CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.
About this deck
Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.
What this deck covers
- General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
- Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
- Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
- Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
- Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.
Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.
The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.
Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.
This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.
Cards in this deck
Card 1
Question
What does an information security policy establish?
Answer
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Card 2
Question
What is phishing?
Answer
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Card 3
Question
What does a public-key certificate bind to an identity?
Answer
A public key, together with identifying information and the issuer's signature.
Card 4
Question
What is data at rest?
Answer
Data stored on media such as disks, databases, backups, or mobile devices.
Card 5
Question
How does policy-driven access control decide a zero-trust access request?
Answer
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Card 6
Question
What does establishing a secure baseline produce?
Answer
An approved, documented configuration that defines the required secure state for a class of computing resource.
Card 7
Question
What is hashing used to verify?
Answer
Whether data has changed by comparing fixed-length digest values.
Card 8
Question
What is impersonation in social engineering?
Answer
Pretending to be a trusted person or organization to obtain access, data, or action.
Card 9
Question
What is virtualization?
Answer
Abstracting physical compute so multiple isolated guest systems can share a host.
Card 10
Question
What is chain of custody?
Answer
A documented history of who collected, handled, transferred, stored, and examined evidence.
Card 11
Question
What is quantitative risk analysis?
Answer
Estimating risk with numerical values such as money, frequency, or probability.
Card 12
Question
What is a phishing awareness campaign?
Answer
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Card 13
Question
What is high availability?
Answer
Designing a service to remain accessible despite expected component failures.
Card 14
Question
What is a network security zone?
Answer
A group of systems with similar trust, function, or control requirements.
Card 15
Question
What is risk transfer?
Answer
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Card 16
Question
What is media sanitization?
Answer
Making stored data infeasible to recover for the intended level of protection.
Card 17
Question
What does CVSS provide?
Answer
A standardized way to describe a vulnerability's technical severity characteristics.
Card 18
Question
What does security alerting do?
Answer
It turns matched events or behavior into a notification that the right responder can review.
Card 19
Question
What does a firewall rule enforce?
Answer
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Card 20
Question
What is deprovisioning?
Answer
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Card 21
Question
How does inline placement differ from a tap or monitor port?
Answer
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Card 22
Question
What is asymmetric encryption?
Answer
Encryption that uses a mathematically related public and private key pair.
Card 23
Question
What does SPF authorize?
Answer
Which mail servers may send mail for a domain in the SMTP envelope.
Card 24
Question
What is a possession factor?
Answer
Something the claimant has, such as a cryptographic authenticator.
Card 25
Question
What does ordinary TLS usually protect and authenticate?
Answer
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Card 26
Question
What is single loss expectancy?
Answer
The estimated loss from one occurrence of a risk event.
Card 27
Question
What does a certificate authority do?
Answer
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Card 28
Question
What is a detective control meant to do?
Answer
Identify that an unwanted event has happened or is happening.
Card 29
Question
What is the security purpose of change-control approval?
Answer
Ensure authorized reviewers assess risk before the production change occurs.
Card 30
Question
What is shadow IT?
Answer
Technology used for organizational work without required approval or oversight.
Card 31
Question
What is a buffer overflow vulnerability?
Answer
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Card 32
Question
What is ransomware?
Answer
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Card 33
Question
How does network segmentation limit an incident?
Answer
It restricts communication paths and reduces lateral movement between zones.
Card 34
Question
How do load balancing and clustering support availability differently?
Answer
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Card 35
Question
What is vendor due diligence?
Answer
Evaluating a provider's security, capability, stability, and fit before commitment.
Card 36
Question
Who is a data subject?
Answer
The person whose personal data is collected or processed.
Card 37
Question
What is attestation?
Answer
A formal assertion or report about a subject matter, often supported by an independent examination.
Card 38
Question
What is a replay attack?
Answer
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Card 39
Question
What does a wireless site survey establish?
Answer
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Card 40
Question
What is the time-of-check stage of a race-condition vulnerability?
Answer
The application verifies a condition or resource state before acting on it.
Card 41
Question
What is a penetration test?
Answer
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Card 42
Question
What is a cold recovery site?
Answer
A facility with basic space and utilities but little preinstalled technology or current data.
Card 43
Question
What is data in transit?
Answer
Data moving between systems or across a network.
Card 44
Question
What is a vendor security questionnaire?
Answer
A structured request for information about a provider's controls and practices.
Card 45
Question
How does an internal actor's starting position differ from an external actor's?
Answer
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Card 46
Question
What can unexpected account lockouts indicate?
Answer
Password guessing, credential stuffing, user error, or a broken client.
Card 47
Question
How do permissions enforce access control?
Answer
They specify which actions a subject may perform on a particular resource.
Card 48
Question
What is log aggregation?
Answer
Central collection of logs from multiple sources for search, correlation, and retention.
Card 49
Question
Why plan a service restart as part of a change?
Answer
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Card 50
Question
What is infrastructure as code?
Answer
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Card 51
Question
What should security-awareness program development start with?
Answer
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Card 52
Question
What is a voice-based social-engineering attack called?
Answer
Vishing.
Card 53
Question
What happens during incident-response preparation?
Answer
Teams establish people, tools, access, communications, training, and procedures before an incident.
Card 54
Question
What does an offensive penetration-testing team do?
Answer
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Card 55
Question
What is federation?
Answer
One security domain relies on identity assertions from another trusted domain.
Card 56
Question
What is asset classification?
Answer
Grouping an asset by sensitivity, criticality, or required handling.
Card 57
Question
What is cross-site scripting?
Answer
Injection of script-capable content that a browser executes in another site's security context.
Card 58
Question
What can IDS or IPS trends reveal?
Answer
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Card 59
Question
What can unexpected resource inaccessibility indicate?
Answer
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Card 60
Question
What is a corrective control meant to do?
Answer
Limit damage and restore a secure state after an event.
Card 61
Question
How do containers differ from virtual machines?
Answer
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Card 62
Question
How does an active security device differ from a passive one?
Answer
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Card 63
Question
Why is unsupported software a persistent attack surface?
Answer
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Card 64
Question
What is annualized rate of occurrence?
Answer
The estimated number of times a risk event occurs per year.
Card 65
Question
What is an inherence factor?
Answer
A biometric characteristic of the claimant.
Card 66
Question
What do a threat actor's sophistication and capability describe?
Answer
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Card 67
Question
What is a SIEM?
Answer
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Card 68
Question
What is sideloading?
Answer
Installing software from outside the platform's approved distribution path.
Card 69
Question
What does an IDS or IPS signature match?
Answer
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Card 70
Question
Why are embedded systems often difficult to patch?
Answer
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Card 71
Question
What is a virtual private network?
Answer
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Card 72
Question
What should an initial security-awareness report establish?
Answer
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Card 73
Question
What is symmetric encryption?
Answer
Encryption that uses the same secret key to encrypt and decrypt data.
Card 74
Question
What happens during incident detection?
Answer
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Card 75
Question
What is recovery time objective?
Answer
The target maximum time to restore a function after disruption.
Card 76
Question
Why prioritize password length?
Answer
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Card 77
Question
What must sanitization accomplish before an asset leaves organizational control?
Answer
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Card 78
Question
What is a real-time operating system designed to provide?
Answer
Predictable response timing for tasks with strict deadlines.
Card 79
Question
What does fail-open behavior do when a control fails?
Answer
It permits traffic or access to preserve availability.
Card 80
Question
What is jailbreaking or rooting a mobile device?
Answer
Removing platform restrictions to gain privileged control over the operating system.
Card 81
Question
What does network access control enforce?
Answer
Identity, device posture, and access policy at network connection time and during a session.
Card 82
Question
What does data loss prevention do?
Answer
Detects and may block sensitive data use or transfer that violates policy.
Card 83
Question
What security property does a blockchain provide?
Answer
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Card 84
Question
What is recovery point objective?
Answer
The target maximum acceptable data loss measured backward in time.
Card 85
Question
How do ICS and SCADA relate?
Answer
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Card 86
Question
What does fail-closed behavior do when a control fails?
Answer
It denies traffic or access to preserve security.
Card 87
Question
Which keys create and verify a typical digital signature?
Answer
The signer creates it with a private key, and others verify it with the corresponding public key.
Card 88
Question
What is SQL injection?
Answer
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Card 89
Question
What does DKIM verify?
