What does an information security policy establish?

Management's required direction, responsibilities, and high-level rules for protecting information and systems.

A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.

What does a public-key certificate bind to an identity?

A public key, together with identifying information and the issuer's signature.

What is data at rest?

Data stored on media such as disks, databases, backups, or mobile devices.

How does policy-driven access control decide a zero-trust access request?

Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.

What does establishing a secure baseline produce?

An approved, documented configuration that defines the required secure state for a class of computing resource.

What is hashing used to verify?

Whether data has changed by comparing fixed-length digest values.

What is impersonation in social engineering?

Pretending to be a trusted person or organization to obtain access, data, or action.

What is virtualization?

Abstracting physical compute so multiple isolated guest systems can share a host.

What is chain of custody?

A documented history of who collected, handled, transferred, stored, and examined evidence.

What is quantitative risk analysis?

Estimating risk with numerical values such as money, frequency, or probability.

What is a phishing awareness campaign?

A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.

What is high availability?

Designing a service to remain accessible despite expected component failures.

What is a network security zone?

A group of systems with similar trust, function, or control requirements.

What is risk transfer?

Shifting some financial or operational consequence to another party, such as through insurance or contract.

What is media sanitization?

Making stored data infeasible to recover for the intended level of protection.

What does CVSS provide?

A standardized way to describe a vulnerability's technical severity characteristics.

What does security alerting do?

It turns matched events or behavior into a notification that the right responder can review.

What does a firewall rule enforce?

A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.

What is deprovisioning?

Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.

How does inline placement differ from a tap or monitor port?

Inline traffic passes through the control; a tap or monitor receives a copy for observation.

What is asymmetric encryption?

Encryption that uses a mathematically related public and private key pair.

What does SPF authorize?

Which mail servers may send mail for a domain in the SMTP envelope.

What is a possession factor?

Something the claimant has, such as a cryptographic authenticator.

What does ordinary TLS usually protect and authenticate?

It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.

What is single loss expectancy?

The estimated loss from one occurrence of a risk event.

What does a certificate authority do?

It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.

What is a detective control meant to do?

Identify that an unwanted event has happened or is happening.

What is the security purpose of change-control approval?

Ensure authorized reviewers assess risk before the production change occurs.

Technology used for organizational work without required approval or oversight.

What is a buffer overflow vulnerability?

A bounds-checking failure that lets input overwrite memory outside its intended buffer.

Malware or an intrusion outcome that denies access to data or systems to extort the victim.

How does network segmentation limit an incident?

It restricts communication paths and reduces lateral movement between zones.

How do load balancing and clustering support availability differently?

Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.

What is vendor due diligence?

Evaluating a provider's security, capability, stability, and fit before commitment.

Who is a data subject?

The person whose personal data is collected or processed.

A formal assertion or report about a subject matter, often supported by an independent examination.

What is a replay attack?

Valid captured data is retransmitted to repeat an authenticated or authorized action.

What does a wireless site survey establish?

Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.

What is the time-of-check stage of a race-condition vulnerability?

The application verifies a condition or resource state before acting on it.

What is a penetration test?

An authorized attempt to exploit weaknesses and demonstrate practical impact.

What is a cold recovery site?

A facility with basic space and utilities but little preinstalled technology or current data.

What is data in transit?

Data moving between systems or across a network.

What is a vendor security questionnaire?

A structured request for information about a provider's controls and practices.

How does an internal actor's starting position differ from an external actor's?

An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.

What can unexpected account lockouts indicate?

Password guessing, credential stuffing, user error, or a broken client.

How do permissions enforce access control?

They specify which actions a subject may perform on a particular resource.

What is log aggregation?

Central collection of logs from multiple sources for search, correlation, and retention.

Why plan a service restart as part of a change?

The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.

What is infrastructure as code?

Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.

What should security-awareness program development start with?

The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.

CompTIA Security+ SY0-701 Flashcards: Complete Objective Review

Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.

Автор Flashcards Open Source App

Об этой колоде

Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.

What this deck covers

General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.

Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.

The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.

Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.

This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.

