Spring Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium APICS CPIM-8.0 Dumps Questions Answers

Page: 1 / 45
Total 606 questions

Certified in Planning and Inventory Management (CPIM 8.0) Questions and Answers

Question 1

When developing information security policies, What is the PRIMARY concern?

Options:

A.

Alignment with business requirements

B.

Compliance with legal requirements

C.

Alignment with regulatory requirements

D.

Compliance with international standards

Buy Now
Question 2

Which of the following provides for continuous improvement of the change control process?

Options:

A.

Configuration Management Database (CMDB) update

B.

Predefine change window

C.

Post change review

D.

Stakeholder notification

Question 3

Which of the following factors typically would distort a sales forecast that is based solely on shipment history?

Options:

A.

Material shortages

B.

Labor rate changes

C.

Currency exchange rates

D.

Customer demands

Question 4

An organization has been the subject of increasingly sophisticated phishing campaigns in recent months and has detected unauthorized access attempts against its Virtual Private Network (VPN) concentrators. Which of the following implementations would have the GREATEST impact on reducing the risk of credential compromise?

Options:

A.

Increasing the network password complexity requirements

B.

Implementing tougher encryption on the VPN

C.

Implementing Multi-Factor Authentication (MFA)

D.

Implementing advanced endpoint protection on user endpoints

Question 5

An example of a flexibility metric for an organization Is:

Options:

A.

average batch size.

B.

scrap rate.

C.

percentageof orders delivered late.

D.

cycle time.

Question 6

What is the MOST beneficial principle of threat modeling?

Options:

A.

To focus on specific adversaries, assets, or techniques

B.

To improve the security and privacy of a system through early and frequent analysis

C.

To create meaningful outcomes when they are of value to external agencies

D.

To create a single threat model representation as multiple models may be inconsistent

Question 7

Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?

Options:

A.

Audit log review

B.

Database encryption

C.

Immutable backups

D.

Database record locking

Question 8

Which of the following statements about demonstrated capacity Is true?

Options:

A.

It reflects the future load.

B.

It should be higher than rated capacity.

C.

It considers utilization and efficiency factors.

D.

It is determined from actual results.

Question 9

An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?

Options:

A.

Allow only a minimal number of developers to reduce the chance for errors.

B.

Ensure the organization has a written policy governing the use of open source code.

C.

Interview a number of the open source developers to determine their experience level.

D.

Scan the code for security vulnerabilities.

Question 10

The production plan defines which of the following targets?

Options:

A.

Sales forecast

B.

Quantities of each product to be produced

C.

Level of output to be produced

D.

Business plans for the company

Question 11

Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?

Options:

A.

The end system and the middleware system must trust each other.

B.

The end system authenticates and verifies the user.

C.

The end system application needs to verify the user’s identity.

D.

The application or system needs to trust the user.

Question 12

Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?

Options:

A.

Capacity of residents to act individually should be increased.

B.

Landscape design features should be used to create the impression of a fortress.

C.

Multiple entrances and exits should be used to keep traffic flowing smoothly through the facility.

D.

Communal areas with amenities should be created to encourage activity and use.

Question 13

In a lean environment, the batch-size decision for planning " A " items would be done by:

Options:

A.

least total cost.

B.

min-max system.

C.

lot-for-lot (L4L).

D.

periodic order quantity.

Question 14

A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?

Options:

A.

Mitigating

B.

Tailoring

C.

Scoping

D.

Compensating

Question 15

Based on the above table, calculate the mean absolute deviation (MAD).

Options:

A.

-25

B.

6.25

C.

18.75

D.

20

Question 16

A vendor has been awarded a contract to supply key business software. The vendor has declined all requests to have its security controls audited by customers. The organization insists the product must go live within 30 days. However, the security team is reluctant to allow the project to go live.

What is the organization ' s BEST next step?

Options:

A.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

B.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

C.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

D.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Question 17

Health information stored in paper form may be destroyed using which of the following methods?

Options:

A.

Shredding

B.

Degaussing

C.

De-identification

D.

Archiving

Question 18

Open Authorized (OAuth) has been chosen as technology to use across applications in the enterprise. Which of the following statements is TRUE about an OAuth token?

Options:

A.

Does not specify a time interval

B.

Can be used for authentication

C.

Can be used across multiple sites

D.

Specifies what information can be accessed

Question 19

An organization’s computer incident responses team PRIMARY responds to which type of control?

Options:

A.

Administrative

B.

Detective

C.

Corrective

D.

presentative

Question 20

An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?

Options:

A.

Diagram the data flows of the software package.

B.

Document the configuration of the software package.

C.

Prioritize risks to determine the mitigation strategy.

D.

Evaluate appropriate countermeasure to be implemented.

Question 21

An organization is implementing Zero Trust Network Access (ZTNA) and needs a strategy to measure device trust for employee laptops. Which measurement strategy is BEST suited and why?

Options:

A.

Remote using a Trusted Platform Module (TPM) due to better protection of the keys

B.

Local using Trusted Platform Module (TPM) because low-level access software can be accessed

C.

Local using Trusted Platform Module (TPM) because of benefits from Segregation Of Duties (SoD)

D.

Remote using a scanning device because of benefits from Segregation Of Duties (SoD)

E.

Local using Mobile Device Management (MDM) because of device policy enforcement

Question 22

Disaster Recovery (DR) training plan outcomes should have which KEY quality?

Options:

A.

Comprehensible

B.

Identifiable

C.

Measurable

D.

Editable

Question 23

After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?

Options:

A.

Natural threats

B.

Elevation of privilege

C.

Repudiation

D.

Information disclosure

Question 24

The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?

Options:

A.

Lot size

B.

Priority

C.

Setup time

D.

Run time

Question 25

A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?

Options:

A.

Product variety will decrease.

B.

Sales volume per product family will increase.

C.

Number of finished items stocked will decrease.

D.

Number of component items stocked will increase.

Question 26

A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider ' s system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?

Options:

A.

SOC 2 Type 1

B.

SOC 2 Type 2

C.

SOC 1 Type 1

D.

SOC 1 Type 2

Question 27

Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?

Options:

A.

Application whitelisting

B.

Data governance

C.

Data loss prevention (DLP)

D.

