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?

Options:

A.

TPM will use the Operating System (OS) for full disk encryption key protection.

B.

TPM will protect the full disk encryption keys.

C.

TPM will handle the allocation of the hardware storage drives for full disk encryption.

D.

TPM will provide full disk encryption automatically.

Question 64

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

Options:

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Question 65

A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?

Options:

A.

Annualized loss reduction measured over time

B.

Assessment of magnitude based on risk analyses

C.

Added economic value

D.

Total cost of ownership

Question 66

Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?

Options:

A.

Econometric models

B.

Computer simulation

C.

Time series decomposition

D.

Weighted moving average

Question 67

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

Options:

A.

Security

B.

Data

C.

Application

D.

Control

Question 68

Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?

Options:

A.

Accounts receivable

B.

Inventory value

C.

Accounts payable

D.

Cost of capital

Question 69

Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:

Options:

A.

reject the request.

B.

accept the request.

C.

forward the request to senior management.

D.

check the availability of required material.

Question 70

Which of the following BEST describes an individual modifying something the individual is not supposed to?

Options:

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Question 71

The question below is based on the following standard and actual data of a production order

Which of the following statements about variances is true?

Options:

A.

The material price vanance for Component A is favorable by S10

B.

The labor pnce variance is unfavorable by S20

C.

The material usage variance for Component B is favorable by $36

D.

The labor efficiency variance is favorable by S20

Question 72

Which of the following BEST describes the responsibility of an information System Security Officer?

Options:

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Question 73

Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?

Options:

A.

Watering hole attack

B.

Man-In-Middle (MITM) attack

C.

Cross-Site Request Forgery (CSRF) attack

D.

PowerShell attack

Question 74

Improvements in an Input/output control (I/O control) system will most likely lead to:

Options:

A.

flattened bills of material (BOMs).

B.

a change in operation sequencing.

C.

reduction in queue size and queue time.

D.

fewer engineering change notifications.

Question 75

Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?

Options:

A.

Maintaining high-capacity utilization

B.

Developing flexible operations

C.

Cross-training workers

D.

Implementing rapid process improvements

Question 76

Given the following data, calculate the appropriate takt time:

Options:

A.

0.25 minutes

B.

1 minute

C.

2 minutes

D.

4 minutes

Question 77

In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:

Options:

A.

reduced forecast variability.

B.

fewer customer order changes.

C.

fewer customer defections.

D.

earlier Identification of shifts Incustomer preferences.

Question 78

Which of the following environments is most suitable for the use of kanban systems?

Options:

A.

Short product life cycles

B.

High levels of customization

C.

Intermittent production

D.

Stable and predictable demand

Question 79

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

Options:

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Question 80

An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?

Options:

A.

Role-Based Access Control (RBAC)

B.

Attribute-Based Access Control (ABAC)

C.

Task-based access control

D.

Risk-adaptive access control

Question 81

An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?

Options:

A.

Circumstances may force a cloud provider to discontinue operations

B.

Most cloud service offerings are unique to each provider and may not be easily portable

C.

Integrity and confidentiality are not ensured properly on most cloud service offerings

D.

The need to develop alternative hosting strategies for applications deployed to the cloud

Question 82

An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization's databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?

Options:

A.

The database vendor

B.

The third-party auditor

C.

The organization

D.

The Cloud Service Provider (CSP)

Question 83

A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?

Options:

A.

Security-focused CM integrates the general concepts of CM with existing security requirements of the organization.

B.

Security-focused CM integrates the general concepts of CM with regulatory requirements placed on an organization.

C.

Security-focused CM surpasses existing security requirements of the organization.

D.

Security-focused CM integrates the general concepts of CM with best practices derived from industry frameworks.

Question 84

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

Options:

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question 85

Access Control Lists (ACL), protection bits, and file passwords are typical examples of which of the following access control methods?

Options:

A.

Discretionary.

B.

Attribute-based.

C.

Mandatory.

D.

Role-based.

Question 86

An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?

Options:

A.

By priority as defined by the critical assets list

B.

The latest Continuity Of Operations Plan (COOP)

C.

Senior management assessment and approval

D.

