CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.
Σχετικά με αυτήν τη δέσμη
Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.
What this deck covers
- General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
- Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
- Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
- Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
- Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.
Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.
The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.
Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.
This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.
Κάρτες σε αυτήν τη δέσμη
Κάρτα 1
Ερώτηση
What does an information security policy establish?
Απάντηση
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Κάρτα 2
Ερώτηση
What is phishing?
Απάντηση
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Κάρτα 3
Ερώτηση
What does a public-key certificate bind to an identity?
Απάντηση
A public key, together with identifying information and the issuer's signature.
Κάρτα 4
Ερώτηση
What is data at rest?
Απάντηση
Data stored on media such as disks, databases, backups, or mobile devices.
Κάρτα 5
Ερώτηση
How does policy-driven access control decide a zero-trust access request?
Απάντηση
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Κάρτα 6
Ερώτηση
What does establishing a secure baseline produce?
Απάντηση
An approved, documented configuration that defines the required secure state for a class of computing resource.
Κάρτα 7
Ερώτηση
What is hashing used to verify?
Απάντηση
Whether data has changed by comparing fixed-length digest values.
Κάρτα 8
Ερώτηση
What is impersonation in social engineering?
Απάντηση
Pretending to be a trusted person or organization to obtain access, data, or action.
Κάρτα 9
Ερώτηση
What is virtualization?
Απάντηση
Abstracting physical compute so multiple isolated guest systems can share a host.
Κάρτα 10
Ερώτηση
What is chain of custody?
Απάντηση
A documented history of who collected, handled, transferred, stored, and examined evidence.
Κάρτα 11
Ερώτηση
What is quantitative risk analysis?
Απάντηση
Estimating risk with numerical values such as money, frequency, or probability.
Κάρτα 12
Ερώτηση
What is a phishing awareness campaign?
Απάντηση
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Κάρτα 13
Ερώτηση
What is high availability?
Απάντηση
Designing a service to remain accessible despite expected component failures.
Κάρτα 14
Ερώτηση
What is a network security zone?
Απάντηση
A group of systems with similar trust, function, or control requirements.
Κάρτα 15
Ερώτηση
What is risk transfer?
Απάντηση
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Κάρτα 16
Ερώτηση
What is media sanitization?
Απάντηση
Making stored data infeasible to recover for the intended level of protection.
Κάρτα 17
Ερώτηση
What does CVSS provide?
Απάντηση
A standardized way to describe a vulnerability's technical severity characteristics.
Κάρτα 18
Ερώτηση
What does security alerting do?
Απάντηση
It turns matched events or behavior into a notification that the right responder can review.
Κάρτα 19
Ερώτηση
What does a firewall rule enforce?
Απάντηση
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Κάρτα 20
Ερώτηση
What is deprovisioning?
Απάντηση
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Κάρτα 21
Ερώτηση
How does inline placement differ from a tap or monitor port?
Απάντηση
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Κάρτα 22
Ερώτηση
What is asymmetric encryption?
Απάντηση
Encryption that uses a mathematically related public and private key pair.
Κάρτα 23
Ερώτηση
What does SPF authorize?
Απάντηση
Which mail servers may send mail for a domain in the SMTP envelope.
Κάρτα 24
Ερώτηση
What is a possession factor?
Απάντηση
Something the claimant has, such as a cryptographic authenticator.
Κάρτα 25
Ερώτηση
What does ordinary TLS usually protect and authenticate?
Απάντηση
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Κάρτα 26
Ερώτηση
What is single loss expectancy?
Απάντηση
The estimated loss from one occurrence of a risk event.
Κάρτα 27
Ερώτηση
What does a certificate authority do?
Απάντηση
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Κάρτα 28
Ερώτηση
What is a detective control meant to do?
Απάντηση
Identify that an unwanted event has happened or is happening.
Κάρτα 29
Ερώτηση
What is the security purpose of change-control approval?
Απάντηση
Ensure authorized reviewers assess risk before the production change occurs.
Κάρτα 30
Ερώτηση
What is shadow IT?
Απάντηση
Technology used for organizational work without required approval or oversight.
Κάρτα 31
Ερώτηση
What is a buffer overflow vulnerability?
Απάντηση
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Κάρτα 32
Ερώτηση
What is ransomware?
Απάντηση
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Κάρτα 33
Ερώτηση
How does network segmentation limit an incident?
Απάντηση
It restricts communication paths and reduces lateral movement between zones.
Κάρτα 34
Ερώτηση
How do load balancing and clustering support availability differently?
Απάντηση
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Κάρτα 35
Ερώτηση
What is vendor due diligence?
Απάντηση
Evaluating a provider's security, capability, stability, and fit before commitment.
Κάρτα 36
Ερώτηση
Who is a data subject?
Απάντηση
The person whose personal data is collected or processed.
Κάρτα 37
Ερώτηση
What is attestation?
Απάντηση
A formal assertion or report about a subject matter, often supported by an independent examination.
Κάρτα 38
Ερώτηση
What is a replay attack?
Απάντηση
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Κάρτα 39
Ερώτηση
What does a wireless site survey establish?
Απάντηση
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Κάρτα 40
Ερώτηση
What is the time-of-check stage of a race-condition vulnerability?
Απάντηση
The application verifies a condition or resource state before acting on it.
Κάρτα 41
Ερώτηση
What is a penetration test?
Απάντηση
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Κάρτα 42
Ερώτηση
What is a cold recovery site?
Απάντηση
A facility with basic space and utilities but little preinstalled technology or current data.
Κάρτα 43
Ερώτηση
What is data in transit?
Απάντηση
Data moving between systems or across a network.
Κάρτα 44
Ερώτηση
What is a vendor security questionnaire?
Απάντηση
A structured request for information about a provider's controls and practices.
Κάρτα 45
Ερώτηση
How does an internal actor's starting position differ from an external actor's?
Απάντηση
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Κάρτα 46
Ερώτηση
What can unexpected account lockouts indicate?
Απάντηση
Password guessing, credential stuffing, user error, or a broken client.
Κάρτα 47
Ερώτηση
How do permissions enforce access control?
Απάντηση
They specify which actions a subject may perform on a particular resource.
Κάρτα 48
Ερώτηση
What is log aggregation?
Απάντηση
Central collection of logs from multiple sources for search, correlation, and retention.
Κάρτα 49
Ερώτηση
Why plan a service restart as part of a change?
Απάντηση
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Κάρτα 50
Ερώτηση
What is infrastructure as code?
Απάντηση
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Κάρτα 51
Ερώτηση
What should security-awareness program development start with?
Απάντηση
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Κάρτα 52
Ερώτηση
What is a voice-based social-engineering attack called?
Απάντηση
Vishing.
Κάρτα 53
Ερώτηση
What happens during incident-response preparation?
Απάντηση
Teams establish people, tools, access, communications, training, and procedures before an incident.
Κάρτα 54
Ερώτηση
What does an offensive penetration-testing team do?
Απάντηση
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Κάρτα 55
Ερώτηση
What is federation?
Απάντηση
One security domain relies on identity assertions from another trusted domain.
Κάρτα 56
Ερώτηση
What is asset classification?
Απάντηση
Grouping an asset by sensitivity, criticality, or required handling.
Κάρτα 57
Ερώτηση
What is cross-site scripting?
Απάντηση
Injection of script-capable content that a browser executes in another site's security context.
Κάρτα 58
Ερώτηση
What can IDS or IPS trends reveal?
Απάντηση
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Κάρτα 59
Ερώτηση
What can unexpected resource inaccessibility indicate?
Απάντηση
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Κάρτα 60
Ερώτηση
What is a corrective control meant to do?
Απάντηση
Limit damage and restore a secure state after an event.
Κάρτα 61
Ερώτηση
How do containers differ from virtual machines?
Απάντηση
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Κάρτα 62
Ερώτηση
How does an active security device differ from a passive one?
Απάντηση
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Κάρτα 63
Ερώτηση
Why is unsupported software a persistent attack surface?
Απάντηση
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Κάρτα 64
Ερώτηση
What is annualized rate of occurrence?
Απάντηση
The estimated number of times a risk event occurs per year.
Κάρτα 65
Ερώτηση
What is an inherence factor?
Απάντηση
A biometric characteristic of the claimant.
Κάρτα 66
Ερώτηση
What do a threat actor's sophistication and capability describe?
Απάντηση
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Κάρτα 67
Ερώτηση
What is a SIEM?
Απάντηση
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Κάρτα 68
Ερώτηση
What is sideloading?
Απάντηση
Installing software from outside the platform's approved distribution path.
Κάρτα 69
Ερώτηση
What does an IDS or IPS signature match?
Απάντηση
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Κάρτα 70
Ερώτηση
Why are embedded systems often difficult to patch?
Απάντηση
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Κάρτα 71
Ερώτηση
What is a virtual private network?
Απάντηση
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Κάρτα 72
Ερώτηση
What should an initial security-awareness report establish?
Απάντηση
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Κάρτα 73
Ερώτηση
What is symmetric encryption?
Απάντηση
Encryption that uses the same secret key to encrypt and decrypt data.
Κάρτα 74
Ερώτηση
What happens during incident detection?
Απάντηση
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Κάρτα 75
Ερώτηση
What is recovery time objective?
Απάντηση
The target maximum time to restore a function after disruption.
Κάρτα 76
Ερώτηση
Why prioritize password length?
Απάντηση
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Κάρτα 77
Ερώτηση
What must sanitization accomplish before an asset leaves organizational control?
Απάντηση
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Κάρτα 78
Ερώτηση
What is a real-time operating system designed to provide?
Απάντηση
Predictable response timing for tasks with strict deadlines.
Κάρτα 79
Ερώτηση
What does fail-open behavior do when a control fails?
Απάντηση
It permits traffic or access to preserve availability.
Κάρτα 80
Ερώτηση
What is jailbreaking or rooting a mobile device?
Απάντηση
Removing platform restrictions to gain privileged control over the operating system.
Κάρτα 81
Ερώτηση
What does network access control enforce?
Απάντηση
Identity, device posture, and access policy at network connection time and during a session.
Κάρτα 82
Ερώτηση
What does data loss prevention do?
Απάντηση
Detects and may block sensitive data use or transfer that violates policy.
Κάρτα 83
Ερώτηση
What security property does a blockchain provide?
Απάντηση
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Κάρτα 84
Ερώτηση
What is recovery point objective?
Απάντηση
The target maximum acceptable data loss measured backward in time.
Κάρτα 85
Ερώτηση
How do ICS and SCADA relate?
Απάντηση
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Κάρτα 86
Ερώτηση
What does fail-closed behavior do when a control fails?
Απάντηση
It denies traffic or access to preserve security.
Κάρτα 87
Ερώτηση
Which keys create and verify a typical digital signature?
Απάντηση
The signer creates it with a private key, and others verify it with the corresponding public key.
Κάρτα 88
Ερώτηση
What is SQL injection?
Απάντηση
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Κάρτα 89
Ερώτηση
What does DKIM verify?
Απάντηση
That selected message content was signed by a domain and was not altered after signing.