Intrusion detection and prevention system (IDPS)

Question 28

An organization has determined that it needs to retain customer records for at least thirty years to discover generational trends in customer behavior. However, relevant local regulation requires that all Personally Identifiable Information (PII) is deleted after expiration of the customer ' s engagement with the organization, which is usually no longer than one year. How should the data be handled at the expiration of customer engagement at one year?

Options:

A.

Because the data contains PII, it should be backed up in an encrypted form, with the encryption key securely kept in a Hardware Security Module (HSM), and all access logged and monitored.

B.

The data should be deleted from the customer website, and archived to a write-once, read-many drive to securely meet the business requirement for analytics.

C.

PII portion of the data should be tokenized or deleted, and the rest of the data stored securely to meet the business requirement for analytics.

D.

Since legal and regulatory compliance takes priority over business requirements, the data should be deleted.

Question 29

A manufacturer has a primary assembly line supported by output from several subassembly lines. Which of the following scenarios would be the best argument for a multilevel master scheduling process?

Options:

A.

Low variation in aggregate subassembly demand

B.

High variation in aggregate subassembly demand

C.

Low variation in subassembly demand mix

D.

High variation in subassembly demand mix

Question 30

Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?

Options:

A.

Due care

B.

Vulnerability management

C.

Software Development Life Cycle (SDLC)

D.

Software assurance

Question 31

Which of the following is the MOST important consideration in a full-scale disaster recovery test?

Options:

A.

Sign off by the Chief Information Officer (CIO)

B.

Financial cost of the organization

C.

Business interruption

D.

Available Information Technology (IT) hardware

Question 32

Which of the following BEST describes an individual modifying something the individual is not supposed to?

Options:

A.

Exfiltration

B.

Tampering

C.

Spoofing

D.

Repudiation

Question 33

What are the FIRST two steps an organization should conduct to classify its assets?

Options:

A.

Define user requirements and collate existing inventories

B.

Categorize assets and set minimum security controls

C.

Conduct an inventory of assets and determine the owners

D.

Obtain senior management buy-in and conduct a risk assessment

Question 34

A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?

Options:

A.

Initiate the organization’s Incident Response Plan (IRP).

B.

Review the organizational social media policy.

C.

Review logs of all user’s social media activity.

D.

Determine a list of information assets that contain PII.

Question 35

A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?

Options:

A.

Authorization controls

B.

Two-Factor Authentication (2FA)

C.

Non-repudiation controls

D.

Access audit

Question 36

Which of the following ensures privileges are current and appropriately reflect an individual’s authorized roles and responsibilities?

Options:

A.

Access authorization

B.

Identity management

C.

Access approval

D.

Access review

Question 37

During a manual source code review, an organization discovered a dependency with an open-source library that has a history of being exploited. Which action should the organization take FIRST to assess the risk of depending on the open-source library?

Options:

A.

Identify the specific version of the open-source library that is implemented

B.

Request a penetration test that will attempt to exploit the open-source library

C.

Deploy the latest compatible version of the open-source library

D.

Submit a change request to remove software dependencies with the open-source library

Question 38

An organization is aiming to be System and Organization Controls (SOC) 2 certified by an audit organization to demonstrate its security and availability maturity to its sub service organizations. Which type of audit does this engagement BEST describe?

Options:

A.

Forensic audit

B.

Third-party audit

C.

Location audit

D.

Internal audit

Question 39

While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user ' s hash from being cached, what is the MOST appropriate policy to mandate?

Options:

A.

Add privileged user to the domain admin group.

B.

Add privileged users to the protected users group.

C.

Enable security options for each privileged user.

D.

Place each privileged user in a separate Kerberos policy.

Question 40

Which of the following is a disadvantage of using federated identity?

Options:

A.

The administrative burden is increased

B.

The application has access to the user’s credentials

C.

Applications may need complex modifications to implement

D.

A compromised credential provides access to all the user’s applications

Question 41

A manufacturer begins production of an item when a customer order is placed. This is an example of a(n):

Options:

A.

Assemble-to-order (ATO) environment

B.

Make-to-stock (MTS) environment

C.

Pull system

D.

Push system

Question 42

Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?

Options:

A.

List and evaluate IAM available products.

B.

Evaluate business needs.

C.

Engage the sponsor and identify Key stakeholders.

D.

Engage the existing Information Technology (IT) environment.

Question 43

What is the BEST preventive measure against employees abusing access privileges?

Options:

A.

Move abusers to other positions

B.

Establish a solid security awareness training program

C.

Terminate abusers

D.

Require frequent password changes

Question 44

If all other factors remain the same, when finished goods inventory investment is increased, service levels typically will:

Options:

A.

remain the same.

B.

increase in direct (linear) proportion.

C.

increase at a decreasing rate.

D.

increase at an increasing rate.

Question 45

Following the setting of an organization’s risk appetite by senior management, a risk manager needs to prioritize all identified risks for treatment. Each risk has been scored based on its Annualized Loss Expectancy (ALE). Management has asked for an immediate risk mitigation plan focusing on top risks. Which is the MOST effective approach for the risk manager to quickly present a proposal to management?

Options:

A.

Rank all risks based on their Single-Loss Expectancy (SLE) and select those that exceed a maximum acceptable threshold derived from the risk appetite.

B.

Rank all risks based on ALE and select those that exceed a maximum acceptable threshold derived from the risk appetite.

C.

Rank all risks based on Single-Loss Expectancy (SLE) and select the top 10 risks.

D.

Rank all risks based on ALE and select the top 10 risks.

Question 46

Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:

Options:

A.

backlog is very low.

B.

the status of work orders is disregarded.

C.

lean principles are used.

D.

material requirements planning (MRP) is used.

Question 47

Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?

Options:

A.

Supply disruptions

B.

Forecast inaccuracy

C.

Procurement problems

D.

Loss of intellectual property

Question 48

Which of the following regarding authentication protocols is a PRIMARY consideration when designing an authentication and key management system?

Options:

A.

Refresh

B.

Visibility

C.

Authorization

D.

Integrity

Question 49

A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?

Options:

A.

Proactive threat modeling

B.

Reactive threat modeling

C.

Risk assessment

D.

