CompTIA Security+ SY0-701 Flashcards: Complete Objective Review

Cartes de ce paquet

1. Carte 1

   Question

   What does an information security policy establish?

   Réponse

   Management's required direction, responsibilities, and high-level rules for protecting information and systems.

2. Carte 2

   Question

   What is phishing?

   Réponse

   A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.

3. Carte 3

   Question

   What does a public-key certificate bind to an identity?

   Réponse

   A public key, together with identifying information and the issuer's signature.

4. Carte 4

   Question

   What is data at rest?

   Réponse

   Data stored on media such as disks, databases, backups, or mobile devices.

5. Carte 5

   Question

   How does policy-driven access control decide a zero-trust access request?

   Réponse

   Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.

6. Carte 6

   Question

   What does establishing a secure baseline produce?

   Réponse

   An approved, documented configuration that defines the required secure state for a class of computing resource.

7. Carte 7

   Question

   What is hashing used to verify?

   Réponse

   Whether data has changed by comparing fixed-length digest values.

8. Carte 8

   Question

   What is impersonation in social engineering?

   Réponse

   Pretending to be a trusted person or organization to obtain access, data, or action.

9. Carte 9

   Question

   What is virtualization?

   Réponse

   Abstracting physical compute so multiple isolated guest systems can share a host.

10. Carte 10

    Question

    What is chain of custody?

    Réponse

    A documented history of who collected, handled, transferred, stored, and examined evidence.

11. Carte 11

    Question

    What is quantitative risk analysis?

    Réponse

    Estimating risk with numerical values such as money, frequency, or probability.

12. Carte 12

    Question

    What is a phishing awareness campaign?

    Réponse

    A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.

13. Carte 13

    Question

    What is high availability?

    Réponse

    Designing a service to remain accessible despite expected component failures.

14. Carte 14

    Question

    What is a network security zone?

    Réponse

    A group of systems with similar trust, function, or control requirements.

15. Carte 15

    Question

    What is risk transfer?

    Réponse

    Shifting some financial or operational consequence to another party, such as through insurance or contract.

16. Carte 16

    Question

    What is media sanitization?

    Réponse

    Making stored data infeasible to recover for the intended level of protection.

17. Carte 17

    Question

    What does CVSS provide?

    Réponse

    A standardized way to describe a vulnerability's technical severity characteristics.

18. Carte 18

    Question

    What does security alerting do?

    Réponse

    It turns matched events or behavior into a notification that the right responder can review.

19. Carte 19

    Question

    What does a firewall rule enforce?

    Réponse

    A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.

20. Carte 20

    Question

    What is deprovisioning?

    Réponse

    Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.

21. Carte 21

    Question

    How does inline placement differ from a tap or monitor port?

    Réponse

    Inline traffic passes through the control; a tap or monitor receives a copy for observation.

22. Carte 22

    Question

    What is asymmetric encryption?

    Réponse

    Encryption that uses a mathematically related public and private key pair.

23. Carte 23

    Question

    What does SPF authorize?

    Réponse

    Which mail servers may send mail for a domain in the SMTP envelope.

24. Carte 24

    Question

    What is a possession factor?

    Réponse

    Something the claimant has, such as a cryptographic authenticator.

25. Carte 25

    Question

    What does ordinary TLS usually protect and authenticate?

    Réponse

    It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.

26. Carte 26

    Question

    What is single loss expectancy?

    Réponse

    The estimated loss from one occurrence of a risk event.

27. Carte 27

    Question

    What does a certificate authority do?

    Réponse

    It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.

28. Carte 28

    Question

    What is a detective control meant to do?

    Réponse

    Identify that an unwanted event has happened or is happening.

29. Carte 29

    Question

    What is the security purpose of change-control approval?

    Réponse

    Ensure authorized reviewers assess risk before the production change occurs.

30. Carte 30

    Question

    What is shadow IT?

    Réponse

    Technology used for organizational work without required approval or oversight.

31. Carte 31

    Question

    What is a buffer overflow vulnerability?

    Réponse

    A bounds-checking failure that lets input overwrite memory outside its intended buffer.

32. Carte 32

    Question

    What is ransomware?

    Réponse

    Malware or an intrusion outcome that denies access to data or systems to extort the victim.

33. Carte 33

    Question

    How does network segmentation limit an incident?

    Réponse

    It restricts communication paths and reduces lateral movement between zones.

34. Carte 34

    Question

    How do load balancing and clustering support availability differently?

    Réponse

    Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.

35. Carte 35

    Question

    What is vendor due diligence?

    Réponse

    Evaluating a provider's security, capability, stability, and fit before commitment.

36. Carte 36

    Question

    Who is a data subject?

    Réponse

    The person whose personal data is collected or processed.

37. Carte 37

    Question

    What is attestation?

    Réponse

    A formal assertion or report about a subject matter, often supported by an independent examination.

38. Carte 38

    Question

    What is a replay attack?

    Réponse

    Valid captured data is retransmitted to repeat an authenticated or authorized action.

39. Carte 39

    Question

    What does a wireless site survey establish?

    Réponse

    Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.

40. Carte 40

    Question

    What is the time-of-check stage of a race-condition vulnerability?

    Réponse

    The application verifies a condition or resource state before acting on it.

41. Carte 41

    Question

    What is a penetration test?

    Réponse

    An authorized attempt to exploit weaknesses and demonstrate practical impact.

42. Carte 42

    Question

    What is a cold recovery site?

    Réponse

    A facility with basic space and utilities but little preinstalled technology or current data.

43. Carte 43

    Question

    What is data in transit?

    Réponse

    Data moving between systems or across a network.

44. Carte 44

    Question

    What is a vendor security questionnaire?

    Réponse

    A structured request for information about a provider's controls and practices.

45. Carte 45

    Question

    How does an internal actor's starting position differ from an external actor's?

    Réponse

    An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.

46. Carte 46

    Question

    What can unexpected account lockouts indicate?

    Réponse

    Password guessing, credential stuffing, user error, or a broken client.

47. Carte 47

    Question

    How do permissions enforce access control?

    Réponse

    They specify which actions a subject may perform on a particular resource.

48. Carte 48

    Question

    What is log aggregation?

    Réponse

    Central collection of logs from multiple sources for search, correlation, and retention.

49. Carte 49

    Question

    Why plan a service restart as part of a change?

    Réponse

    The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.

50. Carte 50

    Question

    What is infrastructure as code?

    Réponse

    Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.

51. Carte 51

    Question

    What should security-awareness program development start with?

    Réponse

    The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.

52. Carte 52

    Question

    What is a voice-based social-engineering attack called?

    Réponse

    Vishing.

53. Carte 53

    Question

    What happens during incident-response preparation?

    Réponse

    Teams establish people, tools, access, communications, training, and procedures before an incident.

54. Carte 54

    Question

    What does an offensive penetration-testing team do?

    Réponse

    It emulates authorized attacker behavior to discover and demonstrate exploitable paths.

55. Carte 55

    Question

    What is federation?

    Réponse

    One security domain relies on identity assertions from another trusted domain.

56. Carte 56

    Question

    What is asset classification?

    Réponse

    Grouping an asset by sensitivity, criticality, or required handling.

57. Carte 57

    Question

    What is cross-site scripting?

    Réponse

    Injection of script-capable content that a browser executes in another site's security context.

58. Carte 58

    Question

    What can IDS or IPS trends reveal?

    Réponse

    Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.

59. Carte 59

    Question

    What can unexpected resource inaccessibility indicate?

    Réponse

    Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.

60. Carte 60

    Question

    What is a corrective control meant to do?

    Réponse

    Limit damage and restore a secure state after an event.

61. Carte 61

    Question

    How do containers differ from virtual machines?

    Réponse

    Containers share the host kernel; virtual machines normally run separate guest operating systems.

62. Carte 62

    Question

    How does an active security device differ from a passive one?

    Réponse

    An active device can alter or block traffic; a passive device observes and reports without changing the flow.

63. Carte 63

    Question

    Why is unsupported software a persistent attack surface?

    Réponse

    Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.

64. Carte 64

    Question

    What is annualized rate of occurrence?

    Réponse

    The estimated number of times a risk event occurs per year.

65. Carte 65

    Question

    What is an inherence factor?

    Réponse

    A biometric characteristic of the claimant.

66. Carte 66

    Question

    What do a threat actor's sophistication and capability describe?

    Réponse

    The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.

67. Carte 67

    Question

    What is a SIEM?

    Réponse

    A platform that centralizes security data and supports search, correlation, alerting, and investigation.

68. Carte 68

    Question

    What is sideloading?

    Réponse

    Installing software from outside the platform's approved distribution path.