Κάρτα 90
Ερώτηση
What is post-incident activity?
Απάντηση
Learning from the event and improving controls, plans, and recovery based on evidence.
Κάρτα 91
Ερώτηση
What characterizes an expansionary risk appetite?
Απάντηση
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Κάρτα 92
Ερώτηση
How do centralized and decentralized architectures differ?
Απάντηση
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Κάρτα 93
Ερώτηση
What does a certificate revocation list publish?
Απάντηση
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Κάρτα 94
Ερώτηση
What is a legal hold?
Απάντηση
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Κάρτα 95
Ερώτηση
What is exposure factor in quantitative risk analysis?
Απάντηση
The estimated percentage of an asset's value lost in one event.
Κάρτα 96
Ερώτηση
What is decentralized architecture?
Απάντηση
Control or service responsibility is distributed across multiple independent components or locations.
Κάρτα 97
Ερώτηση
What is tokenization?
Απάντηση
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Κάρτα 98
Ερώτηση
How can automation act as a workforce multiplier?
Απάντηση
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Κάρτα 99
Ερώτηση
What can endpoint process logs reveal?
Απάντηση
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Κάρτα 100
Ερώτηση
What does the CIA triad protect?
Απάντηση
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Κάρτα 101
Ερώτηση
How does data masking protect information?
Απάντηση
It hides selected values or characters while preserving a usable representation.
Κάρτα 102
Ερώτηση
How can a national requirement affect security governance?
Απάντηση
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Κάρτα 103
Ερώτηση
What do integrations and APIs provide to security orchestration?
Απάντηση
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Κάρτα 104
Ερώτηση
What makes a compliance report external?
Απάντηση
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Κάρτα 105
Ερώτηση
What does a cryptographic algorithm define?
Απάντηση
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Κάρτα 106
Ερώτηση
Why compare systems with a secure baseline regularly?
Απάντηση
To detect drift, unauthorized changes, and missing hardening.
Κάρτα 107
Ερώτηση
What does integrity protect?
Απάντηση
The accuracy and completeness of data and systems against unauthorized change.
Κάρτα 108
Ερώτηση
What does vulnerability classification organize?
Απάντηση
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Κάρτα 109
Ερώτηση
What does a password standard define?
Απάντηση
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Κάρτα 110
Ερώτηση
What technology capacity must a recovery design plan for?
Απάντηση
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Κάρτα 111
Ερώτηση
What does a confidential data classification indicate?
Απάντηση
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Κάρτα 112
Ερώτηση
What makes a vendor assessment independent?
Απάντηση
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Κάρτα 113
Ερώτηση
What lets a worm spread without attaching itself to another file?
Απάντηση
It is a standalone program that replicates across reachable systems or services.
Κάρτα 114
Ερώτηση
What is microsegmentation?
Απάντηση
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Κάρτα 115
Ερώτηση
What can application logs reveal?
Απάντηση
Transactions, errors, user actions, and application-specific security events.
Κάρτα 116
Ερώτηση
What does deploying a secure baseline require?
Απάντηση
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Κάρτα 117
Ερώτηση
How can resource-provisioning automation improve security?
Απάντηση
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Κάρτα 118
Ερώτηση
What does availability protect?
Απάντηση
Reliable, timely access to systems and data when authorized users need them.
Κάρτα 119
Ερώτηση
Why must a change request describe business impact?
Απάντηση
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Κάρτα 120
Ερώτηση
What does an authenticated vulnerability scan add?
Απάντηση
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Κάρτα 121
Ερώτηση
What does a change-management procedure specify?
Απάντηση
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Κάρτα 122
Ερώτηση
What is a sanction for noncompliance?
Απάντηση
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Κάρτα 123
Ερώτηση
How can email deliver a security attack?
Απάντηση
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Κάρτα 124
Ερώτηση
What is an internal compliance audit?
Απάντηση
An organization-led examination of whether selected operations and controls meet defined requirements.
Κάρτα 125
Ερώτηση
What is a Trojan?
Απάντηση
Malware disguised as legitimate or desirable software.
Κάρτα 126
Ερώτηση
What is clustering?
Απάντηση
Multiple systems work together to provide a service and tolerate member failure.
Κάρτα 127
Ερώτηση
What makes data regulated?
Απάντηση
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Κάρτα 128
Ερώτηση
What does a wireless heat map show?
Απάντηση
Measured or modeled signal strength and coverage across a physical area.
Κάρτα 129
Ερώτηση
How should vendor criticality affect due diligence?
Απάντηση
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Κάρτα 130
Ερώτηση
How can a digital signature support non-repudiation?
Απάντηση
It provides evidence that the holder of a private key signed specific data.
Κάρτα 131
Ερώτηση
What should vulnerability prioritization consider beyond severity?
Απάντηση
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Κάρτα 132
Ερώτηση
What is a security guideline?
Απάντηση
Recommended practice that allows judgment unless adopted as a requirement.
Κάρτα 133
Ερώτηση
What usually distinguishes a nation-state threat actor?
Απάντηση
Strategic objectives, substantial resources, patience, and advanced operational capability.
Κάρτα 134
Ερώτηση
What is spyware?
Απάντηση
Software that secretly collects information about a user or system.
Κάρτα 135
Ερώτηση
Why maintain an allow list for applications?
Απάντηση
Only explicitly approved software is permitted to execute.
Κάρτα 136
Ερώτηση
How can an image become an attack vector?
Απάντηση
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Κάρτα 137
Ερώτηση
What makes a security control technical?
Απάντηση
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Κάρτα 138
Ερώτηση
What is identity proofing?
Απάντηση
Establishing that a person is who they claim to be before issuing an account or credential.
Κάρτα 139
Ερώτηση
What is an automated security guardrail?
Απάντηση
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Κάρτα 140
Ερώτηση
Why assign an owner to a planned change?
Απάντηση
To make one party accountable for coordination, execution, and follow-through.
Κάρτα 141
Ερώτηση
How can national privacy law affect data handling?
Απάντηση
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Κάρτα 142
Ερώτηση
What is continuity of operations?
Απάντηση
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Κάρτα 143
Ερώτηση
What security tradeoff comes with BYOD?
Απάντηση
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Κάρτα 144
Ερώτηση
How should policies and handbooks support security training?
Απάντηση
They provide accessible, current rules and reporting steps that training can apply to real situations.
Κάρτα 145
Ερώτηση
What is a keylogger?
Απάντηση
A tool that records keystrokes to capture data such as credentials.
Κάρτα 146
Ερώτηση
What makes information a trade secret?
Απάντηση
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Κάρτα 147
Ερώτηση
What does authentication establish?
Απάντηση
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Κάρτα 148
Ερώτηση
What risk comes from an untrusted file attachment?
Απάντηση
Opening or parsing it can execute malicious code or expose data.
Κάρτα 149
Ερώτηση
How does risk tolerance affect vulnerability remediation?
Απάντηση
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Κάρτα 150
Ερώτηση
How can a global requirement affect security governance?
Απάντηση
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Κάρτα 151
Ερώτηση
Why should questionnaire answers be supported by evidence?
Απάντηση
Self-assertions alone may not prove that controls are designed or operating effectively.
Κάρτα 152
Ερώτηση
What is an independent third-party audit?
Απάντηση
An external party with suitable independence examines evidence against defined criteria.
Κάρτα 153
Ερώτηση
What do account provisioning and deprovisioning do?
Απάντηση
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Κάρτα 154
Ερώτηση
What is an unskilled attacker commonly called?
Απάντηση
A script kiddie: someone who relies on tools or instructions created by others.
Κάρτα 155
Ερώτηση
What is a rootkit?
Απάντηση
Software designed to maintain privileged, concealed access by altering or subverting the system.
Κάρτα 156
Ερώτηση
What does an access control list enforce?
Απάντηση
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Κάρτα 157
Ερώτηση
What should system security monitoring observe?
Απάντηση
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Κάρτα 158
Ερώτηση
What can operating-system security logs reveal?
Απάντηση
Authentication, privilege use, policy changes, services, and other host security events.
Κάρτα 159
Ερώτηση
Why isolate operational technology from general business networks?
Απάντηση
To limit attack paths into safety- and availability-critical processes.
Κάρτα 160
Ερώτηση
What is the COPE mobile deployment model?
Απάντηση
The organization owns the device but permits defined personal use while retaining management control.
Κάρτα 161
Ερώτηση
What security work belongs in asset acquisition and procurement?
Απάντηση
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Κάρτα 162
Ερώτηση
How can user-provisioning automation improve security?
Απάντηση
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Κάρτα 163
Ερώτηση
What people capacity must a continuity plan account for?
Απάντηση
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Κάρτα 164
Ερώτηση
What do authorization models define?
Απάντηση
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Κάρτα 165
Ερώτηση
Why are removable devices an attack vector?
Απάντηση
They can introduce malware or remove data while bypassing network controls.
Κάρτα 166
Ερώτηση
What should predeployment change-test results show?
Απάντηση
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Κάρτα 167
Ερώτηση
What is the time-of-use stage of a race-condition vulnerability?
Απάντηση
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Κάρτα 168
Ερώτηση
What is data in use?
Απάντηση
Data actively processed in memory or by an application.
Κάρτα 169
Ερώτηση
What does open-source vulnerability intelligence contribute?
Απάντηση
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Κάρτα 170
Ερώτηση
What can file-integrity monitoring detect?
Απάντηση
Unexpected changes to protected files, directories, or configuration.
Κάρτα 171
Ερώτηση
Why should deprovisioning be prompt?
Απάντηση
Former users or roles should not retain usable access.
Κάρτα 172
Ερώτηση
What is an acceptable use policy?
Απάντηση
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Κάρτα 173
Ερώτηση
What makes a compliance report internal?
Απάντηση
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Κάρτα 174
Ερώτηση
What is a logic bomb?
Απάντηση
Malicious code that activates when a specified condition or time is reached.
Κάρτα 175
Ερώτηση
What does a right-to-audit clause provide?
Απάντηση
Contractual authority to inspect or obtain evidence about agreed controls.
Κάρτα 176
Ερώτηση
Where should a forward proxy sit in an enterprise traffic path?
Απάντηση
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Κάρτα 177
Ερώτηση
Which cues should make a message look suspicious?
Απάντηση
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Κάρτα 178
Ερώτηση
What makes a security control managerial?
Απάντηση
It directs risk and governance through decisions such as policies, assessments, and oversight.
Κάρτα 179
Ερώτηση
What is the CYOD mobile deployment model?
Απάντηση
The user selects from organization-approved device options that remain subject to corporate security requirements.
Κάρτα 180
Ερώτηση
How does client-based vulnerable software differ from an agentless exposure?
Απάντηση
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Κάρτα 181
Ερώτηση
What makes a risk assessment recurring?
Απάντηση
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Κάρτα 182
Ερώτηση
What does a defensive penetration-testing team practice?
Απάντηση
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Κάρτα 183
Ερώτηση
In a zero-trust data plane, what can the subject or system represent?
Απάντηση
The user, device, workload, or service requesting access to a protected resource.
