New Year Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

APICS CPIM-8.0 - Certified in Planning and Inventory Management (CPIM 8.0)

Page: 9 / 12
Total 585 questions

What MUST be completed before developing physical security controls?

A.

Develop a comprehensive security policy

B.

Provide the annual security awareness training

C.

Contract for licensed and bonded security force

D.

Perform a physical security audit

Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of the environment without scanning the full environment. Scanning a statistical sample has many advantages and disadvantages.

Which of the following is the MOST accurate set of advantages and disadvantages?

A.

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

B.

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

C.

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

D.

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform

A low-cost provider strategy works best when which of the following conditions are met?

A.

Price competition among rivals is similar.

B.

Buyers are more price sensitive.

C.

There are many ways to achieve product differentiation.

D.

There are few industry newcomers.

An organization co-locates three divisions and merges them into one network infrastructure. Prior to the merge, the network manager issued devices to employees for remote login. What security concept should be observed to provide security when a device joins the network or when a client makes an Application Programming Interface (API) call?

A.

Access Control List (ACL)

B.

Non-repudiation

C.

Multi-Factor Authentication (MFA)

D.

Zero Trust (ZT)

In the context of mobile device security, which of the following BEST describes why a walled garden should be implemented?

A.

To track user actions and activity

B.

To prevent the installation of untrusted software

C.

To restrict a user's ability to change device settings

D.

To limit web access to only approved sites

Which approach will BEST mitigate risks associated with root user access while maintaining system functionality?

A.

Creating a system where administrative tasks are performed under monitored sessions using the root account, with audits conducted regularly

B.

Implementing a policy where users log in as root for complex tasks but use personal accounts for everyday activities, with strict logging of root access

C.

Configuring individual user accounts with necessary privileges for specific tasks and employing “sudo” for occasional administrative needs

D.

Allowing key authorized personnel to access the root account for critical system changes, while other staff use limited accounts with “sudo” for routine tasks

A cybersecurity professional has been tasked with instituting a risk management function at a new organization. Which of the following is the MOST important step the professional should take in this endeavor?

A.

Determine the acceptable level of loss exposure at which the organization is comfortable operating.

B.

Conduct a gap assessment and produce a risk rating report for the executive leadership.

C.

Engage consultants to audit the organization against best practices and provide a risk report.

D.

Implement an enterprise Governance, Risk, and Compliance (GRC) management solution.

One of the findings in the recent security assessment of a web application reads: "It appears that security is an afterthought in the web application development process. It is recommended that security be addressed earlier in the development process." Which of these choices would BEST remediate this security finding?

A.

The installation and use of Dynamic Application Security Testing (DAST) software to test written code.

B.

The installation and use of Static Application Security Testing (SAST) software to test written code.

C.

The introduction of a continuous integration/continuous development pipeline to automate security into the software development change process.

D.

The introduction of a security training program for the developers.

An information system security manager is tasked with properly applying risk management principle to their cloud information system as outlined by the National Institute of Standards and Technology (NIST).

Which of the following is the INITIAL step?

A.

Categorize

B.

Select

C.

Assess

D.

Prepare

A newly hired Chief Information Security Officer (CISO) is now responsible to build a third-party assurance for their organization. When assessing a third-party, which of the following questions needs to be answered?

A.

How many employees the third-party employs?

B.

Which level of support does the third-party provide related to security?

C.

What is the monetary value of the third-party contract?

D.

To which standards does the third-party need to be assessed?

Which of the following MUST exist for an activity to be considered an audit?

A.

An auditor that is in no way employed, connected or associated to the organization being audited

B.

Stored Personally Identifiable Information (PII) that an organization has a legal obligation to protect

C.

A predefined standard and systematic approach to test the application of that standard

D.

A certified member of a professional body qualified in the area of inspection

What does the Role-Based Access Control (RBAC) method define?

A.

What equipment is needed to perform

B.

How information is accessed within a system

C.

What actions the user can or cannot do

D.

How to apply the security labels in a system

A lengthy power outage led to unavailability of time critical services resulting in considerable losses. It was determined that a backup electrical generator did not work as intended at the time of the incident due to lack of fuel. What should the security consultant FIRST Investigate?

A.

Maintenance procedures

B.

Supplier contracts

C.

Failover designs

D.

Product catalogs

An independent risk assessment determined that a hospital's existing policies did not have a formal process in place to address system misuse, abuse, or fraudulent activity by internal users. Which of the following would BEST address this deficiency in the Corrective Action Plan?

A.

Create and deploy policies and procedures

B.

Develop and implement a sanction policy

C.

Implement a risk management program

D.

Perform a security control gap analysis

Which if the following is the FIRST control step in provisioning user rights and privileges?

A.

Identification

B.

Authorization

C.

Authentication

D.

Confidentiality