69. Carte 69

    Question

    What does an IDS or IPS signature match?

    Réponse

    A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.

70. Carte 70

    Question

    Why are embedded systems often difficult to patch?

    Réponse

    They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.

71. Carte 71

    Question

    What is a virtual private network?

    Réponse

    An encrypted logical connection that carries private traffic across an untrusted or shared network.

72. Carte 72

    Question

    What should an initial security-awareness report establish?

    Réponse

    The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.

73. Carte 73

    Question

    What is symmetric encryption?

    Réponse

    Encryption that uses the same secret key to encrypt and decrypt data.

74. Carte 74

    Question

    What happens during incident detection?

    Réponse

    Monitoring or a report identifies activity that may meet the organization's incident criteria.

75. Carte 75

    Question

    What is recovery time objective?

    Réponse

    The target maximum time to restore a function after disruption.

76. Carte 76

    Question

    Why prioritize password length?

    Réponse

    Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.

77. Carte 77

    Question

    What must sanitization accomplish before an asset leaves organizational control?

    Réponse

    It must make the retained data infeasible to recover with the method appropriate to the media and risk.

78. Carte 78

    Question

    What is a real-time operating system designed to provide?

    Réponse

    Predictable response timing for tasks with strict deadlines.

79. Carte 79

    Question

    What does fail-open behavior do when a control fails?

    Réponse

    It permits traffic or access to preserve availability.

80. Carte 80

    Question

    What is jailbreaking or rooting a mobile device?

    Réponse

    Removing platform restrictions to gain privileged control over the operating system.

81. Carte 81

    Question

    What does network access control enforce?

    Réponse

    Identity, device posture, and access policy at network connection time and during a session.

82. Carte 82

    Question

    What does data loss prevention do?

    Réponse

    Detects and may block sensitive data use or transfer that violates policy.

83. Carte 83

    Question

    What security property does a blockchain provide?

    Réponse

    A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.

84. Carte 84

    Question

    What is recovery point objective?

    Réponse

    The target maximum acceptable data loss measured backward in time.

85. Carte 85

    Question

    How do ICS and SCADA relate?

    Réponse

    An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.

86. Carte 86

    Question

    What does fail-closed behavior do when a control fails?

    Réponse

    It denies traffic or access to preserve security.

87. Carte 87

    Question

    Which keys create and verify a typical digital signature?

    Réponse

    The signer creates it with a private key, and others verify it with the corresponding public key.

88. Carte 88

    Question

    What is SQL injection?

    Réponse

    Input that alters the structure or meaning of a database query because code and data were not safely separated.

89. Carte 89

    Question

    What does DKIM verify?

    Réponse

    That selected message content was signed by a domain and was not altered after signing.

90. Carte 90

    Question

    What is post-incident activity?

    Réponse

    Learning from the event and improving controls, plans, and recovery based on evidence.

91. Carte 91

    Question

    What characterizes an expansionary risk appetite?

    Réponse

    A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.

92. Carte 92

    Question

    How do centralized and decentralized architectures differ?

    Réponse

    Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.

93. Carte 93

    Question

    What does a certificate revocation list publish?

    Réponse

    Certificate serial numbers that the issuer has invalidated before their scheduled expiration.

94. Carte 94

    Question

    What is a legal hold?

    Réponse

    A directive to preserve potentially relevant information by suspending normal deletion or disposal.

95. Carte 95

    Question

    What is exposure factor in quantitative risk analysis?

    Réponse

    The estimated percentage of an asset's value lost in one event.

96. Carte 96

    Question

    What is decentralized architecture?

    Réponse

    Control or service responsibility is distributed across multiple independent components or locations.

97. Carte 97

    Question

    What is tokenization?

    Réponse

    Replacing sensitive data with a non-sensitive token whose mapping is held separately.

98. Carte 98

    Question

    How can automation act as a workforce multiplier?

    Réponse

    It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.

99. Carte 99

    Question

    What can endpoint process logs reveal?

    Réponse

    Which programs ran, their parent-child relationships, users, timing, and command details when captured.

100. Carte 100

     Question

     What does the CIA triad protect?

     Réponse

     Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.

101. Carte 101

     Question

     How does data masking protect information?

     Réponse

     It hides selected values or characters while preserving a usable representation.

102. Carte 102

     Question

     How can a national requirement affect security governance?

     Réponse

     It can impose country-level duties that policies, controls, records, and oversight must satisfy.

103. Carte 103

     Question

     What do integrations and APIs provide to security orchestration?

     Réponse

     Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.

104. Carte 104

     Question

     What makes a compliance report external?

     Réponse

     It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.

105. Carte 105

     Question

     What does a cryptographic algorithm define?

     Réponse

     The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.

106. Carte 106

     Question

     Why compare systems with a secure baseline regularly?

     Réponse

     To detect drift, unauthorized changes, and missing hardening.

107. Carte 107

     Question

     What does integrity protect?

     Réponse

     The accuracy and completeness of data and systems against unauthorized change.

108. Carte 108

     Question

     What does vulnerability classification organize?

     Réponse

     Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.

109. Carte 109

     Question

     What does a password standard define?

     Réponse

     Mandatory, measurable requirements for creating, storing, using, and changing passwords.

110. Carte 110

     Question

     What technology capacity must a recovery design plan for?

     Réponse

     The compute, storage, software, licenses, and supporting services needed to meet recovery demand.

111. Carte 111

     Question

     What does a confidential data classification indicate?

     Réponse

     Disclosure is limited to authorized people because exposure could harm the organization or affected parties.

112. Carte 112

     Question

     What makes a vendor assessment independent?

     Réponse

     The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.

113. Carte 113

     Question

     What lets a worm spread without attaching itself to another file?

     Réponse

     It is a standalone program that replicates across reachable systems or services.

114. Carte 114

     Question

     What is microsegmentation?

     Réponse

     Fine-grained isolation of individual workloads or small groups with explicit communication policy.

115. Carte 115

     Question

     What can application logs reveal?

     Réponse

     Transactions, errors, user actions, and application-specific security events.

116. Carte 116

     Question

     What does deploying a secure baseline require?

     Réponse

     Applying the approved settings consistently to the intended resources and verifying the realized configuration.

117. Carte 117

     Question

     How can resource-provisioning automation improve security?

     Réponse

     It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.

118. Carte 118

     Question

     What does availability protect?

     Réponse

     Reliable, timely access to systems and data when authorized users need them.

119. Carte 119

     Question

     Why must a change request describe business impact?

     Réponse

     So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.

120. Carte 120

     Question

     What does an authenticated vulnerability scan add?

     Réponse

     Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.

121. Carte 121

     Question

     What does a change-management procedure specify?

     Réponse

     The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.

122. Carte 122

     Question

     What is a sanction for noncompliance?

     Réponse

     A formal penalty or restriction imposed by an authority for failing to meet a requirement.

123. Carte 123

     Question

     How can email deliver a security attack?

     Réponse

     It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.

124. Carte 124

     Question

     What is an internal compliance audit?

     Réponse

     An organization-led examination of whether selected operations and controls meet defined requirements.

125. Carte 125

     Question

     What is a Trojan?

     Réponse

     Malware disguised as legitimate or desirable software.

126. Carte 126

     Question

     What is clustering?

     Réponse

     Multiple systems work together to provide a service and tolerate member failure.

127. Carte 127

     Question

     What makes data regulated?

     Réponse

     A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.

128. Carte 128

     Question

     What does a wireless heat map show?

     Réponse

     Measured or modeled signal strength and coverage across a physical area.

129. Carte 129

     Question

     How should vendor criticality affect due diligence?

     Réponse

     Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.

130. Carte 130

     Question

     How can a digital signature support non-repudiation?

     Réponse

     It provides evidence that the holder of a private key signed specific data.

131. Carte 131

     Question

     What should vulnerability prioritization consider beyond severity?

     Réponse

     Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.

132. Carte 132

     Question

     What is a security guideline?

     Réponse

     Recommended practice that allows judgment unless adopted as a requirement.

133. Carte 133

     Question

     What usually distinguishes a nation-state threat actor?

     Réponse

     Strategic objectives, substantial resources, patience, and advanced operational capability.

134. Carte 134

     Question

     What is spyware?

     Réponse

     Software that secretly collects information about a user or system.

135. Carte 135

     Question

     Why maintain an allow list for applications?

     Réponse

     Only explicitly approved software is permitted to execute.

136. Carte 136

     Question

     How can an image become an attack vector?

     Réponse

     It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.

137. Carte 137

     Question

     What makes a security control technical?

     Réponse

     It is enforced mainly by technology, such as a firewall rule or endpoint policy.