Κάρτα 184
Ερώτηση
What primarily motivates a hacktivist?
Απάντηση
A political, social, or ideological cause.
Κάρτα 185
Ερώτηση
What is bloatware?
Απάντηση
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Κάρτα 186
Ερώτηση
Why keep endpoint-protection signatures and engines current?
Απάντηση
They need current detection logic to recognize newly identified malware and exploit behavior.
Κάρτα 187
Ερώτηση
What should application security monitoring observe?
Απάντηση
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Κάρτα 188
Ερώτηση
What is role-based access control?
Απάντηση
Permissions are assigned to roles, and identities receive access through their roles.
Κάρτα 189
Ερώτηση
What is geographic dispersal?
Απάντηση
Placing redundant resources in separate locations so one regional event does not affect all copies.
Κάρτα 190
Ερώτηση
What is a malicious update?
Απάντηση
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Κάρτα 191
Ερώτηση
What does static application analysis inspect?
Απάντηση
Source code, bytecode, or compiled code without executing the application.
Κάρτα 192
Ερώτηση
What does a firewall access list define?
Απάντηση
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Κάρτα 193
Ερώτηση
What does a disaster recovery policy establish?
Απάντηση
Management expectations for restoring technology and data after a disruptive event.
Κάρτα 194
Ερώτηση
How does logical segmentation separate workloads that share physical infrastructure?
Απάντηση
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Κάρτα 195
Ερώτηση
How should IDS and IPS placement differ?
Απάντηση
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Κάρτα 196
Ερώτηση
What should automated ticket creation capture?
Απάντηση
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Κάρτα 197
Ερώτηση
What makes information intellectual property?
Απάντηση
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Κάρτα 198
Ερώτηση
What is a backout plan?
Απάντηση
Predefined steps for safely reversing a failed or harmful change.
Κάρτα 199
Ερώτηση
Why is an unsecure wireless network an attack vector?
Απάντηση
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Κάρτα 200
Ερώτηση
What is physical brute force?
Απάντηση
Using force to defeat a lock, barrier, enclosure, or other physical control.
Κάρτα 201
Ερώτηση
What is application sandboxing?
Απάντηση
Running code in a constrained environment with limited access to the host and data.
Κάρτα 202
Ερώτηση
Why assign an asset owner?
Απάντηση
One accountable party must decide its use, protection, and lifecycle.
Κάρτα 203
Ερώτηση
What happens during risk identification?
Απάντηση
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Κάρτα 204
Ερώτηση
What should an SLA state about breach notification?
Απάντηση
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Κάρτα 205
Ερώτηση
How do due diligence and due care differ in compliance?
Απάντηση
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Κάρτα 206
Ερώτηση
What is attribute-based access control?
Απάντηση
Policy evaluates attributes of the subject, resource, action, and environment.
Κάρτα 207
Ερώτηση
What does a zero-trust policy engine do?
Απάντηση
It evaluates policy and signals to decide whether access should be allowed.
Κάρτα 208
Ερώτηση
How does a cloud responsibility matrix allocate security duties?
Απάντηση
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Κάρτα 209
Ερώτηση
Where should a load balancer sit in a service path?
Απάντηση
In front of service instances so it can route requests to healthy backends.
Κάρτα 210
Ερώτηση
What should the security team do with a reported suspicious message?
Απάντηση
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Κάρτα 211
Ερώτηση
What makes an operating-system vulnerability high impact?
Απάντηση
It can affect every application and security control that relies on the compromised OS.
Κάρτα 212
Ερώτηση
What does dynamic application analysis inspect?
Απάντηση
The behavior and externally visible weaknesses of a running application.
Κάρτα 213
Ερώτηση
How can false-positive trends affect IDS or IPS tuning?
Απάντηση
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Κάρτα 214
Ερώτηση
What does a business continuity policy establish?
Απάντηση
Management expectations for sustaining and restoring critical business functions.
Κάρτα 215
Ερώτηση
What is a hot recovery site?
Απάντηση
A ready, synchronized environment intended to take over quickly.
Κάρτα 216
Ερώτηση
What makes an insider threat distinct?
Απάντηση
The actor has legitimate access or organizational knowledge that can be misused.
Κάρτα 217
Ερώτηση
What is RFID cloning?
Απάντηση
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Κάρτα 218
Ερώτηση
Why apply vendor security updates promptly?
Απάντηση
They remove known weaknesses before attackers can exploit the unpatched exposure.
Κάρτα 219
Ερώτηση
What should infrastructure security monitoring observe?
Απάντηση
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Κάρτα 220
Ερώτηση
What can firewall logs reveal?
Απάντηση
Allowed or denied network connections across controlled boundaries.
Κάρτα 221
Ερώτηση
Why minimize open service ports?
Απάντηση
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Κάρτα 222
Ερώτηση
What is threat hunting?
Απάντηση
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Κάρτα 223
Ερώτηση
What triggers an ad hoc risk assessment?
Απάντηση
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Κάρτα 224
Ερώτηση
What makes an assessment external?
Απάντηση
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Κάρτα 225
Ερώτηση
What is data sovereignty?
Απάντηση
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Κάρτα 226
Ερώτηση
What security boundary does a cellular connection create for a mobile device?
Απάντηση
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Κάρτα 227
Ερώτηση
What makes a security control operational?
Απάντηση
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Κάρτα 228
Ερώτηση
What is discretionary access control?
Απάντηση
A resource owner can decide who receives access, within system policy.
Κάρτα 229
Ερώτηση
How can careful automation support employee retention?
Απάντηση
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Κάρτα 230
Ερώτηση
Why does ease of deployment matter in an architecture decision?
Απάντηση
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Κάρτα 231
Ερώτηση
What tradeoff comes with placing an NGFW inline?
Απάντηση
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Κάρτα 232
Ερώτηση
What does a zero-trust policy administrator do?
Απάντηση
It carries out the policy engine's decision, such as creating or ending a session.
Κάρτα 233
Ερώτηση
What should a master service agreement define for data return and deletion?
Απάντηση
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Κάρτα 234
Ερώτηση
What is an environmental physical attack?
Απάντηση
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Κάρτα 235
Ερώτηση
When should a maintenance window be chosen?
Απάντηση
When disruption and rollback can be managed with the least business impact.
Κάρτα 236
Ερώτηση
What is memory injection?
Απάντηση
Placing malicious code or data into another process's memory so it executes in that process's context.
Κάρτα 237
Ερώτηση
What does software composition analysis find?
Απάντηση
Known risks and license information in third-party dependencies.
Κάρτα 238
Ερώτηση
What is DNS filtering?
Απάντηση
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Κάρτα 239
Ερώτηση
What should an incident response policy establish?
Απάντηση
Authority, scope, reporting duties, and organizational commitment for incident handling.
Κάρτα 240
Ερώτηση
How can noncompliance cause reputational damage?
Απάντηση
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Κάρτα 241
Ερώτηση
What does full-disk encryption protect?
Απάντηση
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Κάρτα 242
Ερώτηση
Why are default credentials dangerous?
Απάντηση
They are widely known or easily discovered and often remain unchanged.
Κάρτα 243
Ερώτηση
What makes a risk assessment one-time?
Απάντηση
It evaluates a defined decision or scope once without an established repeating cadence.
Κάρτα 244
Ερώτηση
What is a warm recovery site?
Απάντηση
A partially equipped environment that needs some data restoration or configuration before use.
Κάρτα 245
Ερώτηση
What does application input validation do?
Απάντηση
It checks that input matches the expected type, length, range, and format before use.
Κάρτα 246
Ερώτηση
What should an asset inventory record besides a device name?
Απάντηση
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Κάρτα 247
Ερώτηση
What is mandatory access control?
Απάντηση
A central authority enforces access through labels and rules that ordinary owners cannot override.
Κάρτα 248
Ερώτηση
What security benefit does infrastructure as code provide?
Απάντηση
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Κάρτα 249
Ερώτηση
When should a public service control fail closed?
Απάντηση
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Κάρτα 250
Ερώτηση
What should users do with a suspicious message?
Απάντηση
Report it through the approved channel without interacting with its links or attachments.
Κάρτα 251
Ερώτηση
What usually motivates organized cybercrime?
Απάντηση
Financial gain through scalable or repeatable criminal activity.
Κάρτα 252
Ερώτηση
How can malicious code support a network attack?
Απάντηση
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Κάρτα 253
Ερώτηση
When is virtual patching useful?
Απάντηση
When a network or application control can block exploit traffic before the underlying system can be patched.
Κάρτα 254
Ερώτηση
What does security-monitoring reporting provide?
Απάντηση
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Κάρτα 255
Ερώτηση
What does data geolocation identify?
Απάντηση
The physical or legal location where data is stored, processed, or transmitted.
Κάρτα 256
Ερώτηση
What does a zero-trust policy enforcement point do?
Απάντηση
It enables, monitors, and terminates the connection between a subject and a resource.
Κάρτα 257
Ερώτηση
What is cryptographic key exchange?
Απάντηση
A method for parties to establish shared key material over an untrusted channel.
Κάρτα 258
Ερώτηση
How can a vendor become a supply-chain attack vector?
Απάντηση
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Κάρτα 259
Ερώτηση
Why can legacy hardware remain vulnerable?
Απάντηση
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Κάρτα 260
Ερώτηση
What can proprietary vulnerability intelligence add beyond open sources?
Απάντηση
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Κάρτα 261
Ερώτηση
How does a centralized proxy apply web filtering?
Απάντηση
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Κάρτα 262
Ερώτηση
How can continuous integration and testing improve security automation?
Απάντηση
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Κάρτα 263
Ερώτηση
What is containment?
Απάντηση
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Κάρτα 264
Ερώτηση
What is a software development lifecycle policy meant to ensure?
Απάντηση
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Κάρτα 265
Ερώτηση
What makes risk assessment continuous?
Απάντηση
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Κάρτα 266
Ερώτηση
What is a memorandum of agreement?
Απάντηση
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Κάρτα 267
Ερώτηση
What makes a penetration test integrated?
Απάντηση
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Κάρτα 268
Ερώτηση
How does a DNS amplification attack magnify traffic?
Απάντηση
It sends small spoofed queries that trigger larger replies toward the victim.
Κάρτα 269
Ερώτηση
Why does ease of recovery matter in an architecture decision?
Απάντηση
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Κάρτα 270
Ερώτηση
What does 802.1X control before a device receives normal network access?
Απάντηση
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Κάρτα 271
Ερώτηση
What is rule-based access control?
Απάντηση
System-wide rules grant or deny access based on conditions such as network, time, or action.
Κάρτα 272
Ερώτηση
What is mobile device management?
Απάντηση
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Κάρτα 273
Ερώτηση
What tradeoff comes with a cold recovery site?
Απάντηση
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Κάρτα 274
Ερώτηση
Why identify stakeholders before approving a security-sensitive change?
Απάντηση
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Κάρτα 275
Ερώτηση
How do attestation and acknowledgement differ?
Απάντηση
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Κάρτα 276
Ερώτηση
What does zero-trust adaptive identity mean?
Απάντηση
Access decisions adjust to current risk signals rather than relying only on a static login.