The latest Business Impact Analysis (BIA)

Question 87

An information security professional is enhancing the organization's existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?

Options:

A.

In a secure room inside the office

B.

Beside the copy machine

C.

Outside the office

D.

In the human resources area

Question 88

The question below is based on the following information:

Beginning inventory = 43Week 1Week 2Week 3

Forecast202020

Customer orders221710

Projected on-hand

Master production schedule (MPS)80

Available-to-promise (ATP)

What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?

Options:

A.

74

B.

63

C.

61

D.

31

Question 89

Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?

Options:

A.

Pretexting

B.

Diversion theft

C.

Phreaking

D.

Baiting

Question 90

What is the main negative effect of changing the due dates of open orders?

Options:

A.

The schedule information becomes inaccurate.

B.

The customer service level decreases.

C.

It leads to "nervousness" in the schedule.

D.

The schedule does not support demand.

Question 91

Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?

Options:

A.

Data observability

B.

Data portability

C.

Data discovery

D.

Data analytics

Question 92

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question 93

After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization's IAM solution?

Options:

A.

Enhanced background checks

B.

Mobile Multi-Factor Authentication (MFA) application

C.

Biometric system

D.

Personal Identification Number (PIN) code

Question 94

Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?

Options:

A.

Security architecture

B.

Availability architecture

C.

Privacy architecture

D.

Data architecture

Question 95

An organization is planning to streamline its Identity and Access Management (IAM) processes and platform. The executive team mandated a compact platform to efficiently manage identities for internal and third-party services access. What is the BEST platform choice?

Options:

A.

Cloud Single Sign-On (SSO)

B.

On-premise IAM

C.

Cloud IAM

D.

Identity as a Service (IDaaS)

Question 96

At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?

Options:

A.

Layer 1

B.

Layer 2

C.

Layer 4

D.

Layer 3

Question 97

An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?

Options:

A.

Publish and enforce enterprise policies that assign risk decisions to corporate officers.

B.

Publish and enforce enterprise policies that assign risk decisions to cybersecurity analysts.

C.

Publish and enforce enterprise policies that assign risk decisions to business unit managers.

D.

Publish and enforce enterprise policies that assign risk decisions to system administrators.

Question 98

Which of the following describes the 3 MAIN roles of the identity-delegation model?

Options:

A.

Application server, web server, and delegate

B.

Application server, proxy server, and delegate

C.

Delegator, delegate, and service provider

D.

Delegator, application server, and service provider

Question 99

Up-to-date Information about production order status is required to do which of the following tasks?

Options:

A.

Calculate current takt time.

B.

Determine planned orders.

C.

Replenish kanban quantities.

D.

Calculate the cost of work in process (WIP).

Question 100

The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?

Options:

A.

Request a copy of the most recent System and Organization Controls (SOC) report and/or most recent security audit reports and any vulnerability scans of the software code from the vendor.

B.

Purchase the software, deploy it in a test environment, and perform Dynamic Application Security Testing (DAST) on the software.

C.

Request a software demo with permission to have a third-party penetration test completed on it.

D.

Ask the development team to reevaluate the current program and have a toolset developed securely within the organization.

Question 101

A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?

Options:

A.

Authorization controls

B.

Two-Factor Authentication (2FA)

C.

Non-repudiation controls

D.

Access audit

Question 102

What MUST be completed before developing physical security controls?

Options:

A.

Develop a comprehensive security policy

B.

Provide the annual security awareness training

C.

Contract for licensed and bonded security force

D.

Perform a physical security audit

Question 103

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

Options:

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question 104

If fixed costs are §200,000 and 20,000 units are produced, a unit's fixed cost is §10. This is an example of:

Options:

A.

variable costing.

B.

activity-based costing (ABC).

C.

absorption costing.

D.

overhead costing.

Question 105

What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?

Options:

A.

Empty jugs which can easily be filled up with water.

B.

Stock up on generator fuel and execute a generator test.

C.

Request bids for inexpensive generators.

D.

Purchase a contract with a secondary power provider.

Question 106

Which of the following provides for continuous improvement of the change control process?