Answer
That selected message content was signed by a domain and was not altered after signing.
Card 90
Question
What is post-incident activity?
Answer
Learning from the event and improving controls, plans, and recovery based on evidence.
Card 91
Question
What characterizes an expansionary risk appetite?
Answer
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Card 92
Question
How do centralized and decentralized architectures differ?
Answer
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Card 93
Question
What does a certificate revocation list publish?
Answer
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Card 94
Question
What is a legal hold?
Answer
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Card 95
Question
What is exposure factor in quantitative risk analysis?
Answer
The estimated percentage of an asset's value lost in one event.
Card 96
Question
What is decentralized architecture?
Answer
Control or service responsibility is distributed across multiple independent components or locations.
Card 97
Question
What is tokenization?
Answer
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Card 98
Question
How can automation act as a workforce multiplier?
Answer
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Card 99
Question
What can endpoint process logs reveal?
Answer
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Card 100
Question
What does the CIA triad protect?
Answer
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Card 101
Question
How does data masking protect information?
Answer
It hides selected values or characters while preserving a usable representation.
Card 102
Question
How can a national requirement affect security governance?
Answer
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Card 103
Question
What do integrations and APIs provide to security orchestration?
Answer
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Card 104
Question
What makes a compliance report external?
Answer
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Card 105
Question
What does a cryptographic algorithm define?
Answer
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Card 106
Question
Why compare systems with a secure baseline regularly?
Answer
To detect drift, unauthorized changes, and missing hardening.
Card 107
Question
What does integrity protect?
Answer
The accuracy and completeness of data and systems against unauthorized change.
Card 108
Question
What does vulnerability classification organize?
Answer
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Card 109
Question
What does a password standard define?
Answer
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Card 110
Question
What technology capacity must a recovery design plan for?
Answer
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Card 111
Question
What does a confidential data classification indicate?
Answer
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Card 112
Question
What makes a vendor assessment independent?
Answer
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Card 113
Question
What lets a worm spread without attaching itself to another file?
Answer
It is a standalone program that replicates across reachable systems or services.
Card 114
Question
What is microsegmentation?
Answer
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Card 115
Question
What can application logs reveal?
Answer
Transactions, errors, user actions, and application-specific security events.
Card 116
Question
What does deploying a secure baseline require?
Answer
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Card 117
Question
How can resource-provisioning automation improve security?
Answer
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Card 118
Question
What does availability protect?
Answer
Reliable, timely access to systems and data when authorized users need them.
Card 119
Question
Why must a change request describe business impact?
Answer
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Card 120
Question
What does an authenticated vulnerability scan add?
Answer
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Card 121
Question
What does a change-management procedure specify?
Answer
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Card 122
Question
What is a sanction for noncompliance?
Answer
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Card 123
Question
How can email deliver a security attack?
Answer
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Card 124
Question
What is an internal compliance audit?
Answer
An organization-led examination of whether selected operations and controls meet defined requirements.
Card 125
Question
What is a Trojan?
Answer
Malware disguised as legitimate or desirable software.
Card 126
Question
What is clustering?
Answer
Multiple systems work together to provide a service and tolerate member failure.
Card 127
Question
What makes data regulated?
Answer
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Card 128
Question
What does a wireless heat map show?
Answer
Measured or modeled signal strength and coverage across a physical area.
Card 129
Question
How should vendor criticality affect due diligence?
Answer
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Card 130
Question
How can a digital signature support non-repudiation?
Answer
It provides evidence that the holder of a private key signed specific data.
Card 131
Question
What should vulnerability prioritization consider beyond severity?
Answer
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Card 132
Question
What is a security guideline?
Answer
Recommended practice that allows judgment unless adopted as a requirement.
Card 133
Question
What usually distinguishes a nation-state threat actor?
Answer
Strategic objectives, substantial resources, patience, and advanced operational capability.
Card 134
Question
What is spyware?
Answer
Software that secretly collects information about a user or system.
Card 135
Question
Why maintain an allow list for applications?
Answer
Only explicitly approved software is permitted to execute.
Card 136
Question
How can an image become an attack vector?
Answer
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Card 137
Question
What makes a security control technical?
Answer
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Card 138
Question
What is identity proofing?
Answer
Establishing that a person is who they claim to be before issuing an account or credential.
Card 139
Question
What is an automated security guardrail?
Answer
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Card 140
Question
Why assign an owner to a planned change?
Answer
To make one party accountable for coordination, execution, and follow-through.
Card 141
Question
How can national privacy law affect data handling?
Answer
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Card 142
Question
What is continuity of operations?
Answer
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Card 143
Question
What security tradeoff comes with BYOD?
Answer
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Card 144
Question
How should policies and handbooks support security training?
Answer
They provide accessible, current rules and reporting steps that training can apply to real situations.
Card 145
Question
What is a keylogger?
Answer
A tool that records keystrokes to capture data such as credentials.
Card 146
Question
What makes information a trade secret?
Answer
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Card 147
Question
What does authentication establish?
Answer
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Card 148
Question
What risk comes from an untrusted file attachment?
Answer
Opening or parsing it can execute malicious code or expose data.
Card 149
Question
How does risk tolerance affect vulnerability remediation?
Answer
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Card 150
Question
How can a global requirement affect security governance?
Answer
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Card 151
Question
Why should questionnaire answers be supported by evidence?
Answer
Self-assertions alone may not prove that controls are designed or operating effectively.
Card 152
Question
What is an independent third-party audit?
Answer
An external party with suitable independence examines evidence against defined criteria.
Card 153
Question
What do account provisioning and deprovisioning do?
Answer
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Card 154
Question
What is an unskilled attacker commonly called?
Answer
A script kiddie: someone who relies on tools or instructions created by others.
Card 155
Question
What is a rootkit?
Answer
Software designed to maintain privileged, concealed access by altering or subverting the system.
Card 156
Question
What does an access control list enforce?
Answer
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Card 157
Question
What should system security monitoring observe?
Answer
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Card 158
Question
What can operating-system security logs reveal?
Answer
Authentication, privilege use, policy changes, services, and other host security events.
Card 159
Question
Why isolate operational technology from general business networks?
Answer
To limit attack paths into safety- and availability-critical processes.
Card 160
Question
What is the COPE mobile deployment model?
Answer
The organization owns the device but permits defined personal use while retaining management control.
Card 161
Question
What security work belongs in asset acquisition and procurement?
Answer
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Card 162
Question
How can user-provisioning automation improve security?
Answer
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Card 163
Question
What people capacity must a continuity plan account for?
Answer
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Card 164
Question
What do authorization models define?
Answer
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Card 165
Question
Why are removable devices an attack vector?
Answer
They can introduce malware or remove data while bypassing network controls.
Card 166
Question
What should predeployment change-test results show?
Answer
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Card 167
Question
What is the time-of-use stage of a race-condition vulnerability?
Answer
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Card 168
Question
What is data in use?
Answer
Data actively processed in memory or by an application.
Card 169
Question
What does open-source vulnerability intelligence contribute?
Answer
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Card 170
Question
What can file-integrity monitoring detect?
Answer
Unexpected changes to protected files, directories, or configuration.
Card 171
Question
Why should deprovisioning be prompt?
Answer
Former users or roles should not retain usable access.
Card 172
Question
What is an acceptable use policy?
Answer
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Card 173
Question
What makes a compliance report internal?
Answer
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Card 174
Question
What is a logic bomb?
Answer
Malicious code that activates when a specified condition or time is reached.
Card 175
Question
What does a right-to-audit clause provide?
Answer
Contractual authority to inspect or obtain evidence about agreed controls.
Card 176
Question
Where should a forward proxy sit in an enterprise traffic path?
Answer
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Card 177
Question
Which cues should make a message look suspicious?
Answer
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Card 178
Question
What makes a security control managerial?
Answer
It directs risk and governance through decisions such as policies, assessments, and oversight.
Card 179
Question
What is the CYOD mobile deployment model?
Answer
The user selects from organization-approved device options that remain subject to corporate security requirements.
Card 180
Question
How does client-based vulnerable software differ from an agentless exposure?
Answer
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Card 181
Question
What makes a risk assessment recurring?
Answer
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Card 182
Question
What does a defensive penetration-testing team practice?
Answer
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Card 183
Question
In a zero-trust data plane, what can the subject or system represent?