Κάρτα 277
Ερώτηση
What makes a security control physical?
Απάντηση
It protects facilities or equipment through a tangible barrier or mechanism.
Κάρτα 278
Ερώτηση
What is geo-fencing for data?
Απάντηση
Enforcing location-based boundaries on where data or services may be accessed or operated.
Κάρτα 279
Ερώτηση
What does a Trusted Platform Module protect?
Απάντηση
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Κάρτα 280
Ερώτηση
Why can a managed service provider amplify risk?
Απάντηση
Its privileged access and shared tooling can provide a path into many customers.
Κάρτα 281
Ερώτηση
What does probability express in risk analysis?
Απάντηση
A quantified chance that a defined event will occur within stated conditions or time.
Κάρτα 282
Ερώτηση
Why can shadow IT create a threat?
Απάντηση
It bypasses security review, inventory, monitoring, and supported configuration.
Κάρτα 283
Ερώτηση
What is on-path interception?
Απάντηση
An attacker positions between communicating parties to observe or alter traffic.
Κάρτα 284
Ερώτηση
Why include encryption in a system-hardening baseline?
Απάντηση
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Κάρτα 285
Ερώτηση
Why tune security alerts?
Απάντηση
To keep useful detections while reducing noise that wastes analyst attention.
Κάρτα 286
Ερώτηση
What can IPS or IDS logs contribute to an investigation?
Απάντηση
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Κάρτα 287
Ερώτηση
What is VM escape?
Απάντηση
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Κάρτα 288
Ερώτηση
How can segmentation reduce vulnerability exposure before a patch is available?
Απάντηση
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Κάρτα 289
Ερώτηση
Why should firewall policy name the required ports and protocols explicitly?
Απάντηση
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Κάρτα 290
Ερώτηση
What is a change management policy meant to control?
Απάντηση
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Κάρτα 291
Ερώτηση
What is a hybrid-cloud architecture?
Απάντηση
An environment that integrates private or on-premises resources with public cloud services.
Κάρτα 292
Ερώτηση
How do AH and ESP differ in the security services they can provide?
Απάντηση
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Κάρτα 293
Ερώτηση
What makes user behavior risky?
Απάντηση
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Κάρτα 294
Ερώτηση
What is least privilege?
Απάντηση
Granting only the access needed for the required task and no more.
Κάρτα 295
Ερώτηση
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Απάντηση
Transmission to HTTPS, script access, and cross-site sending, respectively.
Κάρτα 296
Ερώτηση
Why discover unmanaged assets?
Απάντηση
Unknown systems cannot be patched, monitored, or governed reliably.
Κάρτα 297
Ερώτηση
What is a service-level agreement?
Απάντηση
Measurable service commitments and remedies, such as availability or response targets.
Κάρτα 298
Ερώτηση
What should govern automated security escalation?
Απάντηση
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Κάρτα 299
Ερώτηση
What is platform diversity as a resilience strategy?
Απάντηση
Using different implementations so one common flaw or failure is less likely to affect every copy.
Κάρτα 300
Ερώτηση
How can replayed session material affect an application?
Απάντηση
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Κάρτα 301
Ερώτηση
What is an implicit trust zone in zero trust?
Απάντηση
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Κάρτα 302
Ερώτηση
What does salting a password hash accomplish?
Απάντηση
It makes identical passwords hash differently and defeats precomputed hash tables.
Κάρτα 303
Ερώτηση
What is spear phishing?
Απάντηση
Phishing tailored to a specific person, role, or organization.
Κάρτα 304
Ερώτηση
What is eradication?
Απάντηση
Removing the attacker's access, malicious artifacts, and exploited conditions.
Κάρτα 305
Ερώτηση
Who is a risk owner?
Απάντηση
The person accountable for deciding and monitoring how a specific risk is handled.
Κάρτα 306
Ερώτηση
What does a partially known penetration-test environment provide?
Απάντηση
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Κάρτα 307
Ερώτηση
What is a microservices architecture?
Απάντηση
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Κάρτα 308
Ερώτηση
What is a jump server?
Απάντηση
A hardened intermediary used to reach systems in a restricted management network.
Κάρτα 309
Ερώτηση
What can happen when a configuration change is made without dependency analysis?
Απάντηση
A downstream service can fail even when the changed component works.
Κάρτα 310
Ερώτηση
What is resource reuse exposure?
Απάντηση
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Κάρτα 311
Ερώτηση
Why does financial information require explicit protection?
Απάντηση
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Κάρτα 312
Ερώτηση
What does CVE provide?
Απάντηση
A common identifier for a publicly disclosed vulnerability.
Κάρτα 313
Ερώτηση
Where can DLP controls operate?
Απάντηση
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Κάρτα 314
Ερώτηση
What does privileged password vaulting protect?
Απάντηση
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Κάρτα 315
Ερώτηση
What does an access-control standard define?
Απάντηση
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Κάρτα 316
Ερώτηση
How can automation support compliance monitoring?
Απάντηση
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Κάρτα 317
Ερώτηση
What does static code analysis examine?
Απάντηση
Source or compiled code for weakness patterns without executing the application.
Κάρτα 318
Ερώτηση
What actor attribute describes funding, time, and personnel?
Απάντηση
Resources.
Κάρτα 319
Ερώτηση
What is DNS poisoning?
Απάντηση
Introducing false DNS data so names resolve to attacker-chosen destinations.
Κάρτα 320
Ερώτηση
Why change default credentials during hardening?
Απάντηση
Default secrets are predictable and commonly targeted.
Κάρτα 321
Ερώτηση
What does quarantine do after a security alert?
Απάντηση
It restricts a suspected asset or object while analysts validate and remediate the risk.
Κάρτα 322
Ερώτηση
What does key stretching do for stored passwords?
Απάντηση
It deliberately makes each password guess more computationally expensive.
Κάρτα 323
Ερώτηση
What is smishing?
Απάντηση
Phishing delivered through SMS or another text-messaging service.
Κάρτα 324
Ερώτηση
What is qualitative risk analysis?
Απάντηση
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Κάρτα 325
Ερώτηση
What is a master service agreement?
Απάντηση
An umbrella contract establishing general legal and commercial terms for ongoing work.
Κάρτα 326
Ερώτηση
What is threat scope reduction?
Απάντηση
Narrowing the systems, privileges, or paths an attacker can reach.
Κάρτα 327
Ερώτηση
Why use a third-party cloud service instead of building locally?
Απάντηση
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Κάρτα 328
Ερώτηση
What should determine security-device placement?
Απάντηση
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Κάρτα 329
Ερώτηση
What does situational awareness mean for a user?
Απάντηση
Notice the people, devices, requests, location, and context around a task before acting.
Κάρτα 330
Ερώτηση
What does a failover test validate?
Απάντηση
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Κάρτα 331
Ερώτηση
What is a preventive control meant to do?
Απάντηση
Stop an unwanted event before it succeeds.
Κάρτα 332
Ερώτηση
What is just-in-time privileged access?
Απάντηση
Elevated access is granted only when needed and expires after a short approved period.
Κάρτα 333
Ερώτηση
What safeguard should security-group automation enforce?
Απάντηση
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Κάρτα 334
Ερώτηση
How does a reflected DDoS attack hide and multiply sources?
Απάντηση
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Κάρτα 335
Ερώτηση
What is a security misconfiguration?
Απάντηση
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Κάρτα 336
Ερώτηση
Why can the same vulnerability have different organizational impact?
Απάντηση
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Κάρτα 337
Ερώτηση
What does URL scanning evaluate before a user opens a web destination?
Απάντηση
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Κάρτα 338
Ερώτηση
What is the board's security governance role?
Απάντηση
Provide oversight, set risk direction, and hold executives accountable.
Κάρτα 339
Ερώτηση
What does code signing establish?
Απάντηση
That code came from the holder of the signing key and has not changed since signing.
Κάρτα 340
Ερώτηση
How should an asset's classification affect security operations?
Απάντηση
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Κάρτα 341
Ερώτηση
How does encryption protect data?
Απάντηση
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Κάρτα 342
Ερώτηση
What is a secure enclave?
Απάντηση
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Κάρτα 343
Ερώτηση
What is business email compromise?
Απάντηση
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Κάρτα 344
Ερώτηση
What is recovery in incident response?
Απάντηση
Restoring services safely, monitoring them, and returning to normal operations.
Κάρτα 345
Ερώτηση
How is single loss expectancy commonly estimated?
Απάντηση
Asset value multiplied by the exposure factor.
Κάρτα 346
Ερώτηση
What does an unknown penetration-test environment provide?
Απάντηση
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Κάρτα 347
Ερώτηση
What security boundary does a hypervisor provide?
Απάντηση
It isolates virtual machines while controlling their access to shared hardware.
Κάρτα 348
Ερώτηση
Why does a TLS tunnel not protect a compromised endpoint?
Απάντηση
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Κάρτα 349
Ερώτηση
Why update diagrams after an infrastructure change?
Απάντηση
Operations and incident responders need the documentation to match the deployed environment.
Κάρτα 350
Ερώτηση
What does privacy ownership assign?
Απάντηση
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Κάρτα 351
Ερώτηση
What does a security control gap analysis compare?
Απάντηση
The controls required for the target state with the controls currently in place.
Κάρτα 352
Ερώτηση
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Απάντηση
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Κάρτα 353
Ερώτηση
What is application privilege escalation?
Απάντηση
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Κάρτα 354
Ερώτηση
What risk remains when unnecessary software is left installed?
Απάντηση
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Κάρτα 355
Ερώτηση
What does SCAP standardize?
Απάντηση
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Κάρτα 356
Ερώτηση
What can packet capture reveal?
Απάντηση
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Κάρτα 357
Ερώτηση
What makes a privileged credential ephemeral?
Απάντηση
It is created for a limited task or session and expires or is destroyed automatically after that use.
Κάρτα 358
Ερώτηση
How do a statement of work and a work order differ?
Απάντηση
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Κάρτα 359
Ερώτηση
Why might multi-cloud improve resilience?
Απάντηση
A provider-wide failure need not stop workloads that can run independently elsewhere.
Κάρτα 360
Ερώτηση
How can a service provider introduce a supply-chain vulnerability?
Απάντηση
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Κάρτα 361
Ερώτηση
What is a false positive in vulnerability scanning?
Απάντηση
A reported weakness that is not actually present or exploitable in the assessed context.
Κάρτα 362
Ερώτηση
How do EDR and XDR differ?
Απάντηση
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Κάρτα 363
Ερώτηση
What should onboarding and offboarding procedures coordinate?
Απάντηση
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Κάρτα 364
Ερώτηση
How should an organization harden managed mobile devices?
Απάντηση
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Κάρτα 365
Ερώτηση
What is a certificate signing request?
Απάντηση
A request containing a public key and subject information for a certificate authority to sign.
Κάρτα 366
Ερώτηση
What is pretexting?
Απάντηση
Using a fabricated role or situation to make a request seem legitimate.
Κάρτα 367
Ερώτηση
How is annualized loss expectancy commonly estimated?