138. Carte 138

     Question

     What is identity proofing?

     Réponse

     Establishing that a person is who they claim to be before issuing an account or credential.

139. Carte 139

     Question

     What is an automated security guardrail?

     Réponse

     A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.

140. Carte 140

     Question

     Why assign an owner to a planned change?

     Réponse

     To make one party accountable for coordination, execution, and follow-through.

141. Carte 141

     Question

     How can national privacy law affect data handling?

     Réponse

     It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.

142. Carte 142

     Question

     What is continuity of operations?

     Réponse

     Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.

143. Carte 143

     Question

     What security tradeoff comes with BYOD?

     Réponse

     The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.

144. Carte 144

     Question

     How should policies and handbooks support security training?

     Réponse

     They provide accessible, current rules and reporting steps that training can apply to real situations.

145. Carte 145

     Question

     What is a keylogger?

     Réponse

     A tool that records keystrokes to capture data such as credentials.

146. Carte 146

     Question

     What makes information a trade secret?

     Réponse

     It provides business value because it is not generally known and is protected through reasonable secrecy measures.

147. Carte 147

     Question

     What does authentication establish?

     Réponse

     It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.

148. Carte 148

     Question

     What risk comes from an untrusted file attachment?

     Réponse

     Opening or parsing it can execute malicious code or expose data.

149. Carte 149

     Question

     How does risk tolerance affect vulnerability remediation?

     Réponse

     It sets how much residual exposure the organization will accept and how quickly a finding must be treated.

150. Carte 150

     Question

     How can a global requirement affect security governance?

     Réponse

     It can require a common control and oversight approach across multiple countries while local obligations still apply.

151. Carte 151

     Question

     Why should questionnaire answers be supported by evidence?

     Réponse

     Self-assertions alone may not prove that controls are designed or operating effectively.

152. Carte 152

     Question

     What is an independent third-party audit?

     Réponse

     An external party with suitable independence examines evidence against defined criteria.

153. Carte 153

     Question

     What do account provisioning and deprovisioning do?

     Réponse

     Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.

154. Carte 154

     Question

     What is an unskilled attacker commonly called?

     Réponse

     A script kiddie: someone who relies on tools or instructions created by others.

155. Carte 155

     Question

     What is a rootkit?

     Réponse

     Software designed to maintain privileged, concealed access by altering or subverting the system.

156. Carte 156

     Question

     What does an access control list enforce?

     Réponse

     Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.

157. Carte 157

     Question

     What should system security monitoring observe?

     Réponse

     Host state and behavior such as processes, authentication, configuration, resource use, and security events.

158. Carte 158

     Question

     What can operating-system security logs reveal?

     Réponse

     Authentication, privilege use, policy changes, services, and other host security events.

159. Carte 159

     Question

     Why isolate operational technology from general business networks?

     Réponse

     To limit attack paths into safety- and availability-critical processes.

160. Carte 160

     Question

     What is the COPE mobile deployment model?

     Réponse

     The organization owns the device but permits defined personal use while retaining management control.

161. Carte 161

     Question

     What security work belongs in asset acquisition and procurement?

     Réponse

     Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.

162. Carte 162

     Question

     How can user-provisioning automation improve security?

     Réponse

     It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.

163. Carte 163

     Question

     What people capacity must a continuity plan account for?

     Réponse

     Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.

164. Carte 164

     Question

     What do authorization models define?

     Réponse

     How permissions are assigned to authenticated subjects and evaluated for requested actions.

165. Carte 165

     Question

     Why are removable devices an attack vector?

     Réponse

     They can introduce malware or remove data while bypassing network controls.

166. Carte 166

     Question

     What should predeployment change-test results show?

     Réponse

     Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.

167. Carte 167

     Question

     What is the time-of-use stage of a race-condition vulnerability?

     Réponse

     The application acts on a resource after the check, creating a gap in which another process may change the resource.

168. Carte 168

     Question

     What is data in use?

     Réponse

     Data actively processed in memory or by an application.

169. Carte 169

     Question

     What does open-source vulnerability intelligence contribute?

     Réponse

     Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.

170. Carte 170

     Question

     What can file-integrity monitoring detect?

     Réponse

     Unexpected changes to protected files, directories, or configuration.

171. Carte 171

     Question

     Why should deprovisioning be prompt?

     Réponse

     Former users or roles should not retain usable access.

172. Carte 172

     Question

     What is an acceptable use policy?

     Réponse

     Rules for permitted and prohibited use of organizational systems, accounts, and data.

173. Carte 173

     Question

     What makes a compliance report internal?

     Réponse

     It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.

174. Carte 174

     Question

     What is a logic bomb?

     Réponse

     Malicious code that activates when a specified condition or time is reached.

175. Carte 175

     Question

     What does a right-to-audit clause provide?

     Réponse

     Contractual authority to inspect or obtain evidence about agreed controls.

176. Carte 176

     Question

     Where should a forward proxy sit in an enterprise traffic path?

     Réponse

     Between clients and external services so outbound requests pass through policy and logging before reaching destinations.

177. Carte 177

     Question

     Which cues should make a message look suspicious?

     Réponse

     Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.

178. Carte 178

     Question

     What makes a security control managerial?

     Réponse

     It directs risk and governance through decisions such as policies, assessments, and oversight.

179. Carte 179

     Question

     What is the CYOD mobile deployment model?

     Réponse

     The user selects from organization-approved device options that remain subject to corporate security requirements.

180. Carte 180

     Question

     How does client-based vulnerable software differ from an agentless exposure?

     Réponse

     Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.

181. Carte 181

     Question

     What makes a risk assessment recurring?

     Réponse

     It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.

182. Carte 182

     Question

     What does a defensive penetration-testing team practice?

     Réponse

     Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.

183. Carte 183

     Question

     In a zero-trust data plane, what can the subject or system represent?

     Réponse

     The user, device, workload, or service requesting access to a protected resource.

184. Carte 184

     Question

     What primarily motivates a hacktivist?

     Réponse

     A political, social, or ideological cause.

185. Carte 185

     Question

     What is bloatware?

     Réponse

     Unnecessary preinstalled software that consumes resources and can expand the attack surface.

186. Carte 186

     Question

     Why keep endpoint-protection signatures and engines current?

     Réponse

     They need current detection logic to recognize newly identified malware and exploit behavior.

187. Carte 187

     Question

     What should application security monitoring observe?

     Réponse

     Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.

188. Carte 188

     Question

     What is role-based access control?

     Réponse

     Permissions are assigned to roles, and identities receive access through their roles.

189. Carte 189

     Question

     What is geographic dispersal?

     Réponse

     Placing redundant resources in separate locations so one regional event does not affect all copies.

190. Carte 190

     Question

     What is a malicious update?

     Réponse

     An update that has been intentionally altered or distributed to install harmful code through a trusted update path.

191. Carte 191

     Question

     What does static application analysis inspect?

     Réponse

     Source code, bytecode, or compiled code without executing the application.

192. Carte 192

     Question

     What does a firewall access list define?

     Réponse

     An ordered set of traffic-matching conditions and the action applied when a condition matches.

193. Carte 193

     Question

     What does a disaster recovery policy establish?

     Réponse

     Management expectations for restoring technology and data after a disruptive event.

194. Carte 194

     Question

     How does logical segmentation separate workloads that share physical infrastructure?

     Réponse

     It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.

195. Carte 195

     Question

     How should IDS and IPS placement differ?

     Réponse

     An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.

196. Carte 196

     Question

     What should automated ticket creation capture?

     Réponse

     The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.

197. Carte 197

     Question

     What makes information intellectual property?

     Réponse

     It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.

198. Carte 198

     Question

     What is a backout plan?

     Réponse

     Predefined steps for safely reversing a failed or harmful change.

199. Carte 199

     Question

     Why is an unsecure wireless network an attack vector?

     Réponse

     Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.

200. Carte 200

     Question

     What is physical brute force?

     Réponse

     Using force to defeat a lock, barrier, enclosure, or other physical control.

201. Carte 201

     Question

     What is application sandboxing?

     Réponse

     Running code in a constrained environment with limited access to the host and data.

202. Carte 202

     Question

     Why assign an asset owner?

     Réponse

     One accountable party must decide its use, protection, and lifecycle.

203. Carte 203

     Question

     What happens during risk identification?

     Réponse

     Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.

204. Carte 204

     Question

     What should an SLA state about breach notification?

     Réponse

     The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.

205. Carte 205

     Question

     How do due diligence and due care differ in compliance?

     Réponse

     Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.

206. Carte 206

     Question

     What is attribute-based access control?