Options:

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Question 107

What should an organization do to prepare for Disaster Recovery (DR) efforts?

Options:

A.

Create a list of key personnel

B.

Create a list of decommissioned hardware

C.

Review tabletop exercises

D.

Replicate access logs

Question 108

When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

Options:

A.

any request for shipment prior to the planning time fence.

B.

any request for shipment prior to the demand time fence (DTF).

C.

requests only for shipment before the next master production schedule (MPS) receipt.

D.

requests only for shipment in the period of the receipt.

Question 109

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 110

A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?

Options:

A.

Its low-level code is zero.

B.

The material requirements for the part will be understated.

C.

The service part demand can be included In the gross requirements.

D.

It shouldn’t have any safety stock.

Question 111

A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?

Options:

A.

$340for rail,$600 for truck

B.

$340for rail.$720 for truck

C.

$860for rail,$720 for truck

D.

$860for rail.$600 for truck

Question 112

A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?

Options:

A.

ZigBee

B.

Radio-Frequency Identification (RFID)

C.

Long-Term Evolution (LTE)

D.

Bluetooth

Question 113

An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?

Options:

A.

Submit a security exception for the application and remove it from vulnerability scanning

B.

Report to the privacy officer and increase logging and monitoring of the application

C.

Continue to operate and monitor the application until it is no longer needed

D.

Implement compensating controls and prioritize upgrading the application

Question 114

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network's Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Question 115

An order winner during the growth stage of a product's life cycle is:

Options:

A.

variety.

B.

availability.

C.

dependability.

D.

price.

Question 116

An external audit is conducted on an organization's cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?

Options:

A.

Resource forecast

B.

Asset inventory

C.

Access to logs

D.

Software license agreements

Question 117

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Question 118

A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.

This is a direct violation of which common security model?

Options:

A.

Clark-Wilson

B.

Bell-LaPadula

C.

Graham-Denning

D.

Take-Grant

Question 119

When starting an external benchmarking study, a firm must first:

Options:

A.

determine the metrics which will be measured and compared.

B.

identify the target firms with which to benchmark against.

C.

understand its own processes and document performance.

D.

determine its areas of weakness versus the competition's.

Question 120

Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.

What is the BEST objective metric for the effectiveness of a security awareness training?

Options:

A.

The management’s attitude toward the training

B.

The number of times users comply with the training

C.

A change of helpdesk calls after the training

D.

The off-hand comments about the training

Question 121

How would a master production schedule (MPS) be used In an assemble-to-order (ATO) manufacturing environment?

Options:

A.

The MPS is used to plan subassemblies and components; end items are only scheduled when a customer order is received.

B.

Subassemblies are scheduled in the MPS when the customer order is received, and production can start.

C.

Typically, the MPS is not used in companies using an ATO manufacturing strategy.

D.

Often In an ATO environment, the MPS is created once a year and only revised if a product is discontinued.

Question 122

Which security audit phase is MOST important to ensure correct controls are applied to classified data in a production environment?

Options:

A.

Data gathering

B.

Data analysis

C.

Planning and research

D.

Audit reporting and follow-up

Question 123

After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?

Options:

A.

Complete an inventory of who has access to systems.

B.

Create a Role-Based Access Control (RBAC) process to determine what a specific group of users can access.

C.

Create an Attribute-Based Access Control (ABAC) process to assign access to users based on their account attributes and characteristics.

D.

Conduct an assessment and remove all inactive accounts.

Question 124

Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?

Options:

A.

An API gateway is a specialized reverse proxy that can make different APIs appear as if they are a single API.

B.

An API gateway inspects traffic and blocks many common attacks against Hypertext Transfer Protocol (HTTP) web services.

C.

An API gateway ensures that a Denial-Of-Service (DoS) attack cannot occur within the application.

D.

An API gateway monitors traffic within internal networks and ensures suspicious patterns are detected on any API.

Question 125

If organizational leadership determines that its required continuous monitoring plan is too costly for the organization, what action should be taken by leadership and the Authorizing Official (AO)?

Options:

A.

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

B.

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

C.

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

D.

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls

Question 126

What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?

Options:

A.

To provide additional layers of firewalls to the environment

B.

