Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?
Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?
Which of the following is the workflow of the identity and access provisioning lifecycle?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
How would blockchain technology support requirements for sharing audit information among a community of organizations?
A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?
What is a strategic process that is aimed at considering possible attack scenarios and vulnerabilities within a proposed or existing application environment for the purpose of clearly identifying risk and impact levels?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
Which of the following is the MOST significant flaw when using Federated Identity Management (FIM)?
A distribution requirements planning (DRP) system has which of the following characteristics?
An information security professional has been tasked with remediating vulnerabilities identified during a recent penetration test. Which of the following sections of the penetration results report would be MOST preferable to remediate hosts one at a time?
During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?
APerform drills on a recurring basis.
B.Harden all critical facilities.
C.Outsource to an external organization.
D.Allocate 100% of required funds.
A manufacturer uses a low-cost strategy. It recently reviewed its components and realized it is using multiple versions of one screw. Reducing the variety of screws will contribute to its cost advantage by:
An organization’s security assessment recommended expanding its secure software development framework to include testing Commercial Off-The-Shelf (COTS) products before deploying those products in production. What is the MOST likely reason for this recommendation?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
A furniture manufacturer using material requirements planning (MRP) and lean manufacturing has changed the bills of material (BOMs) for all chests by making drawers into phantom assemblies. Which of the following outcomes would likely result from this change?
Which of the following provides that redundancy and failover capabilities are built into a system to maximize its uptime?
During a threat modeling exercise using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) framework, it was identified that a web server allocates a socket and forks each time it receives a request from a user without limiting the number of connections or requests.
Which of the following security objectives is MOST likely absent in the web server?
Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?
When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?
Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live. What is the organization ' s BEST next step?
Which of the following concepts MOST accurately refers to an organization ' s ability to fully understand the health of the data in its system at every stage of the lifecycle?
In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?
An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?
Improvements in an Input/output control (I/O control) system will most likely lead to:
Which of the following methods most likely Introduces a temporary variance between the inventory balance and the inventory record?
An organization has decided to advance from qualitative risk assessment to quantitative risk analysis. The information security risk analyst has been tasked with replacing the organization’s qualitative likelihood scale of low, medium, and high with a quantitative approach. Which is the BEST approach for replacing the qualitative input values?
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
Which of the following BEST describes an individual modifying something the individual is not supposed to?
What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?
In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?
Which of the following inventory management techniques is most responsive to changes in demand levels?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
Objective security metrics tend to be easier to gather, easier to interpret, and easier to include in reports to management.
What is the BEST objective metric for the effectiveness of a security awareness training?
An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?
The question below is based on the following standard and actual data of a production order
Which of the following statements about variances is true?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?
An executive is approved to travel to a high-risk country. What is the BEST action the organization can take to ensure the executive’s safety and security?
If an organization wanted to protect is data against loss of confidentiality in transit, which type of encryption is BEST?
An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization ' s resulting private network segment?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
A failure mode and effects analysis (FMEA) could be used for which of the following activities?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
Which of the following categories of web services testing describes correctness testing of web service security functionality?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
A work center has 3 machines that are all run at the same time with a single worker. The work center has an efficiency of 75% and a utilization of 100%. What is the work center ' s capacity in standard hours for an 8-hour shift?
A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.
What is the organization ' s BEST next step?
In an organization that develops aircrafts for military usage, where will the security team focus its efforts to ensure the organization’s data remains confidential?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
After a recent cybersecurity incident, a manufacturing organization is interested in further hardening its Identity and Access Management (IAM) solution. Knowing that the organization limits the use of personal devices in the facility, which could BEST be implemented to enhance the manufacturing organization ' s IAM solution?
A traffic analysis on an organization ' s network identifies a significant degree of inefficient resource use as a result of broadcast traffic. The organization wants to reduce the scope of the broadcasts without impeding the flow of traffic. Which of the following devices is the BEST choice to implement to achieve this goal?
