An organization’s external auditors have issued a management letter identifying significant deficiencies related to the effectiveness of the previous year’s global access certification. The organization wants to move from a department-based access control system to a Role-Based Access Control (RBAC) system. In addition to quickly and securely provisioning users by granting membership into predefined and approved roles, which of these presents the BEST reason to do so?
Zombieload, Meltdown, Spectre, and Fallout are all names of bugs that utilized which of the following types of attack?
A Managed Service Provider (MSP) provides hardware and software support for system maintenance and upgrades to a client organization. Who is MOST responsible for auditing security controls related to the hardware and software?
A newer automotive supplier has not fully developed its information technology (IT) systems. The supplier has Just received a contract from a large automotive manufacturer which requires the supplier to use electronic data interchange (EDI) transactions for receiving orders, sending advance ship notices (ASNs), and receiving invoice payments. What strategy can the supplier adopt to immediately meet the EDI requirements?
A company with stable demand that uses exponential smoothing to forecast demand would typically use a:
According to best practice, at which step in the system lifecycle shall a security professional begin involvement?
When the discrete available-to-promise (ATP) method is used, the master production receipt quantity is committed to:
Which of the following sampling techniques is BEST suited for comprehensive risk assessments?
A security administrator of a large organization is using Mobile Device Management (MDM) technology for protecting mobile devices. Which of the following is the BEST way to ensure that only company-approved mobile software can be deployed?
Which of the below represents the GREATEST cloud-specific policy and organizational risk?
An organization's security policy requires remote hosts to be authenticated before they can access network resources. Which of the following is the BEST option for the organization to enforce its policy?
A security specialist is responsible to improve the security awareness program of a medium-sized organization and tasked to track blocked targeted attacks. Which of the following BEST describes the outcome of the security specialist’s use of metrics for this task?
Which of the following incorporates design techniques promoted by Crime Prevention Through Environmental Design (CPTED)?
What resources does a respondent have when contesting disciplinary action taken by the ISC2 Board of Directors?
Which of the following actions best supports a company's strategic focus on delivery speed to improve competitive advantage?
A financial organization is using an internally developed application.The internal software development team has to adhere to the coding standards of the Software Development Cycle (SDLC).For applications whose functionality is exposed through the public Internet, this requirement consists of testing the application for potential vulnerabilities before it is deployed into production. What is the BEST type of vulnerability test to perform?
Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?
An organization identified a Distributed Denial-Of-Service (DDoS) attack in which a large number of packets were broadcast with the intent of exploiting vulnerabilities of the Internet Protocol (IP) and the Internet Control Message Protocol (ICMP). Which Transmission Control Protocol/Internet Protocol (TCP/IP) layer would be affected by the attack?
What General Data Protection Regulation (GDPR) principle says that data should be collected lawfully and with the person’s consent?
An organization has been struggling to improve their security posture after a recent breach.
Where should the organization focus their efforts?
A healthcare organization is preparing an exercise test plan of its Disaster Recovery Plan (DRP) for the Electronic Medical Record (EMR) application. The Business Continuity (BC) analyst is reviewing the requirements of the DRP. The EMR must provide basic charting services within 4 hours, must not lose more than 15 minutes of data, and must be fully functional within 12 hours. At the completion of the exercise, the analyst is preparing a lessons learned report and notes that the EMR was available after 3 hours and 25 minutes of data was lost. Which PRIMARY requirement needs to be addressed because of the exercise?
A financial institution is implementing an Information Technology (IT) asset management system. Which of the following capabilities is the MOST important to include?
Which of the following techniques is BEST suited to preserve the confidentiality of a system’s data?
An employee returns a borrowed laptop used for lab testing. What is the BEST action the technician should perform upon receiving the laptop to ensure no sensitive information will be exposed?
A firm that currently produces all items to stock is implementing the concept of postponement in all new product designs. Which of the following outcomes is most likely to result?
The demand for an item has increasing forecast error, whereas all other factors remain constant. Which of the following remains constant while maintaining the same customer service level?
Which of the following presents the GREATEST benefit to an organization's security posture when a change management process is implemented?
Which of the following vulnerability types is also known as a serialization flaw and affects the integrity of two processes interacting with the same resource at the same time?
An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).
Which of the following is the INITIAL step?
A plant uses a level production strategy due to the high costs of hiring and letting go of skilled employees. The constrained resource is due to be upgraded in the fourth month of the planning horizon, and that will reduce capacity for that month by 17%.
Which of the following actions would be appropriate in this situation to maintain current levels of customer service and gross margin?
Which of the following should be done FIRST when implementing an Identity And Management (IAM) solution?
Which of the following is the MOST important consideration in a full-scale disaster recovery test?
An organization has hired a new auditor to review its critical systems infrastructure for vulnerabilities. Which of the following BEST describes the methodology the auditor will use?
