# CompTIA Security\+ SY0\-701 Flashcards: Complete Objective Review ![Abstract network paths and learning nodes converging on a calm central gateway\.]() Study every current SY0\-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance\. Por el autor [Flashcards Open Source App]() [Estudia este mazo gratis]() Nibomo se abrirá para que puedas empezar a estudiar\. ## Detalles del mazo - Tarjetas: 744 tarjetas - Versión: 1 - Publicado: 26 de agosto de 2026 - Última actualización: 10 de septiembre de 2026 - Licencia: Common knowledge · CC0 1\.0 - Idiomas del público: [en]() - Materia: Cybersecurity - Nivel: Security\+ SY0\-701 - Etiquetas: security\-plus\-701, governance\-risk, threats\-mitigations, general\-concepts, security\-architecture, security\-operations ## Sobre este mazo Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026. ### What this deck covers * **General security concepts:** control functions, core principles, zero trust, change management, cryptography, certificates, and PKI. * **Threats, vulnerabilities, and mitigations:** threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices. * **Security architecture:** cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design. * **Security operations:** hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources. * **Program management and oversight:** governance, risk, third-party security, compliance, privacy, audits, and awareness. Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart. The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application. Scope was reconciled against [CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0](https://comptiacdn.azureedge.net/webcontent/docs/default-source/exam-objectives/comptia-security-sy0-701-exam-objectives-%286-0%29.pdf?sfvrsn=204179cc_6). Current certification requirements and exam-series status are on the [official CompTIA Security+ page](https://www.comptia.org/en-us/certifications/security/). This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied. ## Mazos similares - [CompTIA A\+ 220\-1201 & 220\-1202 Flashcards: Core 1 and Core 2]() - [CompTIA Network\+ N10\-009 Flashcards: Concepts, Operations & Troubleshooting]() - [AWS Solutions Architect Associate SAA\-C03 Flashcards: Architecture Decisions & Trade\-Offs]() - [NREMT EMT Flashcards: Assessment, Treatment & Operations]() - [EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules]() - [CCSP 2026 Flashcards: August Exam Outline Review]() ## Tarjetas de este mazo ### Tarjeta 1 **Pregunta** What does an information security policy establish? **Respuesta** Management's required direction, responsibilities, and high-level rules for protecting information and systems. ### Tarjeta 2 **Pregunta** What is phishing? **Respuesta** A deceptive message intended to make a target reveal information, open malware, or take an unsafe action. ### Tarjeta 3 **Pregunta** What does a public-key certificate bind to an identity? **Respuesta** A public key, together with identifying information and the issuer's signature. ### Tarjeta 4 **Pregunta** What is data at rest? **Respuesta** Data stored on media such as disks, databases, backups, or mobile devices. ### Tarjeta 5 **Pregunta** How does policy-driven access control decide a zero-trust access request? **Respuesta** Explicit policies or rules evaluate the access request and drive the allow-or-deny decision. ### Tarjeta 6 **Pregunta** What does establishing a secure baseline produce? **Respuesta** An approved, documented configuration that defines the required secure state for a class of computing resource. ### Tarjeta 7 **Pregunta** What is hashing used to verify? **Respuesta** Whether data has changed by comparing fixed-length digest values. ### Tarjeta 8 **Pregunta** What is impersonation in social engineering? **Respuesta** Pretending to be a trusted person or organization to obtain access, data, or action. ### Tarjeta 9 **Pregunta** What is virtualization? **Respuesta** Abstracting physical compute so multiple isolated guest systems can share a host. ### Tarjeta 10 **Pregunta** What is chain of custody? **Respuesta** A documented history of who collected, handled, transferred, stored, and examined evidence. ### Tarjeta 11 **Pregunta** What is quantitative risk analysis? **Respuesta** Estimating risk with numerical values such as money, frequency, or probability. ### Tarjeta 12 **Pregunta** What is a phishing awareness campaign? **Respuesta** A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior. ### Tarjeta 13 **Pregunta** What is high availability? **Respuesta** Designing a service to remain accessible despite expected component failures. ### Tarjeta 14 **Pregunta** What is a network security zone? **Respuesta** A group of systems with similar trust, function, or control requirements. ### Tarjeta 15 **Pregunta** What is risk transfer? **Respuesta** Shifting some financial or operational consequence to another party, such as through insurance or contract. ### Tarjeta 16 **Pregunta** What is media sanitization? **Respuesta** Making stored data infeasible to recover for the intended level of protection. ### Tarjeta 17 **Pregunta** What does CVSS provide? **Respuesta** A standardized way to describe a vulnerability's technical severity characteristics. ### Tarjeta 18 **Pregunta** What does security alerting do? **Respuesta** It turns matched events or behavior into a notification that the right responder can review. ### Tarjeta 19 **Pregunta** What does a firewall rule enforce? **Respuesta** A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions. ### Tarjeta 20 **Pregunta** What is deprovisioning? **Respuesta** Disabling or removing accounts, credentials, sessions, and access when they are no longer needed. ### Tarjeta 21 **Pregunta** How does inline placement differ from a tap or monitor port? **Respuesta** Inline traffic passes through the control; a tap or monitor receives a copy for observation. ### Tarjeta 22 **Pregunta** What is asymmetric encryption? **Respuesta** Encryption that uses a mathematically related public and private key pair. ### Tarjeta 23 **Pregunta** What does SPF authorize? **Respuesta** Which mail servers may send mail for a domain in the SMTP envelope. ### Tarjeta 24 **Pregunta** What is a possession factor? **Respuesta** Something the claimant has, such as a cryptographic authenticator. ### Tarjeta 25 **Pregunta** What does ordinary TLS usually protect and authenticate? **Respuesta** It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured. ### Tarjeta 26 **Pregunta** What is single loss expectancy? **Respuesta** The estimated loss from one occurrence of a risk event. ### Tarjeta 27 **Pregunta** What does a certificate authority do? **Respuesta** It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key. ### Tarjeta 28 **Pregunta** What is a detective control meant to do? **Respuesta** Identify that an unwanted event has happened or is happening. ### Tarjeta 29 **Pregunta** What is the security purpose of change-control approval? **Respuesta** Ensure authorized reviewers assess risk before the production change occurs. ### Tarjeta 30 **Pregunta** What is shadow IT? **Respuesta** Technology used for organizational work without required approval or oversight. ### Tarjeta 31 **Pregunta** What is a buffer overflow vulnerability? **Respuesta** A bounds-checking failure that lets input overwrite memory outside its intended buffer. ### Tarjeta 32 **Pregunta** What is ransomware? **Respuesta** Malware or an intrusion outcome that denies access to data or systems to extort the victim. ### Tarjeta 33 **Pregunta** How does network segmentation limit an incident? **Respuesta** It restricts communication paths and reduces lateral movement between zones. ### Tarjeta 34 **Pregunta** How do load balancing and clustering support availability differently? **Respuesta** Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure. ### Tarjeta 35 **Pregunta** What is vendor due diligence? **Respuesta** Evaluating a provider's security, capability, stability, and fit before commitment. ### Tarjeta 36 **Pregunta** Who is a data subject? **Respuesta** The person whose personal data is collected or processed. ### Tarjeta 37 **Pregunta** What is attestation? **Respuesta** A formal assertion or report about a subject matter, often supported by an independent examination. ### Tarjeta 38 **Pregunta** What is a replay attack? **Respuesta** Valid captured data is retransmitted to repeat an authenticated or authorized action. ### Tarjeta 39 **Pregunta** What does a wireless site survey establish? **Respuesta** Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment. ### Tarjeta 40 **Pregunta** What is the time-of-check stage of a race-condition vulnerability? **Respuesta** The application verifies a condition or resource state before acting on it. ### Tarjeta 41 **Pregunta** What is a penetration test? **Respuesta** An authorized attempt to exploit weaknesses and demonstrate practical impact. ### Tarjeta 42 **Pregunta** What is a cold recovery site? **Respuesta** A facility with basic space and utilities but little preinstalled technology or current data. ### Tarjeta 43 **Pregunta** What is data in transit? **Respuesta** Data moving between systems or across a network. ### Tarjeta 44 **Pregunta** What is a vendor security questionnaire? **Respuesta** A structured request for information about a provider's controls and practices. ### Tarjeta 45 **Pregunta** How does an internal actor's starting position differ from an external actor's? **Respuesta** An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access. ### Tarjeta 46 **Pregunta** What can unexpected account lockouts indicate? **Respuesta** Password guessing, credential stuffing, user error, or a broken client. ### Tarjeta 47 **Pregunta** How do permissions enforce access control? **Respuesta** They specify which actions a subject may perform on a particular resource. ### Tarjeta 48 **Pregunta** What is log aggregation? **Respuesta** Central collection of logs from multiple sources for search, correlation, and retention. ### Tarjeta 49 **Pregunta** Why plan a service restart as part of a change? **Respuesta** The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps. ### Tarjeta 50 **Pregunta** What is infrastructure as code? **Respuesta** Managing infrastructure through versioned, machine-readable definitions rather than manual configuration. ### Tarjeta 51 **Pregunta** What should security-awareness program development start with? **Respuesta** The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes. ### Tarjeta 52 **Pregunta** What is a voice-based social-engineering attack called? **Respuesta** Vishing. ### Tarjeta 53 **Pregunta** What happens during incident-response preparation? **Respuesta** Teams establish people, tools, access, communications, training, and procedures before an incident. ### Tarjeta 54 **Pregunta** What does an offensive penetration-testing team do? **Respuesta** It emulates authorized attacker behavior to discover and demonstrate exploitable paths. ### Tarjeta 55 **Pregunta** What is federation? **Respuesta** One security domain relies on identity assertions from another trusted domain. ### Tarjeta 56 **Pregunta** What is asset classification? **Respuesta** Grouping an asset by sensitivity, criticality, or required handling. ### Tarjeta 57 **Pregunta** What is cross-site scripting? **Respuesta** Injection of script-capable content that a browser executes in another site's security context. ### Tarjeta 58 **Pregunta** What can IDS or IPS trends reveal? **Respuesta** Changes in the frequency, source, target, or type of detected activity that one isolated event may not show. ### Tarjeta 59 **Pregunta** What can unexpected resource inaccessibility indicate? **Respuesta** Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage. ### Tarjeta 60 **Pregunta** What is a corrective control meant to do? **Respuesta** Limit damage and restore a secure state after an event. ### Tarjeta 61 **Pregunta** How do containers differ from virtual machines? **Respuesta** Containers share the host kernel; virtual machines normally run separate guest operating systems. ### Tarjeta 62 **Pregunta** How does an active security device differ from a passive one? **Respuesta** An active device can alter or block traffic; a passive device observes and reports without changing the flow. ### Tarjeta 63 **Pregunta** Why is unsupported software a persistent attack surface? **Respuesta** Known weaknesses may remain reachable because supported fixes and vendor help are no longer available. ### Tarjeta 64 **Pregunta** What is annualized rate of occurrence? **Respuesta** The estimated number of times a risk event occurs per year. ### Tarjeta 65 **Pregunta** What is an inherence factor? **Respuesta** A biometric characteristic of the claimant. ### Tarjeta 66 **Pregunta** What do a threat actor's sophistication and capability describe? **Respuesta** The technical skill, tools, knowledge, resources, and operational discipline the actor can apply. ### Tarjeta 67 **Pregunta** What is a SIEM? **Respuesta** A platform that centralizes security data and supports search, correlation, alerting, and investigation. ### Tarjeta 68 **Pregunta** What is sideloading? **Respuesta** Installing software from outside the platform's approved distribution path. ### Tarjeta 69 **Pregunta** What does an IDS or IPS signature match? **Respuesta** A known pattern in traffic or behavior associated with a threat, exploit, or policy violation. ### Tarjeta 70 **Pregunta** Why are embedded systems often difficult to patch? **Respuesta** They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support. ### Tarjeta 71 **Pregunta** What is a virtual private network? **Respuesta** An encrypted logical connection that carries private traffic across an untrusted or shared network. ### Tarjeta 72 **Pregunta** What should an initial security-awareness report establish? **Respuesta** The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared. ### Tarjeta 73 **Pregunta** What is symmetric encryption? **Respuesta** Encryption that uses the same secret key to encrypt and decrypt data. ### Tarjeta 74 **Pregunta** What happens during incident detection? **Respuesta** Monitoring or a report identifies activity that may meet the organization's incident criteria. ### Tarjeta 75 **Pregunta** What is recovery time objective? **Respuesta** The target maximum time to restore a function after disruption. ### Tarjeta 76 **Pregunta** Why prioritize password length? **Respuesta** Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions. ### Tarjeta 77 **Pregunta** What must sanitization accomplish before an asset leaves organizational control? **Respuesta** It must make the retained data infeasible to recover with the method appropriate to the media and risk. ### Tarjeta 78 **Pregunta** What is a real-time operating system designed to provide? **Respuesta** Predictable response timing for tasks with strict deadlines. ### Tarjeta 79 **Pregunta** What does fail-open behavior do when a control fails? **Respuesta** It permits traffic or access to preserve availability. ### Tarjeta 80 **Pregunta** What is jailbreaking or rooting a mobile device? **Respuesta** Removing platform restrictions to gain privileged control over the operating system. ### Tarjeta 81 **Pregunta** What does network access control enforce? **Respuesta** Identity, device posture, and access policy at network connection time and during a session. ### Tarjeta 82 **Pregunta** What does data loss prevention do? **Respuesta** Detects and may block sensitive data use or transfer that violates policy. ### Tarjeta 83 **Pregunta** What security