Why would a network administrator monitor Internet of Things (IoT) security differently than the security of standards network devices?
Which of the following items does the master scheduler have the authority to change in the master scheduling process?
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
A company ' s primary performance objective Is flexibility. Which of the following measurements is most important?
Which of the following roles is the BEST choice for classifying sensitive data?
An organization ' s security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?
An organization discovered that malicious software was installed on an employee’s work laptop and allowed a competing vendor to access confidential files. The employee was fully aware of the policy not to install unauthorized software on the organization laptop. What is the BEST automated security practice for an organization to implement to avoid this situation?
When a third-party needs to receive privileged information, which of the following would be the BEST to
transport the data?
Which of the following measurements indicates there may be bias In the forecast model?
A bank recently informed a customer that their account has been overdrawn after their latest transaction. This transaction was not authorized by the customer. Upon further investigation, it was determined by the security team that a hacker was able to manipulate the customer ' s pre-authenticated session and force a wire transfer of funds to a foreign bank account. Which type of attack MOST likely occurred?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
Who is responsible for ensuring compliance when an organization uses a cloud provider to host its Virtual Machine (VM) instances?
Which of the following is the GREATEST threat for a Border Gateway Protocol (BGP) deployment on the internet?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
What is the total load requirement for this work center based on the following data?
Which of the following actions hinders the transition from a push system to a pull system?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
Based on the values reported in the table below, what is the inventory turnover?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
Up-to-date Information about production order status is required to do which of the following tasks?
An organization is preparing to deploy Multi-Factor Authentication (MFA) to its workforce. The primary concerns of the organization are cost and security. The organization realizes that their entire workforce has computers and smartphones. Which of the following is BEST suited to address the organization ' s concerns?
The question below is based on the following information:
Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?
The Data Loss Prevention (DLP) team in a major financial institution discovered network traffic that involved movement of sensitive material to a Cloud Service Provider (CSP). What action should be taken FIRST in this situation?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
A large organization that processes protected data issues preconfigured laptops to workers who then access systems and data based on their role. As their technology ages, these laptops are replaced with newer devices. What is the BEST solution to mitigate risk associated with these devices?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?
Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?
Which of the following provides for continuous improvement of the change control process?
Which of the following protocols BEST provides for the secure transfer of voice, data, and video over a network?
Which of the following BEST characterizes the operational benefit of using immutable workloads when working on a cloud-based project?
Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:
Which of the following documents is the BEST reference to describe application functionality?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
The master schedule is an Important tool in the sales and operations planning (S & OP) process because it:
An organization wants to ensure the security of communications across its environment. What is the BEST way to provide confidentiality of data from handheld wireless devices to the internal network?
An independent risk assessment determined that a hospital ' s existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?
In the sales and operations planning (S & OP) process, the demand management function provides:
Which of the following statements best characterizes enterprise resources planning (ERP) systems?
A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?
Which of the following is the BEST type of fire extinguisher for a data center environment?
An organization is concerned about escalating travel costs and requests the finance department to investigate. The finance department discovers unauthorized travel being purchased by former employees through the organization’s web portal. What should the security department validate to prevent this from reoccurring?
Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.
What BEST describes the requirement changes that are happening?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
What is the MAIN reason security is considered as part of the system design phase instead of deferring to later phases?
During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.
Which of the following security controls would BEST prevent this type of incident in the future?
A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?
The project manager has updated the project steering committee that a security vulnerability was found after applying the system security baseline, and remediation has been completed to close the vulnerability. What is the BEST next step for the project?
A contractor hacked into an unencrypted session on an organization ' s wireless network. Which authentication configuration is MOST likely to have enabled this?
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
A recent email-based malware breakout caused a significant volume of traffic and password spam account lockouts for an organization. Which BEST identifies compromised devices?
An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.
