A stockout of dependent-demand item X occurred during the holiday season. To understand the root cause of the stockout, the planner should check if:
Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
Company A has acquired Company B. Company A has decided to start a project to convert Company B ' s enterprise resource planning (ERP) software to the same ERP software that Company A uses. What is a likely reason for this decision?
An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?
After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?
A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?
Which of the following inventory management techniques is most responsive to changes in demand levels?
A manufacturer uses a low-cost strategy. It recently reviewed its components and realized it is using multiple versions of one screw. Reducing the variety of screws will contribute to its cost advantage by:
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?
After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization ' s IAM solution?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
Which burden of proof has been applied when a workplace investigation has a 51 percent or greater certainty that allegations are true?
An organization starts to develop a drone inspection and defect detection system includes different subsystems running at different clouds from different service providers. During the architectural design phase, which security architecture principle should be the MOST important for the security engineer to apply?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
Components of an organization ' s Immediate industry and competitive environment Include:
A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?
A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?
In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:
An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?
Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?
In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?
Which of the following BEST defines whether an organization can consider an alternate location during a contingency?
Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?
Plans are being made to move an organization’s software systems to the cloud in order to utilize the flexibility and scalability of the cloud. Some of these software systems process highly sensitive data. The organization must follow strict legal requirements regarding the location of the highly sensitive data processed by the software systems. Which cloud model will BEST fit the organization’s requirements?
A regular remote user executed an application that allowed the execution of commands with elevated permissions. It was allowed to create new users, start and stop services, and view critical log files. Which exploit type did the application use in this scenario?
Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?
Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?
Which of the following sampling techniques is BEST suited for comprehensive risk assessments?
What can help a security professional assess and mitigate vulnerabilities of an embedded device?
A manufacturer has a forecasted annual demand of 1,000,000 units for a new product. They have to choose 1 of 4 new pieces of equipment to produce this product. Assume that revenue will be $10 per unit for all 4 options.
Which machine will maximize their profit if the manufacturer anticipates market demand will be steady for 3 years and there is no residual value for any of the equipment choices?
MachineFixed CostVariable Cost per UnitAnnual Capacity
AS100.000$6 00800,000 units
B$200,000$5 501.000,000 units
C$250,000$5 001,200,000 units
D$1 000.000$4 501 400.000 units
What is the following is the MAIN reason why hot-spot usually adopt open security mode in wireless networks?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
A company has a demand for 30 units of A, 40 units of B, and 50 units of C. These products are scheduled to run daily in batches of 10 as follows: ABC, ABC, ABC, CBC. What is this scheduling
technique called?
A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.
What is the organization ' s BEST next step?
A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?
Network Access Control (NAC) is used to perform what function for computers joining the network?
After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?
A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?
An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?
A logistics manager Is faced with delivering an order via rail or truck. Shipping via rail costs S300 and takes 14 days. Shipping via truck costs $600 and takes 3 days. If the holding cost is $40 per day, what is the cost to deliver the order?
Which of the physiological biometric scanning methods is considered the MOST invasive?
Which of the following is the BEST activity to mitigate risk from ransomware on mobile devices and removable media in a corporate environment?
What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?
In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?
What is most likely to be the effect of developing a current-state value stream map?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?
Which of the following ports needs to be open for Kerberos Key Distribution Center (KDC) to function properly?
A new organization building is being designed and the security manager has been asked for input on needed security requirements. Which of the following controls are MOST applicable to this scenario?
The question below is based on the following information:
Beginning inventory = 43Week 1Week 2Week 3
Forecast202020
Customer orders221710
Projected on-hand
Master production schedule (MPS)80
Available-to-promise (ATP)
What is the largest customer order that could be accepted for delivery at the end of week 3 without making changes to the master production schedule (MPS)?
Which of the following should be performed FIRST in the course of a digital forensics investigation?
A software development vendor wants to test the Application Programming Interface (API). The testers use and manipulate data to identify the various states of the application behavior. What is the kind of testing that is being used?
Price negotiation is most appropriate when purchasing which of the following product categories?
Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?
A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?
An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?
Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?
A security practitioner notices that workforce members retain access to information systems after transferring to new roles within the organization, which could lead to unauthorized changes to the information systems.
This is a direct violation of which common security model?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?
An information security professional is enhancing the organization ' s existing information security awareness program through educational posters. Which of the following is the MOST effective location for poster placement?
As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?
When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization ' s BEST next step?
A web developer was recently asked to create an organization portal that allows users to retrieve contacts from a popular social media platform using Hypertext Transfer Protocol Secure (HTTPS). Which of the following is BEST suited for authorizing the resource owner to the social media platform?