Answer
The user, device, workload, or service requesting access to a protected resource.
Card 184
Question
What primarily motivates a hacktivist?
Answer
A political, social, or ideological cause.
Card 185
Question
What is bloatware?
Answer
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Card 186
Question
Why keep endpoint-protection signatures and engines current?
Answer
They need current detection logic to recognize newly identified malware and exploit behavior.
Card 187
Question
What should application security monitoring observe?
Answer
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Card 188
Question
What is role-based access control?
Answer
Permissions are assigned to roles, and identities receive access through their roles.
Card 189
Question
What is geographic dispersal?
Answer
Placing redundant resources in separate locations so one regional event does not affect all copies.
Card 190
Question
What is a malicious update?
Answer
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Card 191
Question
What does static application analysis inspect?
Answer
Source code, bytecode, or compiled code without executing the application.
Card 192
Question
What does a firewall access list define?
Answer
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Card 193
Question
What does a disaster recovery policy establish?
Answer
Management expectations for restoring technology and data after a disruptive event.
Card 194
Question
How does logical segmentation separate workloads that share physical infrastructure?
Answer
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Card 195
Question
How should IDS and IPS placement differ?
Answer
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Card 196
Question
What should automated ticket creation capture?
Answer
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Card 197
Question
What makes information intellectual property?
Answer
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Card 198
Question
What is a backout plan?
Answer
Predefined steps for safely reversing a failed or harmful change.
Card 199
Question
Why is an unsecure wireless network an attack vector?
Answer
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Card 200
Question
What is physical brute force?
Answer
Using force to defeat a lock, barrier, enclosure, or other physical control.
Card 201
Question
What is application sandboxing?
Answer
Running code in a constrained environment with limited access to the host and data.
Card 202
Question
Why assign an asset owner?
Answer
One accountable party must decide its use, protection, and lifecycle.
Card 203
Question
What happens during risk identification?
Answer
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Card 204
Question
What should an SLA state about breach notification?
Answer
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Card 205
Question
How do due diligence and due care differ in compliance?
Answer
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Card 206
Question
What is attribute-based access control?
Answer
Policy evaluates attributes of the subject, resource, action, and environment.
Card 207
Question
What does a zero-trust policy engine do?
Answer
It evaluates policy and signals to decide whether access should be allowed.
Card 208
Question
How does a cloud responsibility matrix allocate security duties?
Answer
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Card 209
Question
Where should a load balancer sit in a service path?
Answer
In front of service instances so it can route requests to healthy backends.
Card 210
Question
What should the security team do with a reported suspicious message?
Answer
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Card 211
Question
What makes an operating-system vulnerability high impact?
Answer
It can affect every application and security control that relies on the compromised OS.
Card 212
Question
What does dynamic application analysis inspect?
Answer
The behavior and externally visible weaknesses of a running application.
Card 213
Question
How can false-positive trends affect IDS or IPS tuning?
Answer
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Card 214
Question
What does a business continuity policy establish?
Answer
Management expectations for sustaining and restoring critical business functions.
Card 215
Question
What is a hot recovery site?
Answer
A ready, synchronized environment intended to take over quickly.
Card 216
Question
What makes an insider threat distinct?
Answer
The actor has legitimate access or organizational knowledge that can be misused.
Card 217
Question
What is RFID cloning?
Answer
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Card 218
Question
Why apply vendor security updates promptly?
Answer
They remove known weaknesses before attackers can exploit the unpatched exposure.
Card 219
Question
What should infrastructure security monitoring observe?
Answer
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Card 220
Question
What can firewall logs reveal?
Answer
Allowed or denied network connections across controlled boundaries.
Card 221
Question
Why minimize open service ports?
Answer
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Card 222
Question
What is threat hunting?
Answer
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Card 223
Question
What triggers an ad hoc risk assessment?
Answer
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Card 224
Question
What makes an assessment external?
Answer
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Card 225
Question
What is data sovereignty?
Answer
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Card 226
Question
What security boundary does a cellular connection create for a mobile device?
Answer
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Card 227
Question
What makes a security control operational?
Answer
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Card 228
Question
What is discretionary access control?
Answer
A resource owner can decide who receives access, within system policy.
Card 229
Question
How can careful automation support employee retention?
Answer
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Card 230
Question
Why does ease of deployment matter in an architecture decision?
Answer
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Card 231
Question
What tradeoff comes with placing an NGFW inline?
Answer
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Card 232
Question
What does a zero-trust policy administrator do?
Answer
It carries out the policy engine's decision, such as creating or ending a session.
Card 233
Question
What should a master service agreement define for data return and deletion?
Answer
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Card 234
Question
What is an environmental physical attack?
Answer
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Card 235
Question
When should a maintenance window be chosen?
Answer
When disruption and rollback can be managed with the least business impact.
Card 236
Question
What is memory injection?
Answer
Placing malicious code or data into another process's memory so it executes in that process's context.
Card 237
Question
What does software composition analysis find?
Answer
Known risks and license information in third-party dependencies.
Card 238
Question
What is DNS filtering?
Answer
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Card 239
Question
What should an incident response policy establish?
Answer
Authority, scope, reporting duties, and organizational commitment for incident handling.
Card 240
Question
How can noncompliance cause reputational damage?
Answer
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Card 241
Question
What does full-disk encryption protect?
Answer
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Card 242
Question
Why are default credentials dangerous?
Answer
They are widely known or easily discovered and often remain unchanged.
Card 243
Question
What makes a risk assessment one-time?
Answer
It evaluates a defined decision or scope once without an established repeating cadence.
Card 244
Question
What is a warm recovery site?
Answer
A partially equipped environment that needs some data restoration or configuration before use.
Card 245
Question
What does application input validation do?
Answer
It checks that input matches the expected type, length, range, and format before use.
Card 246
Question
What should an asset inventory record besides a device name?
Answer
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Card 247
Question
What is mandatory access control?
Answer
A central authority enforces access through labels and rules that ordinary owners cannot override.
Card 248
Question
What security benefit does infrastructure as code provide?
Answer
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Card 249
Question
When should a public service control fail closed?
Answer
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Card 250
Question
What should users do with a suspicious message?
Answer
Report it through the approved channel without interacting with its links or attachments.
Card 251
Question
What usually motivates organized cybercrime?
Answer
Financial gain through scalable or repeatable criminal activity.
Card 252
Question
How can malicious code support a network attack?
Answer
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Card 253
Question
When is virtual patching useful?
Answer
When a network or application control can block exploit traffic before the underlying system can be patched.
Card 254
Question
What does security-monitoring reporting provide?
Answer
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Card 255
Question
What does data geolocation identify?
Answer
The physical or legal location where data is stored, processed, or transmitted.
Card 256
Question
What does a zero-trust policy enforcement point do?
Answer
It enables, monitors, and terminates the connection between a subject and a resource.
Card 257
Question
What is cryptographic key exchange?
Answer
A method for parties to establish shared key material over an untrusted channel.
Card 258
Question
How can a vendor become a supply-chain attack vector?
Answer
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Card 259
Question
Why can legacy hardware remain vulnerable?
Answer
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Card 260
Question
What can proprietary vulnerability intelligence add beyond open sources?
Answer
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Card 261
Question
How does a centralized proxy apply web filtering?
Answer
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Card 262
Question
How can continuous integration and testing improve security automation?
Answer
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Card 263
Question
What is containment?
Answer
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Card 264
Question
What is a software development lifecycle policy meant to ensure?
Answer
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Card 265
Question
What makes risk assessment continuous?
Answer
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Card 266
Question
What is a memorandum of agreement?
Answer
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Card 267
Question
What makes a penetration test integrated?
Answer
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Card 268
Question
How does a DNS amplification attack magnify traffic?
Answer
It sends small spoofed queries that trigger larger replies toward the victim.
Card 269
Question
Why does ease of recovery matter in an architecture decision?
Answer
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Card 270
Question
What does 802.1X control before a device receives normal network access?
Answer
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Card 271
Question
What is rule-based access control?
Answer
System-wide rules grant or deny access based on conditions such as network, time, or action.
Card 272
Question
What is mobile device management?
Answer
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Card 273
Question
What tradeoff comes with a cold recovery site?
Answer
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Card 274
Question
Why identify stakeholders before approving a security-sensitive change?
Answer
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Card 275
Question
How do attestation and acknowledgement differ?