     Réponse

     Policy evaluates attributes of the subject, resource, action, and environment.

207. Carte 207

     Question

     What does a zero-trust policy engine do?

     Réponse

     It evaluates policy and signals to decide whether access should be allowed.

208. Carte 208

     Question

     How does a cloud responsibility matrix allocate security duties?

     Réponse

     It maps each security task to the provider, the customer, or both, according to the service model and agreement.

209. Carte 209

     Question

     Where should a load balancer sit in a service path?

     Réponse

     In front of service instances so it can route requests to healthy backends.

210. Carte 210

     Question

     What should the security team do with a reported suspicious message?

     Réponse

     Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.

211. Carte 211

     Question

     What makes an operating-system vulnerability high impact?

     Réponse

     It can affect every application and security control that relies on the compromised OS.

212. Carte 212

     Question

     What does dynamic application analysis inspect?

     Réponse

     The behavior and externally visible weaknesses of a running application.

213. Carte 213

     Question

     How can false-positive trends affect IDS or IPS tuning?

     Réponse

     Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.

214. Carte 214

     Question

     What does a business continuity policy establish?

     Réponse

     Management expectations for sustaining and restoring critical business functions.

215. Carte 215

     Question

     What is a hot recovery site?

     Réponse

     A ready, synchronized environment intended to take over quickly.

216. Carte 216

     Question

     What makes an insider threat distinct?

     Réponse

     The actor has legitimate access or organizational knowledge that can be misused.

217. Carte 217

     Question

     What is RFID cloning?

     Réponse

     Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.

218. Carte 218

     Question

     Why apply vendor security updates promptly?

     Réponse

     They remove known weaknesses before attackers can exploit the unpatched exposure.

219. Carte 219

     Question

     What should infrastructure security monitoring observe?

     Réponse

     Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.

220. Carte 220

     Question

     What can firewall logs reveal?

     Réponse

     Allowed or denied network connections across controlled boundaries.

221. Carte 221

     Question

     Why minimize open service ports?

     Réponse

     Each reachable service adds code, configuration, and authentication paths an attacker can probe.

222. Carte 222

     Question

     What is threat hunting?

     Réponse

     A proactive search for evidence of malicious activity that existing detections have not confirmed.

223. Carte 223

     Question

     What triggers an ad hoc risk assessment?

     Réponse

     A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.

224. Carte 224

     Question

     What makes an assessment external?

     Réponse

     A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.

225. Carte 225

     Question

     What is data sovereignty?

     Réponse

     The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.

226. Carte 226

     Question

     What security boundary does a cellular connection create for a mobile device?

     Réponse

     It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.

227. Carte 227

     Question

     What makes a security control operational?

     Réponse

     It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.

228. Carte 228

     Question

     What is discretionary access control?

     Réponse

     A resource owner can decide who receives access, within system policy.

229. Carte 229

     Question

     How can careful automation support employee retention?

     Réponse

     It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.

230. Carte 230

     Question

     Why does ease of deployment matter in an architecture decision?

     Réponse

     A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.

231. Carte 231

     Question

     What tradeoff comes with placing an NGFW inline?

     Réponse

     It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.

232. Carte 232

     Question

     What does a zero-trust policy administrator do?

     Réponse

     It carries out the policy engine's decision, such as creating or ending a session.

233. Carte 233

     Question

     What should a master service agreement define for data return and deletion?

     Réponse

     The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.

234. Carte 234

     Question

     What is an environmental physical attack?

     Réponse

     Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.

235. Carte 235

     Question

     When should a maintenance window be chosen?

     Réponse

     When disruption and rollback can be managed with the least business impact.

236. Carte 236

     Question

     What is memory injection?

     Réponse

     Placing malicious code or data into another process's memory so it executes in that process's context.

237. Carte 237

     Question

     What does software composition analysis find?

     Réponse

     Known risks and license information in third-party dependencies.

238. Carte 238

     Question

     What is DNS filtering?

     Réponse

     Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.

239. Carte 239

     Question

     What should an incident response policy establish?

     Réponse

     Authority, scope, reporting duties, and organizational commitment for incident handling.

240. Carte 240

     Question

     How can noncompliance cause reputational damage?

     Réponse

     Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.

241. Carte 241

     Question

     What does full-disk encryption protect?

     Réponse

     All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.

242. Carte 242

     Question

     Why are default credentials dangerous?

     Réponse

     They are widely known or easily discovered and often remain unchanged.

243. Carte 243

     Question

     What makes a risk assessment one-time?

     Réponse

     It evaluates a defined decision or scope once without an established repeating cadence.

244. Carte 244

     Question

     What is a warm recovery site?

     Réponse

     A partially equipped environment that needs some data restoration or configuration before use.

245. Carte 245

     Question

     What does application input validation do?

     Réponse

     It checks that input matches the expected type, length, range, and format before use.

246. Carte 246

     Question

     What should an asset inventory record besides a device name?

     Réponse

     Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.

247. Carte 247

     Question

     What is mandatory access control?

     Réponse

     A central authority enforces access through labels and rules that ordinary owners cannot override.

248. Carte 248

     Question

     What security benefit does infrastructure as code provide?

     Réponse

     Repeatable, reviewable deployments that reduce undocumented configuration drift.

249. Carte 249

     Question

     When should a public service control fail closed?

     Réponse

     When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.

250. Carte 250

     Question

     What should users do with a suspicious message?

     Réponse

     Report it through the approved channel without interacting with its links or attachments.

251. Carte 251

     Question

     What usually motivates organized cybercrime?

     Réponse

     Financial gain through scalable or repeatable criminal activity.

252. Carte 252

     Question

     How can malicious code support a network attack?

     Réponse

     It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.

253. Carte 253

     Question

     When is virtual patching useful?

     Réponse

     When a network or application control can block exploit traffic before the underlying system can be patched.

254. Carte 254

     Question

     What does security-monitoring reporting provide?

     Réponse

     A summarized, audience-appropriate view of findings, trends, risk, and response status.

255. Carte 255

     Question

     What does data geolocation identify?

     Réponse

     The physical or legal location where data is stored, processed, or transmitted.

256. Carte 256

     Question

     What does a zero-trust policy enforcement point do?

     Réponse

     It enables, monitors, and terminates the connection between a subject and a resource.

257. Carte 257

     Question

     What is cryptographic key exchange?

     Réponse

     A method for parties to establish shared key material over an untrusted channel.

258. Carte 258

     Question

     How can a vendor become a supply-chain attack vector?

     Réponse

     An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.

259. Carte 259

     Question

     Why can legacy hardware remain vulnerable?

     Réponse

     It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.

260. Carte 260

     Question

     What can proprietary vulnerability intelligence add beyond open sources?

     Réponse

     Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.

261. Carte 261

     Question

     How does a centralized proxy apply web filtering?

     Réponse

     It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.

262. Carte 262

     Question

     How can continuous integration and testing improve security automation?

     Réponse

     Changes receive repeatable checks before deployment instead of reaching production unvalidated.

263. Carte 263

     Question

     What is containment?

     Réponse

     Limiting an incident's spread or damage while preserving necessary operations and evidence.

264. Carte 264

     Question

     What is a software development lifecycle policy meant to ensure?

     Réponse

     Security requirements and checks are integrated throughout design, development, release, and maintenance.

265. Carte 265

     Question

     What makes risk assessment continuous?

     Réponse

     Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.

266. Carte 266

     Question

     What is a memorandum of agreement?

     Réponse

     A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.

267. Carte 267

     Question

     What makes a penetration test integrated?

     Réponse

     Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.

268. Carte 268

     Question

     How does a DNS amplification attack magnify traffic?

     Réponse

     It sends small spoofed queries that trigger larger replies toward the victim.

269. Carte 269

     Question

     Why does ease of recovery matter in an architecture decision?

     Réponse

     The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.

270. Carte 270

     Question

     What does 802.1X control before a device receives normal network access?

     Réponse

     Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.

271. Carte 271

     Question

     What is rule-based access control?

     Réponse

     System-wide rules grant or deny access based on conditions such as network, time, or action.

272. Carte 272

     Question

     What is mobile device management?

     Réponse

     Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.

273. Carte 273

     Question

     What tradeoff comes with a cold recovery site?

     Réponse

     It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.

274. Carte 274

     Question

     Why identify stakeholders before approving a security-sensitive change?

     Réponse

     They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.

275. Carte 275

     Question

     How do attestation and acknowledgement differ?

     Réponse

     Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.

276. Carte 276

     Question

     What does zero-trust adaptive identity mean?

     Réponse

     Access decisions adjust to current risk signals rather than relying only on a static login.

277. Carte 277

     Question

     What makes a security control physical?