Карточки в этой колоде

Карточка 1
Вопрос
What does an information security policy establish?
Ответ
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Карточка 2
Вопрос
What is phishing?
Ответ
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Карточка 3
Вопрос
What does a public-key certificate bind to an identity?
Ответ
A public key, together with identifying information and the issuer's signature.
Карточка 4
Вопрос
What is data at rest?
Ответ
Data stored on media such as disks, databases, backups, or mobile devices.
Карточка 5
Вопрос
How does policy-driven access control decide a zero-trust access request?
Ответ
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Карточка 6
Вопрос
What does establishing a secure baseline produce?
Ответ
An approved, documented configuration that defines the required secure state for a class of computing resource.
Карточка 7
Вопрос
What is hashing used to verify?
Ответ
Whether data has changed by comparing fixed-length digest values.
Карточка 8
Вопрос
What is impersonation in social engineering?
Ответ
Pretending to be a trusted person or organization to obtain access, data, or action.
Карточка 9
Вопрос
What is virtualization?
Ответ
Abstracting physical compute so multiple isolated guest systems can share a host.
Карточка 10
Вопрос
What is chain of custody?
Ответ
A documented history of who collected, handled, transferred, stored, and examined evidence.
Карточка 11
Вопрос
What is quantitative risk analysis?
Ответ
Estimating risk with numerical values such as money, frequency, or probability.
Карточка 12
Вопрос
What is a phishing awareness campaign?
Ответ
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Карточка 13
Вопрос
What is high availability?
Ответ
Designing a service to remain accessible despite expected component failures.
Карточка 14
Вопрос
What is a network security zone?
Ответ
A group of systems with similar trust, function, or control requirements.
Карточка 15
Вопрос
What is risk transfer?
Ответ
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Карточка 16
Вопрос
What is media sanitization?
Ответ
Making stored data infeasible to recover for the intended level of protection.
Карточка 17
Вопрос
What does CVSS provide?
Ответ
A standardized way to describe a vulnerability's technical severity characteristics.
Карточка 18
Вопрос
What does security alerting do?
Ответ
It turns matched events or behavior into a notification that the right responder can review.
Карточка 19
Вопрос
What does a firewall rule enforce?
Ответ
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Карточка 20
Вопрос
What is deprovisioning?
Ответ
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Карточка 21
Вопрос
How does inline placement differ from a tap or monitor port?
Ответ
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Карточка 22
Вопрос
What is asymmetric encryption?
Ответ
Encryption that uses a mathematically related public and private key pair.
Карточка 23
Вопрос
What does SPF authorize?
Ответ
Which mail servers may send mail for a domain in the SMTP envelope.
Карточка 24
Вопрос
What is a possession factor?
Ответ
Something the claimant has, such as a cryptographic authenticator.
Карточка 25
Вопрос
What does ordinary TLS usually protect and authenticate?
Ответ
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Карточка 26
Вопрос
What is single loss expectancy?
Ответ
The estimated loss from one occurrence of a risk event.
Карточка 27
Вопрос
What does a certificate authority do?
Ответ
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Карточка 28
Вопрос
What is a detective control meant to do?
Ответ
Identify that an unwanted event has happened or is happening.
Карточка 29
Вопрос
What is the security purpose of change-control approval?
Ответ
Ensure authorized reviewers assess risk before the production change occurs.
Карточка 30
Вопрос
What is shadow IT?
Ответ
Technology used for organizational work without required approval or oversight.
Карточка 31
Вопрос
What is a buffer overflow vulnerability?
Ответ
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Карточка 32
Вопрос
What is ransomware?
Ответ
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Карточка 33
Вопрос
How does network segmentation limit an incident?
Ответ
It restricts communication paths and reduces lateral movement between zones.
Карточка 34
Вопрос
How do load balancing and clustering support availability differently?
Ответ
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Карточка 35
Вопрос
What is vendor due diligence?
Ответ
Evaluating a provider's security, capability, stability, and fit before commitment.
Карточка 36
Вопрос
Who is a data subject?
Ответ
The person whose personal data is collected or processed.
Карточка 37
Вопрос
What is attestation?
Ответ
A formal assertion or report about a subject matter, often supported by an independent examination.
Карточка 38
Вопрос
What is a replay attack?
Ответ
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Карточка 39
Вопрос
What does a wireless site survey establish?
Ответ
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Карточка 40
Вопрос
What is the time-of-check stage of a race-condition vulnerability?
Ответ
The application verifies a condition or resource state before acting on it.
Карточка 41
Вопрос
What is a penetration test?
Ответ
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Карточка 42
Вопрос
What is a cold recovery site?
Ответ
A facility with basic space and utilities but little preinstalled technology or current data.
Карточка 43
Вопрос
What is data in transit?
Ответ
Data moving between systems or across a network.
Карточка 44
Вопрос
What is a vendor security questionnaire?
Ответ
A structured request for information about a provider's controls and practices.
Карточка 45
Вопрос
How does an internal actor's starting position differ from an external actor's?
Ответ
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Карточка 46
Вопрос
What can unexpected account lockouts indicate?
Ответ
Password guessing, credential stuffing, user error, or a broken client.
Карточка 47
Вопрос
How do permissions enforce access control?
Ответ
They specify which actions a subject may perform on a particular resource.
Карточка 48
Вопрос
What is log aggregation?
Ответ
Central collection of logs from multiple sources for search, correlation, and retention.
Карточка 49
Вопрос
Why plan a service restart as part of a change?
Ответ
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Карточка 50
Вопрос
What is infrastructure as code?
Ответ
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Карточка 51
Вопрос
What should security-awareness program development start with?
Ответ
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Карточка 52
Вопрос
What is a voice-based social-engineering attack called?
Ответ
Vishing.
Карточка 53
Вопрос
What happens during incident-response preparation?
Ответ
Teams establish people, tools, access, communications, training, and procedures before an incident.
Карточка 54
Вопрос
What does an offensive penetration-testing team do?
Ответ
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Карточка 55
Вопрос
What is federation?
Ответ
One security domain relies on identity assertions from another trusted domain.
Карточка 56
Вопрос
What is asset classification?
Ответ
Grouping an asset by sensitivity, criticality, or required handling.
Карточка 57
Вопрос
What is cross-site scripting?
Ответ
Injection of script-capable content that a browser executes in another site's security context.
Карточка 58
Вопрос
What can IDS or IPS trends reveal?
Ответ
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Карточка 59
Вопрос
What can unexpected resource inaccessibility indicate?
Ответ
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Карточка 60
Вопрос
What is a corrective control meant to do?
Ответ
Limit damage and restore a secure state after an event.
Карточка 61
Вопрос
How do containers differ from virtual machines?
Ответ
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Карточка 62
Вопрос
How does an active security device differ from a passive one?
Ответ
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Карточка 63
Вопрос
Why is unsupported software a persistent attack surface?
Ответ
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Карточка 64
Вопрос
What is annualized rate of occurrence?
Ответ
The estimated number of times a risk event occurs per year.
Карточка 65
Вопрос
What is an inherence factor?
Ответ
A biometric characteristic of the claimant.
Карточка 66
Вопрос
What do a threat actor's sophistication and capability describe?
Ответ
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Карточка 67
Вопрос
What is a SIEM?
Ответ
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Карточка 68
Вопрос
What is sideloading?
Ответ
Installing software from outside the platform's approved distribution path.
Карточка 69
Вопрос
What does an IDS or IPS signature match?
Ответ
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Карточка 70
Вопрос
Why are embedded systems often difficult to patch?
Ответ
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Карточка 71
Вопрос
What is a virtual private network?
Ответ
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Карточка 72
Вопрос
What should an initial security-awareness report establish?
Ответ
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Карточка 73
Вопрос
What is symmetric encryption?
Ответ
Encryption that uses the same secret key to encrypt and decrypt data.
Карточка 74
Вопрос
What happens during incident detection?
Ответ
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Карточка 75
Вопрос
What is recovery time objective?
Ответ
The target maximum time to restore a function after disruption.
Карточка 76
Вопрос
Why prioritize password length?
Ответ
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Карточка 77
Вопрос
What must sanitization accomplish before an asset leaves organizational control?
Ответ
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Карточка 78
Вопрос
What is a real-time operating system designed to provide?
Ответ
Predictable response timing for tasks with strict deadlines.
Карточка 79
Вопрос
What does fail-open behavior do when a control fails?
Ответ
It permits traffic or access to preserve availability.
Карточка 80
Вопрос
What is jailbreaking or rooting a mobile device?
Ответ
Removing platform restrictions to gain privileged control over the operating system.
Карточка 81
Вопрос
What does network access control enforce?
Ответ
Identity, device posture, and access policy at network connection time and during a session.
Карточка 82
Вопрос
What does data loss prevention do?
Ответ
Detects and may block sensitive data use or transfer that violates policy.
Карточка 83
Вопрос
What security property does a blockchain provide?
Ответ
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Карточка 84
Вопрос
What is recovery point objective?
Ответ
The target maximum acceptable data loss measured backward in time.
Карточка 85
Вопрос
How do ICS and SCADA relate?
Ответ
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Карточка 86
Вопрос
What does fail-closed behavior do when a control fails?
Ответ
It denies traffic or access to preserve security.
Карточка 87
Вопрос
Which keys create and verify a typical digital signature?
Ответ
The signer creates it with a private key, and others verify it with the corresponding public key.
Карточка 88
Вопрос
What is SQL injection?
Ответ
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Карточка 89
Вопрос
What does DKIM verify?
Ответ
That selected message content was signed by a domain and was not altered after signing.
Карточка 90
Вопрос
What is post-incident activity?
Ответ
Learning from the event and improving controls, plans, and recovery based on evidence.
Карточка 91
Вопрос
What characterizes an expansionary risk appetite?
Ответ
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Карточка 92
Вопрос
How do centralized and decentralized architectures differ?
Ответ
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Карточка 93
Вопрос
What does a certificate revocation list publish?
Ответ
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Карточка 94
Вопрос
What is a legal hold?
Ответ
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Карточка 95
Вопрос
What is exposure factor in quantitative risk analysis?
Ответ
The estimated percentage of an asset's value lost in one event.
Карточка 96
Вопрос
What is decentralized architecture?
Ответ
Control or service responsibility is distributed across multiple independent components or locations.
Карточка 97
Вопрос
What is tokenization?
Ответ
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Карточка 98
Вопрос
How can automation act as a workforce multiplier?
Ответ
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Карточка 99
Вопрос
What can endpoint process logs reveal?
Ответ
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Карточка 100
Вопрос
What does the CIA triad protect?
Ответ
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Карточка 101
Вопрос
How does data masking protect information?
Ответ
It hides selected values or characters while preserving a usable representation.
Карточка 102
Вопрос
How can a national requirement affect security governance?
Ответ
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Карточка 103
Вопрос
What do integrations and APIs provide to security orchestration?
Ответ
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Карточка 104
Вопрос
What makes a compliance report external?
Ответ
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Карточка 105
Вопрос
What does a cryptographic algorithm define?
Ответ
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Карточка 106
Вопрос
Why compare systems with a secure baseline regularly?
Ответ
To detect drift, unauthorized changes, and missing hardening.
Карточка 107
Вопрос
What does integrity protect?
Ответ
The accuracy and completeness of data and systems against unauthorized change.
Карточка 108
Вопрос
What does vulnerability classification organize?
Ответ
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Карточка 109
Вопрос
What does a password standard define?
Ответ
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Карточка 110
Вопрос
What technology capacity must a recovery design plan for?
Ответ
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Карточка 111
Вопрос
What does a confidential data classification indicate?
