dumpspedia logo
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
A company that uses concurrent engineering is likely to experience which of the following outcomes in the first period of a product's life cycle?
Privacy requirements across national boundaries MOST often require protection of which data types?
Broadcast traffic is causing network performance degradation of sensitive equipment.
Which of the following methods is used to prevent the broadcast traffic from impacting availability?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
Under which of the following conditions is excess capacity most likely a good substitute for safety stock?
Which of the following categories of web services testing describes correctness testing of web service security functionality?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and is tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
A startup organization has been growing rapidly and is planning to open a new office on another continent. Until infrastructure for the new office can be built, the organization is setting up remote access to the existing network. Which of the following is the MOST important secure implementation to complete during the expansion?
When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?
The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?
The horizon for forecasts that are input to the sales and operations planning (S&OP) process should be long enough that:
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
An organization is updating an Application Programming Interface (API) to support requests coming from mobile applications distributed on public application stores. The API’s primary function is to supply confidential documents when users request them within the mobile application. Which approach would BEST respond to this use case?
Which of the following measurements indicates there may be bias In the forecast model?
Which of the following are steps involved in the identity and access provisioning lifecycle?
Which of the following mechanisms should a practitioner focus on for the MOST effective information security continuous monitoring?
Which of the following statements characterizes a pull system In distribution management?
Which of the following planes directs the flow of data within a Software-Defined Networking (SDN) architecture?
Which compensating control is the MOST effective to prevent fraud within an organization?
Which of the following tools is used to evaluate the impact that a production plan has on capacity?
Which of the following strategies is most appropriate for a business unit with a low relative market share in a high-growth market?
A low-cost provider strategy works best when which of the following conditions are met?
Which of the following factors is the MOST important consideration for a security team when determining when determining whether cryptographic erasure can be used for disposal of a device?
Which of the following design considerations would offer the BEST protection against unauthorized access to the facility?
When conducting a thorough risk assessment that involves identifying system threats and vulnerabilities and determining the potential for adverse effects on individuals, what additional factors MUST the organization consider?
An organization is looking to integrate security concepts into the code development process early in development to detect issues before the software is launched. Which advantage does the organization gain from using Static Application Security Testing (SAST) techniques versus dynamic application security testing techniques?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
An organizations is developing a new software package for a financial institution. What is the FIRST step when modeling threats to this new software package?
Which of the following BEST represents a security benefit of Software-Defined Networking (SDN)?
An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?
In restoring the entire corporate email system after a major outage and data loss, an email administrator reads a few email message exchanges between the human resources manager and a candidate for an open position. Which of the following BEST describes the behavior of the email administrator, and why?
Long lead-time items with stable demand would best be supported by a supply chain:
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
When performing threat modeling using Spoofing, Tampering, Repudiation, Information Disclosure, Denial Of Service, And Elevation of Privilege (STRIDE), which of the following is an example of a repudiation threat?
A financial organization is using an internally developed application. The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC). For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?
When designing a production cell, which of the following items would be the most important consideration?
A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
An organization has recently been hacked. To prevent future breaches, the Chief Information Security Officer (CISO) hires a third-party vendor to perform penetration testing on the network. Once complete, the vendor provides to the CISO a final report generated by a high-quality vulnerability scanner. The CISO rejects the report as incomplete.
Why is the vendor's penetration test considered incomplete?
What is the PRIMARY benefit an organization obtains by adapting a cybersecurity framework to their cybersecurity program?
Which technology is BEST suited to establish a secure communications link between an individual’s home office and the organization’s Local Area Network (LAN)?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use to test whether servers are set up according to the organization's documented policies and standards?
A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?
Reducing distribution network inventory days of supply will have which of the following Impacts?
Which of the following may authorize an organization to monitor an employee’s company computer and phone usage?
An organization has been struggling to improve their security posture after a recent breach.
Where should the organization focus their efforts?
In a Zero Trust (ZT) model, where should the enforcement component be placed and why?