A security assessor has been engaged to perform a penetration test on control system components located on a shipping vessel. The individuals on the ship do not have any knowledge of how the component is configured or its internal workings. Which of the following test types does this scenario call for?
Which security concept applies if an architecture diagram illustrates a particular user/role combination with access to an asset or applicaton?
In which cloud computing model is Identify And Access Management (IAM) the responsibility of a service provider?
An organization’s security team is looking at ways to minimize the security risk of the container infrastructure. The lead engineer needs to select a suite of remediation actions to minimize risks. Which programmatic approach will result in preventing, detecting , and responding to the GREATEST number of threats aimed at container operations?
An organization implemented a threat modeling program focusing on key assets. However, after a short time it became clear that the organization was having difficulty executing the threat modeling program.
Which approach will MOST likely have been easier to execute?
Broadcast traffic is causing network performance degradation of sensitive equipment.
Which of the following methods is used to prevent the broadcast traffic from impacting availability?
Which of the following systems would be the most cost-efficient for inventory management of a low value item?
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
In the Session layer of the Open Systems Interconnection (OSI) model, which of the following modes allows only one host to send information to its peer?
During a security incident investigation, a security analyst discovered an unauthorized module was compiled into an application package as part of the application assembly phase. This incident occurred immediately prior to being digitally signed and deployed using a deployment pipeline.
Which of the following security controls would BEST prevent this type of incident in the future?
A security engineer is implementing a Supervisory Control and Data Acquisition (SCADA) system.
What is the BEST action the engineer can take to ensure secure operations?
In conducting a new corporate payroll system security review, which of the following individuals should answer questions regarding the data classification?
Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.
Which of the following is the MOST accurate set of advantages and disadvantages?
A consultant has been engaged to support the team in analyzing why the development of a new software product has slipped schedule by a year. The consultant discovered an increase of the functionality requirements due to the failure of the asset tracking program. Which of the following BEST describes which system lifecycle element is impacted?
A new organization building is being designed and the security manager has been asked for input on needed security requirements. Which of the following controls are MOST applicable to this scenario?
The primary consideration In maintenance, repair, and operating (MRO) supply systems typically is:
During an emergency management and planning session, an organization is discussing how to identify, prevent, prepare for, or respond to emergencies. Which of the following will provide the BEST possible outcome?
APerform drills on a recurring basis.
B.Harden all critical facilities.
C.Outsource to an external organization.
D.Allocate 100% of required funds.
What is the MOST appropriate action to take when media classification needs to be downgraded to a less sensitive classification?
Which of the following BEST describes the purpose of black hat testing during an assessment?
Which of the following are compromised in an untrusted network using public key cryptography when a digitally signed message is modified without being detected?
An organization has decided to leverage open source software for its latest application development project. Which of the following would be the MOST effective way to ensure the open source software can be used securely while still meeting business requirements?
A security professional is accessing an organization-issued laptop using biometrics to remotely log into a network resource. Which type of authentication method is described in this scenario?
After a data loss event, an organization is reviewing its Identity and Access Management (IAM) governance process. The organization determines that the process is not operating effectively. What should be the FIRST step to effectively manage the IAM governance process?
The help desk received a call from a user noting the digital certificate on the organization-issued security identification card was invalid. Which is the BEST reason the certificate stopped working?
An executive wants to ensure that risk related to information operations is managed in accordance with the enterprise's risk management thresholds. What is the BEST way to ensure this consistently occurs?
Which of the following BEST describes web service security conformance testing as it relates to web services security testing?
Which of the following represents the level of confidence that software is free from intentional an accidental vulnerabilities?
Which of the following BEST describes how an Application Programming Interface (API) gateway fits into an application architecture?
Global outsourcing and shared suppliers serving an industry are drivers of which category of risk?
Capacity requirements planning (CRP) is applicable primarily In companies operating In an environment where:
Which of the following statements is an assumption on which the economic order quantity (EOQ) model is based?
As a result of a fault at a cloud service provider’s data center, the customer accounts of a utility organization were corrupted. Under the European Union’s (EU) General Data Protection Regulation (GDPR), which entity bears responsibility for resolving this?
As the organization requires user friendly access to a new web-based application, a software developer decides to implement Single Sign-On (SSO). The developer uses the de-facto standard for web-based applications and the implementation includes the use of a JavaScript Object Notation (JSON) web token. With this information, which is the BEST way for the software developer to establish SSO capability?
A financial services organization wants to deploy a wireless network. Which of the following is the WEAKEST option for ensuring a secure network?
A customer of a financial Institution denies that a transaction occurred. Which of the following is used to provide evidence evidence that the customer performed the transaction?
A webmaster has repeatedly used the same certificate sign request to renew an organization's website Secure Sockets Layer (SSL) certificate. What is the MOST significant increased risk for the organization?