Απάντηση
Single loss expectancy multiplied by annualized rate of occurrence.
Κάρτα 368
Ερώτηση
What security consequence follows from containers sharing a kernel?
Απάντηση
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Κάρτα 369
Ερώτηση
Where does 802.1X enforce a network admission decision?
Απάντηση
At the controlled switch port or wireless access point before normal network access is granted.
Κάρτα 370
Ερώτηση
What should insider-threat awareness teach?
Απάντηση
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Κάρτα 371
Ερώτηση
What access action is suitable for careful automation?
Απάντηση
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Κάρτα 372
Ερώτηση
What is an evil twin?
Απάντηση
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 κάρτες
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Μελετήστε αυτήν τη δέσμη δωρεάνΤο Nibomo ανοίγει για να ξεκινήσετε τη μελέτη.
Κάρτα 373
Ερώτηση
Does non-human-readable data need less protection?
Απάντηση
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Κάρτα 374
Ερώτηση
What does authenticating a system establish?
Απάντηση
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Κάρτα 375
Ερώτηση
What does LDAP provide in identity systems?
Απάντηση
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Κάρτα 376
Ερώτηση
What is a deterrent control meant to do?
Απάντηση
Discourage an attacker from attempting an unwanted action.
Κάρτα 377
Ερώτηση
Why update procedures after changing a security control?
Απάντηση
Staff need accurate steps for operating, monitoring, and recovering the new control.
Κάρτα 378
Ερώτηση
How does OCSP differ from a certificate revocation list?
Απάντηση
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Κάρτα 379
Ερώτηση
What is the goal of data exfiltration?
Απάντηση
Remove data from its authorized environment without permission.
Κάρτα 380
Ερώτηση
What is a watering-hole attack?
Απάντηση
Compromising a site frequented by the intended targets so their visits expose them.
Κάρτα 381
Ερώτηση
How can a hardware provider introduce a supply-chain vulnerability?
Απάντηση
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Κάρτα 382
Ερώτηση
What is application forgery?
Απάντηση
Creating or altering a request, token, or object so the application treats it as authentic.
Κάρτα 383
Ερώτηση
How does least privilege mitigate compromise?
Απάντηση
It limits the actions and resources available to a compromised account or process.
Κάρτα 384
Ερώτηση
What is serverless computing?
Απάντηση
A model where the provider manages servers and the customer deploys event-driven code or functions.
Κάρτα 385
Ερώτηση
What makes an infrastructure control effective for a specific risk?
Απάντηση
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Κάρτα 386
Ερώτηση
What does parallel recovery processing test?
Απάντηση
Whether primary and alternate environments can run together consistently before a controlled cutover.
Κάρτα 387
Ερώτηση
Which password-authentication method does WPA3-Personal use?
Απάντηση
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Κάρτα 388
Ερώτηση
How does data retention affect asset disposal?
Απάντηση
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Κάρτα 389
Ερώτηση
What is a false negative in vulnerability scanning?
Απάντηση
A real weakness that the assessment fails to report.
Κάρτα 390
Ερώτηση
What does recurring security scanning add to monitoring?
Απάντηση
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Κάρτα 391
Ερώτηση
What should guide port selection for a secure protocol?
Απάντηση
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Κάρτα 392
Ερώτηση
What does forensic acquisition create?
Απάντηση
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Κάρτα 393
Ερώτηση
How do system owners and data owners divide security accountability?
Απάντηση
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Κάρτα 394
Ερώτηση
What does likelihood express in risk analysis?
Απάντηση
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Κάρτα 395
Ερώτηση
What is a memorandum of understanding?
Απάντηση
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Κάρτα 396
Ερώτηση
What does the right to be forgotten generally require?
Απάντηση
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Κάρτα 397
Ερώτηση
What does an audit committee oversee?
Απάντηση
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Κάρτα 398
Ερώτηση
What does identity interoperability require?
Απάντηση
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Κάρτα 399
Ερώτηση
How does a bollard protect a facility?
Απάντηση
It blocks or redirects vehicles before they can reach a protected area.
Κάρτα 400
Ερώτηση
How can hashing protect a downloaded file?
Απάντηση
A trusted digest lets the recipient detect whether the file changed.
Κάρτα 401
Ερώτηση
What is a credential replay attack?
Απάντηση
Using captured valid credentials or tokens again without needing to discover the secret.
Κάρτα 402
Ερώτηση
How can automation complexity create security risk?
Απάντηση
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Κάρτα 403
Ερώτηση
What must an architecture provide when a component cannot be patched?
Απάντηση
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Κάρτα 404
Ερώτηση
What makes remote access secure?
Απάντηση
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Κάρτα 405
Ερώτηση
What should users verify before connecting removable media or a cable?
Απάντηση
That the device and connection are approved, expected, and handled under organizational policy.
Κάρτα 406
Ερώτηση
What is a self-signed certificate?
Απάντηση
A certificate signed by its own private key rather than by a separate trusted issuer.
Κάρτα 407
Ερώτηση
What is brand impersonation?
Απάντηση
Using a trusted organization's identity or look to deceive people.
Κάρτα 408
Ερώτηση
What characterizes a conservative risk appetite?
Απάντηση
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Κάρτα 409
Ερώτηση
What should a managed mobile device verify before using Wi-Fi?
Απάντηση
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Κάρτα 410
Ερώτηση
What is a zero-day vulnerability?
Απάντηση
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Κάρτα 411
Ερώτηση
What does verification confirm after vulnerability remediation?
Απάντηση
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Κάρτα 412
Ερώτηση
What is user and entity behavior analytics?
Απάντηση
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Κάρτα 413
Ερώτηση
What does a physical security policy establish?
Απάντηση
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Κάρτα 414
Ερώτηση
What does a UPS provide?
Απάντηση
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Κάρτα 415
Ερώτηση
What is a nondisclosure agreement?
Απάντηση
A contract restricting use and disclosure of defined confidential information.
Κάρτα 416
Ερώτηση
What should be checked before assigning a user permission?
Απάντηση
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Κάρτα 417
Ερώτηση
How does espionage differ from ordinary theft?
Απάντηση
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Κάρτα 418
Ερώτηση
What is password spraying?
Απάντηση
Trying a small set of common passwords across many accounts to avoid lockouts.
Κάρτα 419
Ερώτηση
What is the purpose of system isolation during an incident?
Απάντηση
Stop harmful communication while preserving the system for response and investigation.
Κάρτα 420
Ερώτηση
What is a security benchmark?
Απάντηση
A documented set of recommended configuration checks for a platform or product.
Κάρτα 421
Ερώτηση
Which metadata fields give a log record investigative context?
Απάντηση
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Κάρτα 422
Ερώτηση
What does an access-control vestibule prevent?
Απάντηση
It limits tailgating by allowing controlled passage through one door at a time.
Κάρτα 423
Ερώτηση
What is version control's security value for configuration?
Απάντηση
It preserves attributable history and enables review or rollback of changes.
Κάρτα 424
Ερώτηση
Why use both internal and external compliance monitoring?
Απάντηση
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Κάρτα 425
Ερώτηση
What distinguishes on-premises architecture?
Απάντηση
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Κάρτα 426
Ερώτηση
What risk can split tunneling add to a VPN?
Απάντηση
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Κάρτα 427
Ερώτηση
What is a certificate root of trust?
Απάντηση
A trusted root certificate or key from which a client validates a certificate chain.
Κάρτα 428
Ερώτηση
What is typosquatting?
Απάντηση
Registering a look-alike domain based on common typing errors or visual similarity.
Κάρτα 429
Ερώτηση
What is root-cause analysis?
Απάντηση
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Κάρτα 430
Ερώτηση
What is risk tolerance?
Απάντηση
The acceptable variation or boundary around a specific objective or risk area.
Κάρτα 431
Ερώτηση
What is a security self-assessment?
Απάντηση
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Κάρτα 432
Ερώτηση
What does data masking change?
Απάντηση
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Κάρτα 433
Ερώτηση
How do wireless authentication protocols let clients prove identity securely?
Απάντηση
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Κάρτα 434
Ερώτηση
Why reconcile inventory with network discovery?
Απάντηση
Differences expose missing records, retired systems, or unauthorized devices.
Κάρτα 435
Ερώτηση
Why does sideloading raise mobile risk?
Απάντηση
It can bypass store review, signing policy, and managed application controls.
Κάρτα 436
Ερώτηση
What does an information-sharing organization add to vulnerability management?
Απάντηση
Sector or community intelligence about relevant threats, incidents, and defensive action.
Κάρτα 437
Ερώτηση
What does a web-filter block rule specify?
Απάντηση
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Κάρτα 438
Ερώτηση
How do data custodians and data stewards differ?
Απάντηση
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Κάρτα 439
Ερώτηση
What is a brute-force password attack?
Απάντηση
Systematically trying many candidate secrets against an account or protected value.
Κάρτα 440
Ερώτηση
What is a compensating control?
Απάντηση
An alternative safeguard used when the preferred control is impractical or unavailable.
Κάρτα 441
Ερώτηση
How can location act as an authentication factor?
Απάντηση
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Κάρτα 442
Ερώτηση
Why must security automation remain supportable?
Απάντηση
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Κάρτα 443
Ερώτηση
What does a standby generator provide?
Απάντηση
Longer-duration power during a utility outage, after a startup delay.
Κάρτα 444
Ερώτηση
What makes an architecture air-gapped?
Απάντηση
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Κάρτα 445
Ερώτηση
What is a software-defined WAN?
Απάντηση
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Κάρτα 446
Ερώτηση
What password-management behavior should awareness training reinforce?
Απάντηση
Use unique long passwords through an approved manager and report suspected compromise promptly.
Κάρτα 447
Ερώτηση
What security value does fencing provide?
Απάντηση
It defines and delays entry across a physical perimeter.
Κάρτα 448
Ερώτηση
What is a wildcard certificate?
Απάντηση
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Κάρτα 449
Ερώτηση
How does misinformation differ from disinformation?
Απάντηση
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Κάρτα 450
Ερώτηση
What is a risk threshold?
Απάντηση
A defined level that triggers escalation, treatment, or another required response.
Κάρτα 451
Ερώτηση
What does a vendor penetration test contribute to assessment?
Απάντηση
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Κάρτα 452
Ερώτηση
What is the objective of a service-disruption attack?
Απάντηση
Make a system or business function unavailable or unreliable.
Κάρτα 453
Ερώτηση
What is directory traversal?
Απάντηση
Manipulating a file path to reach files outside the directory the application intended to expose.
Κάρτα 454
Ερώτηση
Why decommission an unsupported system?
Απάντηση
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Κάρτα 455
Ερώτηση
Why archive security-monitoring data?
Απάντηση
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Κάρτα 456
Ερώτηση
What role does RADIUS commonly play in enterprise Wi-Fi?
Απάντηση
It centralizes authentication, authorization information, and accounting for network access.
Κάρτα 457
Ερώτηση
Why separate the requester and approver of a high-risk change?
Απάντηση
To reduce error, fraud, and unilateral unauthorized modification.