Answer
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Card 276
Question
What does zero-trust adaptive identity mean?
Answer
Access decisions adjust to current risk signals rather than relying only on a static login.
Card 277
Question
What makes a security control physical?
Answer
It protects facilities or equipment through a tangible barrier or mechanism.
Card 278
Question
What is geo-fencing for data?
Answer
Enforcing location-based boundaries on where data or services may be accessed or operated.
Card 279
Question
What does a Trusted Platform Module protect?
Answer
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Card 280
Question
Why can a managed service provider amplify risk?
Answer
Its privileged access and shared tooling can provide a path into many customers.
Card 281
Question
What does probability express in risk analysis?
Answer
A quantified chance that a defined event will occur within stated conditions or time.
Card 282
Question
Why can shadow IT create a threat?
Answer
It bypasses security review, inventory, monitoring, and supported configuration.
Card 283
Question
What is on-path interception?
Answer
An attacker positions between communicating parties to observe or alter traffic.
Card 284
Question
Why include encryption in a system-hardening baseline?
Answer
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Card 285
Question
Why tune security alerts?
Answer
To keep useful detections while reducing noise that wastes analyst attention.
Card 286
Question
What can IPS or IDS logs contribute to an investigation?
Answer
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Card 287
Question
What is VM escape?
Answer
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Card 288
Question
How can segmentation reduce vulnerability exposure before a patch is available?
Answer
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Card 289
Question
Why should firewall policy name the required ports and protocols explicitly?
Answer
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Card 290
Question
What is a change management policy meant to control?
Answer
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Card 291
Question
What is a hybrid-cloud architecture?
Answer
An environment that integrates private or on-premises resources with public cloud services.
Card 292
Question
How do AH and ESP differ in the security services they can provide?
Answer
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Card 293
Question
What makes user behavior risky?
Answer
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Card 294
Question
What is least privilege?
Answer
Granting only the access needed for the required task and no more.
Card 295
Question
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Answer
Transmission to HTTPS, script access, and cross-site sending, respectively.
Card 296
Question
Why discover unmanaged assets?
Answer
Unknown systems cannot be patched, monitored, or governed reliably.
Card 297
Question
What is a service-level agreement?
Answer
Measurable service commitments and remedies, such as availability or response targets.
Card 298
Question
What should govern automated security escalation?
Answer
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Card 299
Question
What is platform diversity as a resilience strategy?
Answer
Using different implementations so one common flaw or failure is less likely to affect every copy.
Card 300
Question
How can replayed session material affect an application?
Answer
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Card 301
Question
What is an implicit trust zone in zero trust?
Answer
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Card 302
Question
What does salting a password hash accomplish?
Answer
It makes identical passwords hash differently and defeats precomputed hash tables.
Card 303
Question
What is spear phishing?
Answer
Phishing tailored to a specific person, role, or organization.
Card 304
Question
What is eradication?
Answer
Removing the attacker's access, malicious artifacts, and exploited conditions.
Card 305
Question
Who is a risk owner?
Answer
The person accountable for deciding and monitoring how a specific risk is handled.
Card 306
Question
What does a partially known penetration-test environment provide?
Answer
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Card 307
Question
What is a microservices architecture?
Answer
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Card 308
Question
What is a jump server?
Answer
A hardened intermediary used to reach systems in a restricted management network.
Card 309
Question
What can happen when a configuration change is made without dependency analysis?
Answer
A downstream service can fail even when the changed component works.
Card 310
Question
What is resource reuse exposure?
Answer
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Card 311
Question
Why does financial information require explicit protection?
Answer
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Card 312
Question
What does CVE provide?
Answer
A common identifier for a publicly disclosed vulnerability.
Card 313
Question
Where can DLP controls operate?
Answer
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Card 314
Question
What does privileged password vaulting protect?
Answer
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Card 315
Question
What does an access-control standard define?
Answer
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Card 316
Question
How can automation support compliance monitoring?
Answer
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Card 317
Question
What does static code analysis examine?
Answer
Source or compiled code for weakness patterns without executing the application.
Card 318
Question
What actor attribute describes funding, time, and personnel?
Answer
Resources.
Card 319
Question
What is DNS poisoning?
Answer
Introducing false DNS data so names resolve to attacker-chosen destinations.
Card 320
Question
Why change default credentials during hardening?
Answer
Default secrets are predictable and commonly targeted.
Card 321
Question
What does quarantine do after a security alert?
Answer
It restricts a suspected asset or object while analysts validate and remediate the risk.
Card 322
Question
What does key stretching do for stored passwords?
Answer
It deliberately makes each password guess more computationally expensive.
Card 323
Question
What is smishing?
Answer
Phishing delivered through SMS or another text-messaging service.
Card 324
Question
What is qualitative risk analysis?
Answer
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Card 325
Question
What is a master service agreement?
Answer
An umbrella contract establishing general legal and commercial terms for ongoing work.
Card 326
Question
What is threat scope reduction?
Answer
Narrowing the systems, privileges, or paths an attacker can reach.
Card 327
Question
Why use a third-party cloud service instead of building locally?
Answer
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Card 328
Question
What should determine security-device placement?
Answer
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Card 329
Question
What does situational awareness mean for a user?
Answer
Notice the people, devices, requests, location, and context around a task before acting.
Card 330
Question
What does a failover test validate?
Answer
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Card 331
Question
What is a preventive control meant to do?
Answer
Stop an unwanted event before it succeeds.
Card 332
Question
What is just-in-time privileged access?
Answer
Elevated access is granted only when needed and expires after a short approved period.
Card 333
Question
What safeguard should security-group automation enforce?
Answer
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Card 334
Question
How does a reflected DDoS attack hide and multiply sources?
Answer
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Card 335
Question
What is a security misconfiguration?
Answer
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Card 336
Question
Why can the same vulnerability have different organizational impact?
Answer
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Card 337
Question
What does URL scanning evaluate before a user opens a web destination?
Answer
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Card 338
Question
What is the board's security governance role?
Answer
Provide oversight, set risk direction, and hold executives accountable.
Card 339
Question
What does code signing establish?
Answer
That code came from the holder of the signing key and has not changed since signing.
Card 340
Question
How should an asset's classification affect security operations?
Answer
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Card 341
Question
How does encryption protect data?
Answer
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Card 342
Question
What is a secure enclave?
Answer
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Card 343
Question
What is business email compromise?
Answer
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Card 344
Question
What is recovery in incident response?
Answer
Restoring services safely, monitoring them, and returning to normal operations.
Card 345
Question
How is single loss expectancy commonly estimated?
Answer
Asset value multiplied by the exposure factor.
Card 346
Question
What does an unknown penetration-test environment provide?
Answer
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Card 347
Question
What security boundary does a hypervisor provide?
Answer
It isolates virtual machines while controlling their access to shared hardware.
Card 348
Question
Why does a TLS tunnel not protect a compromised endpoint?
Answer
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Card 349
Question
Why update diagrams after an infrastructure change?
Answer
Operations and incident responders need the documentation to match the deployed environment.
Card 350
Question
What does privacy ownership assign?
Answer
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Card 351
Question
What does a security control gap analysis compare?
Answer
The controls required for the target state with the controls currently in place.
Card 352
Question
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Answer
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Card 353
Question
What is application privilege escalation?
Answer
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Card 354
Question
What risk remains when unnecessary software is left installed?
Answer
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Card 355
Question
What does SCAP standardize?
Answer
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Card 356
Question
What can packet capture reveal?
Answer
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Card 357
Question
What makes a privileged credential ephemeral?
Answer
It is created for a limited task or session and expires or is destroyed automatically after that use.
Card 358
Question
How do a statement of work and a work order differ?
Answer
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Card 359
Question
Why might multi-cloud improve resilience?
Answer
A provider-wide failure need not stop workloads that can run independently elsewhere.
Card 360
Question
How can a service provider introduce a supply-chain vulnerability?
Answer
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Card 361
Question
What is a false positive in vulnerability scanning?
Answer
A reported weakness that is not actually present or exploitable in the assessed context.
Card 362
Question
How do EDR and XDR differ?
Answer
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Card 363
Question
What should onboarding and offboarding procedures coordinate?
Answer
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Card 364
Question
How should an organization harden managed mobile devices?
Answer
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Card 365
Question
What is a certificate signing request?
Answer
A request containing a public key and subject information for a certificate authority to sign.