property does a blockchain provide? **Respuesta** A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links. ### Tarjeta 84 **Pregunta** What is recovery point objective? **Respuesta** The target maximum acceptable data loss measured backward in time. ### Tarjeta 85 **Pregunta** How do ICS and SCADA relate? **Respuesta** An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment. ### Tarjeta 86 **Pregunta** What does fail-closed behavior do when a control fails? **Respuesta** It denies traffic or access to preserve security. ### Tarjeta 87 **Pregunta** Which keys create and verify a typical digital signature? **Respuesta** The signer creates it with a private key, and others verify it with the corresponding public key. ### Tarjeta 88 **Pregunta** What is SQL injection? **Respuesta** Input that alters the structure or meaning of a database query because code and data were not safely separated. ### Tarjeta 89 **Pregunta** What does DKIM verify? **Respuesta** That selected message content was signed by a domain and was not altered after signing. ### Tarjeta 90 **Pregunta** What is post-incident activity? **Respuesta** Learning from the event and improving controls, plans, and recovery based on evidence. ### Tarjeta 91 **Pregunta** What characterizes an expansionary risk appetite? **Respuesta** A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity. ### Tarjeta 92 **Pregunta** How do centralized and decentralized architectures differ? **Respuesta** Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations. ### Tarjeta 93 **Pregunta** What does a certificate revocation list publish? **Respuesta** Certificate serial numbers that the issuer has invalidated before their scheduled expiration. ### Tarjeta 94 **Pregunta** What is a legal hold? **Respuesta** A directive to preserve potentially relevant information by suspending normal deletion or disposal. ### Tarjeta 95 **Pregunta** What is exposure factor in quantitative risk analysis? **Respuesta** The estimated percentage of an asset's value lost in one event. ### Tarjeta 96 **Pregunta** What is decentralized architecture? **Respuesta** Control or service responsibility is distributed across multiple independent components or locations. ### Tarjeta 97 **Pregunta** What is tokenization? **Respuesta** Replacing sensitive data with a non-sensitive token whose mapping is held separately. ### Tarjeta 98 **Pregunta** How can automation act as a workforce multiplier? **Respuesta** It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement. ### Tarjeta 99 **Pregunta** What can endpoint process logs reveal? **Respuesta** Which programs ran, their parent-child relationships, users, timing, and command details when captured. ### Tarjeta 100 **Pregunta** What does the CIA triad protect? **Respuesta** Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access. ### Tarjeta 101 **Pregunta** How does data masking protect information? **Respuesta** It hides selected values or characters while preserving a usable representation. ### Tarjeta 102 **Pregunta** How can a national requirement affect security governance? **Respuesta** It can impose country-level duties that policies, controls, records, and oversight must satisfy. ### Tarjeta 103 **Pregunta** What do integrations and APIs provide to security orchestration? **Respuesta** Defined interfaces for exchanging data and triggering actions across tools without manual handoffs. ### Tarjeta 104 **Pregunta** What makes a compliance report external? **Respuesta** It is prepared for a regulator, customer, auditor, partner, or other party outside the organization. ### Tarjeta 105 **Pregunta** What does a cryptographic algorithm define? **Respuesta** The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data. ### Tarjeta 106 **Pregunta** Why compare systems with a secure baseline regularly? **Respuesta** To detect drift, unauthorized changes, and missing hardening. ### Tarjeta 107 **Pregunta** What does integrity protect? **Respuesta** The accuracy and completeness of data and systems against unauthorized change. ### Tarjeta 108 **Pregunta** What does vulnerability classification organize? **Respuesta** Findings into meaningful types or categories so teams can route, compare, and remediate them consistently. ### Tarjeta 109 **Pregunta** What does a password standard define? **Respuesta** Mandatory, measurable requirements for creating, storing, using, and changing passwords. ### Tarjeta 110 **Pregunta** What technology capacity must a recovery design plan for? **Respuesta** The compute, storage, software, licenses, and supporting services needed to meet recovery demand. ### Tarjeta 111 **Pregunta** What does a confidential data classification indicate? **Respuesta** Disclosure is limited to authorized people because exposure could harm the organization or affected parties. ### Tarjeta 112 **Pregunta** What makes a vendor assessment independent? **Respuesta** The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria. ### Tarjeta 113 **Pregunta** What lets a worm spread without attaching itself to another file? **Respuesta** It is a standalone program that replicates across reachable systems or services. ### Tarjeta 114 **Pregunta** What is microsegmentation? **Respuesta** Fine-grained isolation of individual workloads or small groups with explicit communication policy. ### Tarjeta 115 **Pregunta** What can application logs reveal? **Respuesta** Transactions, errors, user actions, and application-specific security events. ### Tarjeta 116 **Pregunta** What does deploying a secure baseline require? **Respuesta** Applying the approved settings consistently to the intended resources and verifying the realized configuration. ### Tarjeta 117 **Pregunta** How can resource-provisioning automation improve security? **Respuesta** It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls. ### Tarjeta 118 **Pregunta** What does availability protect? **Respuesta** Reliable, timely access to systems and data when authorized users need them. ### Tarjeta 119 **Pregunta** Why must a change request describe business impact? **Respuesta** So approvers can weigh the benefit, risk, outage, and affected users before authorizing it. ### Tarjeta 120 **Pregunta** What does an authenticated vulnerability scan add? **Respuesta** Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss. ### Tarjeta 121 **Pregunta** What does a change-management procedure specify? **Respuesta** The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change. ### Tarjeta 122 **Pregunta** What is a sanction for noncompliance? **Respuesta** A formal penalty or restriction imposed by an authority for failing to meet a requirement. ### Tarjeta 123 **Pregunta** How can email deliver a security attack? **Respuesta** It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient. ### Tarjeta 124 **Pregunta** What is an internal compliance audit? **Respuesta** An organization-led examination of whether selected operations and controls meet defined requirements. ### Tarjeta 125 **Pregunta** What is a Trojan? **Respuesta** Malware disguised as legitimate or desirable software. ### Tarjeta 126 **Pregunta** What is clustering? **Respuesta** Multiple systems work together to provide a service and tolerate member failure. ### Tarjeta 127 **Pregunta** What makes data regulated? **Respuesta** A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties. ### Tarjeta 128 **Pregunta** What does a wireless heat map show? **Respuesta** Measured or modeled signal strength and coverage across a physical area. ### Tarjeta 129 **Pregunta** How should vendor criticality affect due diligence? **Respuesta** Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval. ### Tarjeta 130 **Pregunta** How can a digital signature support non-repudiation? **Respuesta** It provides evidence that the holder of a private key signed specific data. ### Tarjeta 131 **Pregunta** What should vulnerability prioritization consider beyond severity? **Respuesta** Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations. ### Tarjeta 132 **Pregunta** What is a security guideline? **Respuesta** Recommended practice that allows judgment unless adopted as a requirement. ### Tarjeta 133 **Pregunta** What usually distinguishes a nation-state threat actor? **Respuesta** Strategic objectives, substantial resources, patience, and advanced operational capability. ### Tarjeta 134 **Pregunta** What is spyware? **Respuesta** Software that secretly collects information about a user or system. ### Tarjeta 135 **Pregunta** Why maintain an allow list for applications? **Respuesta** Only explicitly approved software is permitted to execute. ### Tarjeta 136 **Pregunta** How can an image become an attack vector? **Respuesta** It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code. ### Tarjeta 137 **Pregunta** What makes a security control technical? **Respuesta** It is enforced mainly by technology, such as a firewall rule or endpoint policy. ### Tarjeta 138 **Pregunta** What is identity proofing? **Respuesta** Establishing that a person is who they claim to be before issuing an account or credential. ### Tarjeta 139 **Pregunta** What is an automated security guardrail? **Respuesta** A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group. ### Tarjeta 140 **Pregunta** Why assign an owner to a planned change? **Respuesta** To make one party accountable for coordination, execution, and follow-through. ### Tarjeta 141 **Pregunta** How can national privacy law affect data handling? **Respuesta** It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights. ### Tarjeta 142 **Pregunta** What is continuity of operations? **Respuesta** Maintaining essential functions during disruption and restoring supporting capabilities in a planned order. ### Tarjeta 143 **Pregunta** What security tradeoff comes with BYOD? **Respuesta** The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle. ### Tarjeta 144 **Pregunta** How should policies and handbooks support security training? **Respuesta** They provide accessible, current rules and reporting steps that training can apply to real situations. ### Tarjeta 145 **Pregunta** What is a keylogger? **Respuesta** A tool that records keystrokes to capture data such as credentials. ### Tarjeta 146 **Pregunta** What makes information a trade secret? **Respuesta** It provides business value because it is not generally known and is protected through reasonable secrecy measures. ### Tarjeta 147 **Pregunta** What does authentication establish? **Respuesta** It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim. ### Tarjeta 148 **Pregunta** What risk comes from an untrusted file attachment? **Respuesta** Opening or parsing it can execute malicious code or expose data. ### Tarjeta 149 **Pregunta** How does risk tolerance affect vulnerability remediation? **Respuesta** It sets how much residual exposure the organization will accept and how quickly a finding must be treated. ### Tarjeta 150 **Pregunta** How can a global requirement affect security governance? **Respuesta** It can require a common control and oversight approach across multiple countries while local obligations still apply. ### Tarjeta 151 **Pregunta** Why should questionnaire answers be supported by evidence? **Respuesta** Self-assertions alone may not prove that controls are designed or operating effectively. ### Tarjeta 152 **Pregunta** What is an independent third-party audit? **Respuesta** An external party with suitable independence examines evidence against defined criteria. ### Tarjeta 153 **Pregunta** What do account provisioning and deprovisioning do? **Respuesta** Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed. ### Tarjeta 154 **Pregunta** What is an unskilled attacker commonly called? **Respuesta** A script kiddie: someone who relies on tools or instructions created by others. ### Tarjeta 155 **Pregunta** What is a rootkit? **Respuesta** Software designed to maintain privileged, concealed access by altering or subverting the system. ### Tarjeta 156 **Pregunta** What does an access control list enforce? **Respuesta** Explicit permit or deny rules for subjects, traffic, or actions on a protected resource. ### Tarjeta 157 **Pregunta** What should system security monitoring observe? **Respuesta** Host state and behavior such as processes, authentication, configuration, resource use, and security events. ### Tarjeta 158 **Pregunta** What can operating-system security logs reveal? **Respuesta** Authentication, privilege use, policy changes, services, and other host security events. ### Tarjeta 159 **Pregunta** Why isolate operational technology from general business networks? **Respuesta** To limit attack paths into safety- and availability-critical processes. ### Tarjeta 160 **Pregunta** What is the COPE mobile deployment model? **Respuesta** The organization owns the device but permits defined personal use while retaining management control. ### Tarjeta 161 **Pregunta** What security work belongs in asset acquisition and procurement? **Respuesta** Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment. ### Tarjeta 162 **Pregunta** How can user-provisioning automation improve security? **Respuesta** It creates, changes, and removes access from authoritative identity events with consistent approvals and logging. ### Tarjeta 163 **Pregunta** What people capacity must a continuity plan account for? **Respuesta** Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services. ### Tarjeta 164 **Pregunta** What do authorization models define? **Respuesta** How permissions are assigned to authenticated subjects and evaluated for requested actions. ### Tarjeta 165 **Pregunta** Why are removable devices an attack vector? **Respuesta** They can introduce malware or remove data while bypassing network controls. ### Tarjeta 166 **Pregunta** What should predeployment change-test results show? **Respuesta** Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects. ### Tarjeta 167 **Pregunta** What is the time-of-use stage of a race-condition vulnerability? **Respuesta** The application acts on a resource after the check, creating a gap in which another process may change the resource. ### Tarjeta 168 **Pregunta** What is data in use? **Respuesta** Data actively processed in memory or by an application. ### Tarjeta 169 **Pregunta** What does open-source vulnerability intelligence contribute? **Respuesta** Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure. ### Tarjeta 170 **Pregunta** What can file-integrity monitoring detect? **Respuesta** Unexpected changes to protected files, directories, or configuration. ### Tarjeta 171 **Pregunta** Why should deprovisioning be prompt? **Respuesta** Former users or roles should not retain usable access. ### Tarjeta 172 **Pregunta** What is an acceptable use policy? **Respuesta** Rules for permitted and prohibited use of organizational systems, accounts, and data. ### Tarjeta 173 **Pregunta** What makes a compliance report internal? **Respuesta** It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action. ### Tarjeta 174 **Pregunta** What is a logic bomb? **Respuesta** Malicious code that activates when a specified condition or time is reached. ### Tarjeta 175 **Pregunta** What does a right-to-audit clause provide? **Respuesta** Contractual authority to inspect or obtain evidence about agreed controls. ### Tarjeta 176 **Pregunta** Where should a forward proxy sit in an enterprise traffic path? **Respuesta** Between clients and external services so outbound requests pass through policy and logging before reaching destinations. ### Tarjeta 177 **Pregunta** Which cues should make a message look