Threat modeling assessment

Question 50

An advertising agency is working on a campaign for a prospective client. Competitors are working on a similar campaign and are interested in knowing what the firm has designed. What should the advertising agency do to BEST ensure intellectual property does not leave the organization?

Options:

A.

Protect the information by installing a Data Loss Prevention (DLP) system

B.

Block all organizational email communication with the competitor

C.

Install an Intrusion Prevention System (IPS)

D.

Encrypt the data on the servers and distribute private-key information to authorized users

Question 51

What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?

Options:

A.

A structured risk management process

B.

A common set of security capabilities

C.

A structured cybersecurity program

D.

A common language and methodology

Question 52

An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?

Options:

A.

DNS over Transmission Control Protocol (TCP)

B.

DNS sinkholing

C.

Deep packet inspection

D.

Domain Name System Security Extensions (DNSSEC)

Question 53

The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?

Cost CategoryCost

Custom fees$125

Freight$700

Warehouse rent$200

Matenal cost$500

Options:

A.

$825

B.

$1,325

C.

$1,400

D.

$1,525

Question 54

Which of the following stock location systems would you use in a repetitive manufacturing, lean environment?

Options:

A.

Fixed location

B.

Floating location

C.

Point-of-use storage

D.

Central storage

Question 55

An organization’s computer incident response team PRIMARILY responds to which type of control?

Options:

A.

Detective

B.

Administrative

C.

Preventative

D.

Corrective

Question 56

To ensure the quality of its newly developed software, an organization is aiming to deploy an automated testing tool that validates the source code. What type of testing BEST supports this capability?

Options:

A.

Network vulnerability scanning

B.

Dynamic Application Security Testing (DAST)

C.

Static Application Security Testing (SAST)

D.

Fuzz parsing

Question 57

Which of the following techniques would a group use to prioritize problems?

Options:

A.

Critical path analysis

B.

Pareto analysis

C.

Scatter charts

D.

Cause-and-effect diagrams

Question 58

The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?

Options:

A.

Deploy the solution to a network terminal access point port.

B.

Deploy the solution and connect it to a Switched Port Analyzer (SPAN) port.

C.

Deploy the solution in line with the traffic flows.

D.

Deploy the solution on a separate Virtual Local Area Network (VLAN).

Question 59

A large organization wants to implement a vulnerability management system in its internal network. A security professional has been hired to set up a vulnerability scanner on premises and to execute the scans periodically. Which of the following should be the FIRST action performed by the security professional?

Options:

A.

Configure internal firewalls to accept and pass all scanner traffic and responses

B.

Execute a vulnerability scan to determine the current organization security posture

C.

Select two different vulnerability scanners to get comprehensive reporting

D.

Obtain support from the computing systems ' stakeholders

Question 60

A champion is assigned to lead a threat modeling exercise. Which of the following will be the FIRST thing to consider?

Options:

A.

Using an automated tool to construct system models

B.

Outlining a detailed threat modeling procedure

C.

Scheduling weekly threat modeling sessions

D.

Ensuring the right stakeholder are involved

Question 61

A security engineer is reviewing Incident Response (IR) roles and responsibilities. Several roles have static elevated privileges in case an incident occurs. Instead of static access, what is the BEST access method to manage elevated privileges?

Options:

A.

Just-in-time

B.

Delegated

C.

Break-glass

D.

Automated

Question 62

Which of the following statements best characterizes enterprise resources planning (ERP) systems?

Options:

A.

They track activity from customer order through payment.

B.

They are expensive but easy to implement.

C.

They provide real-time planning and scheduling, decision support, available-to-promise (ATP), and capable-to-promise (CTP) capabilities.

D.

They are used for strategic reporting requirements.

Question 63

An organization is migrating some of its applications to the cloud. The Chief Information Security Officer (CISO) is concerned about the accuracy of the reports showing which application should be migrated and how many applications reside on each server. As a result, the CISO is looking to establish asset management requirements. Which of these elements should be considered part of asset management requirements?

Options:

A.

Threat modelling and discovery

B.

Configuration Management (CM) database

C.

Risk management framework

D.

Integration testing program

Question 64

A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.

What is the BEST action the engineer can take to ensure secure operations?

Options:

A.

Refer to the organization’s SCADA security standards and policies.

B.

Refer to the SCADA risk assessment and industry standards.

C.

Review the organizational Standard Operating Procedures (SOP).

D.

Conduct logging and monitoring of the system and apply need to know and least privileges.

Question 65

Which of the following actions hinders the transition from a push system to a pull system?

Options:

A.

Using standardized containers

B.

Using work orders as a backup

C.

Introducing kanban cards as authorization for material movement

D.

Maintaining a constant number of kanban cards during minor changes in the level of production

Question 66

What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?

Options:

A.

Advanced Threat Protection (ATP)

B.

Address Space Layout Randomization (ASLR)

C.

Structured exception handling overwrite protection

D.

Export address table filtering

Question 67

According to best practice, at which step in the system lifecycle shall a security professional begin involvement?

Options:

A.

Project initiation and planning

B.

Functional requirements and definition

C.

System design specification

D.

Build and document

Question 68

Which of the following demand management approaches tends to be most subjective?

Options:

A.

Seasonal analysis

B.

Time series forecasting

C.

Collaborative planning, forecasting, and replenishment (CPFR)

D.

Delphi method

Question 69

When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:

Options:

A.

any request for shipment prior to the planning time fence.

B.

any request for shipment prior to the demand time fence (DTF).

C.

requests only for shipment before the next master production schedule (MPS) receipt.

D.

requests only for shipment in the period of the receipt.

Question 70

Which of the following is MOST important for an international retail company to consider when handling and retaining information about its customers?

Options:

A.

Internal security policies

B.

General Data Protection Regulation (GDPR)

C.

System And Organization Controls (SOC) audit criteria

D.

Cyber insurance premiums

Question 71

A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?

Options:

A.

Secure Shell (SSH)

B.

Trusted Platform Module (TPM)

C.

Virtual Private Network (VPN)

D.

Transport Layer Security (TLS)

Question 72

Which of the following are steps involved in the identity and access provisioning lifecycle?

Options:

A.

Dissemination, review, revocation

B.

Dissemination, rotation, revocation

C.

Provisioning, review, revocation

D.