Ответ
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Карточка 112
Вопрос
What makes a vendor assessment independent?
Ответ
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Карточка 113
Вопрос
What lets a worm spread without attaching itself to another file?
Ответ
It is a standalone program that replicates across reachable systems or services.
Карточка 114
Вопрос
What is microsegmentation?
Ответ
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Карточка 115
Вопрос
What can application logs reveal?
Ответ
Transactions, errors, user actions, and application-specific security events.
Карточка 116
Вопрос
What does deploying a secure baseline require?
Ответ
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Карточка 117
Вопрос
How can resource-provisioning automation improve security?
Ответ
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Карточка 118
Вопрос
What does availability protect?
Ответ
Reliable, timely access to systems and data when authorized users need them.
Карточка 119
Вопрос
Why must a change request describe business impact?
Ответ
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Карточка 120
Вопрос
What does an authenticated vulnerability scan add?
Ответ
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Карточка 121
Вопрос
What does a change-management procedure specify?
Ответ
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Карточка 122
Вопрос
What is a sanction for noncompliance?
Ответ
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Карточка 123
Вопрос
How can email deliver a security attack?
Ответ
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Карточка 124
Вопрос
What is an internal compliance audit?
Ответ
An organization-led examination of whether selected operations and controls meet defined requirements.
Карточка 125
Вопрос
What is a Trojan?
Ответ
Malware disguised as legitimate or desirable software.
Карточка 126
Вопрос
What is clustering?
Ответ
Multiple systems work together to provide a service and tolerate member failure.
Карточка 127
Вопрос
What makes data regulated?
Ответ
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Карточка 128
Вопрос
What does a wireless heat map show?
Ответ
Measured or modeled signal strength and coverage across a physical area.
Карточка 129
Вопрос
How should vendor criticality affect due diligence?
Ответ
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Карточка 130
Вопрос
How can a digital signature support non-repudiation?
Ответ
It provides evidence that the holder of a private key signed specific data.
Карточка 131
Вопрос
What should vulnerability prioritization consider beyond severity?
Ответ
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Карточка 132
Вопрос
What is a security guideline?
Ответ
Recommended practice that allows judgment unless adopted as a requirement.
Карточка 133
Вопрос
What usually distinguishes a nation-state threat actor?
Ответ
Strategic objectives, substantial resources, patience, and advanced operational capability.
Карточка 134
Вопрос
What is spyware?
Ответ
Software that secretly collects information about a user or system.
Карточка 135
Вопрос
Why maintain an allow list for applications?
Ответ
Only explicitly approved software is permitted to execute.
Карточка 136
Вопрос
How can an image become an attack vector?
Ответ
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Карточка 137
Вопрос
What makes a security control technical?
Ответ
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Карточка 138
Вопрос
What is identity proofing?
Ответ
Establishing that a person is who they claim to be before issuing an account or credential.
Карточка 139
Вопрос
What is an automated security guardrail?
Ответ
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Карточка 140
Вопрос
Why assign an owner to a planned change?
Ответ
To make one party accountable for coordination, execution, and follow-through.
Карточка 141
Вопрос
How can national privacy law affect data handling?
Ответ
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Карточка 142
Вопрос
What is continuity of operations?
Ответ
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Карточка 143
Вопрос
What security tradeoff comes with BYOD?
Ответ
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Карточка 144
Вопрос
How should policies and handbooks support security training?
Ответ
They provide accessible, current rules and reporting steps that training can apply to real situations.
Карточка 145
Вопрос
What is a keylogger?
Ответ
A tool that records keystrokes to capture data such as credentials.
Карточка 146
Вопрос
What makes information a trade secret?
Ответ
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Карточка 147
Вопрос
What does authentication establish?
Ответ
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Карточка 148
Вопрос
What risk comes from an untrusted file attachment?
Ответ
Opening or parsing it can execute malicious code or expose data.
Карточка 149
Вопрос
How does risk tolerance affect vulnerability remediation?
Ответ
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Карточка 150
Вопрос
How can a global requirement affect security governance?
Ответ
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Карточка 151
Вопрос
Why should questionnaire answers be supported by evidence?
Ответ
Self-assertions alone may not prove that controls are designed or operating effectively.
Карточка 152
Вопрос
What is an independent third-party audit?
Ответ
An external party with suitable independence examines evidence against defined criteria.
Карточка 153
Вопрос
What do account provisioning and deprovisioning do?
Ответ
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Карточка 154
Вопрос
What is an unskilled attacker commonly called?
Ответ
A script kiddie: someone who relies on tools or instructions created by others.
Карточка 155
Вопрос
What is a rootkit?
Ответ
Software designed to maintain privileged, concealed access by altering or subverting the system.
Карточка 156
Вопрос
What does an access control list enforce?
Ответ
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Карточка 157
Вопрос
What should system security monitoring observe?
Ответ
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Карточка 158
Вопрос
What can operating-system security logs reveal?
Ответ
Authentication, privilege use, policy changes, services, and other host security events.
Карточка 159
Вопрос
Why isolate operational technology from general business networks?
Ответ
To limit attack paths into safety- and availability-critical processes.
Карточка 160
Вопрос
What is the COPE mobile deployment model?
Ответ
The organization owns the device but permits defined personal use while retaining management control.
Карточка 161
Вопрос
What security work belongs in asset acquisition and procurement?
Ответ
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Карточка 162
Вопрос
How can user-provisioning automation improve security?
Ответ
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Карточка 163
Вопрос
What people capacity must a continuity plan account for?
Ответ
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Карточка 164
Вопрос
What do authorization models define?
Ответ
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Карточка 165
Вопрос
Why are removable devices an attack vector?
Ответ
They can introduce malware or remove data while bypassing network controls.
Карточка 166
Вопрос
What should predeployment change-test results show?
Ответ
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Карточка 167
Вопрос
What is the time-of-use stage of a race-condition vulnerability?
Ответ
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Карточка 168
Вопрос
What is data in use?
Ответ
Data actively processed in memory or by an application.
Карточка 169
Вопрос
What does open-source vulnerability intelligence contribute?
Ответ
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Карточка 170
Вопрос
What can file-integrity monitoring detect?
Ответ
Unexpected changes to protected files, directories, or configuration.
Карточка 171
Вопрос
Why should deprovisioning be prompt?
Ответ
Former users or roles should not retain usable access.
Карточка 172
Вопрос
What is an acceptable use policy?
Ответ
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Карточка 173
Вопрос
What makes a compliance report internal?
Ответ
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Карточка 174
Вопрос
What is a logic bomb?
Ответ
Malicious code that activates when a specified condition or time is reached.
Карточка 175
Вопрос
What does a right-to-audit clause provide?
Ответ
Contractual authority to inspect or obtain evidence about agreed controls.
Карточка 176
Вопрос
Where should a forward proxy sit in an enterprise traffic path?
Ответ
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Карточка 177
Вопрос
Which cues should make a message look suspicious?
Ответ
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Карточка 178
Вопрос
What makes a security control managerial?
Ответ
It directs risk and governance through decisions such as policies, assessments, and oversight.
Карточка 179
Вопрос
What is the CYOD mobile deployment model?
Ответ
The user selects from organization-approved device options that remain subject to corporate security requirements.
Карточка 180
Вопрос
How does client-based vulnerable software differ from an agentless exposure?
Ответ
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Карточка 181
Вопрос
What makes a risk assessment recurring?
Ответ
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Карточка 182
Вопрос
What does a defensive penetration-testing team practice?
Ответ
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Карточка 183
Вопрос
In a zero-trust data plane, what can the subject or system represent?
Ответ
The user, device, workload, or service requesting access to a protected resource.
Карточка 184
Вопрос
What primarily motivates a hacktivist?
Ответ
A political, social, or ideological cause.
Карточка 185
Вопрос
What is bloatware?
Ответ
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Карточка 186
Вопрос
Why keep endpoint-protection signatures and engines current?
Ответ
They need current detection logic to recognize newly identified malware and exploit behavior.
Карточка 187
Вопрос
What should application security monitoring observe?
Ответ
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Карточка 188
Вопрос
What is role-based access control?
Ответ
Permissions are assigned to roles, and identities receive access through their roles.
Карточка 189
Вопрос
What is geographic dispersal?
Ответ
Placing redundant resources in separate locations so one regional event does not affect all copies.
Карточка 190
Вопрос
What is a malicious update?
Ответ
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Карточка 191
Вопрос
What does static application analysis inspect?
Ответ
Source code, bytecode, or compiled code without executing the application.
Карточка 192
Вопрос
What does a firewall access list define?
Ответ
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Карточка 193
Вопрос
What does a disaster recovery policy establish?
Ответ
Management expectations for restoring technology and data after a disruptive event.
Карточка 194
Вопрос
How does logical segmentation separate workloads that share physical infrastructure?
Ответ
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Карточка 195
Вопрос
How should IDS and IPS placement differ?
Ответ
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Карточка 196
Вопрос
What should automated ticket creation capture?
Ответ
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Карточка 197
Вопрос
What makes information intellectual property?
Ответ
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Карточка 198
Вопрос
What is a backout plan?
Ответ
Predefined steps for safely reversing a failed or harmful change.
Карточка 199
Вопрос
Why is an unsecure wireless network an attack vector?
Ответ
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Карточка 200
Вопрос
What is physical brute force?
Ответ
Using force to defeat a lock, barrier, enclosure, or other physical control.
Карточка 201
Вопрос
What is application sandboxing?
Ответ
Running code in a constrained environment with limited access to the host and data.
Карточка 202
Вопрос
Why assign an asset owner?
Ответ
One accountable party must decide its use, protection, and lifecycle.
Карточка 203
Вопрос
What happens during risk identification?
Ответ
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Карточка 204
Вопрос
What should an SLA state about breach notification?
Ответ
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Карточка 205
Вопрос
How do due diligence and due care differ in compliance?
Ответ
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Карточка 206
Вопрос
What is attribute-based access control?
Ответ
Policy evaluates attributes of the subject, resource, action, and environment.
Карточка 207
Вопрос
What does a zero-trust policy engine do?
Ответ
It evaluates policy and signals to decide whether access should be allowed.
Карточка 208
Вопрос
How does a cloud responsibility matrix allocate security duties?
Ответ
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Карточка 209
Вопрос
Where should a load balancer sit in a service path?
Ответ
In front of service instances so it can route requests to healthy backends.
Карточка 210
Вопрос
What should the security team do with a reported suspicious message?
Ответ
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Карточка 211
Вопрос
What makes an operating-system vulnerability high impact?
Ответ
It can affect every application and security control that relies on the compromised OS.
Карточка 212
Вопрос
What does dynamic application analysis inspect?
Ответ
The behavior and externally visible weaknesses of a running application.
Карточка 213
Вопрос
How can false-positive trends affect IDS or IPS tuning?
Ответ
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Карточка 214
Вопрос
What does a business continuity policy establish?
Ответ
Management expectations for sustaining and restoring critical business functions.
Карточка 215
Вопрос
What is a hot recovery site?
Ответ
A ready, synchronized environment intended to take over quickly.
Карточка 216
Вопрос
What makes an insider threat distinct?
Ответ
The actor has legitimate access or organizational knowledge that can be misused.