Once an organization has identified and properly classified their information and data assets, policies and procedures are created to establish requirements for the handling, protection, retention, and disposal of those assets. Which solution is the BEST method to enforce data usage policies, discover sensitive data, monitor the use of sensitive data, and ensure regulatory compliance and intellectual property protection?
A security analyst modifies the organization’s baselines to align the controls more closely with specific security and privacy requirements. Which security concept is this an example of?
A security team member is assessing an organization’s backup strategy that follows the 3-2-1 rule. How many different types of media should they inspect to validate?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
Reducing distribution network inventory days of supply will have which of the following Impacts?
Network Access Control (NAC) is used to perform what function for computers joining the network?
While conducting an information asset audit, it was determined that several devices were running unpatched Operating Systems (0S). Further review Indicated the OS was no longer supported by the vendor. Which of the following BEST indicates the appropriate asset lifecycle stage of the devices?
An organization uses an external Identity Provider (IdP) to secure internal, external, or third-party applications. Which of the following is the GREATEST risk to the organization?
Which of the below represent the GREATEST cloud-specific policy and organizational risk?
While doing a penetration test, auditors found an old credential hash for a privileged user. To prevent a privileged user's hash from being cached, what is the MOST appropriate policy to mandate?
Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?
An organization is preparing for a natural disaster, and management is creating a Disaster Recovery Plan (DRP). What is the BEST input for prioritizing the restoration of vital Information Technology (IT) services?
An organization’s system engineer arranged a meeting with the system owner and a few major stakeholders to finalize the feasibility analysis for a new application.
Which of the following topics will MOST likely be on the agenda?
An agency has the requirement to establish a direct data connection with another organization for the purpose of exchanging data between the agency and organization systems. There is a requirement for a formal agreement between the agency and organization. Which source of standards can the system owners use to define the roles and responsibilities along with details for the technical and security requirements?
Health information stored in paper form may be destroyed using which of the following methods?
Which of the following inventory management techniques is most responsive to changes in demand levels?
Which of the following is the benefit of using Security Content Automation Protocol (SCAP) version 2 on endpoint devices?
Typically, rough-cut capacity planning (RCCP) in a job shop environment would review which of the following work centers to determine the ability to execute the plan?
Which of the following situations is most likely to occur when using a push system?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?
An organization is opening a new data center and is looking for a facilities security officer to provide best practices for the site and facility design. The two major requirements for this organization are not to attract undue attention and avoid proximity to potentially hazardous sites.
What site selection considerations do these requirements BEST fall under when deciding on the location for a facility?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
Which of the following documents is the BEST reference to describe application functionality?
When resolving conflicts, which canon within the ISC2 Code of Ethics requires members to consider duties to principals and Individuals?
To gain entry into a building, individuals are required to use a palm scan. This is an example of which type of control?
The development team wants new commercial software to Integrate into the current systems. What steps can the security office take to ensure the software has no vulnerabilities?
An audit report of security operations has listed some anomalies with third parties being granted access to the internal systems and data without any restrictions.
Which of the following will BEST help remediate this issue?
A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?
Which of the following states of data becomes MOST important to protect as organizations continue to transition toward Application Programming Interface (API)-based solutions?
Disaster Recovery Plan (DRP) training can be considered complete when the participants
Which of the following BEST describes an individual modifying something the individual is not supposed to?
When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?
A security engineer must address resource sharing between various applications without adding physical hardware to the environment. Which secure design principle is used to BEST segregate applications?
Which of the following is the fundamental difference between finite loading and other capacity planning approaches?
Which of the following production activity control (PAC) techniques focuses on optimizing output?
The development team wants new commercial software to integrate into the current system. What steps can the security office take to ensure the software has no vulnerabilities?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
Following the go-live of a new financial software, an organization allowed the Information Technology (IT) officer to maintain all rights and access permissions to help the organization staff should they have challenges in their day-to-day work. What is the BEST way to categorize the situation?