suspicious? **Respuesta** Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment. ### Tarjeta 178 **Pregunta** What makes a security control managerial? **Respuesta** It directs risk and governance through decisions such as policies, assessments, and oversight. ### Tarjeta 179 **Pregunta** What is the CYOD mobile deployment model? **Respuesta** The user selects from organization-approved device options that remain subject to corporate security requirements. ### Tarjeta 180 **Pregunta** How does client-based vulnerable software differ from an agentless exposure? **Respuesta** Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent. ### Tarjeta 181 **Pregunta** What makes a risk assessment recurring? **Respuesta** It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated. ### Tarjeta 182 **Pregunta** What does a defensive penetration-testing team practice? **Respuesta** Detection, investigation, containment, and improvement while authorized offensive activity tests the environment. ### Tarjeta 183 **Pregunta** In a zero-trust data plane, what can the subject or system represent? **Respuesta** The user, device, workload, or service requesting access to a protected resource. ### Tarjeta 184 **Pregunta** What primarily motivates a hacktivist? **Respuesta** A political, social, or ideological cause. ### Tarjeta 185 **Pregunta** What is bloatware? **Respuesta** Unnecessary preinstalled software that consumes resources and can expand the attack surface. ### Tarjeta 186 **Pregunta** Why keep endpoint-protection signatures and engines current? **Respuesta** They need current detection logic to recognize newly identified malware and exploit behavior. ### Tarjeta 187 **Pregunta** What should application security monitoring observe? **Respuesta** Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise. ### Tarjeta 188 **Pregunta** What is role-based access control? **Respuesta** Permissions are assigned to roles, and identities receive access through their roles. ### Tarjeta 189 **Pregunta** What is geographic dispersal? **Respuesta** Placing redundant resources in separate locations so one regional event does not affect all copies. ### Tarjeta 190 **Pregunta** What is a malicious update? **Respuesta** An update that has been intentionally altered or distributed to install harmful code through a trusted update path. ### Tarjeta 191 **Pregunta** What does static application analysis inspect? **Respuesta** Source code, bytecode, or compiled code without executing the application. ### Tarjeta 192 **Pregunta** What does a firewall access list define? **Respuesta** An ordered set of traffic-matching conditions and the action applied when a condition matches. ### Tarjeta 193 **Pregunta** What does a disaster recovery policy establish? **Respuesta** Management expectations for restoring technology and data after a disruptive event. ### Tarjeta 194 **Pregunta** How does logical segmentation separate workloads that share physical infrastructure? **Respuesta** It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware. ### Tarjeta 195 **Pregunta** How should IDS and IPS placement differ? **Respuesta** An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic. ### Tarjeta 196 **Pregunta** What should automated ticket creation capture? **Respuesta** The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event. ### Tarjeta 197 **Pregunta** What makes information intellectual property? **Respuesta** It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret. ### Tarjeta 198 **Pregunta** What is a backout plan? **Respuesta** Predefined steps for safely reversing a failed or harmful change. ### Tarjeta 199 **Pregunta** Why is an unsecure wireless network an attack vector? **Respuesta** Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak. ### Tarjeta 200 **Pregunta** What is physical brute force? **Respuesta** Using force to defeat a lock, barrier, enclosure, or other physical control. ### Tarjeta 201 **Pregunta** What is application sandboxing? **Respuesta** Running code in a constrained environment with limited access to the host and data. ### Tarjeta 202 **Pregunta** Why assign an asset owner? **Respuesta** One accountable party must decide its use, protection, and lifecycle. ### Tarjeta 203 **Pregunta** What happens during risk identification? **Respuesta** Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm. ### Tarjeta 204 **Pregunta** What should an SLA state about breach notification? **Respuesta** The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties. ### Tarjeta 205 **Pregunta** How do due diligence and due care differ in compliance? **Respuesta** Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require. ### Tarjeta 206 **Pregunta** What is attribute-based access control? **Respuesta** Policy evaluates attributes of the subject, resource, action, and environment. ### Tarjeta 207 **Pregunta** What does a zero-trust policy engine do? **Respuesta** It evaluates policy and signals to decide whether access should be allowed. ### Tarjeta 208 **Pregunta** How does a cloud responsibility matrix allocate security duties? **Respuesta** It maps each security task to the provider, the customer, or both, according to the service model and agreement. ### Tarjeta 209 **Pregunta** Where should a load balancer sit in a service path? **Respuesta** In front of service instances so it can route requests to healthy backends. ### Tarjeta 210 **Pregunta** What should the security team do with a reported suspicious message? **Respuesta** Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take. ### Tarjeta 211 **Pregunta** What makes an operating-system vulnerability high impact? **Respuesta** It can affect every application and security control that relies on the compromised OS. ### Tarjeta 212 **Pregunta** What does dynamic application analysis inspect? **Respuesta** The behavior and externally visible weaknesses of a running application. ### Tarjeta 213 **Pregunta** How can false-positive trends affect IDS or IPS tuning? **Respuesta** Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic. ### Tarjeta 214 **Pregunta** What does a business continuity policy establish? **Respuesta** Management expectations for sustaining and restoring critical business functions. ### Tarjeta 215 **Pregunta** What is a hot recovery site? **Respuesta** A ready, synchronized environment intended to take over quickly. ### Tarjeta 216 **Pregunta** What makes an insider threat distinct? **Respuesta** The actor has legitimate access or organizational knowledge that can be misused. ### Tarjeta 217 **Pregunta** What is RFID cloning? **Respuesta** Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections. ### Tarjeta 218 **Pregunta** Why apply vendor security updates promptly? **Respuesta** They remove known weaknesses before attackers can exploit the unpatched exposure. ### Tarjeta 219 **Pregunta** What should infrastructure security monitoring observe? **Respuesta** Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity. ### Tarjeta 220 **Pregunta** What can firewall logs reveal? **Respuesta** Allowed or denied network connections across controlled boundaries. ### Tarjeta 221 **Pregunta** Why minimize open service ports? **Respuesta** Each reachable service adds code, configuration, and authentication paths an attacker can probe. ### Tarjeta 222 **Pregunta** What is threat hunting? **Respuesta** A proactive search for evidence of malicious activity that existing detections have not confirmed. ### Tarjeta 223 **Pregunta** What triggers an ad hoc risk assessment? **Respuesta** A specific change, incident, finding, or decision that requires evaluation outside the regular schedule. ### Tarjeta 224 **Pregunta** What makes an assessment external? **Respuesta** A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions. ### Tarjeta 225 **Pregunta** What is data sovereignty? **Respuesta** The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled. ### Tarjeta 226 **Pregunta** What security boundary does a cellular connection create for a mobile device? **Respuesta** It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy. ### Tarjeta 227 **Pregunta** What makes a security control operational? **Respuesta** It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures. ### Tarjeta 228 **Pregunta** What is discretionary access control? **Respuesta** A resource owner can decide who receives access, within system policy. ### Tarjeta 229 **Pregunta** How can careful automation support employee retention? **Respuesta** It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people. ### Tarjeta 230 **Pregunta** Why does ease of deployment matter in an architecture decision? **Respuesta** A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden. ### Tarjeta 231 **Pregunta** What tradeoff comes with placing an NGFW inline? **Respuesta** It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed. ### Tarjeta 232 **Pregunta** What does a zero-trust policy administrator do? **Respuesta** It carries out the policy engine's decision, such as creating or ending a session. ### Tarjeta 233 **Pregunta** What should a master service agreement define for data return and deletion? **Respuesta** The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends. ### Tarjeta 234 **Pregunta** What is an environmental physical attack? **Respuesta** Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities. ### Tarjeta 235 **Pregunta** When should a maintenance window be chosen? **Respuesta** When disruption and rollback can be managed with the least business impact. ### Tarjeta 236 **Pregunta** What is memory injection? **Respuesta** Placing malicious code or data into another process's memory so it executes in that process's context. ### Tarjeta 237 **Pregunta** What does software composition analysis find? **Respuesta** Known risks and license information in third-party dependencies. ### Tarjeta 238 **Pregunta** What is DNS filtering? **Respuesta** Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate. ### Tarjeta 239 **Pregunta** What should an incident response policy establish? **Respuesta** Authority, scope, reporting duties, and organizational commitment for incident handling. ### Tarjeta 240 **Pregunta** How can noncompliance cause reputational damage? **Respuesta** Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty. ### Tarjeta 241 **Pregunta** What does full-disk encryption protect? **Respuesta** All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection. ### Tarjeta 242 **Pregunta** Why are default credentials dangerous? **Respuesta** They are widely known or easily discovered and often remain unchanged. ### Tarjeta 243 **Pregunta** What makes a risk assessment one-time? **Respuesta** It evaluates a defined decision or scope once without an established repeating cadence. ### Tarjeta 244 **Pregunta** What is a warm recovery site? **Respuesta** A partially equipped environment that needs some data restoration or configuration before use. ### Tarjeta 245 **Pregunta** What does application input validation do? **Respuesta** It checks that input matches the expected type, length, range, and format before use. ### Tarjeta 246 **Pregunta** What should an asset inventory record besides a device name? **Respuesta** Identifiers, owner, location, status, classification, dependencies, and supported version as applicable. ### Tarjeta 247 **Pregunta** What is mandatory access control? **Respuesta** A central authority enforces access through labels and rules that ordinary owners cannot override. ### Tarjeta 248 **Pregunta** What security benefit does infrastructure as code provide? **Respuesta** Repeatable, reviewable deployments that reduce undocumented configuration drift. ### Tarjeta 249 **Pregunta** When should a public service control fail closed? **Respuesta** When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path. ### Tarjeta 250 **Pregunta** What should users do with a suspicious message? **Respuesta** Report it through the approved channel without interacting with its links or attachments. ### Tarjeta 251 **Pregunta** What usually motivates organized cybercrime? **Respuesta** Financial gain through scalable or repeatable criminal activity. ### Tarjeta 252 **Pregunta** How can malicious code support a network attack? **Respuesta** It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution. ### Tarjeta 253 **Pregunta** When is virtual patching useful? **Respuesta** When a network or application control can block exploit traffic before the underlying system can be patched. ### Tarjeta 254 **Pregunta** What does security-monitoring reporting provide? **Respuesta** A summarized, audience-appropriate view of findings, trends, risk, and response status. ### Tarjeta 255 **Pregunta** What does data geolocation identify? **Respuesta** The physical or legal location where data is stored, processed, or transmitted. ### Tarjeta 256 **Pregunta** What does a zero-trust policy enforcement point do? **Respuesta** It enables, monitors, and terminates the connection between a subject and a resource. ### Tarjeta 257 **Pregunta** What is cryptographic key exchange? **Respuesta** A method for parties to establish shared key material over an untrusted channel. ### Tarjeta 258 **Pregunta** How can a vendor become a supply-chain attack vector? **Respuesta** An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers. ### Tarjeta 259 **Pregunta** Why can legacy hardware remain vulnerable? **Respuesta** It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls. ### Tarjeta 260 **Pregunta** What can proprietary vulnerability intelligence add beyond open sources? **Respuesta** Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship. ### Tarjeta 261 **Pregunta** How does a centralized proxy apply web filtering? **Respuesta** It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic. ### Tarjeta 262 **Pregunta** How can continuous integration and testing improve security automation? **Respuesta** Changes receive repeatable checks before deployment instead of reaching production unvalidated. ### Tarjeta 263 **Pregunta** What is containment? **Respuesta** Limiting an incident's spread or damage while preserving necessary operations and evidence. ### Tarjeta 264 **Pregunta** What is a software development lifecycle policy meant to ensure? **Respuesta** Security requirements and checks are integrated throughout design, development, release, and maintenance. ### Tarjeta 265 **Pregunta** What makes risk assessment continuous? **Respuesta** Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review. ### Tarjeta 266 **Pregunta** What is a memorandum of agreement? **Respuesta** A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction. ### Tarjeta 267 **Pregunta** What makes a penetration test integrated? **Respuesta** Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response. ### Tarjeta 268 **Pregunta** How does a DNS amplification attack magnify traffic? **Respuesta** It sends small spoofed queries that trigger larger replies toward the victim. ### Tarjeta 269 **Pregunta** Why does ease of recovery matter in an architecture decision? **Respuesta** The design should let operators restore service and trusted state without fragile, slow, or undocumented steps. ### Tarjeta 270 **Pregunta** What does 802.1X control before a device receives normal network access? **Respuesta** Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed. ### Tarjeta 271 **Pregunta** What is rule-based access control? **Respuesta** System-wide rules grant or deny access based on conditions such as network, time, or action. ### Tarjeta 272 **Pregunta** What is mobile device management? **Respuesta** Central enrollment, configuration, monitoring, and enforcement for