To create additional logical barriers to entry

C.

To allow access to new cryptographic keys

D.

To manage cryptographic keys in a tamper-proof model

Question 127

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 128

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization's ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Question 129

Which of the following planning modules considers the shortest-range planning goals?

Options:

A.

Capacity requirementsplanning(CRP)

B.

Input/output analysis

C.

Resource planning

D.

Rough-cut capacity planning (RCCP)

Question 130

An organization has a requirement that all documents must be auditable and that the original is never modified once created. When designing the system, what security model MUST be implemented in order to meet this requirement?

Options:

A.

Biba Integrity

B.

Brewer-Nash

C.

Bell-LaPadula

D.

Clark-Wilson

Question 131

Exhibit:

A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?

Options:

A.

100% service levels for B and C

B.

Customer B has higher service level

C.

Customer C has higher service level

D.

Customer B and C have same service level

Question 132

The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:

Options:

A.

pipeline inventory.

B.

transportation costs.

C.

inventory turns.

D.

sales revenue.

Question 133

What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?

Options:

A.

Legitimate data collection

B.

Limitation of use

C.

Collection Categorization

D.

Collection limitation

Question 134

Which of the following prioritization rules will have the greatest impact In reducing the number of orders In queue?

Options:

A.

Critical ratio

B.

Shortest processing time

C.

Fewest operations remaining

D.

First come, first served

Question 135

A disadvantage of a capacity-lagging strategy may be:

Options:

A.

lack of capacity to fully meet demand.

B.

risk of excess capacity if demand does not reach forecast.

C.

a high cost of inventories.

D.

planned capital investments occur earlier than needed.

Question 136

A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?

Options:

A.

Suppliers of "A“ classified items

B.

Suppliers recently ISO 9000 certified

C.

Suppliers with the worst performance records

D.

Suppliers with vendor-managed inventory (VMI)

Question 137

Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?

Options:

A.

Data at rest

B.

Data in use

C.

Data in transit

D.

Data on the client machine

Question 138

Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?

Options:

A.

Data

B.

Physical

C.

Network

D.

Transport

Question 139

A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization's corporate cloud. What is the MAIN benefit of the organization's Federated Identity Management (FIM) system to address the need?

Options:

A.

Efficient access provisioning

B.

Increased robustness of authentication

C.

Greater flexibility of access control

D.

Reduced complexity of maintenance and changes

Question 140

Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?

Options:

A.

Identity And Access Management (IAM)

B.

Power and physical security

C.

Configuration Management (CM) and deployment

D.

Installation and connection

Question 141

Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?

Options:

A.

Firewall.

B.

Switch.

C.

Storage.

D.

Router.

Question 142

Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?

Options:

A.

Critical work centers only

B.

Gateway work centers only

C.

Final assembly work centers only

D.

All work centers

Question 143

An effective approach to projecting requirements for materials with long lead times Includes which of the following options?

Options:

A.

Initiate a multilevel master schedule.

B.

Use phantom bills of materials (BOMs).

C.

Increase the level of safety stock.

D.

Decrease the planning horizon.

Question 144

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

Options:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Question 145

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Question 146

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Question 147

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 148

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Question 149

A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?

Options:

A.

Determine local requirements.

B.

Determine federal requirements.

C.

Ensure that all data has been classified.

D.

Designate a person of authority.

Question 150

An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?

Options:

A.

Jump-server on a Local Area Network (LAN)

B.

Bastion host over a Wide Area Network (WAN)

C.

Jump-server connected to a Wireless Local Area Network (WLAN)

D.

Bastion host with Virtual Private Network (VPN) termination point

Question 151

An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?

Options:

A.

Implement step-up authentication for privileged functions within the ERP system.

B.

Implement a periodic review of privileged access within the ERP system.

C.

Implement an automated reconciliation process between ERP and IAM systems.

D.

Implement a periodic review of all ERP access within the IAM system.

Question 152

An organizational policy requires that any data from organization-issued devices be securely destroyed before disposal. Which method provides the BEST assurance of data destruction?

Options:

A.

Incinerating

B.

Reformatting

C.

Degaussing

D.