Карточка 217
Вопрос
What is RFID cloning?
Ответ
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Карточка 218
Вопрос
Why apply vendor security updates promptly?
Ответ
They remove known weaknesses before attackers can exploit the unpatched exposure.
Карточка 219
Вопрос
What should infrastructure security monitoring observe?
Ответ
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Карточка 220
Вопрос
What can firewall logs reveal?
Ответ
Allowed or denied network connections across controlled boundaries.
Карточка 221
Вопрос
Why minimize open service ports?
Ответ
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Карточка 222
Вопрос
What is threat hunting?
Ответ
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Карточка 223
Вопрос
What triggers an ad hoc risk assessment?
Ответ
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Карточка 224
Вопрос
What makes an assessment external?
Ответ
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Карточка 225
Вопрос
What is data sovereignty?
Ответ
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Карточка 226
Вопрос
What security boundary does a cellular connection create for a mobile device?
Ответ
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Карточка 227
Вопрос
What makes a security control operational?
Ответ
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Карточка 228
Вопрос
What is discretionary access control?
Ответ
A resource owner can decide who receives access, within system policy.
Карточка 229
Вопрос
How can careful automation support employee retention?
Ответ
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Карточка 230
Вопрос
Why does ease of deployment matter in an architecture decision?
Ответ
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Карточка 231
Вопрос
What tradeoff comes with placing an NGFW inline?
Ответ
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Карточка 232
Вопрос
What does a zero-trust policy administrator do?
Ответ
It carries out the policy engine's decision, such as creating or ending a session.
Карточка 233
Вопрос
What should a master service agreement define for data return and deletion?
Ответ
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Карточка 234
Вопрос
What is an environmental physical attack?
Ответ
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Карточка 235
Вопрос
When should a maintenance window be chosen?
Ответ
When disruption and rollback can be managed with the least business impact.
Карточка 236
Вопрос
What is memory injection?
Ответ
Placing malicious code or data into another process's memory so it executes in that process's context.
Карточка 237
Вопрос
What does software composition analysis find?
Ответ
Known risks and license information in third-party dependencies.
Карточка 238
Вопрос
What is DNS filtering?
Ответ
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Карточка 239
Вопрос
What should an incident response policy establish?
Ответ
Authority, scope, reporting duties, and organizational commitment for incident handling.
Карточка 240
Вопрос
How can noncompliance cause reputational damage?
Ответ
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Карточка 241
Вопрос
What does full-disk encryption protect?
Ответ
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Карточка 242
Вопрос
Why are default credentials dangerous?
Ответ
They are widely known or easily discovered and often remain unchanged.
Карточка 243
Вопрос
What makes a risk assessment one-time?
Ответ
It evaluates a defined decision or scope once without an established repeating cadence.
Карточка 244
Вопрос
What is a warm recovery site?
Ответ
A partially equipped environment that needs some data restoration or configuration before use.
Карточка 245
Вопрос
What does application input validation do?
Ответ
It checks that input matches the expected type, length, range, and format before use.
Карточка 246
Вопрос
What should an asset inventory record besides a device name?
Ответ
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Карточка 247
Вопрос
What is mandatory access control?
Ответ
A central authority enforces access through labels and rules that ordinary owners cannot override.
Карточка 248
Вопрос
What security benefit does infrastructure as code provide?
Ответ
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Карточка 249
Вопрос
When should a public service control fail closed?
Ответ
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Карточка 250
Вопрос
What should users do with a suspicious message?
Ответ
Report it through the approved channel without interacting with its links or attachments.
Карточка 251
Вопрос
What usually motivates organized cybercrime?
Ответ
Financial gain through scalable or repeatable criminal activity.
Карточка 252
Вопрос
How can malicious code support a network attack?
Ответ
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Карточка 253
Вопрос
When is virtual patching useful?
Ответ
When a network or application control can block exploit traffic before the underlying system can be patched.
Карточка 254
Вопрос
What does security-monitoring reporting provide?
Ответ
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Карточка 255
Вопрос
What does data geolocation identify?
Ответ
The physical or legal location where data is stored, processed, or transmitted.
Карточка 256
Вопрос
What does a zero-trust policy enforcement point do?
Ответ
It enables, monitors, and terminates the connection between a subject and a resource.
Карточка 257
Вопрос
What is cryptographic key exchange?
Ответ
A method for parties to establish shared key material over an untrusted channel.
Карточка 258
Вопрос
How can a vendor become a supply-chain attack vector?
Ответ
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Карточка 259
Вопрос
Why can legacy hardware remain vulnerable?
Ответ
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Карточка 260
Вопрос
What can proprietary vulnerability intelligence add beyond open sources?
Ответ
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Карточка 261
Вопрос
How does a centralized proxy apply web filtering?
Ответ
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Карточка 262
Вопрос
How can continuous integration and testing improve security automation?
Ответ
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Карточка 263
Вопрос
What is containment?
Ответ
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Карточка 264
Вопрос
What is a software development lifecycle policy meant to ensure?
Ответ
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Карточка 265
Вопрос
What makes risk assessment continuous?
Ответ
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Карточка 266
Вопрос
What is a memorandum of agreement?
Ответ
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Карточка 267
Вопрос
What makes a penetration test integrated?
Ответ
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Карточка 268
Вопрос
How does a DNS amplification attack magnify traffic?
Ответ
It sends small spoofed queries that trigger larger replies toward the victim.
Карточка 269
Вопрос
Why does ease of recovery matter in an architecture decision?
Ответ
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Карточка 270
Вопрос
What does 802.1X control before a device receives normal network access?
Ответ
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Карточка 271
Вопрос
What is rule-based access control?
Ответ
System-wide rules grant or deny access based on conditions such as network, time, or action.
Карточка 272
Вопрос
What is mobile device management?
Ответ
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Карточка 273
Вопрос
What tradeoff comes with a cold recovery site?
Ответ
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Карточка 274
Вопрос
Why identify stakeholders before approving a security-sensitive change?
Ответ
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Карточка 275
Вопрос
How do attestation and acknowledgement differ?
Ответ
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Карточка 276
Вопрос
What does zero-trust adaptive identity mean?
Ответ
Access decisions adjust to current risk signals rather than relying only on a static login.
Карточка 277
Вопрос
What makes a security control physical?
Ответ
It protects facilities or equipment through a tangible barrier or mechanism.
Карточка 278
Вопрос
What is geo-fencing for data?
Ответ
Enforcing location-based boundaries on where data or services may be accessed or operated.
Карточка 279
Вопрос
What does a Trusted Platform Module protect?
Ответ
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Карточка 280
Вопрос
Why can a managed service provider amplify risk?
Ответ
Its privileged access and shared tooling can provide a path into many customers.
Карточка 281
Вопрос
What does probability express in risk analysis?
Ответ
A quantified chance that a defined event will occur within stated conditions or time.
Карточка 282
Вопрос
Why can shadow IT create a threat?
Ответ
It bypasses security review, inventory, monitoring, and supported configuration.
Карточка 283
Вопрос
What is on-path interception?
Ответ
An attacker positions between communicating parties to observe or alter traffic.
Карточка 284
Вопрос
Why include encryption in a system-hardening baseline?
Ответ
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Карточка 285
Вопрос
Why tune security alerts?
Ответ
To keep useful detections while reducing noise that wastes analyst attention.
Карточка 286
Вопрос
What can IPS or IDS logs contribute to an investigation?
Ответ
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Карточка 287
Вопрос
What is VM escape?
Ответ
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Карточка 288
Вопрос
How can segmentation reduce vulnerability exposure before a patch is available?
Ответ
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Карточка 289
Вопрос
Why should firewall policy name the required ports and protocols explicitly?
Ответ
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Карточка 290
Вопрос
What is a change management policy meant to control?
Ответ
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Карточка 291
Вопрос
What is a hybrid-cloud architecture?
Ответ
An environment that integrates private or on-premises resources with public cloud services.
Карточка 292
Вопрос
How do AH and ESP differ in the security services they can provide?
Ответ
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Карточка 293
Вопрос
What makes user behavior risky?
Ответ
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Карточка 294
Вопрос
What is least privilege?
Ответ
Granting only the access needed for the required task and no more.
Карточка 295
Вопрос
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Ответ
Transmission to HTTPS, script access, and cross-site sending, respectively.
Карточка 296
Вопрос
Why discover unmanaged assets?
Ответ
Unknown systems cannot be patched, monitored, or governed reliably.
Карточка 297
Вопрос
What is a service-level agreement?
Ответ
Measurable service commitments and remedies, such as availability or response targets.
Карточка 298
Вопрос
What should govern automated security escalation?
Ответ
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Карточка 299
Вопрос
What is platform diversity as a resilience strategy?
Ответ
Using different implementations so one common flaw or failure is less likely to affect every copy.
Карточка 300
Вопрос
How can replayed session material affect an application?
Ответ
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Карточка 301
Вопрос
What is an implicit trust zone in zero trust?
Ответ
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Карточка 302
Вопрос
What does salting a password hash accomplish?
Ответ
It makes identical passwords hash differently and defeats precomputed hash tables.
Карточка 303
Вопрос
What is spear phishing?
Ответ
Phishing tailored to a specific person, role, or organization.
Карточка 304
Вопрос
What is eradication?
Ответ
Removing the attacker's access, malicious artifacts, and exploited conditions.
Карточка 305
Вопрос
Who is a risk owner?
Ответ
The person accountable for deciding and monitoring how a specific risk is handled.
Карточка 306
Вопрос
What does a partially known penetration-test environment provide?
Ответ
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Карточка 307
Вопрос
What is a microservices architecture?
Ответ
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Карточка 308
Вопрос
What is a jump server?
Ответ
A hardened intermediary used to reach systems in a restricted management network.
Карточка 309
Вопрос
What can happen when a configuration change is made without dependency analysis?
Ответ
A downstream service can fail even when the changed component works.
Карточка 310
Вопрос
What is resource reuse exposure?
Ответ
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Карточка 311
Вопрос
Why does financial information require explicit protection?
Ответ
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Карточка 312
Вопрос
What does CVE provide?
Ответ
A common identifier for a publicly disclosed vulnerability.
Карточка 313
Вопрос
Where can DLP controls operate?
Ответ
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Карточка 314
Вопрос
What does privileged password vaulting protect?
Ответ
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Карточка 315
Вопрос
What does an access-control standard define?
Ответ
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Карточка 316
Вопрос
How can automation support compliance monitoring?
Ответ
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Карточка 317
Вопрос
What does static code analysis examine?
Ответ
Source or compiled code for weakness patterns without executing the application.
Карточка 318
Вопрос
What actor attribute describes funding, time, and personnel?
Ответ
Resources.
Карточка 319
Вопрос
What is DNS poisoning?
Ответ
Introducing false DNS data so names resolve to attacker-chosen destinations.
Карточка 320
Вопрос
Why change default credentials during hardening?
Ответ
Default secrets are predictable and commonly targeted.
Карточка 321
Вопрос
What does quarantine do after a security alert?
Ответ
It restricts a suspected asset or object while analysts validate and remediate the risk.
Карточка 322
Вопрос
What does key stretching do for stored passwords?
Ответ
It deliberately makes each password guess more computationally expensive.
Карточка 323