Card 366
Question
What is pretexting?
Answer
Using a fabricated role or situation to make a request seem legitimate.
Card 367
Question
How is annualized loss expectancy commonly estimated?
Answer
Single loss expectancy multiplied by annualized rate of occurrence.
Card 368
Question
What security consequence follows from containers sharing a kernel?
Answer
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Card 369
Question
Where does 802.1X enforce a network admission decision?
Answer
At the controlled switch port or wireless access point before normal network access is granted.
Card 370
Question
What should insider-threat awareness teach?
Answer
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Card 371
Question
What access action is suitable for careful automation?
Answer
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Card 372
Question
What is an evil twin?
Answer
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 cards
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study this deck for freeFlashcards opens so you can start studying.
Card 373
Question
Does non-human-readable data need less protection?
Answer
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Card 374
Question
What does authenticating a system establish?
Answer
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Card 375
Question
What does LDAP provide in identity systems?
Answer
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Card 376
Question
What is a deterrent control meant to do?
Answer
Discourage an attacker from attempting an unwanted action.
Card 377
Question
Why update procedures after changing a security control?
Answer
Staff need accurate steps for operating, monitoring, and recovering the new control.
Card 378
Question
How does OCSP differ from a certificate revocation list?
Answer
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Card 379
Question
What is the goal of data exfiltration?
Answer
Remove data from its authorized environment without permission.
Card 380
Question
What is a watering-hole attack?
Answer
Compromising a site frequented by the intended targets so their visits expose them.
Card 381
Question
How can a hardware provider introduce a supply-chain vulnerability?
Answer
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Card 382
Question
What is application forgery?
Answer
Creating or altering a request, token, or object so the application treats it as authentic.
Card 383
Question
How does least privilege mitigate compromise?
Answer
It limits the actions and resources available to a compromised account or process.
Card 384
Question
What is serverless computing?
Answer
A model where the provider manages servers and the customer deploys event-driven code or functions.
Card 385
Question
What makes an infrastructure control effective for a specific risk?
Answer
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Card 386
Question
What does parallel recovery processing test?
Answer
Whether primary and alternate environments can run together consistently before a controlled cutover.
Card 387
Question
Which password-authentication method does WPA3-Personal use?
Answer
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Card 388
Question
How does data retention affect asset disposal?
Answer
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Card 389
Question
What is a false negative in vulnerability scanning?
Answer
A real weakness that the assessment fails to report.
Card 390
Question
What does recurring security scanning add to monitoring?
Answer
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Card 391
Question
What should guide port selection for a secure protocol?
Answer
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Card 392
Question
What does forensic acquisition create?
Answer
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Card 393
Question
How do system owners and data owners divide security accountability?
Answer
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Card 394
Question
What does likelihood express in risk analysis?
Answer
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Card 395
Question
What is a memorandum of understanding?
Answer
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Card 396
Question
What does the right to be forgotten generally require?
Answer
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Card 397
Question
What does an audit committee oversee?
Answer
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Card 398
Question
What does identity interoperability require?
Answer
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Card 399
Question
How does a bollard protect a facility?
Answer
It blocks or redirects vehicles before they can reach a protected area.
Card 400
Question
How can hashing protect a downloaded file?
Answer
A trusted digest lets the recipient detect whether the file changed.
Card 401
Question
What is a credential replay attack?
Answer
Using captured valid credentials or tokens again without needing to discover the secret.
Card 402
Question
How can automation complexity create security risk?
Answer
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Card 403
Question
What must an architecture provide when a component cannot be patched?
Answer
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Card 404
Question
What makes remote access secure?
Answer
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Card 405
Question
What should users verify before connecting removable media or a cable?
Answer
That the device and connection are approved, expected, and handled under organizational policy.
Card 406
Question
What is a self-signed certificate?
Answer
A certificate signed by its own private key rather than by a separate trusted issuer.
Card 407
Question
What is brand impersonation?
Answer
Using a trusted organization's identity or look to deceive people.
Card 408
Question
What characterizes a conservative risk appetite?
Answer
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Card 409
Question
What should a managed mobile device verify before using Wi-Fi?
Answer
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Card 410
Question
What is a zero-day vulnerability?
Answer
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Card 411
Question
What does verification confirm after vulnerability remediation?
Answer
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Card 412
Question
What is user and entity behavior analytics?
Answer
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Card 413
Question
What does a physical security policy establish?
Answer
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Card 414
Question
What does a UPS provide?
Answer
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Card 415
Question
What is a nondisclosure agreement?
Answer
A contract restricting use and disclosure of defined confidential information.
Card 416
Question
What should be checked before assigning a user permission?
Answer
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Card 417
Question
How does espionage differ from ordinary theft?
Answer
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Card 418
Question
What is password spraying?
Answer
Trying a small set of common passwords across many accounts to avoid lockouts.
Card 419
Question
What is the purpose of system isolation during an incident?
Answer
Stop harmful communication while preserving the system for response and investigation.
Card 420
Question
What is a security benchmark?
Answer
A documented set of recommended configuration checks for a platform or product.
Card 421
Question
Which metadata fields give a log record investigative context?
Answer
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Card 422
Question
What does an access-control vestibule prevent?
Answer
It limits tailgating by allowing controlled passage through one door at a time.
Card 423
Question
What is version control's security value for configuration?
Answer
It preserves attributable history and enables review or rollback of changes.
Card 424
Question
Why use both internal and external compliance monitoring?
Answer
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Card 425
Question
What distinguishes on-premises architecture?
Answer
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Card 426
Question
What risk can split tunneling add to a VPN?
Answer
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Card 427
Question
What is a certificate root of trust?
Answer
A trusted root certificate or key from which a client validates a certificate chain.
Card 428
Question
What is typosquatting?
Answer
Registering a look-alike domain based on common typing errors or visual similarity.
Card 429
Question
What is root-cause analysis?
Answer
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Card 430
Question
What is risk tolerance?
Answer
The acceptable variation or boundary around a specific objective or risk area.
Card 431
Question
What is a security self-assessment?
Answer
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Card 432
Question
What does data masking change?
Answer
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Card 433
Question
How do wireless authentication protocols let clients prove identity securely?
Answer
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Card 434
Question
Why reconcile inventory with network discovery?
Answer
Differences expose missing records, retired systems, or unauthorized devices.
Card 435
Question
Why does sideloading raise mobile risk?
Answer
It can bypass store review, signing policy, and managed application controls.
Card 436
Question
What does an information-sharing organization add to vulnerability management?
Answer
Sector or community intelligence about relevant threats, incidents, and defensive action.
Card 437
Question
What does a web-filter block rule specify?
Answer
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Card 438
Question
How do data custodians and data stewards differ?
Answer
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Card 439
Question
What is a brute-force password attack?
Answer
Systematically trying many candidate secrets against an account or protected value.
Card 440
Question
What is a compensating control?
Answer
An alternative safeguard used when the preferred control is impractical or unavailable.
Card 441
Question
How can location act as an authentication factor?
Answer
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Card 442
Question
Why must security automation remain supportable?
Answer
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Card 443
Question
What does a standby generator provide?
Answer
Longer-duration power during a utility outage, after a startup delay.
Card 444
Question
What makes an architecture air-gapped?
Answer
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Card 445
Question
What is a software-defined WAN?
Answer
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Card 446
Question
What password-management behavior should awareness training reinforce?
Answer
Use unique long passwords through an approved manager and report suspected compromise promptly.
Card 447
Question
What security value does fencing provide?
Answer
It defines and delays entry across a physical perimeter.
Card 448
Question
What is a wildcard certificate?
Answer
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Card 449
Question
How does misinformation differ from disinformation?
Answer
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Card 450
Question
What is a risk threshold?
Answer
A defined level that triggers escalation, treatment, or another required response.
Card 451
Question
What does a vendor penetration test contribute to assessment?
Answer
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Card 452
Question
What is the objective of a service-disruption attack?
Answer
Make a system or business function unavailable or unreliable.
Card 453
Question
What is directory traversal?
Answer
Manipulating a file path to reach files outside the directory the application intended to expose.
Card 454
Question
Why decommission an unsupported system?
Answer
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Card 455
Question
Why archive security-monitoring data?
Answer
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Card 456
Question
What role does RADIUS commonly play in enterprise Wi-Fi?