Κάρτα 458
Ερώτηση
Why can a jailbroken device violate a security baseline?
Απάντηση
It weakens platform isolation and allows unapproved privileged changes.
Κάρτα 459
Ερώτηση
When is tokenization especially useful?
Απάντηση
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Κάρτα 460
Ερώτηση
Why can dark-web intelligence affect vulnerability priority?
Απάντηση
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Κάρτα 461
Ερώτηση
What firewall policy should govern traffic from a screened subnet to internal systems?
Απάντηση
Deny it by default and allow only explicitly required flows.
Κάρτα 462
Ερώτηση
What does SAML commonly carry?
Απάντηση
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Κάρτα 463
Ερώτηση
What does a security governance committee do?
Απάντηση
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Κάρτα 464
Ερώτηση
How can global privacy requirements affect one data process?
Απάντηση
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Κάρτα 465
Ερώτηση
What characterizes an IoT device?
Απάντηση
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Κάρτα 466
Ερώτηση
What is a unified threat management appliance?
Απάντηση
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Κάρτα 467
Ερώτηση
What does a hardware security module provide?
Απάντηση
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Κάρτα 468
Ερώτηση
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Απάντηση
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Κάρτα 469
Ερώτηση
What is a tabletop exercise?
Απάντηση
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Κάρτα 470
Ερώτηση
What does a risk exemption authorize?
Απάντηση
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Κάρτα 471
Ερώτηση
What is a regulatory examination?
Απάντηση
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Κάρτα 472
Ερώτηση
What does physical video surveillance primarily provide?
Απάντηση
Detection and evidence of activity in monitored areas.
Κάρτα 473
Ερώτηση
What is a birthday attack against a hash?
Απάντηση
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Κάρτα 474
Ερώτηση
Why keep backups both onsite and offsite?
Απάντηση
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Κάρτα 475
Ερώτηση
How does technical debt affect security automation?
Απάντηση
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Κάρτα 476
Ερώτηση
What should switch hardening restrict first?
Απάντηση
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Κάρτα 477
Ερώτηση
What should happen when an asset changes owners?
Απάντηση
Inventory, access, support responsibility, and data handling should be updated.
Κάρτα 478
Ερώτηση
What does evidence of a vendor's internal audits contribute?
Απάντηση
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Κάρτα 479
Ερώτηση
What is identity attestation?
Απάντηση
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Κάρτα 480
Ερώτηση
Why can standard enterprise patching be unsafe for an RTOS device?
Απάντηση
A change can disrupt timing guarantees or certified operational behavior.
Κάρτα 481
Ερώτηση
What is secure access service edge?
Απάντηση
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Κάρτα 482
Ερώτηση
What social-engineering habit should awareness training reinforce?
Απάντηση
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Κάρτα 483
Ερώτηση
How can a software provider introduce a supply-chain vulnerability?
Απάντηση
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Κάρτα 484
Ερώτηση
Why include internet exposure in remediation priority?
Απάντηση
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Κάρτα 485
Ερώτηση
What does a mail gateway inspect?
Απάντηση
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Κάρτα 486
Ερώτηση
What is a data controller?
Απάντηση
The entity that determines why and how personal data is processed.
Κάρτα 487
Ερώτηση
How does blackmail motivate a cyberattack?
Απάντηση
The attacker threatens disclosure or harm unless the victim complies.
Κάρτα 488
Ερώτηση
What is a downgrade attack?
Απάντηση
Forcing parties to use an older or weaker protocol or security mode.
Κάρτα 489
Ερώτηση
How does encryption mitigate data exposure?
Απάντηση
It makes captured data unreadable without the required key.
Κάρτα 490
Ερώτηση
How do network and web vulnerability scanners differ?
Απάντηση
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Κάρτα 491
Ερώτηση
How can vulnerability-scan data support an investigation?
Απάντηση
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Κάρτα 492
Ερώτηση
What is key escrow?
Απάντηση
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Κάρτα 493
Ερώτηση
Which human vector commonly uses a fake sign-in page to harvest credentials?
Απάντηση
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Κάρτα 494
Ερώτηση
What is risk avoidance?
Απάντηση
Stopping or not starting the activity that creates the risk.
Κάρτα 495
Ερώτηση
What is data obfuscation?
Απάντηση
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Κάρτα 496
Ερώτηση
What is a directive control?
Απάντηση
A safeguard that tells people what behavior or action is required.
Κάρτα 497
Ερώτηση
What does a security guard add that a camera cannot?
Απάντηση
Human judgment and an immediate physical response.
Κάρτα 498
Ερώτηση
Why define restricted activities in change management?
Απάντηση
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Κάρτα 499
Ερώτηση
What contractual impact can noncompliance create?
Απάντηση
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Κάρτα 500
Ερώτηση
What should determine backup frequency?
Απάντηση
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Κάρτα 501
Ερώτηση
What should router hardening protect?
Απάντηση
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Κάρτα 502
Ερώτηση
What problem does OAuth 2.0 address?
Απάντηση
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Κάρτα 503
Ερώτηση
What does SCADA do?
Απάντηση
It provides supervisory monitoring and control across distributed industrial equipment.
Κάρτα 504
Ερώτηση
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Απάντηση
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Κάρτα 505
Ερώτηση
What distinguishes a computer virus?
Απάντηση
It attaches to a host file or program and spreads when that infected host executes or is shared.
Κάρτα 506
Ερώτηση
What does a key management system coordinate?
Απάντηση
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Κάρτα 507
Ερώτηση
How can an unsecure wired network expose traffic?
Απάντηση
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Κάρτα 508
Ερώτηση
Why is vulnerable device firmware hard to remediate?
Απάντηση
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Κάρτα 509
Ερώτηση
What does patching change in vulnerability remediation?
Απάντηση
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Κάρτα 510
Ερώτηση
What does DMARC add to SPF and DKIM?
Απάντηση
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Κάρτα 511
Ερώτηση
How does automation improve security efficiency?
Απάντηση
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Κάρτα 512
Ερώτηση
What is a simulation exercise?
Απάντηση
A more realistic practice in which participants respond to injected events using operational processes.
Κάρτα 513
Ερώτηση
What is a data processor?
Απάντηση
An entity that processes personal data on behalf of a controller.
Κάρτα 514
Ερώτηση
What is risk mitigation?
Απάντηση
Reducing likelihood, impact, or both through controls or process changes.
Κάρτα 515
Ερώτηση
Why monitor a vendor after onboarding?
Απάντηση
Security posture, ownership, services, incidents, and dependencies can change.
Κάρτα 516
Ερώτηση
What does a physical penetration test assess?
Απάντηση
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Κάρτα 517
Ερώτηση
Why use access badges at a facility?
Απάντηση
To associate entry attempts with authorized identities and enforce access rules.
Κάρτα 518
Ερώτηση
How does permission restriction protect data?
Απάντηση
Only authorized identities receive the actions and scope their roles require.
Κάρτα 519
Ερώτηση
What is the usual objective of ransomware extortion?
Απάντηση
Force payment by denying access, threatening disclosure, or both.
Κάρτα 520
Ερώτηση
What does impossible travel indicate?
Απάντηση
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Κάρτα 521
Ερώτηση
What is configuration enforcement?
Απάντηση
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Κάρτα 522
Ερώτηση
What does a web vulnerability scanner inspect?
Απάντηση
Running web behavior for issues such as unsafe input handling and insecure configuration.
Κάρτα 523
Ερώτηση
How does cost affect an architecture choice?
Απάντηση
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Κάρτα 524
Ερώτηση
What does EAP provide with 802.1X?
Απάντηση
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Κάρτα 525
Ερώτηση
What should operational-security training help users protect?
Απάντηση
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Κάρτα 526
Ερώτηση
What does a time-of-day access rule do?
Απάντηση
Allows or denies a requested action according to an approved schedule.
Κάρτα 527
Ερώτηση
What should cloud infrastructure hardening establish?
Απάντηση
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Κάρτα 528
Ερώτηση
What should an asset owner ensure during offboarding?
Απάντηση
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Κάρτα 529
Ερώτηση
Why encrypt backups?
Απάντηση
Backup media and transfers can expose the same sensitive data as production systems.
Κάρτα 530
Ερώτηση
What is steganography?
Απάντηση
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Κάρτα 531
Ερώτηση
Which human vector uses a fabricated authority role to justify a sensitive request?
Απάντηση
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Κάρτα 532
Ερώτηση
Why does risk transfer not remove accountability?
Απάντηση
The organization can retain legal, reputational, operational, and oversight consequences.
Κάρτα 533
Ερώτηση
Why validate a change after deployment?
Απάντηση
To confirm the intended result occurred without introducing unacceptable side effects.
Κάρτα 534
Ερώτηση
What makes end-of-life hardware a security vulnerability?
Απάντηση
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Κάρτα 535
Ερώτηση
What does an audit add to remediation validation?
Απάντηση
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Κάρτα 536
Ερώτηση
Why can SPF pass while a message still impersonates a brand?
Απάντηση
SPF checks the envelope domain, which may differ from the visible From domain.
Κάρτα 537
Ερώτηση
What role can a government entity have in security governance?
Απάντηση
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Κάρτα 538
Ερώτηση
How do data inventory and retention support privacy governance?
Απάντηση
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Κάρτα 539
Ερώτηση
What can concurrent sessions from distant regions indicate?
Απάντηση
A stolen account or shared credential, subject to VPN and proxy context.
Κάρτα 540
Ερώτηση
What does supply-chain analysis examine?
Απάντηση
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Κάρτα 541
Ερώτηση
What is the purpose of facility lighting as a control?
Απάντηση
Deter covert activity and improve observation of people and areas.
Κάρτα 542
Ερώτηση
What architecture quality keeps a service usable during component failure?
Απάντηση
Availability.
Κάρτα 543
Ερώτηση
When is fail-open behavior preferable to fail-closed behavior?
Απάντηση
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Κάρτα 544
Ερώτηση
Which control function does a login-failure alert provide?
Απάντηση
Detection; it reveals suspicious authentication activity.
Κάρτα 545
Ερώτηση
What does a biometric MFA implementation verify?
Απάντηση
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Κάρτα 546
Ερώτηση
How can automation enforce a security baseline?
Απάντηση
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Κάρτα 547
Ερώτηση
How do wireless cryptographic protocols protect network traffic?
Απάντηση
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Κάρτα 548
Ερώτηση
Why segment sensitive data stores?
Απάντηση
It limits reachable paths and separates them from lower-trust workloads.
Κάρτα 549
Ερώτηση
What must remain secret in an asymmetric key pair?
Απάντηση
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Κάρτα 550
Ερώτηση
How can a supplier become a supply-chain attack vector?
Απάντηση
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Κάρτα 551
Ερώτηση
What is e-discovery?
Απάντηση
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Κάρτα 552
Ερώτηση
What characterizes a neutral risk appetite?
Απάντηση
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Κάρτα 553
Ερώτηση
What is passive reconnaissance?
Απάντηση
Gathering information without directly interacting with the target's systems.
Κάρτα 554
Ερώτηση
What does a philosophical motive mean for a threat actor?