Вопрос
What is smishing?
Ответ
Phishing delivered through SMS or another text-messaging service.
Карточка 324
Вопрос
What is qualitative risk analysis?
Ответ
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Карточка 325
Вопрос
What is a master service agreement?
Ответ
An umbrella contract establishing general legal and commercial terms for ongoing work.
Карточка 326
Вопрос
What is threat scope reduction?
Ответ
Narrowing the systems, privileges, or paths an attacker can reach.
Карточка 327
Вопрос
Why use a third-party cloud service instead of building locally?
Ответ
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Карточка 328
Вопрос
What should determine security-device placement?
Ответ
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Карточка 329
Вопрос
What does situational awareness mean for a user?
Ответ
Notice the people, devices, requests, location, and context around a task before acting.
Карточка 330
Вопрос
What does a failover test validate?
Ответ
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Карточка 331
Вопрос
What is a preventive control meant to do?
Ответ
Stop an unwanted event before it succeeds.
Карточка 332
Вопрос
What is just-in-time privileged access?
Ответ
Elevated access is granted only when needed and expires after a short approved period.
Карточка 333
Вопрос
What safeguard should security-group automation enforce?
Ответ
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Карточка 334
Вопрос
How does a reflected DDoS attack hide and multiply sources?
Ответ
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Карточка 335
Вопрос
What is a security misconfiguration?
Ответ
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Карточка 336
Вопрос
Why can the same vulnerability have different organizational impact?
Ответ
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Карточка 337
Вопрос
What does URL scanning evaluate before a user opens a web destination?
Ответ
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Карточка 338
Вопрос
What is the board's security governance role?
Ответ
Provide oversight, set risk direction, and hold executives accountable.
Карточка 339
Вопрос
What does code signing establish?
Ответ
That code came from the holder of the signing key and has not changed since signing.
Карточка 340
Вопрос
How should an asset's classification affect security operations?
Ответ
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Карточка 341
Вопрос
How does encryption protect data?
Ответ
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Карточка 342
Вопрос
What is a secure enclave?
Ответ
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Карточка 343
Вопрос
What is business email compromise?
Ответ
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Карточка 344
Вопрос
What is recovery in incident response?
Ответ
Restoring services safely, monitoring them, and returning to normal operations.
Карточка 345
Вопрос
How is single loss expectancy commonly estimated?
Ответ
Asset value multiplied by the exposure factor.
Карточка 346
Вопрос
What does an unknown penetration-test environment provide?
Ответ
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Карточка 347
Вопрос
What security boundary does a hypervisor provide?
Ответ
It isolates virtual machines while controlling their access to shared hardware.
Карточка 348
Вопрос
Why does a TLS tunnel not protect a compromised endpoint?
Ответ
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Карточка 349
Вопрос
Why update diagrams after an infrastructure change?
Ответ
Operations and incident responders need the documentation to match the deployed environment.
Карточка 350
Вопрос
What does privacy ownership assign?
Ответ
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Карточка 351
Вопрос
What does a security control gap analysis compare?
Ответ
The controls required for the target state with the controls currently in place.
Карточка 352
Вопрос
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Ответ
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Карточка 353
Вопрос
What is application privilege escalation?
Ответ
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Карточка 354
Вопрос
What risk remains when unnecessary software is left installed?
Ответ
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Карточка 355
Вопрос
What does SCAP standardize?
Ответ
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Карточка 356
Вопрос
What can packet capture reveal?
Ответ
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Карточка 357
Вопрос
What makes a privileged credential ephemeral?
Ответ
It is created for a limited task or session and expires or is destroyed automatically after that use.
Карточка 358
Вопрос
How do a statement of work and a work order differ?
Ответ
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Карточка 359
Вопрос
Why might multi-cloud improve resilience?
Ответ
A provider-wide failure need not stop workloads that can run independently elsewhere.
Карточка 360
Вопрос
How can a service provider introduce a supply-chain vulnerability?
Ответ
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Карточка 361
Вопрос
What is a false positive in vulnerability scanning?
Ответ
A reported weakness that is not actually present or exploitable in the assessed context.
Карточка 362
Вопрос
How do EDR and XDR differ?
Ответ
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Карточка 363
Вопрос
What should onboarding and offboarding procedures coordinate?
Ответ
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Карточка 364
Вопрос
How should an organization harden managed mobile devices?
Ответ
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Карточка 365
Вопрос
What is a certificate signing request?
Ответ
A request containing a public key and subject information for a certificate authority to sign.
Карточка 366
Вопрос
What is pretexting?
Ответ
Using a fabricated role or situation to make a request seem legitimate.
Карточка 367
Вопрос
How is annualized loss expectancy commonly estimated?
Ответ
Single loss expectancy multiplied by annualized rate of occurrence.
Карточка 368
Вопрос
What security consequence follows from containers sharing a kernel?
Ответ
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Карточка 369
Вопрос
Where does 802.1X enforce a network admission decision?
Ответ
At the controlled switch port or wireless access point before normal network access is granted.
Карточка 370
Вопрос
What should insider-threat awareness teach?
Ответ
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Карточка 371
Вопрос
What access action is suitable for careful automation?
Ответ
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Карточка 372
Вопрос
What is an evil twin?
Ответ
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 карточки
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Изучать эту колоду бесплатно
Откроется Flashcards, и вы сможете начать изучение.
Карточка 373
Вопрос
Does non-human-readable data need less protection?
Ответ
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Карточка 374
Вопрос
What does authenticating a system establish?
Ответ
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Карточка 375
Вопрос
What does LDAP provide in identity systems?
Ответ
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Карточка 376
Вопрос
What is a deterrent control meant to do?
Ответ
Discourage an attacker from attempting an unwanted action.
Карточка 377
Вопрос
Why update procedures after changing a security control?
Ответ
Staff need accurate steps for operating, monitoring, and recovering the new control.
Карточка 378
Вопрос
How does OCSP differ from a certificate revocation list?
Ответ
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Карточка 379
Вопрос
What is the goal of data exfiltration?
Ответ
Remove data from its authorized environment without permission.
Карточка 380
Вопрос
What is a watering-hole attack?
Ответ
Compromising a site frequented by the intended targets so their visits expose them.
Карточка 381
Вопрос
How can a hardware provider introduce a supply-chain vulnerability?
Ответ
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Карточка 382
Вопрос
What is application forgery?
Ответ
Creating or altering a request, token, or object so the application treats it as authentic.
Карточка 383
Вопрос
How does least privilege mitigate compromise?
Ответ
It limits the actions and resources available to a compromised account or process.
Карточка 384
Вопрос
What is serverless computing?
Ответ
A model where the provider manages servers and the customer deploys event-driven code or functions.
Карточка 385
Вопрос
What makes an infrastructure control effective for a specific risk?
Ответ
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Карточка 386
Вопрос
What does parallel recovery processing test?
Ответ
Whether primary and alternate environments can run together consistently before a controlled cutover.
Карточка 387
Вопрос
Which password-authentication method does WPA3-Personal use?
Ответ
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Карточка 388
Вопрос
How does data retention affect asset disposal?
Ответ
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Карточка 389
Вопрос
What is a false negative in vulnerability scanning?
Ответ
A real weakness that the assessment fails to report.
Карточка 390
Вопрос
What does recurring security scanning add to monitoring?
Ответ
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Карточка 391
Вопрос
What should guide port selection for a secure protocol?
Ответ
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Карточка 392
Вопрос
What does forensic acquisition create?
Ответ
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Карточка 393
Вопрос
How do system owners and data owners divide security accountability?
Ответ
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Карточка 394
Вопрос
What does likelihood express in risk analysis?
Ответ
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Карточка 395
Вопрос
What is a memorandum of understanding?
Ответ
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Карточка 396
Вопрос
What does the right to be forgotten generally require?
Ответ
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Карточка 397
Вопрос
What does an audit committee oversee?
Ответ
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Карточка 398
Вопрос
What does identity interoperability require?
Ответ
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Карточка 399
Вопрос
How does a bollard protect a facility?
Ответ
It blocks or redirects vehicles before they can reach a protected area.
Карточка 400
Вопрос
How can hashing protect a downloaded file?
Ответ
A trusted digest lets the recipient detect whether the file changed.
Карточка 401
Вопрос
What is a credential replay attack?
Ответ
Using captured valid credentials or tokens again without needing to discover the secret.
Карточка 402
Вопрос
How can automation complexity create security risk?
Ответ
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Карточка 403
Вопрос
What must an architecture provide when a component cannot be patched?
Ответ
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Карточка 404
Вопрос
What makes remote access secure?
Ответ
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Карточка 405
Вопрос
What should users verify before connecting removable media or a cable?
Ответ
That the device and connection are approved, expected, and handled under organizational policy.
Карточка 406
Вопрос
What is a self-signed certificate?
Ответ
A certificate signed by its own private key rather than by a separate trusted issuer.
Карточка 407
Вопрос
What is brand impersonation?
Ответ
Using a trusted organization's identity or look to deceive people.
Карточка 408
Вопрос
What characterizes a conservative risk appetite?
Ответ
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Карточка 409
Вопрос
What should a managed mobile device verify before using Wi-Fi?
Ответ
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Карточка 410
Вопрос
What is a zero-day vulnerability?
Ответ
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Карточка 411
Вопрос
What does verification confirm after vulnerability remediation?
Ответ
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Карточка 412
Вопрос
What is user and entity behavior analytics?
Ответ
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Карточка 413
Вопрос
What does a physical security policy establish?
Ответ
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Карточка 414
Вопрос
What does a UPS provide?
Ответ
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Карточка 415
Вопрос
What is a nondisclosure agreement?
Ответ
A contract restricting use and disclosure of defined confidential information.
Карточка 416
Вопрос
What should be checked before assigning a user permission?
Ответ
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Карточка 417
Вопрос
How does espionage differ from ordinary theft?
Ответ
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Карточка 418
Вопрос
What is password spraying?
Ответ
Trying a small set of common passwords across many accounts to avoid lockouts.
Карточка 419
Вопрос
What is the purpose of system isolation during an incident?
Ответ
Stop harmful communication while preserving the system for response and investigation.
Карточка 420
Вопрос
What is a security benchmark?
Ответ
A documented set of recommended configuration checks for a platform or product.
Карточка 421
Вопрос
Which metadata fields give a log record investigative context?
Ответ
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Карточка 422
Вопрос
What does an access-control vestibule prevent?
Ответ
It limits tailgating by allowing controlled passage through one door at a time.
Карточка 423
Вопрос
What is version control's security value for configuration?
Ответ
It preserves attributable history and enables review or rollback of changes.
Карточка 424
Вопрос
Why use both internal and external compliance monitoring?
Ответ
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Карточка 425
Вопрос
What distinguishes on-premises architecture?
Ответ
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Карточка 426
Вопрос
What risk can split tunneling add to a VPN?
Ответ
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Карточка 427
Вопрос
What is a certificate root of trust?
Ответ