managed mobile devices. ### Tarjeta 273 **Pregunta** What tradeoff comes with a cold recovery site? **Respuesta** It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation. ### Tarjeta 274 **Pregunta** Why identify stakeholders before approving a security-sensitive change? **Respuesta** They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss. ### Tarjeta 275 **Pregunta** How do attestation and acknowledgement differ? **Respuesta** Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement. ### Tarjeta 276 **Pregunta** What does zero-trust adaptive identity mean? **Respuesta** Access decisions adjust to current risk signals rather than relying only on a static login. ### Tarjeta 277 **Pregunta** What makes a security control physical? **Respuesta** It protects facilities or equipment through a tangible barrier or mechanism. ### Tarjeta 278 **Pregunta** What is geo-fencing for data? **Respuesta** Enforcing location-based boundaries on where data or services may be accessed or operated. ### Tarjeta 279 **Pregunta** What does a Trusted Platform Module protect? **Respuesta** Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation. ### Tarjeta 280 **Pregunta** Why can a managed service provider amplify risk? **Respuesta** Its privileged access and shared tooling can provide a path into many customers. ### Tarjeta 281 **Pregunta** What does probability express in risk analysis? **Respuesta** A quantified chance that a defined event will occur within stated conditions or time. ### Tarjeta 282 **Pregunta** Why can shadow IT create a threat? **Respuesta** It bypasses security review, inventory, monitoring, and supported configuration. ### Tarjeta 283 **Pregunta** What is on-path interception? **Respuesta** An attacker positions between communicating parties to observe or alter traffic. ### Tarjeta 284 **Pregunta** Why include encryption in a system-hardening baseline? **Respuesta** It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary. ### Tarjeta 285 **Pregunta** Why tune security alerts? **Respuesta** To keep useful detections while reducing noise that wastes analyst attention. ### Tarjeta 286 **Pregunta** What can IPS or IDS logs contribute to an investigation? **Respuesta** The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity. ### Tarjeta 287 **Pregunta** What is VM escape? **Respuesta** A vulnerability that lets code break out of a virtual machine and affect the host or another guest. ### Tarjeta 288 **Pregunta** How can segmentation reduce vulnerability exposure before a patch is available? **Respuesta** It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement. ### Tarjeta 289 **Pregunta** Why should firewall policy name the required ports and protocols explicitly? **Respuesta** Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths. ### Tarjeta 290 **Pregunta** What is a change management policy meant to control? **Respuesta** How changes are requested, assessed, approved, tested, implemented, and reviewed. ### Tarjeta 291 **Pregunta** What is a hybrid-cloud architecture? **Respuesta** An environment that integrates private or on-premises resources with public cloud services. ### Tarjeta 292 **Pregunta** How do AH and ESP differ in the security services they can provide? **Respuesta** AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration. ### Tarjeta 293 **Pregunta** What makes user behavior risky? **Respuesta** It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths. ### Tarjeta 294 **Pregunta** What is least privilege? **Respuesta** Granting only the access needed for the required task and no more. ### Tarjeta 295 **Pregunta** What do Secure, HttpOnly, and SameSite cookie attributes restrict? **Respuesta** Transmission to HTTPS, script access, and cross-site sending, respectively. ### Tarjeta 296 **Pregunta** Why discover unmanaged assets? **Respuesta** Unknown systems cannot be patched, monitored, or governed reliably. ### Tarjeta 297 **Pregunta** What is a service-level agreement? **Respuesta** Measurable service commitments and remedies, such as availability or response targets. ### Tarjeta 298 **Pregunta** What should govern automated security escalation? **Respuesta** Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely. ### Tarjeta 299 **Pregunta** What is platform diversity as a resilience strategy? **Respuesta** Using different implementations so one common flaw or failure is less likely to affect every copy. ### Tarjeta 300 **Pregunta** How can replayed session material affect an application? **Respuesta** It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action. ### Tarjeta 301 **Pregunta** What is an implicit trust zone in zero trust? **Respuesta** A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement. ### Tarjeta 302 **Pregunta** What does salting a password hash accomplish? **Respuesta** It makes identical passwords hash differently and defeats precomputed hash tables. ### Tarjeta 303 **Pregunta** What is spear phishing? **Respuesta** Phishing tailored to a specific person, role, or organization. ### Tarjeta 304 **Pregunta** What is eradication? **Respuesta** Removing the attacker's access, malicious artifacts, and exploited conditions. ### Tarjeta 305 **Pregunta** Who is a risk owner? **Respuesta** The person accountable for deciding and monitoring how a specific risk is handled. ### Tarjeta 306 **Pregunta** What does a partially known penetration-test environment provide? **Respuesta** The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold. ### Tarjeta 307 **Pregunta** What is a microservices architecture? **Respuesta** An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries. ### Tarjeta 308 **Pregunta** What is a jump server? **Respuesta** A hardened intermediary used to reach systems in a restricted management network. ### Tarjeta 309 **Pregunta** What can happen when a configuration change is made without dependency analysis? **Respuesta** A downstream service can fail even when the changed component works. ### Tarjeta 310 **Pregunta** What is resource reuse exposure? **Respuesta** Sensitive data from a previous use remains accessible when storage or memory is reassigned. ### Tarjeta 311 **Pregunta** Why does financial information require explicit protection? **Respuesta** It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed. ### Tarjeta 312 **Pregunta** What does CVE provide? **Respuesta** A common identifier for a publicly disclosed vulnerability. ### Tarjeta 313 **Pregunta** Where can DLP controls operate? **Respuesta** On endpoints, networks, email, and cloud services, depending on the product and visibility. ### Tarjeta 314 **Pregunta** What does privileged password vaulting protect? **Respuesta** It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password. ### Tarjeta 315 **Pregunta** What does an access-control standard define? **Respuesta** Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access. ### Tarjeta 316 **Pregunta** How can automation support compliance monitoring? **Respuesta** It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context. ### Tarjeta 317 **Pregunta** What does static code analysis examine? **Respuesta** Source or compiled code for weakness patterns without executing the application. ### Tarjeta 318 **Pregunta** What actor attribute describes funding, time, and personnel? **Respuesta** Resources. ### Tarjeta 319 **Pregunta** What is DNS poisoning? **Respuesta** Introducing false DNS data so names resolve to attacker-chosen destinations. ### Tarjeta 320 **Pregunta** Why change default credentials during hardening? **Respuesta** Default secrets are predictable and commonly targeted. ### Tarjeta 321 **Pregunta** What does quarantine do after a security alert? **Respuesta** It restricts a suspected asset or object while analysts validate and remediate the risk. ### Tarjeta 322 **Pregunta** What does key stretching do for stored passwords? **Respuesta** It deliberately makes each password guess more computationally expensive. ### Tarjeta 323 **Pregunta** What is smishing? **Respuesta** Phishing delivered through SMS or another text-messaging service. ### Tarjeta 324 **Pregunta** What is qualitative risk analysis? **Respuesta** Using descriptive scales such as low, medium, and high to compare likelihood and impact. ### Tarjeta 325 **Pregunta** What is a master service agreement? **Respuesta** An umbrella contract establishing general legal and commercial terms for ongoing work. ### Tarjeta 326 **Pregunta** What is threat scope reduction? **Respuesta** Narrowing the systems, privileges, or paths an attacker can reach. ### Tarjeta 327 **Pregunta** Why use a third-party cloud service instead of building locally? **Respuesta** It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk. ### Tarjeta 328 **Pregunta** What should determine security-device placement? **Respuesta** The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs. ### Tarjeta 329 **Pregunta** What does situational awareness mean for a user? **Respuesta** Notice the people, devices, requests, location, and context around a task before acting. ### Tarjeta 330 **Pregunta** What does a failover test validate? **Respuesta** That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions. ### Tarjeta 331 **Pregunta** What is a preventive control meant to do? **Respuesta** Stop an unwanted event before it succeeds. ### Tarjeta 332 **Pregunta** What is just-in-time privileged access? **Respuesta** Elevated access is granted only when needed and expires after a short approved period. ### Tarjeta 333 **Pregunta** What safeguard should security-group automation enforce? **Respuesta** Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point. ### Tarjeta 334 **Pregunta** How does a reflected DDoS attack hide and multiply sources? **Respuesta** The attacker spoofs the victim's address so many third-party services send their replies to the victim. ### Tarjeta 335 **Pregunta** What is a security misconfiguration? **Respuesta** An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource. ### Tarjeta 336 **Pregunta** Why can the same vulnerability have different organizational impact? **Respuesta** Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation. ### Tarjeta 337 **Pregunta** What does URL scanning evaluate before a user opens a web destination? **Respuesta** The address, redirect chain, reputation, category, and known threat indicators associated with the destination. ### Tarjeta 338 **Pregunta** What is the board's security governance role? **Respuesta** Provide oversight, set risk direction, and hold executives accountable. ### Tarjeta 339 **Pregunta** What does code signing establish? **Respuesta** That code came from the holder of the signing key and has not changed since signing. ### Tarjeta 340 **Pregunta** How should an asset's classification affect security operations? **Respuesta** It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact. ### Tarjeta 341 **Pregunta** How does encryption protect data? **Respuesta** It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data. ### Tarjeta 342 **Pregunta** What is a secure enclave? **Respuesta** A hardware-isolated execution area intended to protect selected code and data from the rest of the system. ### Tarjeta 343 **Pregunta** What is business email compromise? **Respuesta** Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release. ### Tarjeta 344 **Pregunta** What is recovery in incident response? **Respuesta** Restoring services safely, monitoring them, and returning to normal operations. ### Tarjeta 345 **Pregunta** How is single loss expectancy commonly estimated? **Respuesta** Asset value multiplied by the exposure factor. ### Tarjeta 346 **Pregunta** What does an unknown penetration-test environment provide? **Respuesta** The tester begins with little or no internal information, modeling an external attacker's discovery process. ### Tarjeta 347 **Pregunta** What security boundary does a hypervisor provide? **Respuesta** It isolates virtual machines while controlling their access to shared hardware. ### Tarjeta 348 **Pregunta** Why does a TLS tunnel not protect a compromised endpoint? **Respuesta** TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption. ### Tarjeta 349 **Pregunta** Why update diagrams after an infrastructure change? **Respuesta** Operations and incident responders need the documentation to match the deployed environment. ### Tarjeta 350 **Pregunta** What does privacy ownership assign? **Respuesta** An accountable role for privacy decisions, obligations, data inventory, and corrective action. ### Tarjeta 351 **Pregunta** What does a security control gap analysis compare? **Respuesta** The controls required for the target state with the controls currently in place. ### Tarjeta 352 **Pregunta** Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external? **Respuesta** External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization. ### Tarjeta 353 **Pregunta** What is application privilege escalation? **Respuesta** Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted. ### Tarjeta 354 **Pregunta** What risk remains when unnecessary software is left installed? **Respuesta** Its code, services, dependencies, and privileges add attack surface even when users do not need it. ### Tarjeta 355 **Pregunta** What does SCAP standardize? **Respuesta** Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information. ### Tarjeta 356 **Pregunta** What can packet capture reveal? **Respuesta** Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized. ### Tarjeta 357 **Pregunta** What makes a privileged credential ephemeral? **Respuesta** It is created for a limited task or session and expires or is destroyed automatically after that use. ### Tarjeta 358 **Pregunta** How do a statement of work and a work order differ? **Respuesta** A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement. ### Tarjeta 359 **Pregunta** Why might multi-cloud improve resilience? **Respuesta** A provider-wide failure need not stop workloads that can run independently elsewhere. ### Tarjeta 360 **Pregunta** How can a service provider introduce a supply-chain vulnerability? **Respuesta** Its privileged access, hosted service, or compromised integration can expose customers that depend on it. ### Tarjeta 361 **Pregunta** What is a false positive in vulnerability scanning? **Respuesta** A reported weakness that is not actually present or exploitable in the assessed context. ### Tarjeta 362 **Pregunta** How do EDR and XDR differ? **Respuesta** EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains. ### Tarjeta 363 **Pregunta** What should onboarding and offboarding procedures coordinate? **Respuesta** Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship. ### Tarjeta 364 **Pregunta** How should an organization harden managed mobile devices? **Respuesta** Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe. ### Tarjeta 365 **Pregunta** What is a certificate signing request? **Respuesta** A request containing a public key and subject information for a certificate authority to sign. ### Tarjeta 366 **Pregunta** What is pretexting? **Respuesta** Using a fabricated role or situation to make a request seem legitimate. ### Tarjeta 367 **Pregunta** How is annualized loss expectancy commonly estimated? **Respuesta** Single loss expectancy multiplied by annualized rate of occurrence. ### Tarjeta 368 **Pregunta** What security consequence follows from containers sharing a kernel? **Respuesta** A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter. ### Tarjeta 369 **Pregunta** Where does 802.1X enforce a network admission decision? **Respuesta** At the controlled switch port or wireless access