Which of the following will BEST help remediate this issue?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
Business management should be engaged in the creation of Business Continuity (BC) and Disaster Recovery plans (DRP) because they need to
Which of the following is the BEST way to identify the various types of software installed on an endpoint?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
The Cloud Security Alliance (CSA) publishes the Egregious Eleven, a list of common threats to organizations using cloud services. According to the CSA Egregious Eleven, which of the following cases falls under the category of misconfiguration and inadequate change control?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?
An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?
An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?
Which of the following activities is an example of collaboration between suppliers and operations which would give more lead time visibility?
The Chief Security Officer (CSO) of an organization would like to have a network security assessment done by the security team. Which of the following is the FIRST step in the security testing methodology?
Employees at an organization use web based services provided by an affiliate. Which of the following risks is unique to this situation?
An information security professional is considering what type of classification label to place on an organization’s software code in order to implement proper access controls. The code is considered intellectual property data and would have a catastrophic impact to the organization if compromised or destroyed. Which of the following would be the MOST appropriate classification label to apply?
Material requirements planning (MRP) performance shows improvement when the total number of:
Health information stored in paper form may be destroyed using which of the following methods?
Which of the following is typically used to control physical access to highly secure facilities?
Which of the following prioritization rules will have the greatest impact In reducing the number of orders In queue?
An organization is migrating some of its applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the accuracy of the reports showing which application should be migrated and how many applications reside on each server. As a result, the CISO is looking to establish asset management requirements. Which of these elements should be considered part of asset management requirements?
Price negotiation is most appropriate when purchasing which of the following product categories?
A software organization is getting ready to launch a new application. A security engineer notices the application allows unrestricted access to files on the web server. Which of the following recommendations will BEST resolve this security issue?
A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?
An organization received a notification from a Commercial Off-The-Shelf (COTS) provider that one of its products will no longer be supported. Using obsolescence progression stages, which of the following risk trigger points was activated in this case?
Which of the physiological biometric scanning methods is considered the MOST invasive?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
An organization is migrating its access controls to a certificate-based authentication system.
What will need to be established to verify the identity of all users connecting to the network before rolling out the system?
The security department was notified about vulnerabilities regarding users ' identity verification in a web application. Which of the following vulnerabilities is the security professional MOST likely to test?
An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?
Which of the following is a system architecture in a data protection strategy?
An organization suffered a loss to an asset at a frequency that was different than the initially estimated Annualized Rate of Occurrence (ARO). What is the appropriate course of action?
An organization ' s penetration test engineer noticed that traffic is being modified between 2 nodes and suspects an eavesdropping attack. On which networking plane is this attack occurring?
An organization has implemented a control that requires users to change their passwords every 30 days. Which setting of the password policy will prevent users from reusing passwords?
A stockout of dependent-demand item X occurred during the holiday season. To understand the root cause of the stockout, the planner should check if:
Internet Small Computer Systems Interface (iSCSI) protocol relies on Transmission Control Protocol/Internet Protocol (TCP/IP). Which can be used maliciously to interrupt the flow of data. Which Information Technology (IT) component would be impacted by such a disruption?
Which of the following describes the 3 MAIN roles of the identity-delegation model?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
An organization has been struggling to improve their security posture after a recent breach. Where should the organization focus their efforts?
Which of the following product design approaches are likely to reduce time to market for a global supply chain?
A computer forensic analyst is examining suspected malware from a computer system post-attack. Upon reverse engineering the code, the analyst sees several concerning instructions. One of those concerning instructions is that it installs a Unified Extensible Firmware Interface Basic Input/Output System (BIOS) rootkit, and when the system is then rebooted, the BIOS checks for a certain unknown program to be installed. Which security feature MOST likely would have detected and prevented this type of attack if already on the system?
What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm ' s balance sheet?
Which of the following mechanisms are PRIMARILY designed to thwart side channel attacks?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?
The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:
Which of the following actions provides the BEST evidence for forensic analysis of powered-off device?
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 19 Jun 2026