Answer
It centralizes authentication, authorization information, and accounting for network access.
Card 457
Question
Why separate the requester and approver of a high-risk change?
Answer
To reduce error, fraud, and unilateral unauthorized modification.
Card 458
Question
Why can a jailbroken device violate a security baseline?
Answer
It weakens platform isolation and allows unapproved privileged changes.
Card 459
Question
When is tokenization especially useful?
Answer
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Card 460
Question
Why can dark-web intelligence affect vulnerability priority?
Answer
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Card 461
Question
What firewall policy should govern traffic from a screened subnet to internal systems?
Answer
Deny it by default and allow only explicitly required flows.
Card 462
Question
What does SAML commonly carry?
Answer
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Card 463
Question
What does a security governance committee do?
Answer
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Card 464
Question
How can global privacy requirements affect one data process?
Answer
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Card 465
Question
What characterizes an IoT device?
Answer
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Card 466
Question
What is a unified threat management appliance?
Answer
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Card 467
Question
What does a hardware security module provide?
Answer
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Card 468
Question
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Answer
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Card 469
Question
What is a tabletop exercise?
Answer
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Card 470
Question
What does a risk exemption authorize?
Answer
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Card 471
Question
What is a regulatory examination?
Answer
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Card 472
Question
What does physical video surveillance primarily provide?
Answer
Detection and evidence of activity in monitored areas.
Card 473
Question
What is a birthday attack against a hash?
Answer
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Card 474
Question
Why keep backups both onsite and offsite?
Answer
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Card 475
Question
How does technical debt affect security automation?
Answer
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Card 476
Question
What should switch hardening restrict first?
Answer
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Card 477
Question
What should happen when an asset changes owners?
Answer
Inventory, access, support responsibility, and data handling should be updated.
Card 478
Question
What does evidence of a vendor's internal audits contribute?
Answer
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Card 479
Question
What is identity attestation?
Answer
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Card 480
Question
Why can standard enterprise patching be unsafe for an RTOS device?
Answer
A change can disrupt timing guarantees or certified operational behavior.
Card 481
Question
What is secure access service edge?
Answer
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Card 482
Question
What social-engineering habit should awareness training reinforce?
Answer
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Card 483
Question
How can a software provider introduce a supply-chain vulnerability?
Answer
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Card 484
Question
Why include internet exposure in remediation priority?
Answer
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Card 485
Question
What does a mail gateway inspect?
Answer
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Card 486
Question
What is a data controller?
Answer
The entity that determines why and how personal data is processed.
Card 487
Question
How does blackmail motivate a cyberattack?
Answer
The attacker threatens disclosure or harm unless the victim complies.
Card 488
Question
What is a downgrade attack?
Answer
Forcing parties to use an older or weaker protocol or security mode.
Card 489
Question
How does encryption mitigate data exposure?
Answer
It makes captured data unreadable without the required key.
Card 490
Question
How do network and web vulnerability scanners differ?
Answer
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Card 491
Question
How can vulnerability-scan data support an investigation?
Answer
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Card 492
Question
What is key escrow?
Answer
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Card 493
Question
Which human vector commonly uses a fake sign-in page to harvest credentials?
Answer
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Card 494
Question
What is risk avoidance?
Answer
Stopping or not starting the activity that creates the risk.
Card 495
Question
What is data obfuscation?
Answer
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Card 496
Question
What is a directive control?
Answer
A safeguard that tells people what behavior or action is required.
Card 497
Question
What does a security guard add that a camera cannot?
Answer
Human judgment and an immediate physical response.
Card 498
Question
Why define restricted activities in change management?
Answer
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Card 499
Question
What contractual impact can noncompliance create?
Answer
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Card 500
Question
What should determine backup frequency?
Answer
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Card 501
Question
What should router hardening protect?
Answer
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Card 502
Question
What problem does OAuth 2.0 address?
Answer
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Card 503
Question
What does SCADA do?
Answer
It provides supervisory monitoring and control across distributed industrial equipment.
Card 504
Question
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Answer
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Card 505
Question
What distinguishes a computer virus?
Answer
It attaches to a host file or program and spreads when that infected host executes or is shared.
Card 506
Question
What does a key management system coordinate?
Answer
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Card 507
Question
How can an unsecure wired network expose traffic?
Answer
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Card 508
Question
Why is vulnerable device firmware hard to remediate?
Answer
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Card 509
Question
What does patching change in vulnerability remediation?
Answer
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Card 510
Question
What does DMARC add to SPF and DKIM?
Answer
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Card 511
Question
How does automation improve security efficiency?
Answer
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Card 512
Question
What is a simulation exercise?
Answer
A more realistic practice in which participants respond to injected events using operational processes.
Card 513
Question
What is a data processor?
Answer
An entity that processes personal data on behalf of a controller.
Card 514
Question
What is risk mitigation?
Answer
Reducing likelihood, impact, or both through controls or process changes.
Card 515
Question
Why monitor a vendor after onboarding?
Answer
Security posture, ownership, services, incidents, and dependencies can change.
Card 516
Question
What does a physical penetration test assess?
Answer
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Card 517
Question
Why use access badges at a facility?
Answer
To associate entry attempts with authorized identities and enforce access rules.
Card 518
Question
How does permission restriction protect data?
Answer
Only authorized identities receive the actions and scope their roles require.
Card 519
Question
What is the usual objective of ransomware extortion?
Answer
Force payment by denying access, threatening disclosure, or both.
Card 520
Question
What does impossible travel indicate?
Answer
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Card 521
Question
What is configuration enforcement?
Answer
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Card 522
Question
What does a web vulnerability scanner inspect?
Answer
Running web behavior for issues such as unsafe input handling and insecure configuration.
Card 523
Question
How does cost affect an architecture choice?
Answer
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Card 524
Question
What does EAP provide with 802.1X?
Answer
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Card 525
Question
What should operational-security training help users protect?
Answer
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Card 526
Question
What does a time-of-day access rule do?
Answer
Allows or denies a requested action according to an approved schedule.
Card 527
Question
What should cloud infrastructure hardening establish?
Answer
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Card 528
Question
What should an asset owner ensure during offboarding?
Answer
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Card 529
Question
Why encrypt backups?
Answer
Backup media and transfers can expose the same sensitive data as production systems.
Card 530
Question
What is steganography?
Answer
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Card 531
Question
Which human vector uses a fabricated authority role to justify a sensitive request?
Answer
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Card 532
Question
Why does risk transfer not remove accountability?
Answer
The organization can retain legal, reputational, operational, and oversight consequences.
Card 533
Question
Why validate a change after deployment?
Answer
To confirm the intended result occurred without introducing unacceptable side effects.
Card 534
Question
What makes end-of-life hardware a security vulnerability?
Answer
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Card 535
Question
What does an audit add to remediation validation?
Answer
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Card 536
Question
Why can SPF pass while a message still impersonates a brand?
Answer
SPF checks the envelope domain, which may differ from the visible From domain.
Card 537
Question
What role can a government entity have in security governance?
Answer
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Card 538
Question
How do data inventory and retention support privacy governance?
Answer
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Card 539
Question
What can concurrent sessions from distant regions indicate?
Answer
A stolen account or shared credential, subject to VPN and proxy context.
Card 540
Question
What does supply-chain analysis examine?
Answer
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Card 541
Question
What is the purpose of facility lighting as a control?
Answer
Deter covert activity and improve observation of people and areas.
Card 542
Question
What architecture quality keeps a service usable during component failure?
Answer
Availability.
Card 543
Question
When is fail-open behavior preferable to fail-closed behavior?
Answer
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Card 544
Question
Which control function does a login-failure alert provide?
Answer
Detection; it reveals suspicious authentication activity.
Card 545
Question
What does a biometric MFA implementation verify?
Answer
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Card 546
Question
How can automation enforce a security baseline?
Answer
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Card 547
Question
How do wireless cryptographic protocols protect network traffic?
Answer
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Card 548
Question
Why segment sensitive data stores?
Answer
It limits reachable paths and separates them from lower-trust workloads.
Card 549
Question
What must remain secret in an asymmetric key pair?
Answer
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Card 550
Question
How can a supplier become a supply-chain attack vector?
Answer
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Card 551
Question
What is e-discovery?
Answer
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Card 552
Question
What characterizes a neutral risk appetite?
Answer
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Card 553
Question
What is passive reconnaissance?