A trusted root certificate or key from which a client validates a certificate chain.
Карточка 428
Вопрос
What is typosquatting?
Ответ
Registering a look-alike domain based on common typing errors or visual similarity.
Карточка 429
Вопрос
What is root-cause analysis?
Ответ
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Карточка 430
Вопрос
What is risk tolerance?
Ответ
The acceptable variation or boundary around a specific objective or risk area.
Карточка 431
Вопрос
What is a security self-assessment?
Ответ
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Карточка 432
Вопрос
What does data masking change?
Ответ
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Карточка 433
Вопрос
How do wireless authentication protocols let clients prove identity securely?
Ответ
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Карточка 434
Вопрос
Why reconcile inventory with network discovery?
Ответ
Differences expose missing records, retired systems, or unauthorized devices.
Карточка 435
Вопрос
Why does sideloading raise mobile risk?
Ответ
It can bypass store review, signing policy, and managed application controls.
Карточка 436
Вопрос
What does an information-sharing organization add to vulnerability management?
Ответ
Sector or community intelligence about relevant threats, incidents, and defensive action.
Карточка 437
Вопрос
What does a web-filter block rule specify?
Ответ
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Карточка 438
Вопрос
How do data custodians and data stewards differ?
Ответ
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Карточка 439
Вопрос
What is a brute-force password attack?
Ответ
Systematically trying many candidate secrets against an account or protected value.
Карточка 440
Вопрос
What is a compensating control?
Ответ
An alternative safeguard used when the preferred control is impractical or unavailable.
Карточка 441
Вопрос
How can location act as an authentication factor?
Ответ
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Карточка 442
Вопрос
Why must security automation remain supportable?
Ответ
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Карточка 443
Вопрос
What does a standby generator provide?
Ответ
Longer-duration power during a utility outage, after a startup delay.
Карточка 444
Вопрос
What makes an architecture air-gapped?
Ответ
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Карточка 445
Вопрос
What is a software-defined WAN?
Ответ
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Карточка 446
Вопрос
What password-management behavior should awareness training reinforce?
Ответ
Use unique long passwords through an approved manager and report suspected compromise promptly.
Карточка 447
Вопрос
What security value does fencing provide?
Ответ
It defines and delays entry across a physical perimeter.
Карточка 448
Вопрос
What is a wildcard certificate?
Ответ
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Карточка 449
Вопрос
How does misinformation differ from disinformation?
Ответ
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Карточка 450
Вопрос
What is a risk threshold?
Ответ
A defined level that triggers escalation, treatment, or another required response.
Карточка 451
Вопрос
What does a vendor penetration test contribute to assessment?
Ответ
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Карточка 452
Вопрос
What is the objective of a service-disruption attack?
Ответ
Make a system or business function unavailable or unreliable.
Карточка 453
Вопрос
What is directory traversal?
Ответ
Manipulating a file path to reach files outside the directory the application intended to expose.
Карточка 454
Вопрос
Why decommission an unsupported system?
Ответ
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Карточка 455
Вопрос
Why archive security-monitoring data?
Ответ
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Карточка 456
Вопрос
What role does RADIUS commonly play in enterprise Wi-Fi?
Ответ
It centralizes authentication, authorization information, and accounting for network access.
Карточка 457
Вопрос
Why separate the requester and approver of a high-risk change?
Ответ
To reduce error, fraud, and unilateral unauthorized modification.
Карточка 458
Вопрос
Why can a jailbroken device violate a security baseline?
Ответ
It weakens platform isolation and allows unapproved privileged changes.
Карточка 459
Вопрос
When is tokenization especially useful?
Ответ
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Карточка 460
Вопрос
Why can dark-web intelligence affect vulnerability priority?
Ответ
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Карточка 461
Вопрос
What firewall policy should govern traffic from a screened subnet to internal systems?
Ответ
Deny it by default and allow only explicitly required flows.
Карточка 462
Вопрос
What does SAML commonly carry?
Ответ
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Карточка 463
Вопрос
What does a security governance committee do?
Ответ
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Карточка 464
Вопрос
How can global privacy requirements affect one data process?
Ответ
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Карточка 465
Вопрос
What characterizes an IoT device?
Ответ
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Карточка 466
Вопрос
What is a unified threat management appliance?
Ответ
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Карточка 467
Вопрос
What does a hardware security module provide?
Ответ
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Карточка 468
Вопрос
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Ответ
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Карточка 469
Вопрос
What is a tabletop exercise?
Ответ
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Карточка 470
Вопрос
What does a risk exemption authorize?
Ответ
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Карточка 471
Вопрос
What is a regulatory examination?
Ответ
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Карточка 472
Вопрос
What does physical video surveillance primarily provide?
Ответ
Detection and evidence of activity in monitored areas.
Карточка 473
Вопрос
What is a birthday attack against a hash?
Ответ
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Карточка 474
Вопрос
Why keep backups both onsite and offsite?
Ответ
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Карточка 475
Вопрос
How does technical debt affect security automation?
Ответ
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Карточка 476
Вопрос
What should switch hardening restrict first?
Ответ
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Карточка 477
Вопрос
What should happen when an asset changes owners?
Ответ
Inventory, access, support responsibility, and data handling should be updated.
Карточка 478
Вопрос
What does evidence of a vendor's internal audits contribute?
Ответ
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Карточка 479
Вопрос
What is identity attestation?
Ответ
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Карточка 480
Вопрос
Why can standard enterprise patching be unsafe for an RTOS device?
Ответ
A change can disrupt timing guarantees or certified operational behavior.
Карточка 481
Вопрос
What is secure access service edge?
Ответ
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Карточка 482
Вопрос
What social-engineering habit should awareness training reinforce?
Ответ
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Карточка 483
Вопрос
How can a software provider introduce a supply-chain vulnerability?
Ответ
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Карточка 484
Вопрос
Why include internet exposure in remediation priority?
Ответ
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Карточка 485
Вопрос
What does a mail gateway inspect?
Ответ
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Карточка 486
Вопрос
What is a data controller?
Ответ
The entity that determines why and how personal data is processed.
Карточка 487
Вопрос
How does blackmail motivate a cyberattack?
Ответ
The attacker threatens disclosure or harm unless the victim complies.
Карточка 488
Вопрос
What is a downgrade attack?
Ответ
Forcing parties to use an older or weaker protocol or security mode.
Карточка 489
Вопрос
How does encryption mitigate data exposure?
Ответ
It makes captured data unreadable without the required key.
Карточка 490
Вопрос
How do network and web vulnerability scanners differ?
Ответ
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Карточка 491
Вопрос
How can vulnerability-scan data support an investigation?
Ответ
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Карточка 492
Вопрос
What is key escrow?
Ответ
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Карточка 493
Вопрос
Which human vector commonly uses a fake sign-in page to harvest credentials?
Ответ
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Карточка 494
Вопрос
What is risk avoidance?
Ответ
Stopping or not starting the activity that creates the risk.
Карточка 495
Вопрос
What is data obfuscation?
Ответ
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Карточка 496
Вопрос
What is a directive control?
Ответ
A safeguard that tells people what behavior or action is required.
Карточка 497
Вопрос
What does a security guard add that a camera cannot?
Ответ
Human judgment and an immediate physical response.
Карточка 498
Вопрос
Why define restricted activities in change management?
Ответ
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Карточка 499
Вопрос
What contractual impact can noncompliance create?
Ответ
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Карточка 500
Вопрос
What should determine backup frequency?
Ответ
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Карточка 501
Вопрос
What should router hardening protect?
Ответ
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Карточка 502
Вопрос
What problem does OAuth 2.0 address?
Ответ
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Карточка 503
Вопрос
What does SCADA do?
Ответ
It provides supervisory monitoring and control across distributed industrial equipment.
Карточка 504
Вопрос
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Ответ
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Карточка 505
Вопрос
What distinguishes a computer virus?
Ответ
It attaches to a host file or program and spreads when that infected host executes or is shared.
Карточка 506
Вопрос
What does a key management system coordinate?
Ответ
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Карточка 507
Вопрос
How can an unsecure wired network expose traffic?
Ответ
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Карточка 508
Вопрос
Why is vulnerable device firmware hard to remediate?
Ответ
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Карточка 509
Вопрос
What does patching change in vulnerability remediation?
Ответ
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Карточка 510
Вопрос
What does DMARC add to SPF and DKIM?
Ответ
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Карточка 511
Вопрос
How does automation improve security efficiency?
Ответ
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Карточка 512
Вопрос
What is a simulation exercise?
Ответ
A more realistic practice in which participants respond to injected events using operational processes.
Карточка 513
Вопрос
What is a data processor?
Ответ
An entity that processes personal data on behalf of a controller.
Карточка 514
Вопрос
What is risk mitigation?
Ответ
Reducing likelihood, impact, or both through controls or process changes.
Карточка 515
Вопрос
Why monitor a vendor after onboarding?
Ответ
Security posture, ownership, services, incidents, and dependencies can change.
Карточка 516
Вопрос
What does a physical penetration test assess?
Ответ
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Карточка 517
Вопрос
Why use access badges at a facility?
Ответ
To associate entry attempts with authorized identities and enforce access rules.
Карточка 518
Вопрос
How does permission restriction protect data?
Ответ
Only authorized identities receive the actions and scope their roles require.
Карточка 519
Вопрос
What is the usual objective of ransomware extortion?
Ответ
Force payment by denying access, threatening disclosure, or both.
Карточка 520
Вопрос
What does impossible travel indicate?
Ответ
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Карточка 521
Вопрос
What is configuration enforcement?
Ответ
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Карточка 522
Вопрос
What does a web vulnerability scanner inspect?
Ответ
Running web behavior for issues such as unsafe input handling and insecure configuration.
Карточка 523
Вопрос
How does cost affect an architecture choice?
Ответ
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Карточка 524
Вопрос
What does EAP provide with 802.1X?
Ответ
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Карточка 525
Вопрос
What should operational-security training help users protect?
Ответ
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Карточка 526
Вопрос
What does a time-of-day access rule do?
Ответ
Allows or denies a requested action according to an approved schedule.
Карточка 527
Вопрос
What should cloud infrastructure hardening establish?
Ответ
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Карточка 528
Вопрос
What should an asset owner ensure during offboarding?
Ответ
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Карточка 529
Вопрос
Why encrypt backups?
Ответ
Backup media and transfers can expose the same sensitive data as production systems.
Карточка 530
Вопрос
What is steganography?
Ответ
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Карточка 531
Вопрос
Which human vector uses a fabricated authority role to justify a sensitive request?
Ответ
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Карточка 532
Вопрос
Why does risk transfer not remove accountability?
Ответ
The organization can retain legal, reputational, operational, and oversight consequences.
Карточка 533
Вопрос
Why validate a change after deployment?
Ответ
To confirm the intended result occurred without introducing unacceptable side effects.
Карточка 534
Вопрос
What makes end-of-life hardware a security vulnerability?
Ответ
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Карточка 535
Вопрос
What does an audit add to remediation validation?
Ответ
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Карточка 536
Вопрос
