An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?
The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?
Cost CategoryCost
Custom fees$125
Freight$700
Warehouse rent$200
Matenal cost$500
A webmaster has repeatedly used the same certificate sign request to renew an organization ' s website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?
A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?
A planner has chosen to increase the order point for a raw material. Which of the following costs is most likely to increase?
In a rapidly changing business environment, a primary advantage of an effective customer relationship management (CRM) program is:
A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?
Which of the following documents is the BEST reference to describe application functionality?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
Which of the following measurements indicates there may be bias In the forecast model?
An external audit is conducted on an organization ' s cloud Information Technology (IT) infrastructure. This organization has been using cloud IT services for several years, but its use is not regulated in any way by the organization and security audits have never been conducted in the past. Which task will be the MOST challenging to conduct an effective security audit?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
Which of the following terms below BEST describes the measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces security policy?
An organization needs a firewall that maps packets to connections and uses Transmission Control Protocol/Internet Protocol (TCP/IP) header fields to keep track of connections. Which type of firewall will be recommended?
In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?
A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?
A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?
Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?
An organization has been struggling to improve their security posture after a recent breach.
Where should the organization focus their efforts?
A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?
An information security auditor is creating an audit program to assess endpoint security controls for portable storage media movement. Which type of control will MOST likely be part of the program?
An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?
Which of the following BEST defines whether an organization can consider an alternate location during a contingency?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
An organization is working to secure its Supervisory Control And Data Acquisition (SCADA) system, Which monitors water supply to the city. What type of security should the organization ensure FIRST?
Which of the following methods would be appropriate for forecasting the demand for a product family when there is a significant trend and seasonality in the demand history?
A potentially life-threatening vulnerability is found in vendor software that is used to manage critical systems. Which of the following is generally considered the BEST method to disclose the vulnerability from an ethical hacking perspective?
A cybersecurity analyst is reviewing a recent incident in which the adversaries were able to move vertically within the network. Which attack phase MOST clearly represents this scenario?
A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?
Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?
A cybersecurity analyst has recently been assigned to work with a product development team. The team has usually needed to perform a lot of rework late in the development cycle on past projects due to application security concerns. They would like to minimize the amount of rework necessary. Which would be the BEST option to enable secure code review early in the product development?
Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?
Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?
The cost accountant has discovered a consistent overage in actual run time for one operation. This information should be sent first to the:
A Structured Query Language (SQL) database is hosted on a hardened, secure server. All unused ports are locked down, but external connections from untrusted networks are still required to be allowed through. What is the BEST way to ensure transactions to/from this server remain secure?
Who is responsible for ensuring compliance when an organization uses a cloud provider to host its Virtual Machine (VM) instances?
A distribution requirements planning (DRP) system has which of the following characteristics?
An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.
Which of the following topics will MOST likely be on the agenda?
An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?
The planned channels of Inventory disbursement from one or more sources to field warehouses are known as:
Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?
One of the findings in the recent security assessment of a web application reads: " It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process. " Which of these choices would BEST remediate this security finding?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?
What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?
An organization wants to ensure a risk does not occur. The action taken is to eliminate the attack surface by uninstalling vulnerable software. Which risk response strategy did the organization take?
The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?
Which of the following should be performed FIRST in the course of a digital forensics investigation?
Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?
A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization ' s corporate cloud. What is the MAIN benefit of the organization ' s Federated Identity Management (FIM) system to address the need?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
Which of the following criteria is used to determine safety stock in a distribution center (DC)?
Which of the following is typically used to control physical access to highly secure facilities?
Which of the following MUST be in place for security to be effective in an organization?
The Data Loss Prevention (DLP) team in a major financial institution discovered network traffic that involved movement of sensitive material to a Cloud Service Provider (CSP). What action should be taken FIRST in this situation?
The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?
What are the FIRST two steps an organization should conduct to classify its assets?
The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:
What order BEST reflects the steps when adding threat modeling practices to a Software Development Life Cycle (SDLC)?
A security engineer developing software for a professional services organization has a requirement that users cannot have concurrent access to data of clients that are competitors. Which security model should the security engineer implement to meet this requirement?
An OpenID Connect (OIDC) authorization server received two requests from a client. The server identifies the request as replay attack and rejects the request. Which of the following BEST describes these requests?