point before normal network access is granted. ### Tarjeta 370 **Pregunta** What should insider-threat awareness teach? **Respuesta** Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels. ### Tarjeta 371 **Pregunta** What access action is suitable for careful automation? **Respuesta** Enabling or disabling a defined service or account from an approved lifecycle or incident event. ### Tarjeta 372 **Pregunta** What is an evil twin? **Respuesta** A rogue wireless network made to resemble a legitimate one so users connect to it. ### Tarjeta 373 **Pregunta** Does non-human-readable data need less protection? **Respuesta** No. Encoded or machine-readable data can carry the same sensitive meaning and impact. ### Tarjeta 374 **Pregunta** What does authenticating a system establish? **Respuesta** It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents. ### Tarjeta 375 **Pregunta** What does LDAP provide in identity systems? **Respuesta** A standard protocol for querying and modifying directory entries such as users, groups, and attributes. ### Tarjeta 376 **Pregunta** What is a deterrent control meant to do? **Respuesta** Discourage an attacker from attempting an unwanted action. ### Tarjeta 377 **Pregunta** Why update procedures after changing a security control? **Respuesta** Staff need accurate steps for operating, monitoring, and recovering the new control. ### Tarjeta 378 **Pregunta** How does OCSP differ from a certificate revocation list? **Respuesta** OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers. ### Tarjeta 379 **Pregunta** What is the goal of data exfiltration? **Respuesta** Remove data from its authorized environment without permission. ### Tarjeta 380 **Pregunta** What is a watering-hole attack? **Respuesta** Compromising a site frequented by the intended targets so their visits expose them. ### Tarjeta 381 **Pregunta** How can a hardware provider introduce a supply-chain vulnerability? **Respuesta** A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment. ### Tarjeta 382 **Pregunta** What is application forgery? **Respuesta** Creating or altering a request, token, or object so the application treats it as authentic. ### Tarjeta 383 **Pregunta** How does least privilege mitigate compromise? **Respuesta** It limits the actions and resources available to a compromised account or process. ### Tarjeta 384 **Pregunta** What is serverless computing? **Respuesta** A model where the provider manages servers and the customer deploys event-driven code or functions. ### Tarjeta 385 **Pregunta** What makes an infrastructure control effective for a specific risk? **Respuesta** Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat. ### Tarjeta 386 **Pregunta** What does parallel recovery processing test? **Respuesta** Whether primary and alternate environments can run together consistently before a controlled cutover. ### Tarjeta 387 **Pregunta** Which password-authentication method does WPA3-Personal use? **Respuesta** Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing. ### Tarjeta 388 **Pregunta** How does data retention affect asset disposal? **Respuesta** Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction. ### Tarjeta 389 **Pregunta** What is a false negative in vulnerability scanning? **Respuesta** A real weakness that the assessment fails to report. ### Tarjeta 390 **Pregunta** What does recurring security scanning add to monitoring? **Respuesta** Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes. ### Tarjeta 391 **Pregunta** What should guide port selection for a secure protocol? **Respuesta** Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths. ### Tarjeta 392 **Pregunta** What does forensic acquisition create? **Respuesta** A controlled, documented copy or collection of relevant evidence while preserving its integrity and context. ### Tarjeta 393 **Pregunta** How do system owners and data owners divide security accountability? **Respuesta** A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements. ### Tarjeta 394 **Pregunta** What does likelihood express in risk analysis? **Respuesta** A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable. ### Tarjeta 395 **Pregunta** What is a memorandum of understanding? **Respuesta** A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction. ### Tarjeta 396 **Pregunta** What does the right to be forgotten generally require? **Respuesta** Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies. ### Tarjeta 397 **Pregunta** What does an audit committee oversee? **Respuesta** Audit independence, plans, significant findings, management responses, and corrective-action follow-through. ### Tarjeta 398 **Pregunta** What does identity interoperability require? **Respuesta** Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems. ### Tarjeta 399 **Pregunta** How does a bollard protect a facility? **Respuesta** It blocks or redirects vehicles before they can reach a protected area. ### Tarjeta 400 **Pregunta** How can hashing protect a downloaded file? **Respuesta** A trusted digest lets the recipient detect whether the file changed. ### Tarjeta 401 **Pregunta** What is a credential replay attack? **Respuesta** Using captured valid credentials or tokens again without needing to discover the secret. ### Tarjeta 402 **Pregunta** How can automation complexity create security risk? **Respuesta** Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse. ### Tarjeta 403 **Pregunta** What must an architecture provide when a component cannot be patched? **Respuesta** Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired. ### Tarjeta 404 **Pregunta** What makes remote access secure? **Respuesta** Controlled, authenticated, encrypted access to a private resource from outside its local trusted network. ### Tarjeta 405 **Pregunta** What should users verify before connecting removable media or a cable? **Respuesta** That the device and connection are approved, expected, and handled under organizational policy. ### Tarjeta 406 **Pregunta** What is a self-signed certificate? **Respuesta** A certificate signed by its own private key rather than by a separate trusted issuer. ### Tarjeta 407 **Pregunta** What is brand impersonation? **Respuesta** Using a trusted organization's identity or look to deceive people. ### Tarjeta 408 **Pregunta** What characterizes a conservative risk appetite? **Respuesta** A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity. ### Tarjeta 409 **Pregunta** What should a managed mobile device verify before using Wi-Fi? **Respuesta** The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic. ### Tarjeta 410 **Pregunta** What is a zero-day vulnerability? **Respuesta** A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw. ### Tarjeta 411 **Pregunta** What does verification confirm after vulnerability remediation? **Respuesta** Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope. ### Tarjeta 412 **Pregunta** What is user and entity behavior analytics? **Respuesta** Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services. ### Tarjeta 413 **Pregunta** What does a physical security policy establish? **Respuesta** Required protection for facilities, people, equipment, entry, monitoring, and response to physical events. ### Tarjeta 414 **Pregunta** What does a UPS provide? **Respuesta** Immediate short-term power and power conditioning while systems shut down or alternate power starts. ### Tarjeta 415 **Pregunta** What is a nondisclosure agreement? **Respuesta** A contract restricting use and disclosure of defined confidential information. ### Tarjeta 416 **Pregunta** What should be checked before assigning a user permission? **Respuesta** The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused. ### Tarjeta 417 **Pregunta** How does espionage differ from ordinary theft? **Respuesta** It seeks confidential intelligence for strategic advantage, often while remaining hidden. ### Tarjeta 418 **Pregunta** What is password spraying? **Respuesta** Trying a small set of common passwords across many accounts to avoid lockouts. ### Tarjeta 419 **Pregunta** What is the purpose of system isolation during an incident? **Respuesta** Stop harmful communication while preserving the system for response and investigation. ### Tarjeta 420 **Pregunta** What is a security benchmark? **Respuesta** A documented set of recommended configuration checks for a platform or product. ### Tarjeta 421 **Pregunta** Which metadata fields give a log record investigative context? **Respuesta** Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID. ### Tarjeta 422 **Pregunta** What does an access-control vestibule prevent? **Respuesta** It limits tailgating by allowing controlled passage through one door at a time. ### Tarjeta 423 **Pregunta** What is version control's security value for configuration? **Respuesta** It preserves attributable history and enables review or rollback of changes. ### Tarjeta 424 **Pregunta** Why use both internal and external compliance monitoring? **Respuesta** Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny. ### Tarjeta 425 **Pregunta** What distinguishes on-premises architecture? **Respuesta** The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties. ### Tarjeta 426 **Pregunta** What risk can split tunneling add to a VPN? **Respuesta** The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection. ### Tarjeta 427 **Pregunta** What is a certificate root of trust? **Respuesta** A trusted root certificate or key from which a client validates a certificate chain. ### Tarjeta 428 **Pregunta** What is typosquatting? **Respuesta** Registering a look-alike domain based on common typing errors or visual similarity. ### Tarjeta 429 **Pregunta** What is root-cause analysis? **Respuesta** Identifying the underlying conditions that allowed an incident, not just its visible symptoms. ### Tarjeta 430 **Pregunta** What is risk tolerance? **Respuesta** The acceptable variation or boundary around a specific objective or risk area. ### Tarjeta 431 **Pregunta** What is a security self-assessment? **Respuesta** A structured internal evaluation in which the organization measures its own controls against selected criteria. ### Tarjeta 432 **Pregunta** What does data masking change? **Respuesta** It replaces sensitive values with altered but usable representations, often preserving format for testing or display. ### Tarjeta 433 **Pregunta** How do wireless authentication protocols let clients prove identity securely? **Respuesta** They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange. ### Tarjeta 434 **Pregunta** Why reconcile inventory with network discovery? **Respuesta** Differences expose missing records, retired systems, or unauthorized devices. ### Tarjeta 435 **Pregunta** Why does sideloading raise mobile risk? **Respuesta** It can bypass store review, signing policy, and managed application controls. ### Tarjeta 436 **Pregunta** What does an information-sharing organization add to vulnerability management? **Respuesta** Sector or community intelligence about relevant threats, incidents, and defensive action. ### Tarjeta 437 **Pregunta** What does a web-filter block rule specify? **Respuesta** The URL, domain, category, reputation, content, user, or context that should prevent a web request. ### Tarjeta 438 **Pregunta** How do data custodians and data stewards differ? **Respuesta** Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction. ### Tarjeta 439 **Pregunta** What is a brute-force password attack? **Respuesta** Systematically trying many candidate secrets against an account or protected value. ### Tarjeta 440 **Pregunta** What is a compensating control? **Respuesta** An alternative safeguard used when the preferred control is impractical or unavailable. ### Tarjeta 441 **Pregunta** How can location act as an authentication factor? **Respuesta** A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone. ### Tarjeta 442 **Pregunta** Why must security automation remain supportable? **Respuesta** Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change. ### Tarjeta 443 **Pregunta** What does a standby generator provide? **Respuesta** Longer-duration power during a utility outage, after a startup delay. ### Tarjeta 444 **Pregunta** What makes an architecture air-gapped? **Respuesta** It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary. ### Tarjeta 445 **Pregunta** What is a software-defined WAN? **Respuesta** A centrally managed overlay that selects wide-area paths by policy across underlying network links. ### Tarjeta 446 **Pregunta** What password-management behavior should awareness training reinforce? **Respuesta** Use unique long passwords through an approved manager and report suspected compromise promptly. ### Tarjeta 447 **Pregunta** What security value does fencing provide? **Respuesta** It defines and delays entry across a physical perimeter. ### Tarjeta 448 **Pregunta** What is a wildcard certificate? **Respuesta** A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain. ### Tarjeta 449 **Pregunta** How does misinformation differ from disinformation? **Respuesta** Misinformation is false regardless of intent; disinformation is deliberately false or misleading. ### Tarjeta 450 **Pregunta** What is a risk threshold? **Respuesta** A defined level that triggers escalation, treatment, or another required response. ### Tarjeta 451 **Pregunta** What does a vendor penetration test contribute to assessment? **Respuesta** Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope. ### Tarjeta 452 **Pregunta** What is the objective of a service-disruption attack? **Respuesta** Make a system or business function unavailable or unreliable. ### Tarjeta 453 **Pregunta** What is directory traversal? **Respuesta** Manipulating a file path to reach files outside the directory the application intended to expose. ### Tarjeta 454 **Pregunta** Why decommission an unsupported system? **Respuesta** Removing it eliminates an exposure that can no longer be patched or securely maintained. ### Tarjeta 455 **Pregunta** Why archive security-monitoring data? **Respuesta** To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system. ### Tarjeta 456 **Pregunta** What role does RADIUS commonly play in enterprise Wi-Fi? **Respuesta** It centralizes authentication, authorization information, and accounting for network access. ### Tarjeta 457 **Pregunta** Why separate the requester and approver of a high-risk change? **Respuesta** To reduce error, fraud, and unilateral unauthorized modification. ### Tarjeta 458 **Pregunta** Why can a jailbroken device violate a security baseline? **Respuesta** It weakens platform isolation and allows unapproved privileged changes. ### Tarjeta 459 **Pregunta** When is tokenization especially useful? **Respuesta** When a system needs a surrogate value without retaining the original sensitive value in that workflow. ### Tarjeta 460 **Pregunta** Why can dark-web intelligence affect vulnerability priority? **Respuesta** Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated. ### Tarjeta 461 **Pregunta** What firewall policy should govern traffic from a screened subnet to internal systems? **Respuesta** Deny it by default and allow only explicitly required flows. ### Tarjeta 462 **Pregunta** What does SAML commonly carry? **Respuesta** XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity. ### Tarjeta 463 **Pregunta** What does a security governance committee do? **Respuesta** It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter. ### Tarjeta 464 **Pregunta** How can global privacy requirements affect one data process? **Respuesta** A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located. ### Tarjeta 