What is the BEST way to plan for power disruptions when implementing a Disaster Recovery Plan (DRP)?
A company's primary performance objective Is flexibility. Which of the following measurements is most important?
A product manager wishes to store sensitive development data using a cloud storage vendor while maintaining exclusive control over passwords and encryption credentials. What is the BEST method for meeting these requirements?
An independent risk assessment determined that a hospital's existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?
A part is sold as a service part, and It is also used as a component In another part. Which of the following statements about the planning for this part is true?
Which of the following Internet Protocol Security (IPSec) components provides the MOST confidentiality for the information that is being transmitted?
Which of the following does a federated Identity Provider (IDP) need in order to grant access to identity information?
Which of the following is a core subset of The Open Group Architecture Framework (TOGAF) enterprise architecture model?
When an organization is recruiting for roles within the organization, at which stage of the employee life cycle are termination procedures incorporated?
Reducing distribution network inventory days of supply will have which of the following Impacts?
Which of the following combines multiple software programming tools into one package?
An organization has a legacy application used in production. Security updates are no longer provided, which makes the legacy application vulnerable. The legacy application stores Social Security numbers and credit card numbers. Which actions will BEST reduce the risk?
An organization has integrated its enterprise resource planning system into its centralized Identity and Access Management (IAM) system to automate provisioning of access. A security audit revealed that privileged access granted within the ERP system is not visible in the IAM system. Which of the following controls BEST mitigates this risk?
Which of the following is a PRIMARY benefit of sharing assessment results among key organizational officials across information boundaries?
Price negotiation is most appropriate when purchasing which of the following product categories?
Which threat modeling methodology is focused on assessing risks from organizational assets?
When implementing solutions for information security continuous monitoring, which method provides the MOST interoperability between security tools?
A security consultant is working with an organization to help evaluate a proposal received from a new managed security service provider. There are questions about the confidentiality and effectiveness of the provider's system over a period of time. Which of the following System And Organization Controls (SOC) report types should the consultant request from the provider?
The Information Technology (IT) manager of a large organization has been tasked with implementing a distributed third-party Identity As A Service (IDaaS). The local security team is concerned that the Identity Provider (IdP) and resource provider have direct connectivity outside of enterprise control. Which of the following authentication methods BEST address this concern?
A United States (US)-based online gaming provider, which operates in Germany, collects and uses a large amount of user behavioral data. A customer from Germany requests a copy of all their personal data.
What is the MOST appropriate course of action for the organization to take?
Which of the following product design approaches are likely to reduce time to market for a global supply chain?
While conducting penetration testing, one of the testers noticed evidence of additional penetration activities not part of the test. Which of the following is the NEXT course of action for the lead penetration tester?
An organization processes healthcare data, stores credit card data, and must provide audited financial statements, each of which is controlled by a separate compliance standard. To support compliance against multiple standards and the testing of the greatest number of controls with a limited budget, how would the internal audit team BEST audit the organization?
The Chief Information Security Officer (CISO) is meeting with the external network security evaluation team's blue team leader to confirm the internal system administrator's work schedules, hardware lists, and logistical support for their debriefing. Which of the following would be the MOST likely topic of discussion for the briefing?
Which of the following combines multiple software programming tools into one package?
An organization is retiring an old server out of the data center. This server was used to store and process sensitive information. The server is being sent off-site to a recycling center. Which declassification method should be performed prior to it being sent off-site?
A security engineer has determined the need to implement preventative controls into their Wireless Local Area Network (WLAN) for added protection. Which preventative control provides the MOST security?
An Information Technology (IT) professional is seeking a control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which of the following frameworks BEST meets this need?
An infrastructure team is setting up a wireless network for employees at a new location of the organization that is located near a very busy city transport hub. Which should be the MOST important antenna consideration with regard to securing the wireless network for the infrastructure team?
Which of the following should Business Impact Analysis (BIA) reports always include?
Which of the following statements best characterizes enterprise resources planning (ERP) systems?
A security engineer is implementing an authentication system for a new web application. The authentication requirements include the ability for a server to authenticate the client and for the client to authenticate the server. Which of the following choices BEST supports this requirement?
Given the bill of material (BOM) information below and independent requirements of 10 pieces (pcs) per week of Component A and 20 pieces (pcs) per week of Component B, what is the weekly gross requirement of component F?
An support technician is contacted by an imposter claiming to be a supervisor and is asked specifically to perform a task that violates the organization’s security policies. What type of attack is this?
Which of the following is an access control method that organizations can use to prevent unauthorized access?
Which of the following is the MAIN element in achieving a successful security strategy?
Which of the following is the BEST option for a security director to use in order to mitigate the risk of inappropriate use of credentials by individuals with administrative rights?