     Réponse

     It protects facilities or equipment through a tangible barrier or mechanism.

278. Carte 278

     Question

     What is geo-fencing for data?

     Réponse

     Enforcing location-based boundaries on where data or services may be accessed or operated.

279. Carte 279

     Question

     What does a Trusted Platform Module protect?

     Réponse

     Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.

280. Carte 280

     Question

     Why can a managed service provider amplify risk?

     Réponse

     Its privileged access and shared tooling can provide a path into many customers.

281. Carte 281

     Question

     What does probability express in risk analysis?

     Réponse

     A quantified chance that a defined event will occur within stated conditions or time.

282. Carte 282

     Question

     Why can shadow IT create a threat?

     Réponse

     It bypasses security review, inventory, monitoring, and supported configuration.

283. Carte 283

     Question

     What is on-path interception?

     Réponse

     An attacker positions between communicating parties to observe or alter traffic.

284. Carte 284

     Question

     Why include encryption in a system-hardening baseline?

     Réponse

     It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.

285. Carte 285

     Question

     Why tune security alerts?

     Réponse

     To keep useful detections while reducing noise that wastes analyst attention.

286. Carte 286

     Question

     What can IPS or IDS logs contribute to an investigation?

     Réponse

     The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.

287. Carte 287

     Question

     What is VM escape?

     Réponse

     A vulnerability that lets code break out of a virtual machine and affect the host or another guest.

288. Carte 288

     Question

     How can segmentation reduce vulnerability exposure before a patch is available?

     Réponse

     It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.

289. Carte 289

     Question

     Why should firewall policy name the required ports and protocols explicitly?

     Réponse

     Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.

290. Carte 290

     Question

     What is a change management policy meant to control?

     Réponse

     How changes are requested, assessed, approved, tested, implemented, and reviewed.

291. Carte 291

     Question

     What is a hybrid-cloud architecture?

     Réponse

     An environment that integrates private or on-premises resources with public cloud services.

292. Carte 292

     Question

     How do AH and ESP differ in the security services they can provide?

     Réponse

     AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.

293. Carte 293

     Question

     What makes user behavior risky?

     Réponse

     It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.

294. Carte 294

     Question

     What is least privilege?

     Réponse

     Granting only the access needed for the required task and no more.

295. Carte 295

     Question

     What do Secure, HttpOnly, and SameSite cookie attributes restrict?

     Réponse

     Transmission to HTTPS, script access, and cross-site sending, respectively.

296. Carte 296

     Question

     Why discover unmanaged assets?

     Réponse

     Unknown systems cannot be patched, monitored, or governed reliably.

297. Carte 297

     Question

     What is a service-level agreement?

     Réponse

     Measurable service commitments and remedies, such as availability or response targets.

298. Carte 298

     Question

     What should govern automated security escalation?

     Réponse

     Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.

299. Carte 299

     Question

     What is platform diversity as a resilience strategy?

     Réponse

     Using different implementations so one common flaw or failure is less likely to affect every copy.

300. Carte 300

     Question

     How can replayed session material affect an application?

     Réponse

     It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.

301. Carte 301

     Question

     What is an implicit trust zone in zero trust?

     Réponse

     A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.

302. Carte 302

     Question

     What does salting a password hash accomplish?

     Réponse

     It makes identical passwords hash differently and defeats precomputed hash tables.

303. Carte 303

     Question

     What is spear phishing?

     Réponse

     Phishing tailored to a specific person, role, or organization.

304. Carte 304

     Question

     What is eradication?

     Réponse

     Removing the attacker's access, malicious artifacts, and exploited conditions.

305. Carte 305

     Question

     Who is a risk owner?

     Réponse

     The person accountable for deciding and monitoring how a specific risk is handled.

306. Carte 306

     Question

     What does a partially known penetration-test environment provide?

     Réponse

     The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.

307. Carte 307

     Question

     What is a microservices architecture?

     Réponse

     An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.

308. Carte 308

     Question

     What is a jump server?

     Réponse

     A hardened intermediary used to reach systems in a restricted management network.

309. Carte 309

     Question

     What can happen when a configuration change is made without dependency analysis?

     Réponse

     A downstream service can fail even when the changed component works.

310. Carte 310

     Question

     What is resource reuse exposure?

     Réponse

     Sensitive data from a previous use remains accessible when storage or memory is reassigned.

311. Carte 311

     Question

     Why does financial information require explicit protection?

     Réponse

     It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.

312. Carte 312

     Question

     What does CVE provide?

     Réponse

     A common identifier for a publicly disclosed vulnerability.

313. Carte 313

     Question

     Where can DLP controls operate?

     Réponse

     On endpoints, networks, email, and cloud services, depending on the product and visibility.

314. Carte 314

     Question

     What does privileged password vaulting protect?

     Réponse

     It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.

315. Carte 315

     Question

     What does an access-control standard define?

     Réponse

     Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.

316. Carte 316

     Question

     How can automation support compliance monitoring?

     Réponse

     It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.

317. Carte 317

     Question

     What does static code analysis examine?

     Réponse

     Source or compiled code for weakness patterns without executing the application.

318. Carte 318

     Question

     What actor attribute describes funding, time, and personnel?

     Réponse

     Resources.

319. Carte 319

     Question

     What is DNS poisoning?

     Réponse

     Introducing false DNS data so names resolve to attacker-chosen destinations.

320. Carte 320

     Question

     Why change default credentials during hardening?

     Réponse

     Default secrets are predictable and commonly targeted.

321. Carte 321

     Question

     What does quarantine do after a security alert?

     Réponse

     It restricts a suspected asset or object while analysts validate and remediate the risk.

322. Carte 322

     Question

     What does key stretching do for stored passwords?

     Réponse

     It deliberately makes each password guess more computationally expensive.

323. Carte 323

     Question

     What is smishing?

     Réponse

     Phishing delivered through SMS or another text-messaging service.

324. Carte 324

     Question

     What is qualitative risk analysis?

     Réponse

     Using descriptive scales such as low, medium, and high to compare likelihood and impact.

325. Carte 325

     Question

     What is a master service agreement?

     Réponse

     An umbrella contract establishing general legal and commercial terms for ongoing work.

326. Carte 326

     Question

     What is threat scope reduction?

     Réponse

     Narrowing the systems, privileges, or paths an attacker can reach.

327. Carte 327

     Question

     Why use a third-party cloud service instead of building locally?

     Réponse

     It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.

328. Carte 328

     Question

     What should determine security-device placement?

     Réponse

     The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.

329. Carte 329

     Question

     What does situational awareness mean for a user?

     Réponse

     Notice the people, devices, requests, location, and context around a task before acting.

330. Carte 330

     Question

     What does a failover test validate?

     Réponse

     That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.

331. Carte 331

     Question

     What is a preventive control meant to do?

     Réponse

     Stop an unwanted event before it succeeds.

332. Carte 332

     Question

     What is just-in-time privileged access?

     Réponse

     Elevated access is granted only when needed and expires after a short approved period.

333. Carte 333

     Question

     What safeguard should security-group automation enforce?

     Réponse

     Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.

334. Carte 334

     Question

     How does a reflected DDoS attack hide and multiply sources?

     Réponse

     The attacker spoofs the victim's address so many third-party services send their replies to the victim.

335. Carte 335

     Question

     What is a security misconfiguration?

     Réponse

     An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.

336. Carte 336

     Question

     Why can the same vulnerability have different organizational impact?

     Réponse

     Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.

337. Carte 337

     Question

     What does URL scanning evaluate before a user opens a web destination?

     Réponse

     The address, redirect chain, reputation, category, and known threat indicators associated with the destination.

338. Carte 338

     Question

     What is the board's security governance role?

     Réponse

     Provide oversight, set risk direction, and hold executives accountable.

339. Carte 339

     Question

     What does code signing establish?

     Réponse

     That code came from the holder of the signing key and has not changed since signing.

340. Carte 340

     Question

     How should an asset's classification affect security operations?

     Réponse

     It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.

341. Carte 341

     Question

     How does encryption protect data?

     Réponse

     It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.

342. Carte 342

     Question

     What is a secure enclave?

     Réponse

     A hardware-isolated execution area intended to protect selected code and data from the rest of the system.

343. Carte 343

     Question

     What is business email compromise?

     Réponse

     Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.

344. Carte 344

     Question

     What is recovery in incident response?

     Réponse

     Restoring services safely, monitoring them, and returning to normal operations.

345. Carte 345

     Question

     How is single loss expectancy commonly estimated?

     Réponse

     Asset value multiplied by the exposure factor.

346. Carte 346

     Question

     What does an unknown penetration-test environment provide?