Απάντηση
The actor acts to advance a belief or moral position rather than primarily for money.
Κάρτα 555
Ερώτηση
What does unexpected resource consumption indicate?
Απάντηση
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Κάρτα 556
Ερώτηση
What does a host-based intrusion prevention system do?
Απάντηση
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Κάρτα 557
Ερώτηση
How does agent-based monitoring differ from agentless monitoring?
Απάντηση
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Κάρτα 558
Ερώτηση
What can network logs contribute to an investigation?
Απάντηση
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Κάρτα 559
Ερώτηση
What is the purpose of a backup restore test?
Απάντηση
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Κάρτα 560
Ερώτηση
Why can obsolete hardware become a security risk?
Απάντηση
It may lack supported firmware, modern protections, or replacement parts.
Κάρτα 561
Ερώτηση
What does rescanning confirm after remediation?
Απάντηση
Whether the scanner can still detect the original finding on the affected asset.
Κάρτα 562
Ερώτηση
What should a secure transport method provide?
Απάντηση
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Κάρτα 563
Ερώτηση
How can law affect security governance?
Απάντηση
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Κάρτα 564
Ερώτηση
What does resilience mean for a security architecture?
Απάντηση
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Κάρτα 565
Ερώτηση
Why minimize an infrastructure's attack surface?
Απάντηση
Fewer exposed services and paths leave fewer opportunities for exploitation.
Κάρτα 566
Ερώτηση
What does executing a security-awareness program require?
Απάντηση
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Κάρτα 567
Ερώτηση
What does an infrared security sensor detect?
Απάντηση
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Κάρτα 568
Ερώτηση
What is a knowledge factor?
Απάντηση
Something the claimant knows, such as a password.
Κάρτα 569
Ερώτηση
Why review allow-list and deny-list impact before a change?
Απάντηση
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Κάρτα 570
Ερώτηση
What does partition-level encryption protect?
Απάντηση
One selected disk partition, leaving other partitions outside that encryption boundary.
Κάρτα 571
Ερώτηση
How can instant messaging deliver a security attack?
Απάντηση
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Κάρτα 572
Ερώτηση
What can repeated blocked-content events indicate?
Απάντηση
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Κάρτα 573
Ερώτηση
What should a server-hardening baseline reduce?
Απάντηση
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Κάρτα 574
Ερώτηση
When is physical media destruction appropriate?
Απάντηση
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Κάρτα 575
Ερώτηση
What is mean time to repair?
Απάντηση
The average time required to restore a failed component or service.
Κάρτα 576
Ερώτηση
Why disclose conflicts of interest during vendor selection?
Απάντηση
A personal or financial relationship can bias evaluation away from the organization's requirements.
Κάρτα 577
Ερώτηση
What is a fine for noncompliance?
Απάντηση
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Κάρτα 578
Ερώτηση
What does a public data classification authorize?
Απάντηση
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Κάρτα 579
Ερώτηση
What security benefit comes from standard infrastructure configurations?
Απάντηση
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Κάρτα 580
Ερώτηση
How does horizontal scaling increase capacity?
Απάντηση
It adds more service instances and distributes work among them.
Κάρτα 581
Ερώτηση
Why can added connectivity weaken segmentation?
Απάντηση
Each allowed path can become a route for lateral movement or data escape.
Κάρτα 582
Ερώτηση
What coding practice is central to preventing SQL injection?
Απάντηση
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Κάρτα 583
Ερώτηση
When is a compensating control appropriate for a vulnerability?
Απάντηση
When timely removal or patching is infeasible and another control can reduce the risk.
Κάρτα 584
Ερώτηση
How does agent-based web filtering enforce policy?
Απάντηση
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Κάρτα 585
Ερώτηση
How can regulation differ from an internal policy?
Απάντηση
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Κάρτα 586
Ερώτηση
What is a storage snapshot?
Απάντηση
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Κάρτα 587
Ερώτηση
What does password age measure?
Απάντηση
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Κάρτα 588
Ερώτηση
What does an ethical motive mean in vulnerability research?
Απάντηση
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Κάρτα 589
Ερώτηση
What can missing security logs indicate?
Απάντηση
Logging failure, tampering, retention misconfiguration, or an inactive source.
Κάρτα 590
Ερώτηση
Why disable unused ports and protocols?
Απάντηση
They expose unnecessary communication paths and code that attackers can reach.
Κάρτα 591
Ερώτηση
What does antivirus contribute to monitoring?
Απάντηση
It scans files, memory, or behavior and reports suspected malicious code.
Κάρτα 592
Ερώτηση
What is a honeypot?
Απάντηση
A decoy system or service designed to attract and observe malicious activity.
Κάρτα 593
Ερώτηση
What does file-level encryption protect?
Απάντηση
Selected files independently of whether the rest of the disk or volume is encrypted.
Κάρτα 594
Ερώτηση
How can SMS deliver a security attack?
Απάντηση
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Κάρτα 595
Ερώτηση
What happens during incident analysis?
Απάντηση
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Κάρτα 596
Ερώτηση
What is mean time between failures?
Απάντηση
The average operating time between repairable failures.
Κάρτα 597
Ερώτηση
What is active reconnaissance?
Απάντηση
Probing or interacting with target systems to discover services and behavior.
Κάρτα 598
Ερώτηση
What constraint should guide ICS or SCADA hardening?
Απάντηση
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Κάρτα 599
Ερώτηση
Which control function does restoring a clean system image provide?
Απάντηση
Correction; it returns the system to a known-good state.
Κάρτα 600
Ερώτηση
What does responsiveness mean in an architecture decision?
Απάντηση
How quickly the system and its operators can adapt to demand, failure, or attack.
Κάρτα 601
Ερώτηση
How does out-of-band access strengthen remote administration?
Απάντηση
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Κάρτα 602
Ερώτηση
What makes user behavior unexpected?
Απάντηση
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Κάρτα 603
Ερώτηση
What is a work order?
Απάντηση
A document authorizing a defined unit of work under an existing agreement.
Κάρτα 604
Ερώτηση
What can out-of-cycle logging indicate?
Απάντηση
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Κάρτα 605
Ερώτηση
Why update a standard operating procedure after a change?
Απάντηση
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Κάρτα 606
Ερώτηση
What coding practice limits cross-site scripting?
Απάντηση
Context-appropriate output encoding, supported by safe templating and input handling.
Κάρτα 607
Ερώτηση
What does a restricted data classification indicate?
Απάντηση
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Κάρτα 608
Ερώτηση
How does a bug bounty support responsible disclosure?
Απάντηση
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Κάρτα 609
Ερώτηση
What does web-filter content categorization provide?
Απάντηση
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Κάρτα 610
Ερώτηση
How do hard and soft authentication tokens differ?
Απάντηση
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Κάρτα 611
Ερώτηση
How can industry requirements affect security governance?
Απάντηση
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Κάρτα 612
Ερώτηση
How can noncompliance cause loss of a license?
Απάντηση
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Κάρτα 613
Ερώτηση
What does volume-level encryption protect?
Απάντηση
All data within a selected logical storage volume.
Κάρτα 614
Ερώτηση
How can impersonation exploit familiarity?
Απάντηση
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Κάρτα 615
Ερώτηση
How does RTO guide recovery design?
Απάντηση
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Κάρτα 616
Ερώτηση
What is a honeynet?
Απάντηση
A network of decoy systems used to study or divert attackers.
Κάρτα 617
Ερώτηση
What does backup replication provide?
Απάντηση
Additional synchronized or copied recovery data in another system or location.
Κάρτα 618
Ερώτηση
What lets automation scale securely?
Απάντηση
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Κάρτα 619
Ερώτηση
Why monitor a hardened computing resource continuously?
Απάντηση
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Κάρτα 620
Ερώτηση
Why keep a certificate of destruction?
Απάντηση
It documents that a disposal provider handled specified media under the agreed process.
Κάρτα 621
Ερώτηση
Why consider patch availability before selecting a platform?
Απάντηση
Unsupported or difficult-to-update components accumulate known exposure.
Κάρτα 622
Ερώτηση
Why should remote administration use an encrypted, authenticated protocol?
Απάντηση
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Κάρτα 623
Ερώτηση
How can revenge motivate an insider incident?
Απάντηση
A disgruntled person may damage systems or disclose data to punish the organization.
Κάρτα 624
Ερώτηση
What is a published or documented indicator of malicious activity?
Απάντηση
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Κάρτα 625
Ερώτηση
Why monitor a system more closely when a mitigation exception is accepted?
Απάντηση
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Κάρτα 626
Ερώτηση
What is an SNMP trap?
Απάντηση
An unsolicited device notification sent to a management system when a configured event occurs.
Κάρτα 627
Ερώτηση
How can an automated report support an investigation?
Απάντηση
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Κάρτα 628
Ερώτηση
What is a security key?
Απάντηση
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Κάρτα 629
Ερώτηση
What does database-level encryption protect?
Απάντηση
A database or selected database structures through controls managed at the database layer.
Κάρτα 630
Ερώτηση
How does brand impersonation exploit trust?
Απάντηση
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Κάρτα 631
Ερώτηση
What browser-side impact can a cross-site scripting vulnerability create?
Απάντηση
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Κάρτα 632
Ερώτηση
How can a system or process audit identify vulnerabilities?
Απάντηση
It compares evidence with required configuration and procedure to reveal control gaps.
Κάρτα 633
Ερώτηση
What security role can Group Policy provide?
Απάντηση
Centralized Windows configuration of account, application, audit, and system security settings.
Κάρτα 634
Ερώτηση
What should incident-response training prepare people to do?
Απάντηση
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Κάρτα 635
Ερώτηση
Why must governance track local or regional requirements?
Απάντηση
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Κάρτα 636
Ερώτηση
How can a dependency become a useful key risk indicator?
Απάντηση
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Κάρτα 637
Ερώτηση
What is a business partners agreement?
Απάντηση
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Κάρτα 638
Ερώτηση
What makes an audit regulatory?
Απάντηση
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Κάρτα 639
Ερώτηση
What is a honeyfile?
Απάντηση
A decoy file whose access can reveal unauthorized activity.
Κάρτα 640
Ερώτηση
Why does legal information require explicit protection?
Απάντηση
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Κάρτα 641
Ερώτηση
Which indicator can mass file renaming and encryption produce?
Απάντηση
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Κάρτα 642
Ερώτηση
What remains with an organization after transferring architecture risk?
Απάντηση
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Κάρτα 643
Ερώτηση
When does local console placement provide useful administrative access?
Απάντηση
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Κάρτα 644
Ερώτηση
What makes a harmful user action unintentional?
Απάντηση
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Κάρτα 645
Ερώτηση
How should an organization harden workstations?
Απάντηση
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Κάρτα 646
Ερώτηση
What is journaling in recovery?
Απάντηση
Recording ordered changes so data can be replayed or restored to a consistent point.
Κάρτα 647
Ερώτηση
What downtime must a change plan account for?
Απάντηση
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Κάρτα 648
Ερώτηση
Why must a privacy program map local or regional law to data flows?