Answer
Gathering information without directly interacting with the target's systems.
Card 554
Question
What does a philosophical motive mean for a threat actor?
Answer
The actor acts to advance a belief or moral position rather than primarily for money.
Card 555
Question
What does unexpected resource consumption indicate?
Answer
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Card 556
Question
What does a host-based intrusion prevention system do?
Answer
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Card 557
Question
How does agent-based monitoring differ from agentless monitoring?
Answer
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Card 558
Question
What can network logs contribute to an investigation?
Answer
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Card 559
Question
What is the purpose of a backup restore test?
Answer
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Card 560
Question
Why can obsolete hardware become a security risk?
Answer
It may lack supported firmware, modern protections, or replacement parts.
Card 561
Question
What does rescanning confirm after remediation?
Answer
Whether the scanner can still detect the original finding on the affected asset.
Card 562
Question
What should a secure transport method provide?
Answer
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Card 563
Question
How can law affect security governance?
Answer
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Card 564
Question
What does resilience mean for a security architecture?
Answer
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Card 565
Question
Why minimize an infrastructure's attack surface?
Answer
Fewer exposed services and paths leave fewer opportunities for exploitation.
Card 566
Question
What does executing a security-awareness program require?
Answer
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Card 567
Question
What does an infrared security sensor detect?
Answer
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Card 568
Question
What is a knowledge factor?
Answer
Something the claimant knows, such as a password.
Card 569
Question
Why review allow-list and deny-list impact before a change?
Answer
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Card 570
Question
What does partition-level encryption protect?
Answer
One selected disk partition, leaving other partitions outside that encryption boundary.
Card 571
Question
How can instant messaging deliver a security attack?
Answer
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Card 572
Question
What can repeated blocked-content events indicate?
Answer
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Card 573
Question
What should a server-hardening baseline reduce?
Answer
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Card 574
Question
When is physical media destruction appropriate?
Answer
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Card 575
Question
What is mean time to repair?
Answer
The average time required to restore a failed component or service.
Card 576
Question
Why disclose conflicts of interest during vendor selection?
Answer
A personal or financial relationship can bias evaluation away from the organization's requirements.
Card 577
Question
What is a fine for noncompliance?
Answer
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Card 578
Question
What does a public data classification authorize?
Answer
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Card 579
Question
What security benefit comes from standard infrastructure configurations?
Answer
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Card 580
Question
How does horizontal scaling increase capacity?
Answer
It adds more service instances and distributes work among them.
Card 581
Question
Why can added connectivity weaken segmentation?
Answer
Each allowed path can become a route for lateral movement or data escape.
Card 582
Question
What coding practice is central to preventing SQL injection?
Answer
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Card 583
Question
When is a compensating control appropriate for a vulnerability?
Answer
When timely removal or patching is infeasible and another control can reduce the risk.
Card 584
Question
How does agent-based web filtering enforce policy?
Answer
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Card 585
Question
How can regulation differ from an internal policy?
Answer
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Card 586
Question
What is a storage snapshot?
Answer
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Card 587
Question
What does password age measure?
Answer
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Card 588
Question
What does an ethical motive mean in vulnerability research?
Answer
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Card 589
Question
What can missing security logs indicate?
Answer
Logging failure, tampering, retention misconfiguration, or an inactive source.
Card 590
Question
Why disable unused ports and protocols?
Answer
They expose unnecessary communication paths and code that attackers can reach.
Card 591
Question
What does antivirus contribute to monitoring?
Answer
It scans files, memory, or behavior and reports suspected malicious code.
Card 592
Question
What is a honeypot?
Answer
A decoy system or service designed to attract and observe malicious activity.
Card 593
Question
What does file-level encryption protect?
Answer
Selected files independently of whether the rest of the disk or volume is encrypted.
Card 594
Question
How can SMS deliver a security attack?
Answer
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Card 595
Question
What happens during incident analysis?
Answer
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Card 596
Question
What is mean time between failures?
Answer
The average operating time between repairable failures.
Card 597
Question
What is active reconnaissance?
Answer
Probing or interacting with target systems to discover services and behavior.
Card 598
Question
What constraint should guide ICS or SCADA hardening?
Answer
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Card 599
Question
Which control function does restoring a clean system image provide?
Answer
Correction; it returns the system to a known-good state.
Card 600
Question
What does responsiveness mean in an architecture decision?
Answer
How quickly the system and its operators can adapt to demand, failure, or attack.
Card 601
Question
How does out-of-band access strengthen remote administration?
Answer
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Card 602
Question
What makes user behavior unexpected?
Answer
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Card 603
Question
What is a work order?
Answer
A document authorizing a defined unit of work under an existing agreement.
Card 604
Question
What can out-of-cycle logging indicate?
Answer
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Card 605
Question
Why update a standard operating procedure after a change?
Answer
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Card 606
Question
What coding practice limits cross-site scripting?
Answer
Context-appropriate output encoding, supported by safe templating and input handling.
Card 607
Question
What does a restricted data classification indicate?
Answer
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Card 608
Question
How does a bug bounty support responsible disclosure?
Answer
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Card 609
Question
What does web-filter content categorization provide?
Answer
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Card 610
Question
How do hard and soft authentication tokens differ?
Answer
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Card 611
Question
How can industry requirements affect security governance?
Answer
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Card 612
Question
How can noncompliance cause loss of a license?
Answer
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Card 613
Question
What does volume-level encryption protect?
Answer
All data within a selected logical storage volume.
Card 614
Question
How can impersonation exploit familiarity?
Answer
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Card 615
Question
How does RTO guide recovery design?
Answer
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Card 616
Question
What is a honeynet?
Answer
A network of decoy systems used to study or divert attackers.
Card 617
Question
What does backup replication provide?
Answer
Additional synchronized or copied recovery data in another system or location.
Card 618
Question
What lets automation scale securely?
Answer
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Card 619
Question
Why monitor a hardened computing resource continuously?
Answer
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Card 620
Question
Why keep a certificate of destruction?
Answer
It documents that a disposal provider handled specified media under the agreed process.
Card 621
Question
Why consider patch availability before selecting a platform?
Answer
Unsupported or difficult-to-update components accumulate known exposure.
Card 622
Question
Why should remote administration use an encrypted, authenticated protocol?
Answer
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Card 623
Question
How can revenge motivate an insider incident?
Answer
A disgruntled person may damage systems or disclose data to punish the organization.
Card 624
Question
What is a published or documented indicator of malicious activity?
Answer
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Card 625
Question
Why monitor a system more closely when a mitigation exception is accepted?
Answer
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Card 626
Question
What is an SNMP trap?
Answer
An unsolicited device notification sent to a management system when a configured event occurs.
Card 627
Question
How can an automated report support an investigation?
Answer
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Card 628
Question
What is a security key?
Answer
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Card 629
Question
What does database-level encryption protect?
Answer
A database or selected database structures through controls managed at the database layer.
Card 630
Question
How does brand impersonation exploit trust?
Answer
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Card 631
Question
What browser-side impact can a cross-site scripting vulnerability create?
Answer
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Card 632
Question
How can a system or process audit identify vulnerabilities?
Answer
It compares evidence with required configuration and procedure to reveal control gaps.
Card 633
Question
What security role can Group Policy provide?
Answer
Centralized Windows configuration of account, application, audit, and system security settings.
Card 634
Question
What should incident-response training prepare people to do?
Answer
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Card 635
Question
Why must governance track local or regional requirements?
Answer
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Card 636
Question
How can a dependency become a useful key risk indicator?
Answer
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Card 637
Question
What is a business partners agreement?
Answer
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Card 638
Question
What makes an audit regulatory?
Answer
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Card 639
Question
What is a honeyfile?
Answer
A decoy file whose access can reveal unauthorized activity.
Card 640
Question
Why does legal information require explicit protection?
Answer
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Card 641
Question
Which indicator can mass file renaming and encryption produce?
Answer
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Card 642
Question
What remains with an organization after transferring architecture risk?
Answer
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Card 643
Question
When does local console placement provide useful administrative access?
Answer
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Card 644
Question
What makes a harmful user action unintentional?
Answer
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Card 645
Question
How should an organization harden workstations?
Answer
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Card 646
Question
What is journaling in recovery?
Answer
Recording ordered changes so data can be replayed or restored to a consistent point.