Why can SPF pass while a message still impersonates a brand?
Ответ
SPF checks the envelope domain, which may differ from the visible From domain.
Карточка 537
Вопрос
What role can a government entity have in security governance?
Ответ
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Карточка 538
Вопрос
How do data inventory and retention support privacy governance?
Ответ
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Карточка 539
Вопрос
What can concurrent sessions from distant regions indicate?
Ответ
A stolen account or shared credential, subject to VPN and proxy context.
Карточка 540
Вопрос
What does supply-chain analysis examine?
Ответ
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Карточка 541
Вопрос
What is the purpose of facility lighting as a control?
Ответ
Deter covert activity and improve observation of people and areas.
Карточка 542
Вопрос
What architecture quality keeps a service usable during component failure?
Ответ
Availability.
Карточка 543
Вопрос
When is fail-open behavior preferable to fail-closed behavior?
Ответ
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Карточка 544
Вопрос
Which control function does a login-failure alert provide?
Ответ
Detection; it reveals suspicious authentication activity.
Карточка 545
Вопрос
What does a biometric MFA implementation verify?
Ответ
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Карточка 546
Вопрос
How can automation enforce a security baseline?
Ответ
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Карточка 547
Вопрос
How do wireless cryptographic protocols protect network traffic?
Ответ
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Карточка 548
Вопрос
Why segment sensitive data stores?
Ответ
It limits reachable paths and separates them from lower-trust workloads.
Карточка 549
Вопрос
What must remain secret in an asymmetric key pair?
Ответ
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Карточка 550
Вопрос
How can a supplier become a supply-chain attack vector?
Ответ
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Карточка 551
Вопрос
What is e-discovery?
Ответ
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Карточка 552
Вопрос
What characterizes a neutral risk appetite?
Ответ
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Карточка 553
Вопрос
What is passive reconnaissance?
Ответ
Gathering information without directly interacting with the target's systems.
Карточка 554
Вопрос
What does a philosophical motive mean for a threat actor?
Ответ
The actor acts to advance a belief or moral position rather than primarily for money.
Карточка 555
Вопрос
What does unexpected resource consumption indicate?
Ответ
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Карточка 556
Вопрос
What does a host-based intrusion prevention system do?
Ответ
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Карточка 557
Вопрос
How does agent-based monitoring differ from agentless monitoring?
Ответ
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Карточка 558
Вопрос
What can network logs contribute to an investigation?
Ответ
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Карточка 559
Вопрос
What is the purpose of a backup restore test?
Ответ
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Карточка 560
Вопрос
Why can obsolete hardware become a security risk?
Ответ
It may lack supported firmware, modern protections, or replacement parts.
Карточка 561
Вопрос
What does rescanning confirm after remediation?
Ответ
Whether the scanner can still detect the original finding on the affected asset.
Карточка 562
Вопрос
What should a secure transport method provide?
Ответ
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Карточка 563
Вопрос
How can law affect security governance?
Ответ
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Карточка 564
Вопрос
What does resilience mean for a security architecture?
Ответ
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Карточка 565
Вопрос
Why minimize an infrastructure's attack surface?
Ответ
Fewer exposed services and paths leave fewer opportunities for exploitation.
Карточка 566
Вопрос
What does executing a security-awareness program require?
Ответ
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Карточка 567
Вопрос
What does an infrared security sensor detect?
Ответ
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Карточка 568
Вопрос
What is a knowledge factor?
Ответ
Something the claimant knows, such as a password.
Карточка 569
Вопрос
Why review allow-list and deny-list impact before a change?
Ответ
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Карточка 570
Вопрос
What does partition-level encryption protect?
Ответ
One selected disk partition, leaving other partitions outside that encryption boundary.
Карточка 571
Вопрос
How can instant messaging deliver a security attack?
Ответ
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Карточка 572
Вопрос
What can repeated blocked-content events indicate?
Ответ
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Карточка 573
Вопрос
What should a server-hardening baseline reduce?
Ответ
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Карточка 574
Вопрос
When is physical media destruction appropriate?
Ответ
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Карточка 575
Вопрос
What is mean time to repair?
Ответ
The average time required to restore a failed component or service.
Карточка 576
Вопрос
Why disclose conflicts of interest during vendor selection?
Ответ
A personal or financial relationship can bias evaluation away from the organization's requirements.
Карточка 577
Вопрос
What is a fine for noncompliance?
Ответ
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Карточка 578
Вопрос
What does a public data classification authorize?
Ответ
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Карточка 579
Вопрос
What security benefit comes from standard infrastructure configurations?
Ответ
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Карточка 580
Вопрос
How does horizontal scaling increase capacity?
Ответ
It adds more service instances and distributes work among them.
Карточка 581
Вопрос
Why can added connectivity weaken segmentation?
Ответ
Each allowed path can become a route for lateral movement or data escape.
Карточка 582
Вопрос
What coding practice is central to preventing SQL injection?
Ответ
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Карточка 583
Вопрос
When is a compensating control appropriate for a vulnerability?
Ответ
When timely removal or patching is infeasible and another control can reduce the risk.
Карточка 584
Вопрос
How does agent-based web filtering enforce policy?
Ответ
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Карточка 585
Вопрос
How can regulation differ from an internal policy?
Ответ
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Карточка 586
Вопрос
What is a storage snapshot?
Ответ
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Карточка 587
Вопрос
What does password age measure?
Ответ
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Карточка 588
Вопрос
What does an ethical motive mean in vulnerability research?
Ответ
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Карточка 589
Вопрос
What can missing security logs indicate?
Ответ
Logging failure, tampering, retention misconfiguration, or an inactive source.
Карточка 590
Вопрос
Why disable unused ports and protocols?
Ответ
They expose unnecessary communication paths and code that attackers can reach.
Карточка 591
Вопрос
What does antivirus contribute to monitoring?
Ответ
It scans files, memory, or behavior and reports suspected malicious code.
Карточка 592
Вопрос
What is a honeypot?
Ответ
A decoy system or service designed to attract and observe malicious activity.
Карточка 593
Вопрос
What does file-level encryption protect?
Ответ
Selected files independently of whether the rest of the disk or volume is encrypted.
Карточка 594
Вопрос
How can SMS deliver a security attack?
Ответ
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Карточка 595
Вопрос
What happens during incident analysis?
Ответ
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Карточка 596
Вопрос
What is mean time between failures?
Ответ
The average operating time between repairable failures.
Карточка 597
Вопрос
What is active reconnaissance?
Ответ
Probing or interacting with target systems to discover services and behavior.
Карточка 598
Вопрос
What constraint should guide ICS or SCADA hardening?
Ответ
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Карточка 599
Вопрос
Which control function does restoring a clean system image provide?
Ответ
Correction; it returns the system to a known-good state.
Карточка 600
Вопрос
What does responsiveness mean in an architecture decision?
Ответ
How quickly the system and its operators can adapt to demand, failure, or attack.
Карточка 601
Вопрос
How does out-of-band access strengthen remote administration?
Ответ
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Карточка 602
Вопрос
What makes user behavior unexpected?
Ответ
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Карточка 603
Вопрос
What is a work order?
Ответ
A document authorizing a defined unit of work under an existing agreement.
Карточка 604
Вопрос
What can out-of-cycle logging indicate?
Ответ
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Карточка 605
Вопрос
Why update a standard operating procedure after a change?
Ответ
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Карточка 606
Вопрос
What coding practice limits cross-site scripting?
Ответ
Context-appropriate output encoding, supported by safe templating and input handling.
Карточка 607
Вопрос
What does a restricted data classification indicate?
Ответ
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Карточка 608
Вопрос
How does a bug bounty support responsible disclosure?
Ответ
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Карточка 609
Вопрос
What does web-filter content categorization provide?
Ответ
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Карточка 610
Вопрос
How do hard and soft authentication tokens differ?
Ответ
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Карточка 611
Вопрос
How can industry requirements affect security governance?
Ответ
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Карточка 612
Вопрос
How can noncompliance cause loss of a license?
Ответ
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Карточка 613
Вопрос
What does volume-level encryption protect?
Ответ
All data within a selected logical storage volume.
Карточка 614
Вопрос
How can impersonation exploit familiarity?
Ответ
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Карточка 615
Вопрос
How does RTO guide recovery design?
Ответ
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Карточка 616
Вопрос
What is a honeynet?
Ответ
A network of decoy systems used to study or divert attackers.
Карточка 617
Вопрос
What does backup replication provide?
Ответ
Additional synchronized or copied recovery data in another system or location.
Карточка 618
Вопрос
What lets automation scale securely?
Ответ
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Карточка 619
Вопрос
Why monitor a hardened computing resource continuously?
Ответ
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Карточка 620
Вопрос
Why keep a certificate of destruction?
Ответ
It documents that a disposal provider handled specified media under the agreed process.
Карточка 621
Вопрос
Why consider patch availability before selecting a platform?
Ответ
Unsupported or difficult-to-update components accumulate known exposure.
Карточка 622
Вопрос
Why should remote administration use an encrypted, authenticated protocol?
Ответ
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Карточка 623
Вопрос
How can revenge motivate an insider incident?
Ответ
A disgruntled person may damage systems or disclose data to punish the organization.
Карточка 624
Вопрос
What is a published or documented indicator of malicious activity?
Ответ
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Карточка 625
Вопрос
Why monitor a system more closely when a mitigation exception is accepted?
Ответ
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Карточка 626
Вопрос
What is an SNMP trap?
Ответ
An unsolicited device notification sent to a management system when a configured event occurs.
Карточка 627
Вопрос
How can an automated report support an investigation?
Ответ
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Карточка 628
Вопрос
What is a security key?
Ответ
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Карточка 629
Вопрос
What does database-level encryption protect?
Ответ
A database or selected database structures through controls managed at the database layer.
Карточка 630
Вопрос
How does brand impersonation exploit trust?
Ответ
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Карточка 631
Вопрос
What browser-side impact can a cross-site scripting vulnerability create?
Ответ
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Карточка 632
Вопрос
How can a system or process audit identify vulnerabilities?
Ответ
It compares evidence with required configuration and procedure to reveal control gaps.
Карточка 633
Вопрос
What security role can Group Policy provide?
Ответ
Centralized Windows configuration of account, application, audit, and system security settings.
Карточка 634
Вопрос
What should incident-response training prepare people to do?
Ответ
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Карточка 635
Вопрос
Why must governance track local or regional requirements?
Ответ
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Карточка 636
Вопрос
How can a dependency become a useful key risk indicator?
Ответ
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Карточка 637
Вопрос
What is a business partners agreement?
Ответ
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Карточка 638
Вопрос
What makes an audit regulatory?
Ответ
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Карточка 639
Вопрос
What is a honeyfile?
Ответ
A decoy file whose access can reveal unauthorized activity.
Карточка 640
Вопрос
Why does legal information require explicit protection?
Ответ
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Карточка 641
Вопрос
Which indicator can mass file renaming and encryption produce?
Ответ
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Карточка 642
Вопрос