A department manager executes threat modeling at the beginning of a project and throughout its lifecycle. What type of threat modeling is being performed?
Which of the following procedures should be defined when establishing information and asset handling requirements?
Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?
What FIRST step should a newly appointed Data Protection Officer (DPO) take to develop an organization's regulatory compliance policy?
The master schedule is an Important tool in the sales and operations planning (S&OP) process because it:
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
What are the FIRST two steps an organization should conduct to classify its assets?
Which of the following trade-offs should be evaluated when determining where to place inventory in a multi-echelon supply chain network?
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
An organization is restructuring its network architecture in which system administrators from the corporate office need to be able to connect to the branch office to perform various system maintenance activities. What network architecture would be MOST secure?
What is the process when a security assessor compiles potential targets from the attacker’s perspective, such as data flows, and interactions with users?
Which of the following roles is the BEST choice for classifying sensitive data?
If the total part failure rate of a machine is 0.00055 failures per hour, what would be the mean time between failures (MTBF) in hours?
A company is having trouble with raw material deliveries and has decided to develop a supplier certification program. The certification process most appropriately would start with which of the following suppliers?
For a process that is outside its upper control limit (UCL), which of the following techniques would best be used to return the process under control?
A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?
What is the FIRST element that must be evaluated in a security governance program?
An information system containing Protected Health Information (PHI) will be accessed by doctors, nurses, and others working in a hospital. The same application will be used by staff in the pharmacy department only for dispensing prescribed medication. Additionally, patients can log in to view medical history. The system owner needs to propose an access control model that considers environment, situation, compliance, and security policies while dynamically granting the required level of access. Which access control model is the MOST suitable?
The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
The time spent In queue by a specific manufacturing job is determined by which of the following factors related to the order?
Which of the following security features is utilized to validate both user credentials and the health of the client device on a network?
Which of the following situations is most likely to occur when using a push system?
A Software As A Service (SaaS) solution was compromised due to multiple missing security controls. The SaaS deployment was rushed and the Software Development Life Cycle (SDLC) was not followed. Which SDLC phase would have been MOST effective in preventing this failure?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
After reviewing the output of a threat modelling workshop, the development manager decides not to implement the application features where issues were identified. What is the BEST description of how the threats from the workshop are being addressed?
We have observed the inventory system does not handle plastic parts well." What should be added to the problem statement to make it more useful?
A team is tasked with developing new email encryption software. To ensure security, what will be the PRIMARY focus during the initial phase of development?
An organization routes traffic between two of its sites using non-revenue network paths provided by peers on an Internet exchange point. What is the MOST appropriate recommendation the organization's security staff can make to prevent a compromise?
Which of the following is typically used to control physical access to highly secure facilities?
An organization is attempting to address the security risk introduced by employees writing down door entry passcodes. Which of the following security measures BEST mitigates this risk?
A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
Which of the physiological biometric scanning methods is considered the MOST invasive?
Which of the following MUST be checked during the validation of software verification capabilities?
An organization is considering options to outsource their Information Technology (IT) operations. Although they do not sell anything on the Internet, they have a strong requirement in uptime of their application. After evaluating the offerings received by the Cloud Service Provider (CSP), the IT manager decided it was mandatory to develop processes to continue operations without access to community or public cloud-based applications. Which of the following arguments MOST likely led the IT manager to make this decision?
One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?
An organization’s computer incident responses team PRIMARY responds to which type of control?
Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?
Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?
The question below is based on the following information:
Work Center 1 has an available capacity of 1,200 hours per month. Which of the following amounts represents the cumulative difference between the required capacity and the available capacity of Months 1 through 3?
During the sales and operations planning (S&OP) process, which of the following tasks is the primary responsibility of the functional representatives on the supply planning team?
An information security professional is tasked with configuring full disk encryption on new hardware equipped with a Trusted Platform Module (TPM). How does TPM further enhance the security posture of full disk encryption if configured properly?
TESTED 31 Oct 2025