     Réponse

     The tester begins with little or no internal information, modeling an external attacker's discovery process.

347. Carte 347

     Question

     What security boundary does a hypervisor provide?

     Réponse

     It isolates virtual machines while controlling their access to shared hardware.

348. Carte 348

     Question

     Why does a TLS tunnel not protect a compromised endpoint?

     Réponse

     TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.

349. Carte 349

     Question

     Why update diagrams after an infrastructure change?

     Réponse

     Operations and incident responders need the documentation to match the deployed environment.

350. Carte 350

     Question

     What does privacy ownership assign?

     Réponse

     An accountable role for privacy decisions, obligations, data inventory, and corrective action.

351. Carte 351

     Question

     What does a security control gap analysis compare?

     Réponse

     The controls required for the target state with the controls currently in place.

352. Carte 352

     Question

     Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?

     Réponse

     External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.

353. Carte 353

     Question

     What is application privilege escalation?

     Réponse

     Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.

354. Carte 354

     Question

     What risk remains when unnecessary software is left installed?

     Réponse

     Its code, services, dependencies, and privileges add attack surface even when users do not need it.

355. Carte 355

     Question

     What does SCAP standardize?

     Réponse

     Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.

356. Carte 356

     Question

     What can packet capture reveal?

     Réponse

     Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.

357. Carte 357

     Question

     What makes a privileged credential ephemeral?

     Réponse

     It is created for a limited task or session and expires or is destroyed automatically after that use.

358. Carte 358

     Question

     How do a statement of work and a work order differ?

     Réponse

     A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.

359. Carte 359

     Question

     Why might multi-cloud improve resilience?

     Réponse

     A provider-wide failure need not stop workloads that can run independently elsewhere.

360. Carte 360

     Question

     How can a service provider introduce a supply-chain vulnerability?

     Réponse

     Its privileged access, hosted service, or compromised integration can expose customers that depend on it.

361. Carte 361

     Question

     What is a false positive in vulnerability scanning?

     Réponse

     A reported weakness that is not actually present or exploitable in the assessed context.

362. Carte 362

     Question

     How do EDR and XDR differ?

     Réponse

     EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.

363. Carte 363

     Question

     What should onboarding and offboarding procedures coordinate?

     Réponse

     Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.

364. Carte 364

     Question

     How should an organization harden managed mobile devices?

     Réponse

     Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.

365. Carte 365

     Question

     What is a certificate signing request?

     Réponse

     A request containing a public key and subject information for a certificate authority to sign.

366. Carte 366

     Question

     What is pretexting?

     Réponse

     Using a fabricated role or situation to make a request seem legitimate.

367. Carte 367

     Question

     How is annualized loss expectancy commonly estimated?

     Réponse

     Single loss expectancy multiplied by annualized rate of occurrence.

368. Carte 368

     Question

     What security consequence follows from containers sharing a kernel?

     Réponse

     A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.

369. Carte 369

     Question

     Where does 802.1X enforce a network admission decision?

     Réponse

     At the controlled switch port or wireless access point before normal network access is granted.

370. Carte 370

     Question

     What should insider-threat awareness teach?

     Réponse

     Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.

371. Carte 371

     Question

     What access action is suitable for careful automation?

     Réponse

     Enabling or disabling a defined service or account from an approved lifecycle or incident event.

372. Carte 372

     Question

     What is an evil twin?

     Réponse

     A rogue wireless network made to resemble a legitimate one so users connect to it.

     

     744 cartes

     CompTIA Security+ SY0-701 Flashcards: Complete Objective Review

     Réviser ce paquet gratuitement

     Nibomo s'ouvre pour que vous puissiez commencer à réviser.

373. Carte 373

     Question

     Does non-human-readable data need less protection?

     Réponse

     No. Encoded or machine-readable data can carry the same sensitive meaning and impact.

374. Carte 374

     Question

     What does authenticating a system establish?

     Réponse

     It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.

375. Carte 375

     Question

     What does LDAP provide in identity systems?

     Réponse

     A standard protocol for querying and modifying directory entries such as users, groups, and attributes.

376. Carte 376

     Question

     What is a deterrent control meant to do?

     Réponse

     Discourage an attacker from attempting an unwanted action.

377. Carte 377

     Question

     Why update procedures after changing a security control?

     Réponse

     Staff need accurate steps for operating, monitoring, and recovering the new control.

378. Carte 378

     Question

     How does OCSP differ from a certificate revocation list?

     Réponse

     OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.

379. Carte 379

     Question

     What is the goal of data exfiltration?

     Réponse

     Remove data from its authorized environment without permission.

380. Carte 380

     Question

     What is a watering-hole attack?

     Réponse

     Compromising a site frequented by the intended targets so their visits expose them.

381. Carte 381

     Question

     How can a hardware provider introduce a supply-chain vulnerability?

     Réponse

     A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.

382. Carte 382

     Question

     What is application forgery?

     Réponse

     Creating or altering a request, token, or object so the application treats it as authentic.

383. Carte 383

     Question

     How does least privilege mitigate compromise?

     Réponse

     It limits the actions and resources available to a compromised account or process.

384. Carte 384

     Question

     What is serverless computing?

     Réponse

     A model where the provider manages servers and the customer deploys event-driven code or functions.

385. Carte 385

     Question

     What makes an infrastructure control effective for a specific risk?

     Réponse

     Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.

386. Carte 386

     Question

     What does parallel recovery processing test?

     Réponse

     Whether primary and alternate environments can run together consistently before a controlled cutover.

387. Carte 387

     Question

     Which password-authentication method does WPA3-Personal use?

     Réponse

     Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.

388. Carte 388

     Question

     How does data retention affect asset disposal?

     Réponse

     Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.

389. Carte 389

     Question

     What is a false negative in vulnerability scanning?

     Réponse

     A real weakness that the assessment fails to report.

390. Carte 390

     Question

     What does recurring security scanning add to monitoring?

     Réponse

     Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.

391. Carte 391

     Question

     What should guide port selection for a secure protocol?

     Réponse

     Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.

392. Carte 392

     Question

     What does forensic acquisition create?

     Réponse

     A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.

393. Carte 393

     Question

     How do system owners and data owners divide security accountability?

     Réponse

     A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.

394. Carte 394

     Question

     What does likelihood express in risk analysis?

     Réponse

     A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.

395. Carte 395

     Question

     What is a memorandum of understanding?

     Réponse

     A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.

396. Carte 396

     Question

     What does the right to be forgotten generally require?

     Réponse

     Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.

397. Carte 397

     Question

     What does an audit committee oversee?

     Réponse

     Audit independence, plans, significant findings, management responses, and corrective-action follow-through.

398. Carte 398

     Question

     What does identity interoperability require?

     Réponse

     Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.

399. Carte 399

     Question

     How does a bollard protect a facility?

     Réponse

     It blocks or redirects vehicles before they can reach a protected area.

400. Carte 400

     Question

     How can hashing protect a downloaded file?

     Réponse

     A trusted digest lets the recipient detect whether the file changed.

401. Carte 401

     Question

     What is a credential replay attack?

     Réponse

     Using captured valid credentials or tokens again without needing to discover the secret.

402. Carte 402

     Question

     How can automation complexity create security risk?

     Réponse

     Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.

403. Carte 403

     Question

     What must an architecture provide when a component cannot be patched?

     Réponse

     Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.

404. Carte 404

     Question

     What makes remote access secure?

     Réponse

     Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.

405. Carte 405

     Question

     What should users verify before connecting removable media or a cable?

     Réponse

     That the device and connection are approved, expected, and handled under organizational policy.

406. Carte 406

     Question

     What is a self-signed certificate?

     Réponse

     A certificate signed by its own private key rather than by a separate trusted issuer.

407. Carte 407

     Question

     What is brand impersonation?

     Réponse

     Using a trusted organization's identity or look to deceive people.

408. Carte 408

     Question

     What characterizes a conservative risk appetite?

     Réponse

     A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.

409. Carte 409

     Question

     What should a managed mobile device verify before using Wi-Fi?

     Réponse

     The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.

410. Carte 410

     Question

     What is a zero-day vulnerability?

     Réponse

     A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.

411. Carte 411

     Question

     What does verification confirm after vulnerability remediation?

     Réponse

     Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.

412. Carte 412

     Question

     What is user and entity behavior analytics?

     Réponse

     Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.

413. Carte 413

     Question

     What does a physical security policy establish?

     Réponse

     Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.

414. Carte 414

     Question

     What does a UPS provide?

     Réponse

     Immediate short-term power and power conditioning while systems shut down or alternate power starts.

415. Carte 415

     Question

     What is a nondisclosure agreement?