Provisioning, Dissemination, revocation

Question 73

In pyramid forecasting, the " roll up " process begins with:

Options:

A.

combining individual product item forecasts into forecasts for product families.

B.

combining forecasts for product families into a total business forecast.

C.

allocating total business forecast changes to product families.

D.

allocating product family forecast changes to individual products.

Question 74

Which of the following categories of web services testing describes correctness testing of web service security functionality?

Options:

A.

Focuses on ensuring that security operations performed by a web service meets its stated requirements

B.

Generally includes threat modeling, requirements risk analysis, and security modeling

C.

Ensures that individual protocol implementations adhere to the relevant published standards

D.

Focuses on the smallest unit of the web service application, apart from the rest of the application

Question 75

A software organization is getting ready to launch a new application. A security engineer notices the application allows unrestricted access to files on the web server. Which of the following recommendations will BEST resolve this security issue?

Options:

A.

Eliminate all calls for file access requests.

B.

Eliminate illegitimate calls for file access requests.

C.

Whitelist files and folders for file access requests.

D.

Blacklist files and folders for file access requests.

Question 76

Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?

Options:

A.

Integrity and authentication

B.

Integrity and non-repuditation

C.

Integrity and availability

D.

Confidentiality and availability

Question 77

An organization has identified that an individual has failed to adhere to a given standard set by the organization. Based on the needs of the organization, it was decided that an exception process will be created. What is the PRIMARY benefit of establishing an exception process?

Options:

A.

Prevent future material audit findings.

B.

Provide administrators with more autonomy.

C.

Enable management of organizational risk.

D.

Ensure better Business Continuity (BC).

Question 78

An organization decides to conduct penetration testing. Senior management is concerned about the potential loss of information through data exfiltration. The organization is currently preparing a major product launch that is time-sensitive. Which of the following methods of testing is MOST appropriate?

Options:

A.

Gray box

B.

Green box

C.

Black box

D.

White box

Question 79

A low-cost provider strategy works best when which of the following conditions are met?

Options:

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

Question 80

A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?

Options:

A.

Determine local requirements.

B.

Determine federal requirements.

C.

Ensure that all data has been classified.

D.

Designate a person of authority.

Question 81

A manufacturing facility uses common wireless technologies to communicate. The head of security is concerned about eavesdropping by attackers outside the perimeter fence. The distance between the facility and fence is at least 300 feet (100 m). Which of the following wireless technologies is MOST likely to be available to an attacker outside the fence?

Options:

A.

ZigBee

B.

Radio-Frequency Identification (RFID)

C.

Long-Term Evolution (LTE)

D.

Bluetooth

Question 82

When assessing a new vendor as a possible business partner, what would BEST demonstrate that the vendor has a proactive approach to data security compliance?

Options:

A.

The vendor provides documented safeguards in handling confidential data.

B.

The vendor provides a copy of their externally performed risk assessment.

C.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

D.

The vendor has a signed contract in place before work with data begins.

Question 83

A company can easily change Its workforce, but inventory carrying costs are high. Which of the following strategies would be most appropriate during times of highly fluctuating demand?

Options:

A.

Produceto backorders

B.

Produceat a constant level

C.

Produceto the sales forecast

D.

Produceto demand

Question 84

What is the PRIMARY benefit an organization obtains by cybersecurity framework to their cybersecurity program?

Options:

A.

A common set of security capabilities

B.

A common language and methodology

C.

A structured cybersecurity program

D.

A structured risk management process

Question 85

A company with stable demand that uses exponential smoothing to forecast demand would typically use a:

Options:

A.

low alpha value.

B.

low beta value.

C.

high beta value.

D.

high alpha value.

Question 86

The question below is based on the following alternative schedules for a lot of 1,200.

A company works 8-hour, single-shift days. Setups are 4 hours for Operation 20 and 4 hours for Operation 40. Each operation has multiple machines available.

Which of the following statements is correct?

Options:

A.

Operation overlapping results in reduced total setup costs.

B.

Operation overlapping results in reduced total span time.

C.

Lot splitting results in the shortest overall lead time.

D.

Lot splitting results in reduced total setup costs.

Question 87

During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.

Which of the following security controls would BEST prevent this type of incident in the future?

Options:

A.

Invoke code repository vulnerability scanning on a regularly scheduled basis.

B.

Implement Role-Based Access Controls (RBAC) in each component of the deployment pipeline.

C.

Encrypt the application package after being digitally signed.

D.

Implement a software Bill of Materials (BOM) for each application package.

Question 88

A stockout of dependent-demand item X occurred during the holiday season. To understand the root cause of the stockout, the planner should check if:

Options:

A.

There was high customer demand for X.

B.

There was a wrong seasonal index applied to X.

C.

There was an inventory inaccuracy for X.

D.

There was a low forecast for X.

Question 89

An example of a cradle-to-cradle sustainability model would be:

Options:

A.

a laundry service collects dirty baby clothes from families; cleans the clothes in large, efficient batches; and then sorts and delivers the clothes back to each family.

B.

a coffee shop collects paper waste in its restaurants, has a selected supplier collect the paper waste to be recycled, and then purchases paper products from that supplier.

C.

a company uses wood that has been gathered from multiple sources to construct items, such as beds and toys for babies and young children.

D.

a bank offers the lowest interest rates on loans to firms that are committed to using recycled materials and implementing zero-waste initiatives in their processes.

Question 90

An independent risk assessment determined that a hospital ' s existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

Options:

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Question 91

A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?

Options:

A.

Local self-encryption with passwords managed by a local password manager

B.

Client-side encryption keys and passwords generated dynamically during cloud access sessions

C.

Zero-knowledge encryption keys provided by the cloud storage vendor

D.

Passwords generated by a local password manager during cloud access sessions and encrypted in transit

Question 92

What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?

Options:

A.

Threat categorization

B.

Threat avoidance

C.

Threat acceptance

D.

Threat mitigation

Question 93

An organization has hired a consultant to establish their Identity and Access Management (IAM) system. One of the consultant’s main priorities will be to understand the current state and establish visibility across the environment. How can the consultant start to establish an IAM governance process?

Options:

A.

Implement Attribute-Based Access Control (ABAC) process for sensitive applications.