Erasing

Question 153

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

Options:

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question 154

A cloud-based web application requires the use of cryptographic keys to encrypt user-uploaded files at rest. Where is the safest place to store these cryptographic keys?

Options:

A.

Keys are stored in a password protected zip file.

B.

Keys are stored with source code in a revision control system.

C.

Keys are stored in a cloud-based file storage system.

D.

Keys are stored in a central, internal key management system.

Question 155

An organization’s computer incident response team PRIMARILY responds to which type of control?

Options:

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Question 156

Check sheets can be used to:

Options:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question 157

Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?

Options:

A.

Use compliant encryption algorithms and tools.

B.

Use a secure password management tool to store sensitive information.

C.

Implement Mobile Device Management (MDM).

D.

Develop and test an appropriate data backup and recovery plan.

Question 158

What are the FIRST two steps an organization should conduct to classify its assets?

Options:

A.

Define user requirements and collate existing inventories

B.

Categorize assets and set minimum security controls

C.

Conduct an inventory of assets and determine the owners

D.

Obtain senior management buy-in and conduct a risk assessment

Question 159

Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?

Options:

A.

Removal is authorized directly by executive management.

B.

Removal is authorized using a formal sign-out process.

C.

Removal is authorized when remote use is required for business.

D.

Removal is authorized if the asset has been disposed of.

Question 160

Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate the existing Information Technology (IT) environment.

C.

Evaluate business needs.

D.

Engage the sponsor and identify key stakeholders.

Question 161

The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?

Options:

A.

Organization's security policy and standards

B.

How data will be stored and accessed

C.

Regulatory and compliance requirements

D.

Where data will be stored and accessed

Question 162

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 163

During the initiation phase of a project to acquire a customer relation management system, what is the FIRST step a project team will take for early integration of security?

Options:

A.

Develop a list of security requirements for the system.

B.

Conduct project planning and a feasibility assessment.

C.

Define system security classifications.

D.

Review relevant regulatory practices and standards.

Question 164

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Question 165

Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?

Options:

A.

Project management office

B.

Chief Financial Officer (CFO)

C.

Board of Directors

D.

Chief Information Security Officer (CISO)

Question 166

A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.

Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?

Options:

A.

Increase planned production for the next three periods.

B.

Defer the upgrade to a period beyond the planning time fence.

C.

Increase planned production from the fifth period on.

D.

Defer the upgrade to the period in which the highest stock level is planned.

Question 167

Which of the following measurements indicates there may be bias In the forecast model?

Options:

A.

Mean absolute deviation (MAD)

B.

Standard deviation

C.

Tracking signal

D.

Variance

Question 168

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

Options:

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Question 169

What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?

Options:

A.

Draft an organizational policy on retention for approval.

B.

Ensure that periodic data governance compliance meetings occur.

C.

Understand applicable laws, regulations, and policies with regard to the data.

D.

Determine the classification of each data type.

Question 170

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 171

Which Virtual Private Network (VPN) protocol provides a built-in encryption?

Options:

A.

Layer 2 Tunneling Protocol

B.

Point-to-Point Tunneling Protocol

C.

Layer 2 Forwarding Protocol

D.

Internet Protocol Security (IPsec)

Question 172

What is the PRIMARY secure protocol used by a Content Delivery Network (CDN)?

Options:

A.

Internet Protocol Security (IPsec)

B.

Secure shell (SSH)

C.

Transport Layer Security (TLS)

D.

Secure File Transfer Protocol (SFTP)

Question 173

What priority control technique is most appropriate for a firm using a cellular production system?

Options:

A.

Shortest processing time (SPT) rule

B.

Distribution requirements planning (DRP)

C.

Pull production activity control (PAC)

D.

Push production activity control (PAC)

Question 174

An organization provides customer call center operations for major financial service organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

B.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

National Institute Of Standards And Technology and International Organization For Standardization (ISO) frameworks

Question 175

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S&OP) meeting.

Exam Detail
Vendor: APICS
Certification: CPIM
Exam Code: CPIM-8.0
Last Update: Dec 8, 2025
CPIM-8.0 Question Answers
Page: 1 / 44
Total 585 questions