     Réponse

     A contract restricting use and disclosure of defined confidential information.

416. Carte 416

     Question

     What should be checked before assigning a user permission?

     Réponse

     The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.

417. Carte 417

     Question

     How does espionage differ from ordinary theft?

     Réponse

     It seeks confidential intelligence for strategic advantage, often while remaining hidden.

418. Carte 418

     Question

     What is password spraying?

     Réponse

     Trying a small set of common passwords across many accounts to avoid lockouts.

419. Carte 419

     Question

     What is the purpose of system isolation during an incident?

     Réponse

     Stop harmful communication while preserving the system for response and investigation.

420. Carte 420

     Question

     What is a security benchmark?

     Réponse

     A documented set of recommended configuration checks for a platform or product.

421. Carte 421

     Question

     Which metadata fields give a log record investigative context?

     Réponse

     Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.

422. Carte 422

     Question

     What does an access-control vestibule prevent?

     Réponse

     It limits tailgating by allowing controlled passage through one door at a time.

423. Carte 423

     Question

     What is version control's security value for configuration?

     Réponse

     It preserves attributable history and enables review or rollback of changes.

424. Carte 424

     Question

     Why use both internal and external compliance monitoring?

     Réponse

     Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.

425. Carte 425

     Question

     What distinguishes on-premises architecture?

     Réponse

     The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.

426. Carte 426

     Question

     What risk can split tunneling add to a VPN?

     Réponse

     The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.

427. Carte 427

     Question

     What is a certificate root of trust?

     Réponse

     A trusted root certificate or key from which a client validates a certificate chain.

428. Carte 428

     Question

     What is typosquatting?

     Réponse

     Registering a look-alike domain based on common typing errors or visual similarity.

429. Carte 429

     Question

     What is root-cause analysis?

     Réponse

     Identifying the underlying conditions that allowed an incident, not just its visible symptoms.

430. Carte 430

     Question

     What is risk tolerance?

     Réponse

     The acceptable variation or boundary around a specific objective or risk area.

431. Carte 431

     Question

     What is a security self-assessment?

     Réponse

     A structured internal evaluation in which the organization measures its own controls against selected criteria.

432. Carte 432

     Question

     What does data masking change?

     Réponse

     It replaces sensitive values with altered but usable representations, often preserving format for testing or display.

433. Carte 433

     Question

     How do wireless authentication protocols let clients prove identity securely?

     Réponse

     They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.

434. Carte 434

     Question

     Why reconcile inventory with network discovery?

     Réponse

     Differences expose missing records, retired systems, or unauthorized devices.

435. Carte 435

     Question

     Why does sideloading raise mobile risk?

     Réponse

     It can bypass store review, signing policy, and managed application controls.

436. Carte 436

     Question

     What does an information-sharing organization add to vulnerability management?

     Réponse

     Sector or community intelligence about relevant threats, incidents, and defensive action.

437. Carte 437

     Question

     What does a web-filter block rule specify?

     Réponse

     The URL, domain, category, reputation, content, user, or context that should prevent a web request.

438. Carte 438

     Question

     How do data custodians and data stewards differ?

     Réponse

     Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.

439. Carte 439

     Question

     What is a brute-force password attack?

     Réponse

     Systematically trying many candidate secrets against an account or protected value.

440. Carte 440

     Question

     What is a compensating control?

     Réponse

     An alternative safeguard used when the preferred control is impractical or unavailable.

441. Carte 441

     Question

     How can location act as an authentication factor?

     Réponse

     A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.

442. Carte 442

     Question

     Why must security automation remain supportable?

     Réponse

     Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.

443. Carte 443

     Question

     What does a standby generator provide?

     Réponse

     Longer-duration power during a utility outage, after a startup delay.

444. Carte 444

     Question

     What makes an architecture air-gapped?

     Réponse

     It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.

445. Carte 445

     Question

     What is a software-defined WAN?

     Réponse

     A centrally managed overlay that selects wide-area paths by policy across underlying network links.

446. Carte 446

     Question

     What password-management behavior should awareness training reinforce?

     Réponse

     Use unique long passwords through an approved manager and report suspected compromise promptly.

447. Carte 447

     Question

     What security value does fencing provide?

     Réponse

     It defines and delays entry across a physical perimeter.

448. Carte 448

     Question

     What is a wildcard certificate?

     Réponse

     A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.

449. Carte 449

     Question

     How does misinformation differ from disinformation?

     Réponse

     Misinformation is false regardless of intent; disinformation is deliberately false or misleading.

450. Carte 450

     Question

     What is a risk threshold?

     Réponse

     A defined level that triggers escalation, treatment, or another required response.

451. Carte 451

     Question

     What does a vendor penetration test contribute to assessment?

     Réponse

     Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.

452. Carte 452

     Question

     What is the objective of a service-disruption attack?

     Réponse

     Make a system or business function unavailable or unreliable.

453. Carte 453

     Question

     What is directory traversal?

     Réponse

     Manipulating a file path to reach files outside the directory the application intended to expose.

454. Carte 454

     Question

     Why decommission an unsupported system?

     Réponse

     Removing it eliminates an exposure that can no longer be patched or securely maintained.

455. Carte 455

     Question

     Why archive security-monitoring data?

     Réponse

     To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.

456. Carte 456

     Question

     What role does RADIUS commonly play in enterprise Wi-Fi?

     Réponse

     It centralizes authentication, authorization information, and accounting for network access.

457. Carte 457

     Question

     Why separate the requester and approver of a high-risk change?

     Réponse

     To reduce error, fraud, and unilateral unauthorized modification.

458. Carte 458

     Question

     Why can a jailbroken device violate a security baseline?

     Réponse

     It weakens platform isolation and allows unapproved privileged changes.

459. Carte 459

     Question

     When is tokenization especially useful?

     Réponse

     When a system needs a surrogate value without retaining the original sensitive value in that workflow.

460. Carte 460

     Question

     Why can dark-web intelligence affect vulnerability priority?

     Réponse

     Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.

461. Carte 461

     Question

     What firewall policy should govern traffic from a screened subnet to internal systems?

     Réponse

     Deny it by default and allow only explicitly required flows.

462. Carte 462

     Question

     What does SAML commonly carry?

     Réponse

     XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.

463. Carte 463

     Question

     What does a security governance committee do?

     Réponse

     It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.

464. Carte 464

     Question

     How can global privacy requirements affect one data process?

     Réponse

     A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.

465. Carte 465

     Question

     What characterizes an IoT device?

     Réponse

     It combines sensing or actuation with network connectivity, often under tight resource and update constraints.

466. Carte 466

     Question

     What is a unified threat management appliance?

     Réponse

     One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.

467. Carte 467

     Question

     What does a hardware security module provide?

     Réponse

     A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.

468. Carte 468

     Question

     A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?

     Réponse

     Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.

469. Carte 469

     Question

     What is a tabletop exercise?

     Réponse

     A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.

470. Carte 470

     Question

     What does a risk exemption authorize?

     Réponse

     A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.

471. Carte 471

     Question

     What is a regulatory examination?

     Réponse

     An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.

472. Carte 472

     Question

     What does physical video surveillance primarily provide?

     Réponse

     Detection and evidence of activity in monitored areas.

473. Carte 473

     Question

     What is a birthday attack against a hash?

     Réponse

     Using collision probability to find any two matching digests much faster than targeting one exact preimage.

474. Carte 474

     Question

     Why keep backups both onsite and offsite?

     Réponse

     Onsite copies support fast recovery, while offsite copies survive a site-wide loss.

475. Carte 475

     Question

     How does technical debt affect security automation?

     Réponse

     Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.

476. Carte 476

     Question

     What should switch hardening restrict first?

     Réponse

     Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.

477. Carte 477

     Question

     What should happen when an asset changes owners?

     Réponse

     Inventory, access, support responsibility, and data handling should be updated.

478. Carte 478

     Question

     What does evidence of a vendor's internal audits contribute?

     Réponse

     It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.

479. Carte 479

     Question

     What is identity attestation?

     Réponse

     Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.

480. Carte 480

     Question

     Why can standard enterprise patching be unsafe for an RTOS device?

     Réponse

     A change can disrupt timing guarantees or certified operational behavior.

481. Carte 481

     Question

     What is secure access service edge?

     Réponse

     A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.

482. Carte 482

     Question

     What social-engineering habit should awareness training reinforce?

     Réponse

     Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.

483. Carte 483

     Question

     How can a software provider introduce a supply-chain vulnerability?

     Réponse

     A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.

484. Carte 484

     Question

     Why include internet exposure in remediation priority?

     Réponse

     A reachable vulnerable service usually has more attack opportunity than an isolated one.