B.

Determine authoritative identity sources.

C.

Understand connectivity to target applications.

D.

Implement Role-Based Access Control (RBAC) process for web-based applications.

Question 94

Which of the following systems would be the most cost-efficient for inventory management of a low value item?

Options:

A.

Order point

B.

Material requirements planning (MRP)

C.

Periodic review

D.

Economic order quantity(EOQ)

Question 95

Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?

Options:

A.

Data

B.

Physical

C.

Network

D.

Transport

Question 96

A large retail organization will be creating new Application Programming Interfaces (API) as part of a customer-facing shopping solution. The solution will accept information from users both inside and outside of the organization. What is the safest software development practice the team can follow to protect the APIs against Structured Query Language Injection (SQLi) attacks?

Options:

A.

Strictly validate all inputs for safe characters.

B.

Grant database access using the principle of least authority.

C.

Escape special characters in input statements.

D.

Use prepared input statements.

Question 97

In choosing suppliers, a company wishes to maintain maximum leverage to reduce costs. Which of the following supply chain strategies would provide this opportunity?

Options:

A.

Single sourcing

B.

Multisourcing

C.

Long-term agreement

D.

Service-level agreement (SLA)

Question 98

A webmaster has repeatedly used the same certificate sign request to renew an organization ' s website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?

Options:

A.

Logical access control against symmetric key

B.

Cryptanalysis against symmetric key

C.

Cryptanalysis against private key

D.

Logical access control against private key

Question 99

An organization ' s security policy requires sensitive information to be protected when being transmitted to external sources via would be the BEST security solution to choose?

Options:

A.

Use spam filters and anti-virus software to send emails externally.

B.

Configure digital signatures to send emails externally.

C.

Configure the system to utilize to send encrypted emails externally.

D.

Use e-mail security gateway to send emails externally.

Question 100

Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?

Options:

A.

Definition of anti-spam policies

B.

Removal of previous email servers

C.

Definition of key management policies

D.

Backup of email messages and folders

Question 101

Which of the following items does the master scheduler have the authority to change in the master scheduling process?

Options:

A.

Product mix

B.

Aggregate volume

C.

Engineering change effectivity date

D.

Customer order quantities

Question 102

An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization ' s documented policies and standards?

Options:

A.

Select an appropriate sample size of changes to production servers related to critical systems within the audit period and ensure they adhere to documented policies and standards.

B.

Select an appropriate sample size of recently deployed servers and review their configuration files against the organization ' s policies and standards.

C.

Select all production servers related to critical systems and review their configuration files against the organization ' s policies and standards.

D.

Select an appropriate sample size of changes to recently deployed servers within the audit period and ensure they adhere to documented policies and standards.

Question 103

What is the BEST item to consider when designing security for information systems?

Options:

A.

The comprehensive level of assurance required

B.

The jurisdiction of the information system

C.

The security requirements of the board

D.

The Disaster Recovery Plan (DRP)

Question 104

Who is responsible for ensuring compliance when an organization uses a cloud provider to host its Virtual Machine (VM) instances?

Options:

A.

An independent auditor employed by the cloud provider is responsible for ensuring compliance.

B.

The cyber insurance carrier is responsible for ensuring compliance.

C.

The cloud provider may have a level of responsibility; however, the customer is ultimately responsible for ensuring compliance.

D.

Compliance is equally shared between the cloud provider, the customer, and third-party vendors that interact with the VM instances.

Question 105

Which of the following methods places a replenishment order when the quantity on hand falls below a predetermined level?

Options:

A.

Min-max system

B.

Fixed order quantity

C.

Periodic review

D.

Available-to-promlse (ATP)

Question 106

Corporate fraud has historically been difficult to detect. Which of the following methods has been the MOST helpful in unmasking embezzlement?

Options:

A.

Accidental discovery

B.

Management review

C.

Anonymous tip lines

D.

Internal audit

Question 107

Which of the following controls should a financial Institution have in place in order to prevent a trader from both entering and executing a trade?

Options:

A.

Cameras in the trading room

B.

Two-Factor Authentication (2FA)

C.

Separation of Duties (SoD)

D.

Least privilege

Question 108

During an investigation, a forensic analyst executed a task to allow for the authentication of all documents, data, and objects collected, if required. Which of the options below BEST describes this task?

Options:

A.

Electronically stored information was collected through a forensic tool.

B.

Metadata was collected from files and objects were listed in a notebook.

C.

A chain of custody form was filled with all items quantity and descriptions.

D.

Archive tagging was applied to all digital data and physical papers were stamped.

Question 109

A cybersecurity analyst is responsible for identifying potential security threats and vulnerabilities in the organization ' s software systems. Which action BEST demonstrates the understanding and application of threat modeling concepts and methodologies?

Options:

A.

Implementing a Business Continuity Plan (BCP)

B.

Conducting access control assessments for the data center

C.

Analyzing potential attack vectors for a new software application

D.

Developing a Disaster Recovery Plan (DRP) for critical systems

Question 110

Cloud computing introduces the concept of the shared responsibility model. This model can MOST accurately be described as defining shared responsibility between which of the following?

Options:

A.

Hosts and guest environments

B.

Operating Systems (OS) and applications

C.

Networks and virtual environments

D.

Customers and providers

Question 111

An organization is running a cloud-based application to process the information obtained at point-of-sale devices. Which guideline should be applied to the application?

Options:

A.

Health Insurance Portability And Accountability Act (HIPAA)

B.

Application Security Verification Standard (ASVS)

C.

Payment Card Industry Data Security Standard (PCI DSS)

D.

Gramm-Leach-Bliley Act (GLBA)

Question 112

An organization provides customer call center operations for major financial services organizations around the world. As part of a long-term strategy, the organization plans to add healthcare clients to the portfolio. In preparation for contract negotiations with new clients, to which cybersecurity framework(s) should the security team ensure the organization adhere?

Options:

A.

Control Objectives For Information And Related Technology (COBIT) and Health Insurance Portability And Accountability Act (HIPAA) frameworks

B.

National Institute Of Standards And Technology (NIST) and International Organization For Standardization (ISO) frameworks

C.

Frameworks specific to the industries and locations clients do business in

D.

