A semiconductor manufacturer is writing a physical asset handling policy. Which of the following is MOST likely to be the rationale for the policy?
Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?
Which compensating control is the MOST effective to prevent fraud within an organization?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?
A disadvantage of a capacity-lagging strategy may be:
In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?
Which of the following statements about demonstrated capacity Is true?
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?
Cost CategoryCost
Custom fees$125
Freight$700
Warehouse rent$200
Matenal cost$500
Which of the following MUST be checked during the validation of software verification capabilities?
Which of the following statements characterizes a pull system In distribution management?
A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer's pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?
A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.
What is the BEST action the engineer can take to ensure secure operations?
A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?
An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?
Risk pooling would work best for items with:
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
Which of the following situations is most likely to occur when using a push system?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?
When developing information security policies, What is the PRIMARY concern?
An example of an assignable cause of variation in process performance is:
Which of the following combines multiple software programming tools into one package?
Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
What is the MOST important security benefit of comprehensive asset management?
Which of the following BEST describes the purpose of black hat testing during an assessment?
Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S&OP) horizon for a product family that is
made to stock?
An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?
A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?
Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?
A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?
Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?
Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?
What is the main negative effect of changing the due dates of open orders?
An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization's concerns?
When designing a production cell, which of the following items would be the most important consideration?
What document MOST likely states an organization’s values?
The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?
A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?
In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
Which of the following BEST describes an individual modifying something the individual is not supposed to?
Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.
What is the BEST objective metric for the effectiveness of a security awareness training?
Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
Improvements in an Input/output control (I/O control) system will most likely lead to:
Which of the following is the BEST reason to conduct a penetration test?
Which of the following should recommendations from a Plan Of Action And Milestones (POA&M) be based on?
The production plan relates to a firm's financial planning because it is used to:
Management should support investments in new process technologies that:
Which activity follows the discovery phase of vulnerability management?
An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?
What function prevents unauthorized devices from gaining access to a network?
An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?
Which of the following ports needs to be open for Kerberos Key Distribution Center (KDC) to function properly?
Which of the following is MOST accurate when comparing patch management and vulnerability management?
What BEST describes the end goal of a Disaster Recovery (DR) program?
Which of the following inventory management techniques is most responsive to changes in demand levels?
An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
Exhibit:
A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?
Which of the following is a methodology for threat modeling in application?
Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:
Which of the physiological biometric scanning methods is considered the MOST invasive?
An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?
An example of a flexibility metric for an organization Is:
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?
A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?
An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?
After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?
An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?
An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?
Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?
An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?
What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?
Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?
Which of the following production activity control (PAC) techniques focuses on optimizing output?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
An advantage of applying ABC classification to a firm's replenishment items is that:
Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?
Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to
A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center's capacity in standard hours for an 8-hour shift?
Which of the following benefits typically will be realized when switching from a functional to a cellular layout?
The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?
Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:
In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:
If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.
Which of the following will BEST help remediate this issue?
What does the Role-Based Access Control (RBAC) method define?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?
Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?
A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?
An organization starts to develop a drone inspection and defect detection system includes different subsystems running at different clouds from different service providers. During the architectural design phase, which security architecture principle should be the MOST important for the security engineer to apply?
A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?
A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?
A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
Which of the following is typically used to control physical access to highly secure facilities?
Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?
A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?
In order for an organization to mature their data governance processes to ensure compliance, they have created a data classification matrix.
What are the next BEST activities to build on this completed work?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
A company assembles kits of hand tools after receipt of the order from distributors and uses two-level master scheduling. The appropriate levels of detail for the forecasts that are input to master scheduling would be total number of kits and:
A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.
Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?
A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?
Given the following data, calculate the appropriate takt time:
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?
Which of the following techniques would a group use to prioritize problems?
For a company that uses first in, first out (FIFO) inventory accounting, the actual use in production of a recently arrived shipment of more expensive components rather than lower-cost components
previously received will have which of the following results?
To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
Remote sensors have been deployed at a utility site to reduce overall response times for maintenance staff supporting critical infrastructure. Wireless communications are used to communicate with the remote sensors, as it is the most cost-effective method and minimizes risk to public health and safety. The utility organization has deployed a Host-Based Intrusion Prevention System (HIPS) to monitor and protect the sensors. Which statement BEST describes the risk that is mitigated by utilizing this security tool?
An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?
Which of the following is the workflow of the identity and access provisioning lifecycle?
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
Maintaining software asset security is MOST dependent on what information?
During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?
Which of the following concepts MOST accurately refers to an organization's ability to fully understand the health of the data in its system at every stage of the lifecycle?
Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?
Components of an organization's Immediate industry and competitive environment Include:
It takes an average of 3 hours to set up a model and 1 hour to run, but depending on the complexity of the models, the setup time can be significantly different. Last week. 2 modelers were working on different projects. Each worked 40 hours. One modeler finished 5 models a day, and the other finished 1 model a day. What was the demonstrated capacity last week?
While conducting penetration testing, one of the testers noticed evidence of additional penetration activities not part of the test. Which of the following is the NEXT course of action for the lead penetration tester?
Network Access Control (NAC) is used to perform what function for computers joining the network?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?
What should an organization do to prepare for Disaster Recovery (DR) efforts?
Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
The question below is based on the following standard and actual data of a production order
Which of the following statements about variances is true?
A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?
An attacker wants to decrypt a message and has no knowledge of what may have been in the original message. The attacker chooses to use an attack that will exhaust the keyspace in order to decrypt the message. What type of cryptanalytic attack is the attacker using?
In preparing for a facility location decision, proximity to suppliers would be classified as which kind of criteria?
According to best practice, at which step in the system lifecycle shall a security professional begin involvement?
What are the FIRST two steps an organization should conduct to classify its assets?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?