465 **Pregunta** What characterizes an IoT device? **Respuesta** It combines sensing or actuation with network connectivity, often under tight resource and update constraints. ### Tarjeta 466 **Pregunta** What is a unified threat management appliance? **Respuesta** One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection. ### Tarjeta 467 **Pregunta** What does a hardware security module provide? **Respuesta** A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys. ### Tarjeta 468 **Pregunta** A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains? **Respuesta** Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client. ### Tarjeta 469 **Pregunta** What is a tabletop exercise? **Respuesta** A discussion-based walkthrough of a scenario to test decisions, roles, and procedures. ### Tarjeta 470 **Pregunta** What does a risk exemption authorize? **Respuesta** A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration. ### Tarjeta 471 **Pregunta** What is a regulatory examination? **Respuesta** An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements. ### Tarjeta 472 **Pregunta** What does physical video surveillance primarily provide? **Respuesta** Detection and evidence of activity in monitored areas. ### Tarjeta 473 **Pregunta** What is a birthday attack against a hash? **Respuesta** Using collision probability to find any two matching digests much faster than targeting one exact preimage. ### Tarjeta 474 **Pregunta** Why keep backups both onsite and offsite? **Respuesta** Onsite copies support fast recovery, while offsite copies survive a site-wide loss. ### Tarjeta 475 **Pregunta** How does technical debt affect security automation? **Respuesta** Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely. ### Tarjeta 476 **Pregunta** What should switch hardening restrict first? **Respuesta** Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration. ### Tarjeta 477 **Pregunta** What should happen when an asset changes owners? **Respuesta** Inventory, access, support responsibility, and data handling should be updated. ### Tarjeta 478 **Pregunta** What does evidence of a vendor's internal audits contribute? **Respuesta** It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure. ### Tarjeta 479 **Pregunta** What is identity attestation? **Respuesta** Evidence that an identity, device, authenticator, or claim has been verified by a trusted process. ### Tarjeta 480 **Pregunta** Why can standard enterprise patching be unsafe for an RTOS device? **Respuesta** A change can disrupt timing guarantees or certified operational behavior. ### Tarjeta 481 **Pregunta** What is secure access service edge? **Respuesta** A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources. ### Tarjeta 482 **Pregunta** What social-engineering habit should awareness training reinforce? **Respuesta** Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity. ### Tarjeta 483 **Pregunta** How can a software provider introduce a supply-chain vulnerability? **Respuesta** A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers. ### Tarjeta 484 **Pregunta** Why include internet exposure in remediation priority? **Respuesta** A reachable vulnerable service usually has more attack opportunity than an isolated one. ### Tarjeta 485 **Pregunta** What does a mail gateway inspect? **Respuesta** Inbound and outbound email for threats, policy violations, spoofing, and sensitive data. ### Tarjeta 486 **Pregunta** What is a data controller? **Respuesta** The entity that determines why and how personal data is processed. ### Tarjeta 487 **Pregunta** How does blackmail motivate a cyberattack? **Respuesta** The attacker threatens disclosure or harm unless the victim complies. ### Tarjeta 488 **Pregunta** What is a downgrade attack? **Respuesta** Forcing parties to use an older or weaker protocol or security mode. ### Tarjeta 489 **Pregunta** How does encryption mitigate data exposure? **Respuesta** It makes captured data unreadable without the required key. ### Tarjeta 490 **Pregunta** How do network and web vulnerability scanners differ? **Respuesta** Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses. ### Tarjeta 491 **Pregunta** How can vulnerability-scan data support an investigation? **Respuesta** It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline. ### Tarjeta 492 **Pregunta** What is key escrow? **Respuesta** Controlled storage of a recoverable copy of a cryptographic key by an authorized party. ### Tarjeta 493 **Pregunta** Which human vector commonly uses a fake sign-in page to harvest credentials? **Respuesta** Phishing; the message sends the target to an imitation service that captures the submitted credentials. ### Tarjeta 494 **Pregunta** What is risk avoidance? **Respuesta** Stopping or not starting the activity that creates the risk. ### Tarjeta 495 **Pregunta** What is data obfuscation? **Respuesta** Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy. ### Tarjeta 496 **Pregunta** What is a directive control? **Respuesta** A safeguard that tells people what behavior or action is required. ### Tarjeta 497 **Pregunta** What does a security guard add that a camera cannot? **Respuesta** Human judgment and an immediate physical response. ### Tarjeta 498 **Pregunta** Why define restricted activities in change management? **Respuesta** High-risk actions can then require extra authorization, separation of duties, or a prohibited window. ### Tarjeta 499 **Pregunta** What contractual impact can noncompliance create? **Respuesta** It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach. ### Tarjeta 500 **Pregunta** What should determine backup frequency? **Respuesta** The recovery point objective, data-change rate, business impact, and available replication or storage capacity. ### Tarjeta 501 **Pregunta** What should router hardening protect? **Respuesta** Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy. ### Tarjeta 502 **Pregunta** What problem does OAuth 2.0 address? **Respuesta** Delegated authorization: a client obtains limited access to a resource without receiving the user's password. ### Tarjeta 503 **Pregunta** What does SCADA do? **Respuesta** It provides supervisory monitoring and control across distributed industrial equipment. ### Tarjeta 504 **Pregunta** How does a Layer 3/4 firewall rule differ from a Layer 7 rule? **Respuesta** Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions. ### Tarjeta 505 **Pregunta** What distinguishes a computer virus? **Respuesta** It attaches to a host file or program and spreads when that infected host executes or is shared. ### Tarjeta 506 **Pregunta** What does a key management system coordinate? **Respuesta** Secure key creation, storage, access, rotation, revocation, recovery, and destruction. ### Tarjeta 507 **Pregunta** How can an unsecure wired network expose traffic? **Respuesta** An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak. ### Tarjeta 508 **Pregunta** Why is vulnerable device firmware hard to remediate? **Respuesta** Firmware updates may be rare, vendor-dependent, or impossible after support ends. ### Tarjeta 509 **Pregunta** What does patching change in vulnerability remediation? **Respuesta** It installs the vendor's corrected code or configuration to remove the underlying software weakness. ### Tarjeta 510 **Pregunta** What does DMARC add to SPF and DKIM? **Respuesta** Domain alignment, receiver policy, and reporting for messages claiming the visible From domain. ### Tarjeta 511 **Pregunta** How does automation improve security efficiency? **Respuesta** It performs repeatable actions quickly and consistently while reducing manual handoffs and rework. ### Tarjeta 512 **Pregunta** What is a simulation exercise? **Respuesta** A more realistic practice in which participants respond to injected events using operational processes. ### Tarjeta 513 **Pregunta** What is a data processor? **Respuesta** An entity that processes personal data on behalf of a controller. ### Tarjeta 514 **Pregunta** What is risk mitigation? **Respuesta** Reducing likelihood, impact, or both through controls or process changes. ### Tarjeta 515 **Pregunta** Why monitor a vendor after onboarding? **Respuesta** Security posture, ownership, services, incidents, and dependencies can change. ### Tarjeta 516 **Pregunta** What does a physical penetration test assess? **Respuesta** Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules. ### Tarjeta 517 **Pregunta** Why use access badges at a facility? **Respuesta** To associate entry attempts with authorized identities and enforce access rules. ### Tarjeta 518 **Pregunta** How does permission restriction protect data? **Respuesta** Only authorized identities receive the actions and scope their roles require. ### Tarjeta 519 **Pregunta** What is the usual objective of ransomware extortion? **Respuesta** Force payment by denying access, threatening disclosure, or both. ### Tarjeta 520 **Pregunta** What does impossible travel indicate? **Respuesta** One identity appears to authenticate from distant locations too quickly for legitimate travel. ### Tarjeta 521 **Pregunta** What is configuration enforcement? **Respuesta** Continuously applying or restoring approved settings so systems do not remain in an insecure state. ### Tarjeta 522 **Pregunta** What does a web vulnerability scanner inspect? **Respuesta** Running web behavior for issues such as unsafe input handling and insecure configuration. ### Tarjeta 523 **Pregunta** How does cost affect an architecture choice? **Respuesta** It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life. ### Tarjeta 524 **Pregunta** What does EAP provide with 802.1X? **Respuesta** A framework for carrying an authentication method between the supplicant and authentication infrastructure. ### Tarjeta 525 **Pregunta** What should operational-security training help users protect? **Respuesta** Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence. ### Tarjeta 526 **Pregunta** What does a time-of-day access rule do? **Respuesta** Allows or denies a requested action according to an approved schedule. ### Tarjeta 527 **Pregunta** What should cloud infrastructure hardening establish? **Respuesta** Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift. ### Tarjeta 528 **Pregunta** What should an asset owner ensure during offboarding? **Respuesta** Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process. ### Tarjeta 529 **Pregunta** Why encrypt backups? **Respuesta** Backup media and transfers can expose the same sensitive data as production systems. ### Tarjeta 530 **Pregunta** What is steganography? **Respuesta** Hiding the existence of data inside another medium rather than merely encrypting its contents. ### Tarjeta 531 **Pregunta** Which human vector uses a fabricated authority role to justify a sensitive request? **Respuesta** Pretexting; the attacker invents a credible role and situation to make the request seem legitimate. ### Tarjeta 532 **Pregunta** Why does risk transfer not remove accountability? **Respuesta** The organization can retain legal, reputational, operational, and oversight consequences. ### Tarjeta 533 **Pregunta** Why validate a change after deployment? **Respuesta** To confirm the intended result occurred without introducing unacceptable side effects. ### Tarjeta 534 **Pregunta** What makes end-of-life hardware a security vulnerability? **Respuesta** The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path. ### Tarjeta 535 **Pregunta** What does an audit add to remediation validation? **Respuesta** Independent evidence that the approved fix, process, and documentation were completed and remain effective. ### Tarjeta 536 **Pregunta** Why can SPF pass while a message still impersonates a brand? **Respuesta** SPF checks the envelope domain, which may differ from the visible From domain. ### Tarjeta 537 **Pregunta** What role can a government entity have in security governance? **Respuesta** It can establish, enforce, or oversee legal and regulatory requirements within its authority. ### Tarjeta 538 **Pregunta** How do data inventory and retention support privacy governance? **Respuesta** The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized. ### Tarjeta 539 **Pregunta** What can concurrent sessions from distant regions indicate? **Respuesta** A stolen account or shared credential, subject to VPN and proxy context. ### Tarjeta 540 **Pregunta** What does supply-chain analysis examine? **Respuesta** Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service. ### Tarjeta 541 **Pregunta** What is the purpose of facility lighting as a control? **Respuesta** Deter covert activity and improve observation of people and areas. ### Tarjeta 542 **Pregunta** What architecture quality keeps a service usable during component failure? **Respuesta** Availability. ### Tarjeta 543 **Pregunta** When is fail-open behavior preferable to fail-closed behavior? **Respuesta** When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision. ### Tarjeta 544 **Pregunta** Which control function does a login-failure alert provide? **Respuesta** Detection; it reveals suspicious authentication activity. ### Tarjeta 545 **Pregunta** What does a biometric MFA implementation verify? **Respuesta** A measured physical or behavioral characteristic presented by the user, matched against an enrolled template. ### Tarjeta 546 **Pregunta** How can automation enforce a security baseline? **Respuesta** It compares realized settings with the approved state and reports or corrects unauthorized drift. ### Tarjeta 547 **Pregunta** How do wireless cryptographic protocols protect network traffic? **Respuesta** They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used. ### Tarjeta 548 **Pregunta** Why segment sensitive data stores? **Respuesta** It limits reachable paths and separates them from lower-trust workloads. ### Tarjeta 549 **Pregunta** What must remain secret in an asymmetric key pair? **Respuesta** The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use. ### Tarjeta 550 **Pregunta** How can a supplier become a supply-chain attack vector? **Respuesta** A compromised material, component, credential, or delivery process can weaken products before they reach the organization. ### Tarjeta 551 **Pregunta** What is e-discovery? **Respuesta** Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter. ### Tarjeta 552 **Pregunta** What characterizes a neutral risk appetite? **Respuesta** A balanced willingness to accept uncertainty when expected value and controls justify the exposure. ### Tarjeta 553 **Pregunta** What is passive reconnaissance? **Respuesta** Gathering information without directly interacting with the target's systems. ### Tarjeta 554 **Pregunta** What does a philosophical motive mean for a threat actor? **Respuesta** The actor acts to advance a belief or moral position rather than primarily for money. ### Tarjeta 555 **Pregunta** What does unexpected resource consumption indicate? **Respuesta** Possible malware, denial of service, cryptomining, or a malfunction that needs investigation. ### Tarjeta 556 **Pregunta** What does a host-based intrusion prevention system do? **Respuesta** It monitors activity on one host and can block behavior that matches exploit or attack rules. ### Tarjeta 557 **Pregunta** How does agent-based monitoring differ from agentless monitoring? **Respuesta** An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility. ### Tarjeta 558 **Pregunta** What can network logs contribute to an investigation? **Respuesta** Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment. ### Tarjeta 559 **Pregunta** What is the purpose of a backup restore