Frameworks that fit the organization’s risk appetite, as cybersecurity does not vary industry to industry

Question 113

Which of the following is PRIMARILY responsible for deciding the classification of data in an organization?

Options:

A.

Data owner/steward

B.

Authorizing Official (AO)

C.

Chief Information Security Officer (CISO)

D.

Data custodian

Question 114

Risk pooling would work best for items with:

Options:

A.

low demand uncertainty and short lead times.

B.

low demand uncertainty and long lead times.

C.

high demand uncertainty and short lead times.

D.

high demand uncertainty and long lead times.

Question 115

In which of the following phases of the product life cycle is product price most effective in influencing demand?

Options:

A.

Introduction

B.

Growth

C.

Maturity

D.

Decline

Question 116

A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?

Options:

A.

Enabling software to enforce authorized network profiles

B.

Having an automated alerting capability when a problem is detected

C.

Third-party software to monitor configuration changes on the network

D.

Using a monitoring tool to capture all network activity

Question 117

An organization experienced multiple compromises of endpoints, leading to breaches of systems and data. In updating its strategy to defend against these threats, which of the following BEST considers the organization’s needs?

Options:

A.

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)

B.

Zero Trust (ZT) threat modeling

C.

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

D.

Process for Attack Simulation and Threat Analysis (PASTA)

Question 118

The results of a threat campaign show a high risk of potential intrusion. Which of the following parameters of the Common Vulnerability Scoring System (CVSS) will MOST likely provide information on threat conditions for the organization to consider?

Options:

A.

Modified base metrics

B.

Remediation level

C.

Integrity requirements

D.

Attack complexity

Question 119

Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm ' s balance sheet?

Options:

A.

Decreased fixed assets

B.

Decreased retained earnings

C.

Increased accounts receivable

D.

Increased intangible assets

Question 120

A large volume of outbound Transmission Control Protocol (TCP) connections from the same source Internet Protocol (IP) address was observed at a satellite office firewall. Which of the following is the MOST likely explanation?

Options:

A.

There is only one managed switch port device on the satellite network.

B.

The command and control server has shut down all but one host.

C.

The network hosts are behind a Network Address Translation (NAT) device.

D.

The malware has shut down all but one host used for command and control.

Question 121

Which of the following is typically used to control physical access to highly secure facilities?

Options:

A.

Surveillance

B.

Mantrap

C.

Dual control

D.

Door locks

Question 122

Which of the physiological biometric scanning methods is considered the MOST invasive?

Options:

A.

Retina

B.

Facial recognition

C.

Iris

D.

Hand geometry

Question 123

What is an important countermeasure to consider when hardening network devices and servers to reduce the effectiveness of unauthorized network scanning?

Options:

A.

Filter inbound logging and auditing configuration of all network devices.

B.

Filter inbound Internet Control Message Protocol (ICMP) messages at the network edge.

C.

Filter outbound logging and auditing configuration of all network devices.

D.

Filter outbound Internet Control Message Protocol (ICMP) messages at the network edge.

Question 124

Marketing has requested a significant change in the mix for a product family. The requested change falls between the demand and the planning time fences. The most appropriate action by the master scheduler is to:

Options:

A.

reject the request.

B.

accept the request.

C.

forward the request to senior management.

D.

check the availability of required material.

Question 125

An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?

Options:

A.

Tokenization

B.

Anonymization

C.

Obfuscation

D.

Destruction

Question 126

Which protocol is the BEST option to provide authentication, confidentiality, and data integrity between two applications?

Options:

A.

File Transfer Protocol (FTP)

B.

Security Assertion Markup Language (SAML)

C.

Peer-To-Peer (P2P) communication

D.

Transport Layer Security (TLS)

Question 127

A warehouse manager assigns orders to warehouse personnel grouped by where the goods are stored. This type of picking is called a(n):

Options:

A.

Zone system

B.

Area system

C.

Multi-order system

D.

Pull system

Question 128

A systems engineer has been tasked by management to provide a recommendation with a prioritized, focused set of actions to help the organization stop high-risk cyber attacks and ensure data security. What should the systems engineer recommend the organization use to accomplish this?

Options:

A.

Center for Internet Security critical security controls

B.

Control Objectives for Information and Related Technology (COBIT)

C.

Inventory baseline controls

D.

Security content automation protocol controls

Question 129

Which of the below represent the GREATEST cloud-specific policy and organizational risk?

Options:

A.

Loss of governance between the client and cloud provider

B.

Loss of business reputation due to co-tenant activities

C.

Supply chain failure

D.

Cloud service termination or failure

Question 130

An audit of antivirus server reports shows a number of workstations do not have current signatures installed. The organization security standard requires all systems to have current antivirus signatures. What distinct part of the audit finding did the auditor fail to include?

Options:

A.

Criteria

B.

Condition

C.

Effect

D.

Cause

Question 131

Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?

Options:

A.

Security

B.

Data

C.

Application

D.

Control

Question 132

Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?

Options:

A.

80

B.

120

C.

160

D.

200

Question 133

Which of the following is an information security management framework?

Options:

A.

Control Objectives For Information And Related Technologies (COBIT)

B.

Information Technology Infrastructure Library (ITIL)

C.

International Organization For Standardization (ISO) 27001

D.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Question 134

Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?

Options:

A.

Mai-In-The-Middle (MITM)

B.

Side-Channel

C.

Frequency analysis

D.

Fault injection

Question 135

When implementing a data classification program, Which is MOST important for measuring businesss impact?

Options:

A.

Data classification program being rolled out in accordance with policies and procedures

B.

Measuring the size of the data set to understand scoping for compliance requirements

C.

The adverse effect of data leakage

D.

The early appointment of data custodians

Question 136

Which of the following is the workflow of the identity and access provisioning lifecycle?

Options:

A.

Creation, Assessment, Deletion

B.

Assessment, Creation, Deletion

C.

Provision, Review, Revocation

D.

Review, Provision, Revocation

Question 137

The most effective way to manage demand uncertainty and improve customer service is to reduce:

Options:

A.

Backlogs

B.

Lead times

C.

Safety stock

D.

Product options

Question 138

Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?

Options:

A.

Using excess cash generated to fund other business units

B.

Investing in the acquisition of competitors

C.