Small, independent demands for components and subassemblies typically arise from which of the following sources?
If a work center is already loaded to full capacity, which of the following actions would be best to take before releasing a new order?
An advertising agency is working on a campaign for a prospective client. Competitors are working on a similar campaign and are interested in knowing what the firm has designed. What should the advertising agency do to BEST ensure intellectual property does not leave the organization?
Privacy requirements across national boundaries MOST often require protection of which data types?
Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?
The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?
Which of the following is the MOST effective practice for tracking organizational assets when removed from the premises?
The security department was notified about vulnerabilities regarding users ' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?
The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:
In order for an organization to mature their data governance processes to ensure compliance, they have created a data classification matrix.
What are the next BEST activities to build on this completed work?
Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?
An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?
The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization ' s regulatory compliance policy?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user ' s hash from being cached, what is the MOST appropriate policy to mandate?
An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.
Why is the vendor ' s penetration test considered incomplete?
Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?
An effective approach to projecting requirements for materials with long lead times Includes which of the following options?
A company has the following production conditions:
Batch size: 1,000 items
Processing time: 4 minutes per item
Setup time: 2 hours
Utilization: 80%
Efficiency: 80%
Which of the following actions would result in the work being done in the least amount of time?
Which of the following are steps involved in the identity and access provisioning lifecycle?
An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).
Which of the following is the INITIAL step?
An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?
Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
A security officer has been tasked with performing security assessments on the organization’s in the current calendar year. While collecting data, the officer realizes that more than one business until will be engaged in the assessment. What activity MUST be included in the data collection phase?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
Broadcast traffic is causing network performance degradation of sensitive equipment.
Which of the following methods is used to prevent the broadcast traffic from impacting availability?
A distribution requirements planning (DRP) system has which of the following characteristics?
An organization ' s security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?
An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization ' s resulting private network segment?
Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?
Endpoint security needs to be established after an organization procured 1,000 industrial Internet Of Things (IoT) sensors. Which of the following challenges are the security engineers MOST likely to face?
The master schedule is an Important tool in the sales and operations planning (S & OP) process because it:
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?
A web application is found to have SQL injection (SQLI) vulnerabilities. What is the BEST option to remediate?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?
An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?
A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?
A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?
An organization has network services in a data center that are provisioned only for internal use, and staff at offices and staff working from home both use the services to store sensitive customer data. The organization does not want the Internet Protocol (IP) address of the service to receive traffic from users not related to the organization. Which technology is MOST useful to the organization in protecting this network?
During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?
An organization has decided to give decommissioned computers to a school in a developing country. The company data handling policy prohibits the storage of confidential and sensitive data. What would be the BEST technique to use to avoid data remanence, and to minimize the operational burden for the inheriting school?
When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?
Which threat modeling methodology is focused on assessing risks from organizational assets?
Which of the following environments is most suitable for the use of kanban systems?
Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?
An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?
At which Open Systems Interconnection (OSI) layer does User Datagram Protocol (UDP) function?
An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?
A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?
The Data Loss Prevention (DLP) team in a major financial institution discovered network traffic that involved movement of sensitive material to a Cloud Service Provider (CSP). What action should be taken FIRST in this situation?
The Chief Information Security Officer (CISO) for an international organization with offices operating globally has been tasked with developing a new data encryption policy that can be applied to all areas of the business. What is the MOST important factor that must be considered?
Which of the following MUST be in place for security to be effective in an organization?
A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?
Which of the following tools shows process changes and random variation over time?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
A cybersecurity analyst has recently been assigned to work with a product development team. The team has usually needed to perform a lot of rework late in the development cycle on past projects due to application security concerns. They would like to minimize the amount of rework necessary. Which would be the BEST option to enable secure code review early in the product development?
Which of the following BEST describes the responsibility of an information System Security Officer?
The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:
Long lead-time items with stable demand would best be supported by a supply chain:
An organization is transitioning from a traditional server-centric infrastructure to a cloud-based Infrastructure. Shortly after the transition, a major breach occurs to the organization ' s databases. In an Infrastructure As A Service (IaaS) model, who would be held responsible for the breach?
Which of the following MUST be checked during the validation of software verification capabilities?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
A Generic Routing Encapsulation (GRE) tunnel moves data across a third-party Internet Protocol (IP) network. What is the risk of using GRE tunnels?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
What is the FIRST element that must be evaluated in a security governance program?
An organization’s computer incident response team PRIMARILY responds to which type of control?
CPIM |
TESTED 29 May 2026