test? **Respuesta** Demonstrate under tested conditions that required data and systems can be recovered within expectations. ### Tarjeta 560 **Pregunta** Why can obsolete hardware become a security risk? **Respuesta** It may lack supported firmware, modern protections, or replacement parts. ### Tarjeta 561 **Pregunta** What does rescanning confirm after remediation? **Respuesta** Whether the scanner can still detect the original finding on the affected asset. ### Tarjeta 562 **Pregunta** What should a secure transport method provide? **Respuesta** Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic. ### Tarjeta 563 **Pregunta** How can law affect security governance? **Respuesta** It can impose mandatory duties based on jurisdiction, data, industry, or activity. ### Tarjeta 564 **Pregunta** What does resilience mean for a security architecture? **Respuesta** The ability to withstand disruption, adapt, and recover while preserving essential functions. ### Tarjeta 565 **Pregunta** Why minimize an infrastructure's attack surface? **Respuesta** Fewer exposed services and paths leave fewer opportunities for exploitation. ### Tarjeta 566 **Pregunta** What does executing a security-awareness program require? **Respuesta** Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes. ### Tarjeta 567 **Pregunta** What does an infrared security sensor detect? **Respuesta** A change in infrared energy, often the heat pattern created by a person moving through its field of view. ### Tarjeta 568 **Pregunta** What is a knowledge factor? **Respuesta** Something the claimant knows, such as a password. ### Tarjeta 569 **Pregunta** Why review allow-list and deny-list impact before a change? **Respuesta** Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies. ### Tarjeta 570 **Pregunta** What does partition-level encryption protect? **Respuesta** One selected disk partition, leaving other partitions outside that encryption boundary. ### Tarjeta 571 **Pregunta** How can instant messaging deliver a security attack? **Respuesta** It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel. ### Tarjeta 572 **Pregunta** What can repeated blocked-content events indicate? **Respuesta** Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources. ### Tarjeta 573 **Pregunta** What should a server-hardening baseline reduce? **Respuesta** Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change. ### Tarjeta 574 **Pregunta** When is physical media destruction appropriate? **Respuesta** When reuse is unnecessary or sanitization cannot provide adequate assurance. ### Tarjeta 575 **Pregunta** What is mean time to repair? **Respuesta** The average time required to restore a failed component or service. ### Tarjeta 576 **Pregunta** Why disclose conflicts of interest during vendor selection? **Respuesta** A personal or financial relationship can bias evaluation away from the organization's requirements. ### Tarjeta 577 **Pregunta** What is a fine for noncompliance? **Respuesta** A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement. ### Tarjeta 578 **Pregunta** What does a public data classification authorize? **Respuesta** Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply. ### Tarjeta 579 **Pregunta** What security benefit comes from standard infrastructure configurations? **Respuesta** They reduce variation, make review repeatable, and let the same approved controls be applied across resources. ### Tarjeta 580 **Pregunta** How does horizontal scaling increase capacity? **Respuesta** It adds more service instances and distributes work among them. ### Tarjeta 581 **Pregunta** Why can added connectivity weaken segmentation? **Respuesta** Each allowed path can become a route for lateral movement or data escape. ### Tarjeta 582 **Pregunta** What coding practice is central to preventing SQL injection? **Respuesta** Use parameterized queries so untrusted values remain data rather than executable query syntax. ### Tarjeta 583 **Pregunta** When is a compensating control appropriate for a vulnerability? **Respuesta** When timely removal or patching is infeasible and another control can reduce the risk. ### Tarjeta 584 **Pregunta** How does agent-based web filtering enforce policy? **Respuesta** Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy. ### Tarjeta 585 **Pregunta** How can regulation differ from an internal policy? **Respuesta** Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties. ### Tarjeta 586 **Pregunta** What is a storage snapshot? **Respuesta** A point-in-time representation of data or system state, whose independence depends on how it is stored. ### Tarjeta 587 **Pregunta** What does password age measure? **Respuesta** How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change. ### Tarjeta 588 **Pregunta** What does an ethical motive mean in vulnerability research? **Respuesta** The researcher intends to improve security, typically through authorized testing and responsible disclosure. ### Tarjeta 589 **Pregunta** What can missing security logs indicate? **Respuesta** Logging failure, tampering, retention misconfiguration, or an inactive source. ### Tarjeta 590 **Pregunta** Why disable unused ports and protocols? **Respuesta** They expose unnecessary communication paths and code that attackers can reach. ### Tarjeta 591 **Pregunta** What does antivirus contribute to monitoring? **Respuesta** It scans files, memory, or behavior and reports suspected malicious code. ### Tarjeta 592 **Pregunta** What is a honeypot? **Respuesta** A decoy system or service designed to attract and observe malicious activity. ### Tarjeta 593 **Pregunta** What does file-level encryption protect? **Respuesta** Selected files independently of whether the rest of the disk or volume is encrypted. ### Tarjeta 594 **Pregunta** How can SMS deliver a security attack? **Respuesta** A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel. ### Tarjeta 595 **Pregunta** What happens during incident analysis? **Respuesta** Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved. ### Tarjeta 596 **Pregunta** What is mean time between failures? **Respuesta** The average operating time between repairable failures. ### Tarjeta 597 **Pregunta** What is active reconnaissance? **Respuesta** Probing or interacting with target systems to discover services and behavior. ### Tarjeta 598 **Pregunta** What constraint should guide ICS or SCADA hardening? **Respuesta** Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled. ### Tarjeta 599 **Pregunta** Which control function does restoring a clean system image provide? **Respuesta** Correction; it returns the system to a known-good state. ### Tarjeta 600 **Pregunta** What does responsiveness mean in an architecture decision? **Respuesta** How quickly the system and its operators can adapt to demand, failure, or attack. ### Tarjeta 601 **Pregunta** How does out-of-band access strengthen remote administration? **Respuesta** It uses a management path separate from production traffic, preserving controlled access during an outage or compromise. ### Tarjeta 602 **Pregunta** What makes user behavior unexpected? **Respuesta** It differs materially from the person's normal role, timing, location, resource use, or established work pattern. ### Tarjeta 603 **Pregunta** What is a work order? **Respuesta** A document authorizing a defined unit of work under an existing agreement. ### Tarjeta 604 **Pregunta** What can out-of-cycle logging indicate? **Respuesta** Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job. ### Tarjeta 605 **Pregunta** Why update a standard operating procedure after a change? **Respuesta** It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution. ### Tarjeta 606 **Pregunta** What coding practice limits cross-site scripting? **Respuesta** Context-appropriate output encoding, supported by safe templating and input handling. ### Tarjeta 607 **Pregunta** What does a restricted data classification indicate? **Respuesta** Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm. ### Tarjeta 608 **Pregunta** How does a bug bounty support responsible disclosure? **Respuesta** It defines eligible systems, rules, reporting, and possible rewards for external researchers. ### Tarjeta 609 **Pregunta** What does web-filter content categorization provide? **Respuesta** A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently. ### Tarjeta 610 **Pregunta** How do hard and soft authentication tokens differ? **Respuesta** A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device. ### Tarjeta 611 **Pregunta** How can industry requirements affect security governance? **Respuesta** Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls. ### Tarjeta 612 **Pregunta** How can noncompliance cause loss of a license? **Respuesta** An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work. ### Tarjeta 613 **Pregunta** What does volume-level encryption protect? **Respuesta** All data within a selected logical storage volume. ### Tarjeta 614 **Pregunta** How can impersonation exploit familiarity? **Respuesta** The attacker imitates a known person or routine communication style so the request receives less scrutiny. ### Tarjeta 615 **Pregunta** How does RTO guide recovery design? **Respuesta** It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices. ### Tarjeta 616 **Pregunta** What is a honeynet? **Respuesta** A network of decoy systems used to study or divert attackers. ### Tarjeta 617 **Pregunta** What does backup replication provide? **Respuesta** Additional synchronized or copied recovery data in another system or location. ### Tarjeta 618 **Pregunta** What lets automation scale securely? **Respuesta** Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource. ### Tarjeta 619 **Pregunta** Why monitor a hardened computing resource continuously? **Respuesta** New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed. ### Tarjeta 620 **Pregunta** Why keep a certificate of destruction? **Respuesta** It documents that a disposal provider handled specified media under the agreed process. ### Tarjeta 621 **Pregunta** Why consider patch availability before selecting a platform? **Respuesta** Unsupported or difficult-to-update components accumulate known exposure. ### Tarjeta 622 **Pregunta** Why should remote administration use an encrypted, authenticated protocol? **Respuesta** It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint. ### Tarjeta 623 **Pregunta** How can revenge motivate an insider incident? **Respuesta** A disgruntled person may damage systems or disclose data to punish the organization. ### Tarjeta 624 **Pregunta** What is a published or documented indicator of malicious activity? **Respuesta** A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity. ### Tarjeta 625 **Pregunta** Why monitor a system more closely when a mitigation exception is accepted? **Respuesta** Monitoring can reveal exploitation or control failure while the documented exception remains open. ### Tarjeta 626 **Pregunta** What is an SNMP trap? **Respuesta** An unsolicited device notification sent to a management system when a configured event occurs. ### Tarjeta 627 **Pregunta** How can an automated report support an investigation? **Respuesta** It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline. ### Tarjeta 628 **Pregunta** What is a security key? **Respuesta** A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin. ### Tarjeta 629 **Pregunta** What does database-level encryption protect? **Respuesta** A database or selected database structures through controls managed at the database layer. ### Tarjeta 630 **Pregunta** How does brand impersonation exploit trust? **Respuesta** It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate. ### Tarjeta 631 **Pregunta** What browser-side impact can a cross-site scripting vulnerability create? **Respuesta** It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session. ### Tarjeta 632 **Pregunta** How can a system or process audit identify vulnerabilities? **Respuesta** It compares evidence with required configuration and procedure to reveal control gaps. ### Tarjeta 633 **Pregunta** What security role can Group Policy provide? **Respuesta** Centralized Windows configuration of account, application, audit, and system security settings. ### Tarjeta 634 **Pregunta** What should incident-response training prepare people to do? **Respuesta** Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions. ### Tarjeta 635 **Pregunta** Why must governance track local or regional requirements? **Respuesta** They may impose location-specific duties that differ from national, global, industry, or contractual rules. ### Tarjeta 636 **Pregunta** How can a dependency become a useful key risk indicator? **Respuesta** A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing. ### Tarjeta 637 **Pregunta** What is a business partners agreement? **Respuesta** An agreement defining how business partners will work together, including responsibilities and security or data-handling terms. ### Tarjeta 638 **Pregunta** What makes an audit regulatory? **Respuesta** It evaluates compliance with requirements established or enforced by a government or delegated authority. ### Tarjeta 639 **Pregunta** What is a honeyfile? **Respuesta** A decoy file whose access can reveal unauthorized activity. ### Tarjeta 640 **Pregunta** Why does legal information require explicit protection? **Respuesta** It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk. ### Tarjeta 641 **Pregunta** Which indicator can mass file renaming and encryption produce? **Respuesta** Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them. ### Tarjeta 642 **Pregunta** What remains with an organization after transferring architecture risk? **Respuesta** Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences. ### Tarjeta 643 **Pregunta** When does local console placement provide useful administrative access? **Respuesta** When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path. ### Tarjeta 644 **Pregunta** What makes a harmful user action unintentional? **Respuesta** The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse. ### Tarjeta 645 **Pregunta** How should an organization harden workstations? **Respuesta** Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall. ### Tarjeta 646 **Pregunta** What is journaling in recovery? **Respuesta** Recording ordered changes so data can be replayed or restored to a consistent point. ### Tarjeta 647 **Pregunta** What downtime must a change plan account for? **Respuesta** The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems. ### Tarjeta 648 **Pregunta** Why must a privacy program map local or regional law to data flows? **Respuesta** The applicable duties can change with the location of the person, organization, processing, or stored data. ### Tarjeta 649 **Pregunta** Why combine independent preventive controls at different layers? **Respuesta** A failure at one layer does not automatically let the same attack succeed at the next layer. ### Tarjeta 650 **Pregunta** What is passwordless authentication? **Respuesta** A flow that does not require the user to enter a memorized password, often using public-key credentials. ### Tarjeta 651 **Pregunta** How can automation improve security reaction time? **Respuesta** It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs. ### Tarjeta 652 **Pregunta** What does record-level encryption protect? **Respuesta** Individual records or fields, allowing finer protection than encrypting the entire database. ### Tarjeta 653 **Pregunta** How can business email compromise misuse urgency? **Respuesta** It pressures an employee to bypass normal verification for a