Investing in projects to maintain market share

D.

Designing product improvements to protect market share

Question 139

The project manager for a new application development is building a test framework. It has been agreed that the framework will Include penetration testing; however, the project manager is keen to identify any flaws prior to the code being ready for execution. Which of the following techniques BEST supports this requirement?

Options:

A.

System vulnerability scans

B.

Database injection tests

C.

System reliability tests

D.

Static source code analysis

Question 140

An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?

Options:

A.

Privileged Access Management (PAM) policy

B.

Multi-Factor Authentication (MFA)

C.

Video log monitoring

D.

Notification alerts

Question 141

Which of the following is the BEST solution to implement to mitigate the risk of data breach in the event of a lost or stolen mobile device?

Options:

A.

Mobile application management

B.

Bring Your Own Device (BYOD) policy

C.

Network Access Control (NAC)

D.

Mobile Device Management (MDM)

Question 142

Information regarding a major new customer is received from sales. The company ' s most appropriate initial response would be to adjust the:

Options:

A.

production volume.

B.

master production schedule (MPS).

C.

sales and operations plan.

D.

forecast.

Question 143

An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?

Options:

A.

Verify sanitization results by trying to read 100% of the media.

B.

Determine the type of media in the computer and apply the appropriate method of sanitization.

C.

Use cryptographic erasure to ensure data on the media device is erased.

D.

Use a program that will overwrite existing data with a fixed pattern of binary zeroes.

Question 144

An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.

Which of the following topics will MOST likely be on the agenda?

Options:

A.

Results of the preliminary cost-benefit studies

B.

Design of the application system and database processes

C.

Communication of procedures and reporting requirements

D.

Identification of inter-application dependencies

Question 145

Which of the following is a document that will be obtained at the end of an asset’s lifecycle?

Options:

A.

Asset registry

B.

Bill of lading

C.

Certificate of disposal

D.

Master data record

Question 146

Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?

Options:

A.

Improved threat detection

B.

Flexible firewall configuration

C.

Network availability

D.

Improved threat prevention

Question 147

Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?

Options:

A.

Independent verification and validation

B.

Code signing

C.

Digital Rights Management (DRM)

D.

Software assessment

Question 148

In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?

Options:

A.

The behavior is ethical, because the email administrator was not deliberately looking for the email and only accidentally read the emails.

B.

The behavior is ethical, because the email administrator read the emails to confirm that the email system was properly restored.

C.

The behavior is not ethical, because the email administrator exceeded his or her privilege and trust in reading the email messages.

D.

The behavior is not ethical, because the email administrator should have informed the manager about the restoration in advance.

Question 149

An organization currently has a network with 55,000 unique Internet Protocol (IP) addresses in their private Internet Protocol version 4 (IPv4) network range and has acquired another organization and must integrate their 25,000 endpoints with the existing, flat network topology. If subnetting is not implemented, which network class is implied for the organization ' s resulting private network segment?

Options:

A.

A

B.

B

C.

C

D.

E

Question 150

Which of the following represents the BEST metric when measuring the effectiveness of a security awareness program?

Options:

A.

Interview the candidates ' managers about training effectiveness.

B.

Test the candidates on the content of the program.

C.

Require the candidates ' signatures to certify that they have attended training.

D.

Provide management reporting of candidate completion status.

Question 151

The horizon for forecasts that are input to the sales and operations planning (S & OP) process should be long enough that:

Options:

A.

cumulative forecast deviation approaches zero.

B.

planned product launches can be incorporated.

C.

required resources can be properly planned.

D.

supply constraints can be resolved.

Question 152

What is the MOST effective way to begin a risk assessment?

Options:

A.

Reviewing the policy, objectives, mandate, and commitment to manage risk

B.

Learning the organization ' s ability to accept and/or manage risks

C.

Identifying the resources available to manage risks within the organization

D.

Identifying the nature of the risks faced by the organization

Question 153

Which of the following factors is the MOST important consideration for a security team when determining whether cryptographic erasure can be used for disposal of a device?

Options:

A.

If the data on the device exceeds what cryptographic erasure can safely process

B.

If the methods meet the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001

C.

If security policies allow for cryptographic erasure based on the data stored on the device

D.

If the device was encrypted prior using cipher block chaining

Question 154

Check sheets can be used to:

Options:

A.

determine the frequency of a defect and the time period between occurrences.

B.

provide a quick method to identify if possible defects exist.

C.

allow improvement teams to see if action items are being completed on time.

D.

provide an indication of correlation between defects.

Question 155

A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?

Options:

A.

Network firewalls

B.

Logical isolation

C.

Application firewalls

D.

Physical isolation

Question 156

A forecasting method that responds slowly to changes in demand would be most appropriate when the historical demand pattern shows a:

Options:

A.

Minor seasonal component

B.

Major seasonal component

C.

Minor random component

D.

Major random component

Question 157

In which of the following circumstances is an organization MOST likely to report the accidental release of personal data to the European Union (EU) General Data Protection Regulation (GDPR) supervisory authority and affected users?

Options:

A.

The release of personal data was made to a highly trusted third-party vendor and there was confirmation that the data was not accessed before it was returned.

B.

The personal data was stored in a highly encrypted format and there is confirmation that the encryption keys were not accessed or released.

C.

All the personal data from the accidental release was from individuals who are not living in the EU.

D.

The personal data released only contained the ages and names of children who may or may not be living in the EU.

Question 158

Broadcast traffic is causing network performance degradation of sensitive equipment.

Which of the following methods is used to prevent the broadcast traffic from impacting availability?

Options:

A.

Place the sensitive equipment behind a firewall to prevent the broadcast traffic from impacting the equipment.

B.

Implement Quality of Service (QoS) on network switches to throttle the sensitive equipment traffic.

C.

Move the sensitive equipment to a different switch port to prevent the broadcast traffic from impacting the equipment.

D.

Use Network Access Control (NAC) to prevent the broadcast traffic from broadcasting.

Question 159

What can help a security professional assess and mitigate vulnerabilities of an embedded device?

Options:

A.

Conduct black-box testing.

B.

Conduct red-box testing.

C.

Conduct yellow-box testing.

D.

Conduct green-box testing.

Question 160

An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?

Options:

A.