Card 647
Question
What downtime must a change plan account for?
Answer
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Card 648
Question
Why must a privacy program map local or regional law to data flows?
Answer
The applicable duties can change with the location of the person, organization, processing, or stored data.
Card 649
Question
Why combine independent preventive controls at different layers?
Answer
A failure at one layer does not automatically let the same attack succeed at the next layer.
Card 650
Question
What is passwordless authentication?
Answer
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Card 651
Question
How can automation improve security reaction time?
Answer
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Card 652
Question
What does record-level encryption protect?
Answer
Individual records or fields, allowing finer protection than encrypting the entire database.
Card 653
Question
How can business email compromise misuse urgency?
Answer
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Card 654
Question
What does impact measure in risk analysis?
Answer
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Card 655
Question
What makes cyber activity part of warfare?
Answer
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Card 656
Question
Which indicator can a newly created privileged account produce outside the normal change window?
Answer
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Card 657
Question
How can configuration enforcement validate a deployed mitigation?
Answer
It compares the realized settings with the approved state and corrects or reports drift.
Card 658
Question
How does validating an alert improve alert tuning?
Answer
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Card 659
Question
What data-layer impact can a SQL injection vulnerability create?
Answer
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Card 660
Question
What environmental variables can change vulnerability priority?
Answer
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Card 661
Question
What security role does SELinux provide?
Answer
Mandatory access controls that confine processes according to centrally defined policy.
Card 662
Question
Why review governance documents periodically?
Answer
Business, technology, threats, and external obligations change.
Card 663
Question
Why evaluate power requirements for a system design?
Answer
Power capacity and redundancy constrain availability and recovery.
Card 664
Question
When is IPsec a better tunnel choice than TLS?
Answer
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Card 665
Question
What is a honeytoken?
Answer
A fake credential or data element that generates a high-confidence alert when used.
Card 666
Question
What should embedded-system hardening prioritize?
Answer
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Card 667
Question
Why must sanitization address data remanence?
Answer
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Card 668
Question
Why require rules of engagement for vendor testing?
Answer
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Card 669
Question
What does a private data classification indicate?
Answer
The information concerns an individual or limited internal audience and should not be exposed publicly.
Card 670
Question
What does a tabletop recovery exercise test?
Answer
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Card 671
Question
Why prevent password reuse?
Answer
One compromised password should not unlock other accounts or services.
Card 672
Question
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Answer
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Card 673
Question
What does transport encryption protect?
Answer
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Card 674
Question
How can a voice call become an attack vector?
Answer
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Card 675
Question
What should a digital-forensics report document?
Answer
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Card 676
Question
What tradeoff comes with an expansionary risk appetite?
Answer
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Card 677
Question
What does a known penetration-test environment provide?
Answer
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Card 678
Question
Why evaluate compute requirements before deployment?
Answer
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Card 679
Question
Why place sensors at network choke points?
Answer
They can observe traffic crossing important trust boundaries.
Card 680
Question
What should hybrid or remote-work security training emphasize?
Answer
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Card 681
Question
Why plan an application restart separately from a service restart?
Answer
The application may need its own state handling, user coordination, health checks, and rollback point.
Card 682
Question
What is a cryptographic vulnerability?
Answer
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Card 683
Question
Why report findings by asset owner?
Answer
Owners need clear accountability and a prioritized remediation queue.
Card 684
Question
What should guide selection of a secure protocol?
Answer
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Card 685
Question
How do centralized and decentralized governance structures differ?
Answer
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Card 686
Question
How does privacy-aware design limit data retention?
Answer
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Card 687
Question
What does a pressure security sensor detect?
Answer
Force or weight applied to a protected surface, such as a floor mat or fence line.
Card 688
Question
What automation costs should a security team plan for?
Answer
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Card 689
Question
What should RTOS hardening preserve while reducing attack surface?
Answer
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Card 690
Question
What is the goal of disruption-for-chaos activity?
Answer
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Card 691
Question
Which indicator can repeated password guessing produce?
Answer
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Card 692
Question
How does removing unnecessary software harden a system?
Answer
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Card 693
Question
What does NetFlow provide?
Answer
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Card 694
Question
How can a dashboard support an investigation?
Answer
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Card 695
Question
When should a password be expired?
Answer
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Card 696
Question
Why does cryptographic key length matter?
Answer
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Card 697
Question
How can an unsecure Bluetooth connection become an attack vector?
Answer
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Card 698
Question
What is a key risk indicator?
Answer
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Card 699
Question
What should vendor monitoring verify when a contract ends?
Answer
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Card 700
Question
What does a sensitive data classification indicate?
Answer
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Card 701
Question
What does software-defined networking separate?
Answer
The control plane that decides traffic behavior from the data plane that forwards traffic.
Card 702
Question
Where should a web application firewall be placed?
Answer
In the path of web requests before they reach the protected application.
Card 703
Question
What does a simulated recovery exercise test?
Answer
Participants perform realistic response actions in a controlled environment without disrupting production.
Card 704
Question
How can a team verify that a detective control is effective?
Answer
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Card 705
Question
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Answer
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Card 706
Question
What makes a vulnerability cloud-specific?
Answer
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Card 707
Question
How can insurance respond to vulnerability risk?
Answer
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Card 708
Question
How does reputation improve web filtering?
Answer
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Card 709
Question
What does an encryption policy establish?
Answer
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Card 710
Question
How does a microwave security sensor detect movement?
Answer
It emits microwave energy and detects changes in the reflected signal caused by motion.
Card 711
Question
What should IoT-device hardening change before deployment?
Answer
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Card 712
Question
Why track software licenses as assets?
Answer
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Card 713
Question
What does a password manager improve?
Answer
It can generate and store unique long passwords so users do not memorize or reuse them.
Card 714
Question
What makes a ledger open and public?
Answer
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Card 715
Question
What should a payment-change request trigger?
Answer
Independent verification through a known channel before any account or payment detail is changed.
Card 716
Question
What does preserving digital evidence require?
Answer
Protecting its integrity, context, access history, and availability from collection through final disposition.
Card 717
Question
What should a risk report tell decision-makers?
Answer
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Card 718
Question
What should an external assessment report provide?
Answer
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Card 719
Question
What is a centralized design's main resilience risk?
Answer
A central dependency can become a bottleneck or single point of failure.
Card 720
Question
What does mutual TLS add to a TLS-protected service connection?
Answer
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Card 721
Question
What should recurring security-awareness reporting show?
Answer
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Card 722
Question
Why do legacy applications require extra change planning?
Answer
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Card 723
Question
How do a data controller and a data processor differ?
Answer
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Card 724
Question
How can orchestration become a single point of failure?
Answer
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Card 725
Question
Why should defenses account for a threat actor's sophistication and capability?
Answer
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Card 726
Question
How does an injection attack make an application execute unintended instructions?
Answer
It sends crafted input that an interpreter treats as code or commands instead of data.
Card 727
Question
What does a host-based firewall control?
Answer
Inbound and outbound network traffic for one endpoint according to local rules.
Card 728
Question
Why revise alerting after an incident?
Answer
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Card 729
Question
Why include security duties in procurement criteria?
Answer
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Card 730
Question
What does a critical data classification indicate?
Answer
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Card 731
Question
What infrastructure capacity must support failover?
Answer
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Card 732
Question
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Answer
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Card 733
Question
How does a remediation exemption differ from an exception?
Answer
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Card 734
Question
Why should automated EDR or XDR blocking have an exception and rollback path?
Answer
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Card 735
Question
What does a security playbook provide?
Answer
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Card 736
Question
How does an ultrasonic security sensor detect movement?
Answer
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Card 737
Question
What should a managed mobile device require for Bluetooth connections?
Answer
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Card 738
Question
How do password complexity rules differ from password length?
Answer
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Card 739
Question
What makes a certificate third-party trusted?
Answer
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Card 740
Question
Why is an out-of-band check effective against impersonation?
Answer
It verifies the request through a separate, previously trusted communication path.
Card 741
Question
What does a risk exception authorize?
Answer
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Card 742
Question
What security challenge grows in a decentralized design?
Answer
Consistent policy, inventory, monitoring, and patching become harder.
Card 743
Question
How should controls be selected for an unused network path?
Answer
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Card 744
Question
How can a buffer-overflow attack affect an application?
Answer
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.
744 cards
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Flashcards opens so you can start studying.