payment, credential, or data request. ### Tarjeta 654 **Pregunta** What does impact measure in risk analysis? **Respuesta** The consequence to objectives, such as financial, operational, safety, legal, or reputational harm. ### Tarjeta 655 **Pregunta** What makes cyber activity part of warfare? **Respuesta** It supports military or state conflict objectives such as disruption, intelligence, or influence. ### Tarjeta 656 **Pregunta** Which indicator can a newly created privileged account produce outside the normal change window? **Respuesta** Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled. ### Tarjeta 657 **Pregunta** How can configuration enforcement validate a deployed mitigation? **Respuesta** It compares the realized settings with the approved state and corrects or reports drift. ### Tarjeta 658 **Pregunta** How does validating an alert improve alert tuning? **Respuesta** The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence. ### Tarjeta 659 **Pregunta** What data-layer impact can a SQL injection vulnerability create? **Respuesta** It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations. ### Tarjeta 660 **Pregunta** What environmental variables can change vulnerability priority? **Respuesta** Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment. ### Tarjeta 661 **Pregunta** What security role does SELinux provide? **Respuesta** Mandatory access controls that confine processes according to centrally defined policy. ### Tarjeta 662 **Pregunta** Why review governance documents periodically? **Respuesta** Business, technology, threats, and external obligations change. ### Tarjeta 663 **Pregunta** Why evaluate power requirements for a system design? **Respuesta** Power capacity and redundancy constrain availability and recovery. ### Tarjeta 664 **Pregunta** When is IPsec a better tunnel choice than TLS? **Respuesta** Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection. ### Tarjeta 665 **Pregunta** What is a honeytoken? **Respuesta** A fake credential or data element that generates a high-confidence alert when used. ### Tarjeta 666 **Pregunta** What should embedded-system hardening prioritize? **Respuesta** Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path. ### Tarjeta 667 **Pregunta** Why must sanitization address data remanence? **Respuesta** Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk. ### Tarjeta 668 **Pregunta** Why require rules of engagement for vendor testing? **Respuesta** Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity. ### Tarjeta 669 **Pregunta** What does a private data classification indicate? **Respuesta** The information concerns an individual or limited internal audience and should not be exposed publicly. ### Tarjeta 670 **Pregunta** What does a tabletop recovery exercise test? **Respuesta** Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps. ### Tarjeta 671 **Pregunta** Why prevent password reuse? **Respuesta** One compromised password should not unlock other accounts or services. ### Tarjeta 672 **Pregunta** Which malicious-activity indicator is unexplained sustained CPU or memory use? **Respuesta** Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use. ### Tarjeta 673 **Pregunta** What does transport encryption protect? **Respuesta** It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints. ### Tarjeta 674 **Pregunta** How can a voice call become an attack vector? **Respuesta** An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions. ### Tarjeta 675 **Pregunta** What should a digital-forensics report document? **Respuesta** The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion. ### Tarjeta 676 **Pregunta** What tradeoff comes with an expansionary risk appetite? **Respuesta** It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit. ### Tarjeta 677 **Pregunta** What does a known penetration-test environment provide? **Respuesta** The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing. ### Tarjeta 678 **Pregunta** Why evaluate compute requirements before deployment? **Respuesta** Insufficient resources can cause failure, while excessive resources increase cost and attack surface. ### Tarjeta 679 **Pregunta** Why place sensors at network choke points? **Respuesta** They can observe traffic crossing important trust boundaries. ### Tarjeta 680 **Pregunta** What should hybrid or remote-work security training emphasize? **Respuesta** Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments. ### Tarjeta 681 **Pregunta** Why plan an application restart separately from a service restart? **Respuesta** The application may need its own state handling, user coordination, health checks, and rollback point. ### Tarjeta 682 **Pregunta** What is a cryptographic vulnerability? **Respuesta** A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection. ### Tarjeta 683 **Pregunta** Why report findings by asset owner? **Respuesta** Owners need clear accountability and a prioritized remediation queue. ### Tarjeta 684 **Pregunta** What should guide selection of a secure protocol? **Respuesta** The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints. ### Tarjeta 685 **Pregunta** How do centralized and decentralized governance structures differ? **Respuesta** Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency. ### Tarjeta 686 **Pregunta** How does privacy-aware design limit data retention? **Respuesta** It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle. ### Tarjeta 687 **Pregunta** What does a pressure security sensor detect? **Respuesta** Force or weight applied to a protected surface, such as a floor mat or fence line. ### Tarjeta 688 **Pregunta** What automation costs should a security team plan for? **Respuesta** Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow. ### Tarjeta 689 **Pregunta** What should RTOS hardening preserve while reducing attack surface? **Respuesta** Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled. ### Tarjeta 690 **Pregunta** What is the goal of disruption-for-chaos activity? **Respuesta** Create instability or damage itself rather than pursue a clear financial or intelligence return. ### Tarjeta 691 **Pregunta** Which indicator can repeated password guessing produce? **Respuesta** Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy. ### Tarjeta 692 **Pregunta** How does removing unnecessary software harden a system? **Respuesta** It eliminates code, services, dependencies, and privileges that an attacker could otherwise target. ### Tarjeta 693 **Pregunta** What does NetFlow provide? **Respuesta** Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts. ### Tarjeta 694 **Pregunta** How can a dashboard support an investigation? **Respuesta** It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope. ### Tarjeta 695 **Pregunta** When should a password be expired? **Respuesta** When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard. ### Tarjeta 696 **Pregunta** Why does cryptographic key length matter? **Respuesta** It affects the work required to search the key space, although security also depends on the algorithm and implementation. ### Tarjeta 697 **Pregunta** How can an unsecure Bluetooth connection become an attack vector? **Respuesta** Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands. ### Tarjeta 698 **Pregunta** What is a key risk indicator? **Respuesta** A metric that signals changing exposure or increasing likelihood of an adverse outcome. ### Tarjeta 699 **Pregunta** What should vendor monitoring verify when a contract ends? **Respuesta** Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved. ### Tarjeta 700 **Pregunta** What does a sensitive data classification indicate? **Respuesta** The information needs safeguards because unauthorized access, change, or loss could cause harm. ### Tarjeta 701 **Pregunta** What does software-defined networking separate? **Respuesta** The control plane that decides traffic behavior from the data plane that forwards traffic. ### Tarjeta 702 **Pregunta** Where should a web application firewall be placed? **Respuesta** In the path of web requests before they reach the protected application. ### Tarjeta 703 **Pregunta** What does a simulated recovery exercise test? **Respuesta** Participants perform realistic response actions in a controlled environment without disrupting production. ### Tarjeta 704 **Pregunta** How can a team verify that a detective control is effective? **Respuesta** Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence. ### Tarjeta 705 **Pregunta** How should defenders apply a published or documented indicator to telemetry and validate it before escalating? **Respuesta** Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating. ### Tarjeta 706 **Pregunta** What makes a vulnerability cloud-specific? **Respuesta** It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior. ### Tarjeta 707 **Pregunta** How can insurance respond to vulnerability risk? **Respuesta** It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties. ### Tarjeta 708 **Pregunta** How does reputation improve web filtering? **Respuesta** It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk. ### Tarjeta 709 **Pregunta** What does an encryption policy establish? **Respuesta** Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties. ### Tarjeta 710 **Pregunta** How does a microwave security sensor detect movement? **Respuesta** It emits microwave energy and detects changes in the reflected signal caused by motion. ### Tarjeta 711 **Pregunta** What should IoT-device hardening change before deployment? **Respuesta** Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access. ### Tarjeta 712 **Pregunta** Why track software licenses as assets? **Respuesta** License ownership, permitted use, updates, and end-of-support status affect compliance and risk. ### Tarjeta 713 **Pregunta** What does a password manager improve? **Respuesta** It can generate and store unique long passwords so users do not memorize or reuse them. ### Tarjeta 714 **Pregunta** What makes a ledger open and public? **Respuesta** Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries. ### Tarjeta 715 **Pregunta** What should a payment-change request trigger? **Respuesta** Independent verification through a known channel before any account or payment detail is changed. ### Tarjeta 716 **Pregunta** What does preserving digital evidence require? **Respuesta** Protecting its integrity, context, access history, and availability from collection through final disposition. ### Tarjeta 717 **Pregunta** What should a risk report tell decision-makers? **Respuesta** The risk, uncertainty, business impact, owner, treatment, trend, and decision required. ### Tarjeta 718 **Pregunta** What should an external assessment report provide? **Respuesta** Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions. ### Tarjeta 719 **Pregunta** What is a centralized design's main resilience risk? **Respuesta** A central dependency can become a bottleneck or single point of failure. ### Tarjeta 720 **Pregunta** What does mutual TLS add to a TLS-protected service connection? **Respuesta** It adds client authentication, commonly with a client certificate, so the client and server authenticate each other. ### Tarjeta 721 **Pregunta** What should recurring security-awareness reporting show? **Respuesta** Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions. ### Tarjeta 722 **Pregunta** Why do legacy applications require extra change planning? **Respuesta** They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely. ### Tarjeta 723 **Pregunta** How do a data controller and a data processor differ? **Respuesta** A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf. ### Tarjeta 724 **Pregunta** How can orchestration become a single point of failure? **Respuesta** Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them. ### Tarjeta 725 **Pregunta** Why should defenses account for a threat actor's sophistication and capability? **Respuesta** Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them. ### Tarjeta 726 **Pregunta** How does an injection attack make an application execute unintended instructions? **Respuesta** It sends crafted input that an interpreter treats as code or commands instead of data. ### Tarjeta 727 **Pregunta** What does a host-based firewall control? **Respuesta** Inbound and outbound network traffic for one endpoint according to local rules. ### Tarjeta 728 **Pregunta** Why revise alerting after an incident? **Respuesta** The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert. ### Tarjeta 729 **Pregunta** Why include security duties in procurement criteria? **Respuesta** Security is easier to require before selection than to retrofit after dependency and data transfer begin. ### Tarjeta 730 **Pregunta** What does a critical data classification indicate? **Respuesta** The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls. ### Tarjeta 731 **Pregunta** What infrastructure capacity must support failover? **Respuesta** The alternate site, network, power, cooling, and facility resources needed to carry the transferred load. ### Tarjeta 732 **Pregunta** Why does shared cloud context matter when evaluating a cloud-specific vulnerability? **Respuesta** The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness. ### Tarjeta 733 **Pregunta** How does a remediation exemption differ from an exception? **Respuesta** Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation. ### Tarjeta 734 **Pregunta** Why should automated EDR or XDR blocking have an exception and rollback path? **Respuesta** A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly. ### Tarjeta 735 **Pregunta** What does a security playbook provide? **Respuesta** A repeatable set of roles, decisions, and actions for handling a defined operational scenario. ### Tarjeta 736 **Pregunta** How does an ultrasonic security sensor detect movement? **Respuesta** It emits high-frequency sound and detects changes in the returning sound pattern caused by motion. ### Tarjeta 737 **Pregunta** What should a managed mobile device require for Bluetooth connections? **Respuesta** Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles. ### Tarjeta 738 **Pregunta** How do password complexity rules differ from password length? **Respuesta** Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone. ### Tarjeta 739 **Pregunta** What makes a certificate third-party trusted? **Respuesta** A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems. ### Tarjeta 740 **Pregunta** Why is an out-of-band check effective against impersonation? **Respuesta** It verifies the request through a separate, previously trusted communication path. ### Tarjeta 741 **Pregunta** What does a risk exception authorize? **Respuesta** A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration. ### Tarjeta 742 **Pregunta** What security challenge grows in a decentralized design? **Respuesta** Consistent policy, inventory, monitoring, and patching become harder. ### Tarjeta 743 **Pregunta** How should controls be selected for an unused network path? **Respuesta** Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable. ### Tarjeta 744 **Pregunta** How can a buffer-overflow attack affect an application? **Respuesta** It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution. --- *[Ver la versión HTML con estilo de esta página]()* *Los agentes de IA pueden crear una cuenta para el usuario en este servicio empezando con `GET https://api.nibomo.com/v1/`. Una vez configurados, también pueden conectarse por MCP en `https://mcp.nibomo.com/mcp`.* *Consejo: añade `.md` a cualquier URL en https://nibomo.com para obtener una versión limpia en Markdown de esa página.*