To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
An organization wants to implement Zero Trust (ZT). The Information Technology (IT) department is already using Multi-Factor Authentication (MFA) and Identity and Access Management (IAM). Which of the following would be the BEST solution for the organization to implement in order to have a ZT network?
A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.
What is the BEST action the engineer can take to ensure secure operations?
An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer ' s engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?
An organization has deployed an Identity And Access Management (IAM) tool and is expanding their information governance program. Which of the following would BEST be included in the governance for IAM?
What is the BEST reason to include a Hardware Security Module (HSM) in the key management system when securing cloud storage?
Which of the following actions best supports a company ' s strategic focus on delivery speed to improve competitive advantage?
A large volume of outbound Transmission Control Protocol (TCP) connections from the same source Internet Protocol (IP) address was observed at a satellite office firewall. Which of the following is the MOST likely explanation?
The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:
Which of the following actions hinders the transition from a push system to a pull system?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
A third-party vendor is procured to conduct a non-financial audit. Which report evaluates the effectiveness of the controls?
Which of the following is a threat modeling methodology used for accessing threats against applications and Operating Systems (OS)?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
A large organization is planning to lay off half of its staff. From an information security point of view, what is the BEST way of approaching affected staff?
Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?
An organization requires all passwords to include two uppercase characters, two numbers, and two special characters. After a security professional has successfully retrieved the hashed password file from a server, what would be the fastest attack to conduct on the file?
A hot Disaster Recovery (DR) data center is the victim of a data breach. The hackers are able to access and copy 10GB of clear text confidential information. Which of the following could have decreased the amount of exposure from this data breach?
Price negotiation is most appropriate when purchasing which of the following product categories?
What is the BEST protection method to ensure that an unauthorized entry attempt would fail when securing highly sensitive areas?
The question below is based on the following alternative schedules for a lot of 1,200.
A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.
Which of the following statements is correct?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
Which of the following environments is most suitable for the use of kanban systems?
Which of the following methods is most often used to manage inventory planning variability across the supply chain?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
When designing a production cell, which of the following items would be the most important consideration?
What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?
Which of the following roles is the BEST choice for classifying sensitive data?
Bad actors with little expense can easily make calls. Which social engineer strategy is a telecommunications ONLY risk concept?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
Up-to-date Information about production order status is required to do which of the following tasks?
An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
Which of the following presents the GREATEST benefit to an organization ' s security posture when a change management process is implemented?
Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?
Based on the values reported in the table below, what is the inventory turnover?
In the sales and operations planning (S & OP) process, the demand management function provides:
An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?
An effective approach to projecting requirements for materials with long lead times Includes which of the following options?
What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?
Which of the following regarding authentication protocols is a PRIMARY consideration when designing an authentication and key management system?
An organization undergoing acquisition merged IT departments and infrastructure. During server decommissioning, some servers still in use by customers were mistakenly removed, causing order processing failures. Which type of review would have BEST avoided this scenario?
What is the BEST preventive measure against employees abusing access privileges?
What is the total load requirement for this work center based on the following data?
A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?
When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
A security team leader needs to communicate the value of the security program. As the security team leader determines the return on security investments, what is the MOST important aspect to incorporate?
After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization ' s IAM solution?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?
Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?
Which of the following circumstances would cause a move from acceptance sampling to 100% inspection?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
Which of the following conditions is most likely to result in planned production that is greater than the total demand over the sales and operations planning (S & OP) horizon for a product family that is
made to stock?
An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization ' s concerns?
An organization is migrating its access controls to a certificate-based authentication system.
What will need to be established to verify the identity of all users connecting to the network before rolling out the system?
Which of the following benefits typically will be realized when switching from a functional to a cellular layout?
Which of the following should Business Impact Analysis (BIA) reports always include?
An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?
Which threat modeling methodology is focused on assessing risks from organizational assets?
A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?
An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
Which of the following should recommendations from a Plan Of Action And Milestones (POA & M) be based on?
When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?
Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?
A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?
Which of the following BEST describes the responsibility of an information System Security Officer?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?
In which of the following phases of the product life cycle is product price most effective in influencing demand?
In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?
A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?
An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?
An organization’s computer incident responses team PRIMARY responds to which type of control?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization ' s software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?
An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?
A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer ' s pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?