What remains with an organization after transferring architecture risk?
Ответ
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Карточка 643
Вопрос
When does local console placement provide useful administrative access?
Ответ
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Карточка 644
Вопрос
What makes a harmful user action unintentional?
Ответ
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Карточка 645
Вопрос
How should an organization harden workstations?
Ответ
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Карточка 646
Вопрос
What is journaling in recovery?
Ответ
Recording ordered changes so data can be replayed or restored to a consistent point.
Карточка 647
Вопрос
What downtime must a change plan account for?
Ответ
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Карточка 648
Вопрос
Why must a privacy program map local or regional law to data flows?
Ответ
The applicable duties can change with the location of the person, organization, processing, or stored data.
Карточка 649
Вопрос
Why combine independent preventive controls at different layers?
Ответ
A failure at one layer does not automatically let the same attack succeed at the next layer.
Карточка 650
Вопрос
What is passwordless authentication?
Ответ
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Карточка 651
Вопрос
How can automation improve security reaction time?
Ответ
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Карточка 652
Вопрос
What does record-level encryption protect?
Ответ
Individual records or fields, allowing finer protection than encrypting the entire database.
Карточка 653
Вопрос
How can business email compromise misuse urgency?
Ответ
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Карточка 654
Вопрос
What does impact measure in risk analysis?
Ответ
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Карточка 655
Вопрос
What makes cyber activity part of warfare?
Ответ
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Карточка 656
Вопрос
Which indicator can a newly created privileged account produce outside the normal change window?
Ответ
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Карточка 657
Вопрос
How can configuration enforcement validate a deployed mitigation?
Ответ
It compares the realized settings with the approved state and corrects or reports drift.
Карточка 658
Вопрос
How does validating an alert improve alert tuning?
Ответ
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Карточка 659
Вопрос
What data-layer impact can a SQL injection vulnerability create?
Ответ
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Карточка 660
Вопрос
What environmental variables can change vulnerability priority?
Ответ
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Карточка 661
Вопрос
What security role does SELinux provide?
Ответ
Mandatory access controls that confine processes according to centrally defined policy.
Карточка 662
Вопрос
Why review governance documents periodically?
Ответ
Business, technology, threats, and external obligations change.
Карточка 663
Вопрос
Why evaluate power requirements for a system design?
Ответ
Power capacity and redundancy constrain availability and recovery.
Карточка 664
Вопрос
When is IPsec a better tunnel choice than TLS?
Ответ
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Карточка 665
Вопрос
What is a honeytoken?
Ответ
A fake credential or data element that generates a high-confidence alert when used.
Карточка 666
Вопрос
What should embedded-system hardening prioritize?
Ответ
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Карточка 667
Вопрос
Why must sanitization address data remanence?
Ответ
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Карточка 668
Вопрос
Why require rules of engagement for vendor testing?
Ответ
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Карточка 669
Вопрос
What does a private data classification indicate?
Ответ
The information concerns an individual or limited internal audience and should not be exposed publicly.
Карточка 670
Вопрос
What does a tabletop recovery exercise test?
Ответ
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Карточка 671
Вопрос
Why prevent password reuse?
Ответ
One compromised password should not unlock other accounts or services.
Карточка 672
Вопрос
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Ответ
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Карточка 673
Вопрос
What does transport encryption protect?
Ответ
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Карточка 674
Вопрос
How can a voice call become an attack vector?
Ответ
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Карточка 675
Вопрос
What should a digital-forensics report document?
Ответ
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Карточка 676
Вопрос
What tradeoff comes with an expansionary risk appetite?
Ответ
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Карточка 677
Вопрос
What does a known penetration-test environment provide?
Ответ
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Карточка 678
Вопрос
Why evaluate compute requirements before deployment?
Ответ
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Карточка 679
Вопрос
Why place sensors at network choke points?
Ответ
They can observe traffic crossing important trust boundaries.
Карточка 680
Вопрос
What should hybrid or remote-work security training emphasize?
Ответ
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Карточка 681
Вопрос
Why plan an application restart separately from a service restart?
Ответ
The application may need its own state handling, user coordination, health checks, and rollback point.
Карточка 682
Вопрос
What is a cryptographic vulnerability?
Ответ
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Карточка 683
Вопрос
Why report findings by asset owner?
Ответ
Owners need clear accountability and a prioritized remediation queue.
Карточка 684
Вопрос
What should guide selection of a secure protocol?
Ответ
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Карточка 685
Вопрос
How do centralized and decentralized governance structures differ?
Ответ
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Карточка 686
Вопрос
How does privacy-aware design limit data retention?
Ответ
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Карточка 687
Вопрос
What does a pressure security sensor detect?
Ответ
Force or weight applied to a protected surface, such as a floor mat or fence line.
Карточка 688
Вопрос
What automation costs should a security team plan for?
Ответ
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Карточка 689
Вопрос
What should RTOS hardening preserve while reducing attack surface?
Ответ
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Карточка 690
Вопрос
What is the goal of disruption-for-chaos activity?
Ответ
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Карточка 691
Вопрос
Which indicator can repeated password guessing produce?
Ответ
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Карточка 692
Вопрос
How does removing unnecessary software harden a system?
Ответ
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Карточка 693
Вопрос
What does NetFlow provide?
Ответ
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Карточка 694
Вопрос
How can a dashboard support an investigation?
Ответ
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Карточка 695
Вопрос
When should a password be expired?
Ответ
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Карточка 696
Вопрос
Why does cryptographic key length matter?
Ответ
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Карточка 697
Вопрос
How can an unsecure Bluetooth connection become an attack vector?
Ответ
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Карточка 698
Вопрос
What is a key risk indicator?
Ответ
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Карточка 699
Вопрос
What should vendor monitoring verify when a contract ends?
Ответ
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Карточка 700
Вопрос
What does a sensitive data classification indicate?
Ответ
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Карточка 701
Вопрос
What does software-defined networking separate?
Ответ
The control plane that decides traffic behavior from the data plane that forwards traffic.
Карточка 702
Вопрос
Where should a web application firewall be placed?
Ответ
In the path of web requests before they reach the protected application.
Карточка 703
Вопрос
What does a simulated recovery exercise test?
Ответ
Participants perform realistic response actions in a controlled environment without disrupting production.
Карточка 704
Вопрос
How can a team verify that a detective control is effective?
Ответ
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Карточка 705
Вопрос
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Ответ
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Карточка 706
Вопрос
What makes a vulnerability cloud-specific?
Ответ
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Карточка 707
Вопрос
How can insurance respond to vulnerability risk?
Ответ
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Карточка 708
Вопрос
How does reputation improve web filtering?
Ответ
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Карточка 709
Вопрос
What does an encryption policy establish?
Ответ
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Карточка 710
Вопрос
How does a microwave security sensor detect movement?
Ответ
It emits microwave energy and detects changes in the reflected signal caused by motion.
Карточка 711
Вопрос
What should IoT-device hardening change before deployment?
Ответ
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Карточка 712
Вопрос
Why track software licenses as assets?
Ответ
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Карточка 713
Вопрос
What does a password manager improve?
Ответ
It can generate and store unique long passwords so users do not memorize or reuse them.
Карточка 714
Вопрос
What makes a ledger open and public?
Ответ
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Карточка 715
Вопрос
What should a payment-change request trigger?
Ответ
Independent verification through a known channel before any account or payment detail is changed.
Карточка 716
Вопрос
What does preserving digital evidence require?
Ответ
Protecting its integrity, context, access history, and availability from collection through final disposition.
Карточка 717
Вопрос
What should a risk report tell decision-makers?
Ответ
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Карточка 718
Вопрос
What should an external assessment report provide?
Ответ
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Карточка 719
Вопрос
What is a centralized design's main resilience risk?
Ответ
A central dependency can become a bottleneck or single point of failure.
Карточка 720
Вопрос
What does mutual TLS add to a TLS-protected service connection?
Ответ
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Карточка 721
Вопрос
What should recurring security-awareness reporting show?
Ответ
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Карточка 722
Вопрос
Why do legacy applications require extra change planning?
Ответ
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Карточка 723
Вопрос
How do a data controller and a data processor differ?
Ответ
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Карточка 724
Вопрос
How can orchestration become a single point of failure?
Ответ
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Карточка 725
Вопрос
Why should defenses account for a threat actor's sophistication and capability?
Ответ
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Карточка 726
Вопрос
How does an injection attack make an application execute unintended instructions?
Ответ
It sends crafted input that an interpreter treats as code or commands instead of data.
Карточка 727
Вопрос
What does a host-based firewall control?
Ответ
Inbound and outbound network traffic for one endpoint according to local rules.
Карточка 728
Вопрос
Why revise alerting after an incident?
Ответ
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Карточка 729
Вопрос
Why include security duties in procurement criteria?
Ответ
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Карточка 730
Вопрос
What does a critical data classification indicate?
Ответ
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Карточка 731
Вопрос
What infrastructure capacity must support failover?
Ответ
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Карточка 732
Вопрос
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Ответ
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Карточка 733
Вопрос
How does a remediation exemption differ from an exception?
Ответ
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Карточка 734
Вопрос
Why should automated EDR or XDR blocking have an exception and rollback path?
Ответ
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Карточка 735
Вопрос
What does a security playbook provide?
Ответ
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Карточка 736
Вопрос
How does an ultrasonic security sensor detect movement?
Ответ
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Карточка 737
Вопрос
What should a managed mobile device require for Bluetooth connections?
Ответ
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Карточка 738
Вопрос
How do password complexity rules differ from password length?
Ответ
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Карточка 739
Вопрос
What makes a certificate third-party trusted?
Ответ
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Карточка 740
Вопрос
Why is an out-of-band check effective against impersonation?
Ответ
It verifies the request through a separate, previously trusted communication path.
Карточка 741
Вопрос
What does a risk exception authorize?
Ответ
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Карточка 742
Вопрос
What security challenge grows in a decentralized design?
Ответ
Consistent policy, inventory, monitoring, and patching become harder.
Карточка 743
Вопрос
How should controls be selected for an unused network path?
Ответ
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Карточка 744
Вопрос
How can a buffer-overflow attack affect an application?
Ответ
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.

Abstract network paths and learning nodes converging on a calm central gateway.

744 карточки