International Organization For Standardization (ISO)

B.

European Committee for Electrotechnical Standardization

C.

Caribbean Community Regional Organization for Standards and Quality

D.

Institute of Electrical and Electronics Engineers (IEEE)

Question 161

An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?

Options:

A.

Network ' s Service Set Identifier (SSID) visibility and vulnerabilities are not cast out too far.

B.

Parabolic antenna is used for signal convergence.

C.

Network efficiently allows maximum channel separation.

D.

Implement Wired Equivalent Privacy (WEP) encryption.

Question 162

Which of the following tactics can be employed effectively to reduce appraisal quality costs?

Options:

A.

Investing in prevention

B.

Conducting quality audits

C.

Loosening product specifications

D.

Implementing house of quality (HOQ)

Question 163

Which of the following is the MOST effective approach to reduce the threat of rogue devices being introduced to the internal network?

Options:

A.

Authorize connecting devices

B.

Authenticate connecting devices

C.

Disable unauthorized devices

D.

Scan connecting devices

Question 164

Which of the following is the BEST type of fire extinguisher for a data center environment?

Options:

A.

Class A

B.

Class B

C.

Class C

D.

Class D

Question 165

A company selling seasonal products is preparing their sales and operations plan for the coming year. Their current labor staffing is at the maximum for their production facility and cannot meet the forecasted demand. The business plan shows they do not have the financial capability to add to the production facility. Which of the following actions would be most appropriate?

Options:

A.

Uselevel production planning and investigate subcontracting to meet the extra demand.

B.

Usechaseproduction planningand only take the orders that can be produced In the highdemand season.

C.

Usehybridproduction planningto save labor costs and inventory costs in the low demand season.

D.

Usehybridproduction planningand reduce the size of the customer base during the highdemand season.

Question 166

Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?

Options:

A.

Intrusion Detection System (IDS)

B.

Internet Protocol Security (IPSec)

C.

Virtual Private Network (VPN)

D.

Network Access Control (NAC)

Question 167

A company’s Marketing and Sales departments have identified an opportunity to develop a new market for a product family and requested an increase in the production plan. Which of the following actions would be most appropriate to account for the new market opportunity?

Options:

A.

Increase the production plan as requested.

B.

Regenerate the material requirements plan.

C.

Regenerate the master production schedule (MPS).

D.

Present the proposal at the executive sales and operations (S & OP) meeting.

Question 168

A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.

What is the MOST appropriate course of action for the organization to take?

Options:

A.

Provide all the requested data in an organization’s proprietary encrypted format and deliver a viewing application.

B.

Gather all the data about all the users and provide it to the customer in Extensible Markup Language (XML) format.

C.

Gather and provide all the requested data in Extensible Markup Language (XML) format.

D.

Provide a time convenient to the customer to visit the organization’s premises and provide an overview of all the processed data by an organization’s privacy officer.

Question 169

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

Options:

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

Question 170

A company confirms a customer order based on available capacity and inventory, even though the current production plan does not cover the entire order quantity. This situation is an example of what type of order fulfillment policy?

Options:

A.

Assemble-to-order (ATO)

B.

Capable-to-promise (CTP)

C.

Available-to-promise (ATP)

D.

Configure-to-order (CTO)

Question 171

A company has the following production conditions:

    Batch size: 1,000 items

    Processing time: 4 minutes per item

    Setup time: 2 hours

    Utilization: 80%

    Efficiency: 80%

Which of the following actions would result in the work being done in the least amount of time?

Options:

A.

Reduce the processing time for each item to 3.5 minutes.

B.

Increase either utilization or efficiency to 100%.

C.

Increase both utilization and efficiency to 90%.

D.

Eliminate the need for a setup to process the batch.

Question 172

In which of the following situations would you use an X-bar chart?

Options:

A.

Track the number of defects that are found in each unit.

B.

Measure the difference between the largest and the smallest in a sample.

C.

Determine the average value of a group of units.

D.

Estimate a subgroup variation.

Question 173

A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?

Options:

A.

Something one does

B.

Something one is

C.

Something one has

D.

Something one knows

Question 174

A company ' s primary performance objective Is flexibility. Which of the following measurements is most important?

Options:

A.

Labor productivity

B.

Schedule adherence

C.

Machine changeover time

D.

Cycle time

Question 175

While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?

Options:

A.

Maintain

B.

Modify

C.

Procure

D.

Dispose

Question 176

The primary outcome of frequent replenishments in a distribution requirements planning (DRP) system is that:

Options:

A.

lead times to customers decrease.

B.

transportation costs decrease.

C.

the level of required safety stock is reduced.

D.

more efficient load consolidation occurs.

Question 177

Which of the following outcomes Is a benefit of mixed-model scheduling?

Options:

A.

Increased inventory

B.

Improved demand response

C.

Fewer setups

D.

Fewer material shortages

Question 178

Which of the following benefits typically will be realized when switching from a functional to a cellular layout?

Options:

A.

Equipment utilization will be higher.

B.

Quality inspections will be reduced.

C.

Capital expenditures will be reduced.

D.

Products will have faster throughput.

Question 179

Which of the following BEST describes the responsibility of an information System Security Officer?

Options:

A.

Establish the baseline, architecture, and management direction and ensure compliance

B.

Ensure adherence to physical security policies and procedures

C.

Direct, coordinate, plan, and organize information security activities

D.

Ensure the availability of the systems and their contents

Question 180

Privacy requirements across national boundaries MOST often require protection of which data types?

Options:

A.

Contact information for elected officials and local and national government web content

B.

Contact information related to minors, medical records, and Personally Identifiable Information (PII)

C.

Contact information for board members, proprietary trade secrets, and income statements

D.

Contact information related to medical doctors, Protected Health Information (PHI), and Personally Identifiable Information (PII)

Question 181

Which security audit phase is MOST important to ensure correct controls are applied to classified data in a production environment?

Options:

A.

Data gathering

B.

Data analysis

C.

Planning and research

D.

Audit reporting and follow-up

Exam Detail
Vendor: APICS
Certification: CPIM
Exam Code: CPIM-8.0
Last Update: May 28, 2026
CPIM-8.0 Question Answers
Page: 1 / 45
Total 606 questions