The Chief Information Security Officer (CISO) defined a requirement to install a network security solution that will have the ability to inspect and block data flowing over network in real time. What network deployment scenario will be MOST suitable?
Additional requirements that are outside the original design are being added to a project, increasing the timeline and cost of the project.
What BEST describes the requirement changes that are happening?
The Business Continuity Plan (BCP) has multiple components. The information security plan portion must prioritize its efforts. Which 3 aspects of information security MUST be prioritized?
Which of the following security techniques can be used to ensure the integrity of software as well as determine who developed the software?
Which if the following is the FIRST control step in provisioning user rights and privileges?
An organization wants to control access at a high-traffic entrance using magnetic-stripe cards for identification. Which of the following is the BEST for the organization to utilize?
An organization is implementing an enterprise resource planning system using the traditional waterfall Software development Life Cycle (SDLC) model. When is the BEST time to perform a code review to identity security gaps?
An organization is implementing improvements to secure the Software Development Life Cycle (SDLC). When should defensive three modeling occur?
A security practitioner has been asked to investigate the presence of customer Personally Identifiable Information (PII) on a social media website. Where does the practitioner begin?
Labor3 people
Work hours10 hours per day
Days4 days per week
Meetings with work area employees1/2 hour per day
Work area efficiency85%
Given the information above, what is the weekly theoretical capacity of this work area in hours?
Which role is MOST accountable for allocating security function resources in order to initiate the information security governance and risk management policy?
What is the MOST likely cause for a penetration tester having difficulties finding the stack to inject code?
To mitigate risk related to natural disasters, an organization has a separate location with systems and communications in place. Data must be restored on the remote systems before they are ready for use. What type of remote site is this?
After a recent threat modeling workshop, the organization has requested that the Chief Information Security Officer (CISO) implement zero trust (ZT) policies. What was the MOST likely threat identified in the workshop?
A multinational organization acquires a subsidiary. The acquisition results in the need to integrate a large population of new users into the organization's corporate cloud. What is the MAIN benefit of the organization's Federated Identity Management (FIM) system to address the need?
An effective approach to projecting requirements for materials with long lead times Includes which of the following options?
An organization has a call center that uses a Voice Over Internet Protocol (VoIP) system. The conversations are sensitive, and the organization is concerned about employees other than the call agents accessing these conversations. What is the MOST effective additional security measure to make?
When implementing a data classification program, Which is MOST important for measuring businesss impact?
Which Open Systems Interconnection (OSI) layer is concerned with Denial-Of-Service (DoS) SYN flood attacks?
An organizational policy requires that any data from organization-issued devices be securely destroyed before disposal. Which method provides the BEST assurance of data destruction?
A security consultant is recommending the implementation of a security-focused Configuration Management (CM) process in an organization. What would be the BEST benefit the security consultant would include in the recommendation?
A security analyst has been asked to build a data retention policy for a hospital. What is the FIRST action that needs to be performed in building this policy?
A low-cost provider strategy works best when which of the following conditions are met?
Which of the following should be done FIRST when implementing an Identity and Access Management (IAM) solution?
Which of the following MUST be checked during the validation of software verification capabilities?
The trade-off of increasing safety stock to improve customer fill rate would be a decrease in:
Given the information below, reducing which measure by 10% would contribute most to shortening the cash-to-cash cycle time?
When conducting a vulnerability test using a scanner tool, which unintended consequence can occur?
Which of the following is the BEST way to identify the various types of software installed on an endpoint?
An organization is designing a new Disaster Recovery (DR) site. What is the BEST option to harden security of the site?
Exhibit:
A company has prioritized customers A, B, and C, filling orders in that sequence. What are the impacts to customer service levels for customers B and C?
An organization donates used computer equipment to a non-profit group. A system administrator used a degausser on both the magnetic and Solid State Drives (SSD) before delivery. A volunteer at the non-profit group discovered some of the drives still contained readable data and alerted the system administrator. What is the BEST solution to ensure that computer equipment does not contain data before release?
Increased use of third-party logistics (3PL) services is likely to have which of the following effects on a firm's balance sheet?
Before securing a email system using OpenPGP in an organization, Which of the following actions MUST be performed?
The costs provided in the table below are associated with buying a quantity larger than immediately needed. What Is the total landed cost based on this table?
Cost CategoryCost
Custom fees$125
Freight$700
Warehouse rent$200
Matenal cost$500
An organization wishes to utilize a managed Domain Name System (DNS) provider to reduce the risk of users accessing known malicious sites when web browsing. The organization operates DNS forwarders that forward queries for all external domains to the DNS provider. Which of the following techniques could enable the organization to identify client systems that have attempted to access known malicious domains?
Which of the following is the BEST type of fire extinguisher for a data center environment?
In order to meet retention requirements, it may be necessary to migrate digital records to different media because of which of the following issues?