Απάντηση
The applicable duties can change with the location of the person, organization, processing, or stored data.
Κάρτα 649
Ερώτηση
Why combine independent preventive controls at different layers?
Απάντηση
A failure at one layer does not automatically let the same attack succeed at the next layer.
Κάρτα 650
Ερώτηση
What is passwordless authentication?
Απάντηση
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Κάρτα 651
Ερώτηση
How can automation improve security reaction time?
Απάντηση
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Κάρτα 652
Ερώτηση
What does record-level encryption protect?
Απάντηση
Individual records or fields, allowing finer protection than encrypting the entire database.
Κάρτα 653
Ερώτηση
How can business email compromise misuse urgency?
Απάντηση
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Κάρτα 654
Ερώτηση
What does impact measure in risk analysis?
Απάντηση
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Κάρτα 655
Ερώτηση
What makes cyber activity part of warfare?
Απάντηση
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Κάρτα 656
Ερώτηση
Which indicator can a newly created privileged account produce outside the normal change window?
Απάντηση
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Κάρτα 657
Ερώτηση
How can configuration enforcement validate a deployed mitigation?
Απάντηση
It compares the realized settings with the approved state and corrects or reports drift.
Κάρτα 658
Ερώτηση
How does validating an alert improve alert tuning?
Απάντηση
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Κάρτα 659
Ερώτηση
What data-layer impact can a SQL injection vulnerability create?
Απάντηση
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Κάρτα 660
Ερώτηση
What environmental variables can change vulnerability priority?
Απάντηση
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Κάρτα 661
Ερώτηση
What security role does SELinux provide?
Απάντηση
Mandatory access controls that confine processes according to centrally defined policy.
Κάρτα 662
Ερώτηση
Why review governance documents periodically?
Απάντηση
Business, technology, threats, and external obligations change.
Κάρτα 663
Ερώτηση
Why evaluate power requirements for a system design?
Απάντηση
Power capacity and redundancy constrain availability and recovery.
Κάρτα 664
Ερώτηση
When is IPsec a better tunnel choice than TLS?
Απάντηση
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Κάρτα 665
Ερώτηση
What is a honeytoken?
Απάντηση
A fake credential or data element that generates a high-confidence alert when used.
Κάρτα 666
Ερώτηση
What should embedded-system hardening prioritize?
Απάντηση
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Κάρτα 667
Ερώτηση
Why must sanitization address data remanence?
Απάντηση
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Κάρτα 668
Ερώτηση
Why require rules of engagement for vendor testing?
Απάντηση
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Κάρτα 669
Ερώτηση
What does a private data classification indicate?
Απάντηση
The information concerns an individual or limited internal audience and should not be exposed publicly.
Κάρτα 670
Ερώτηση
What does a tabletop recovery exercise test?
Απάντηση
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Κάρτα 671
Ερώτηση
Why prevent password reuse?
Απάντηση
One compromised password should not unlock other accounts or services.
Κάρτα 672
Ερώτηση
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Απάντηση
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Κάρτα 673
Ερώτηση
What does transport encryption protect?
Απάντηση
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Κάρτα 674
Ερώτηση
How can a voice call become an attack vector?
Απάντηση
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Κάρτα 675
Ερώτηση
What should a digital-forensics report document?
Απάντηση
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Κάρτα 676
Ερώτηση
What tradeoff comes with an expansionary risk appetite?
Απάντηση
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Κάρτα 677
Ερώτηση
What does a known penetration-test environment provide?
Απάντηση
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Κάρτα 678
Ερώτηση
Why evaluate compute requirements before deployment?
Απάντηση
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Κάρτα 679
Ερώτηση
Why place sensors at network choke points?
Απάντηση
They can observe traffic crossing important trust boundaries.
Κάρτα 680
Ερώτηση
What should hybrid or remote-work security training emphasize?
Απάντηση
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Κάρτα 681
Ερώτηση
Why plan an application restart separately from a service restart?
Απάντηση
The application may need its own state handling, user coordination, health checks, and rollback point.
Κάρτα 682
Ερώτηση
What is a cryptographic vulnerability?
Απάντηση
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Κάρτα 683
Ερώτηση
Why report findings by asset owner?
Απάντηση
Owners need clear accountability and a prioritized remediation queue.
Κάρτα 684
Ερώτηση
What should guide selection of a secure protocol?
Απάντηση
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Κάρτα 685
Ερώτηση
How do centralized and decentralized governance structures differ?
Απάντηση
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Κάρτα 686
Ερώτηση
How does privacy-aware design limit data retention?
Απάντηση
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Κάρτα 687
Ερώτηση
What does a pressure security sensor detect?
Απάντηση
Force or weight applied to a protected surface, such as a floor mat or fence line.
Κάρτα 688
Ερώτηση
What automation costs should a security team plan for?
Απάντηση
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Κάρτα 689
Ερώτηση
What should RTOS hardening preserve while reducing attack surface?
Απάντηση
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Κάρτα 690
Ερώτηση
What is the goal of disruption-for-chaos activity?
Απάντηση
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Κάρτα 691
Ερώτηση
Which indicator can repeated password guessing produce?
Απάντηση
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Κάρτα 692
Ερώτηση
How does removing unnecessary software harden a system?
Απάντηση
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Κάρτα 693
Ερώτηση
What does NetFlow provide?
Απάντηση
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Κάρτα 694
Ερώτηση
How can a dashboard support an investigation?
Απάντηση
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Κάρτα 695
Ερώτηση
When should a password be expired?
Απάντηση
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Κάρτα 696
Ερώτηση
Why does cryptographic key length matter?
Απάντηση
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Κάρτα 697
Ερώτηση
How can an unsecure Bluetooth connection become an attack vector?
Απάντηση
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Κάρτα 698
Ερώτηση
What is a key risk indicator?
Απάντηση
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Κάρτα 699
Ερώτηση
What should vendor monitoring verify when a contract ends?
Απάντηση
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Κάρτα 700
Ερώτηση
What does a sensitive data classification indicate?
Απάντηση
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Κάρτα 701
Ερώτηση
What does software-defined networking separate?
Απάντηση
The control plane that decides traffic behavior from the data plane that forwards traffic.
Κάρτα 702
Ερώτηση
Where should a web application firewall be placed?
Απάντηση
In the path of web requests before they reach the protected application.
Κάρτα 703
Ερώτηση
What does a simulated recovery exercise test?
Απάντηση
Participants perform realistic response actions in a controlled environment without disrupting production.
Κάρτα 704
Ερώτηση
How can a team verify that a detective control is effective?
Απάντηση
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Κάρτα 705
Ερώτηση
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Απάντηση
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Κάρτα 706
Ερώτηση
What makes a vulnerability cloud-specific?
Απάντηση
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Κάρτα 707
Ερώτηση
How can insurance respond to vulnerability risk?
Απάντηση
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Κάρτα 708
Ερώτηση
How does reputation improve web filtering?
Απάντηση
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Κάρτα 709
Ερώτηση
What does an encryption policy establish?
Απάντηση
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Κάρτα 710
Ερώτηση
How does a microwave security sensor detect movement?
Απάντηση
It emits microwave energy and detects changes in the reflected signal caused by motion.
Κάρτα 711
Ερώτηση
What should IoT-device hardening change before deployment?
Απάντηση
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Κάρτα 712
Ερώτηση
Why track software licenses as assets?
Απάντηση
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Κάρτα 713
Ερώτηση
What does a password manager improve?
Απάντηση
It can generate and store unique long passwords so users do not memorize or reuse them.
Κάρτα 714
Ερώτηση
What makes a ledger open and public?
Απάντηση
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Κάρτα 715
Ερώτηση
What should a payment-change request trigger?
Απάντηση
Independent verification through a known channel before any account or payment detail is changed.
Κάρτα 716
Ερώτηση
What does preserving digital evidence require?
Απάντηση
Protecting its integrity, context, access history, and availability from collection through final disposition.
Κάρτα 717
Ερώτηση
What should a risk report tell decision-makers?
Απάντηση
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Κάρτα 718
Ερώτηση
What should an external assessment report provide?
Απάντηση
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Κάρτα 719
Ερώτηση
What is a centralized design's main resilience risk?
Απάντηση
A central dependency can become a bottleneck or single point of failure.
Κάρτα 720
Ερώτηση
What does mutual TLS add to a TLS-protected service connection?
Απάντηση
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Κάρτα 721
Ερώτηση
What should recurring security-awareness reporting show?
Απάντηση
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Κάρτα 722
Ερώτηση
Why do legacy applications require extra change planning?
Απάντηση
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Κάρτα 723
Ερώτηση
How do a data controller and a data processor differ?
Απάντηση
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Κάρτα 724
Ερώτηση
How can orchestration become a single point of failure?
Απάντηση
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Κάρτα 725
Ερώτηση
Why should defenses account for a threat actor's sophistication and capability?
Απάντηση
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Κάρτα 726
Ερώτηση
How does an injection attack make an application execute unintended instructions?
Απάντηση
It sends crafted input that an interpreter treats as code or commands instead of data.
Κάρτα 727
Ερώτηση
What does a host-based firewall control?
Απάντηση
Inbound and outbound network traffic for one endpoint according to local rules.
Κάρτα 728
Ερώτηση
Why revise alerting after an incident?
Απάντηση
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Κάρτα 729
Ερώτηση
Why include security duties in procurement criteria?
Απάντηση
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Κάρτα 730
Ερώτηση
What does a critical data classification indicate?
Απάντηση
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Κάρτα 731
Ερώτηση
What infrastructure capacity must support failover?
Απάντηση
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Κάρτα 732
Ερώτηση
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Απάντηση
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Κάρτα 733
Ερώτηση
How does a remediation exemption differ from an exception?
Απάντηση
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Κάρτα 734
Ερώτηση
Why should automated EDR or XDR blocking have an exception and rollback path?
Απάντηση
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Κάρτα 735
Ερώτηση
What does a security playbook provide?
Απάντηση
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Κάρτα 736
Ερώτηση
How does an ultrasonic security sensor detect movement?
Απάντηση
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Κάρτα 737
Ερώτηση
What should a managed mobile device require for Bluetooth connections?
Απάντηση
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Κάρτα 738
Ερώτηση
How do password complexity rules differ from password length?
Απάντηση
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Κάρτα 739
Ερώτηση
What makes a certificate third-party trusted?
Απάντηση
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Κάρτα 740
Ερώτηση
Why is an out-of-band check effective against impersonation?
Απάντηση
It verifies the request through a separate, previously trusted communication path.
Κάρτα 741
Ερώτηση
What does a risk exception authorize?
Απάντηση
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Κάρτα 742
Ερώτηση
What security challenge grows in a decentralized design?
Απάντηση
Consistent policy, inventory, monitoring, and patching become harder.
Κάρτα 743
Ερώτηση
How should controls be selected for an unused network path?
Απάντηση
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Κάρτα 744
Ερώτηση
How can a buffer-overflow attack affect an application?
Απάντηση
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.
744 κάρτες
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Το Nibomo ανοίγει για να ξεκινήσετε τη μελέτη.