485. Carte 485

     Question

     What does a mail gateway inspect?

     Réponse

     Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.

486. Carte 486

     Question

     What is a data controller?

     Réponse

     The entity that determines why and how personal data is processed.

487. Carte 487

     Question

     How does blackmail motivate a cyberattack?

     Réponse

     The attacker threatens disclosure or harm unless the victim complies.

488. Carte 488

     Question

     What is a downgrade attack?

     Réponse

     Forcing parties to use an older or weaker protocol or security mode.

489. Carte 489

     Question

     How does encryption mitigate data exposure?

     Réponse

     It makes captured data unreadable without the required key.

490. Carte 490

     Question

     How do network and web vulnerability scanners differ?

     Réponse

     Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.

491. Carte 491

     Question

     How can vulnerability-scan data support an investigation?

     Réponse

     It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.

492. Carte 492

     Question

     What is key escrow?

     Réponse

     Controlled storage of a recoverable copy of a cryptographic key by an authorized party.

493. Carte 493

     Question

     Which human vector commonly uses a fake sign-in page to harvest credentials?

     Réponse

     Phishing; the message sends the target to an imitation service that captures the submitted credentials.

494. Carte 494

     Question

     What is risk avoidance?

     Réponse

     Stopping or not starting the activity that creates the risk.

495. Carte 495

     Question

     What is data obfuscation?

     Réponse

     Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.

496. Carte 496

     Question

     What is a directive control?

     Réponse

     A safeguard that tells people what behavior or action is required.

497. Carte 497

     Question

     What does a security guard add that a camera cannot?

     Réponse

     Human judgment and an immediate physical response.

498. Carte 498

     Question

     Why define restricted activities in change management?

     Réponse

     High-risk actions can then require extra authorization, separation of duties, or a prohibited window.

499. Carte 499

     Question

     What contractual impact can noncompliance create?

     Réponse

     It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.

500. Carte 500

     Question

     What should determine backup frequency?

     Réponse

     The recovery point objective, data-change rate, business impact, and available replication or storage capacity.

501. Carte 501

     Question

     What should router hardening protect?

     Réponse

     Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.

502. Carte 502

     Question

     What problem does OAuth 2.0 address?

     Réponse

     Delegated authorization: a client obtains limited access to a resource without receiving the user's password.

503. Carte 503

     Question

     What does SCADA do?

     Réponse

     It provides supervisory monitoring and control across distributed industrial equipment.

504. Carte 504

     Question

     How does a Layer 3/4 firewall rule differ from a Layer 7 rule?

     Réponse

     Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.

505. Carte 505

     Question

     What distinguishes a computer virus?

     Réponse

     It attaches to a host file or program and spreads when that infected host executes or is shared.

506. Carte 506

     Question

     What does a key management system coordinate?

     Réponse

     Secure key creation, storage, access, rotation, revocation, recovery, and destruction.

507. Carte 507

     Question

     How can an unsecure wired network expose traffic?

     Réponse

     An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.

508. Carte 508

     Question

     Why is vulnerable device firmware hard to remediate?

     Réponse

     Firmware updates may be rare, vendor-dependent, or impossible after support ends.

509. Carte 509

     Question

     What does patching change in vulnerability remediation?

     Réponse

     It installs the vendor's corrected code or configuration to remove the underlying software weakness.

510. Carte 510

     Question

     What does DMARC add to SPF and DKIM?

     Réponse

     Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.

511. Carte 511

     Question

     How does automation improve security efficiency?

     Réponse

     It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.

512. Carte 512

     Question

     What is a simulation exercise?

     Réponse

     A more realistic practice in which participants respond to injected events using operational processes.

513. Carte 513

     Question

     What is a data processor?

     Réponse

     An entity that processes personal data on behalf of a controller.

514. Carte 514

     Question

     What is risk mitigation?

     Réponse

     Reducing likelihood, impact, or both through controls or process changes.

515. Carte 515

     Question

     Why monitor a vendor after onboarding?

     Réponse

     Security posture, ownership, services, incidents, and dependencies can change.

516. Carte 516

     Question

     What does a physical penetration test assess?

     Réponse

     Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.

517. Carte 517

     Question

     Why use access badges at a facility?

     Réponse

     To associate entry attempts with authorized identities and enforce access rules.

518. Carte 518

     Question

     How does permission restriction protect data?

     Réponse

     Only authorized identities receive the actions and scope their roles require.

519. Carte 519

     Question

     What is the usual objective of ransomware extortion?

     Réponse

     Force payment by denying access, threatening disclosure, or both.

520. Carte 520

     Question

     What does impossible travel indicate?

     Réponse

     One identity appears to authenticate from distant locations too quickly for legitimate travel.

521. Carte 521

     Question

     What is configuration enforcement?

     Réponse

     Continuously applying or restoring approved settings so systems do not remain in an insecure state.

522. Carte 522

     Question

     What does a web vulnerability scanner inspect?

     Réponse

     Running web behavior for issues such as unsafe input handling and insecure configuration.

523. Carte 523

     Question

     How does cost affect an architecture choice?

     Réponse

     It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.

524. Carte 524

     Question

     What does EAP provide with 802.1X?

     Réponse

     A framework for carrying an authentication method between the supplicant and authentication infrastructure.

525. Carte 525

     Question

     What should operational-security training help users protect?

     Réponse

     Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.

526. Carte 526

     Question

     What does a time-of-day access rule do?

     Réponse

     Allows or denies a requested action according to an approved schedule.

527. Carte 527

     Question

     What should cloud infrastructure hardening establish?

     Réponse

     Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.

528. Carte 528

     Question

     What should an asset owner ensure during offboarding?

     Réponse

     Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.

529. Carte 529

     Question

     Why encrypt backups?

     Réponse

     Backup media and transfers can expose the same sensitive data as production systems.

530. Carte 530

     Question

     What is steganography?

     Réponse

     Hiding the existence of data inside another medium rather than merely encrypting its contents.

531. Carte 531

     Question

     Which human vector uses a fabricated authority role to justify a sensitive request?

     Réponse

     Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.

532. Carte 532

     Question

     Why does risk transfer not remove accountability?

     Réponse

     The organization can retain legal, reputational, operational, and oversight consequences.

533. Carte 533

     Question

     Why validate a change after deployment?

     Réponse

     To confirm the intended result occurred without introducing unacceptable side effects.

534. Carte 534

     Question

     What makes end-of-life hardware a security vulnerability?

     Réponse

     The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.

535. Carte 535

     Question

     What does an audit add to remediation validation?

     Réponse

     Independent evidence that the approved fix, process, and documentation were completed and remain effective.

536. Carte 536

     Question

     Why can SPF pass while a message still impersonates a brand?

     Réponse

     SPF checks the envelope domain, which may differ from the visible From domain.

537. Carte 537

     Question

     What role can a government entity have in security governance?

     Réponse

     It can establish, enforce, or oversee legal and regulatory requirements within its authority.

538. Carte 538

     Question

     How do data inventory and retention support privacy governance?

     Réponse

     The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.

539. Carte 539

     Question

     What can concurrent sessions from distant regions indicate?

     Réponse

     A stolen account or shared credential, subject to VPN and proxy context.

540. Carte 540

     Question

     What does supply-chain analysis examine?

     Réponse

     Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.

541. Carte 541

     Question

     What is the purpose of facility lighting as a control?

     Réponse

     Deter covert activity and improve observation of people and areas.

542. Carte 542

     Question

     What architecture quality keeps a service usable during component failure?

     Réponse

     Availability.

543. Carte 543

     Question

     When is fail-open behavior preferable to fail-closed behavior?

     Réponse

     When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.

544. Carte 544

     Question

     Which control function does a login-failure alert provide?

     Réponse

     Detection; it reveals suspicious authentication activity.

545. Carte 545

     Question

     What does a biometric MFA implementation verify?

     Réponse

     A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.

546. Carte 546

     Question

     How can automation enforce a security baseline?

     Réponse

     It compares realized settings with the approved state and reports or corrects unauthorized drift.

547. Carte 547

     Question

     How do wireless cryptographic protocols protect network traffic?

     Réponse

     They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.

548. Carte 548

     Question

     Why segment sensitive data stores?

     Réponse

     It limits reachable paths and separates them from lower-trust workloads.

549. Carte 549

     Question

     What must remain secret in an asymmetric key pair?

     Réponse

     The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.

550. Carte 550

     Question

     How can a supplier become a supply-chain attack vector?

     Réponse

     A compromised material, component, credential, or delivery process can weaken products before they reach the organization.

551. Carte 551

     Question

     What is e-discovery?

     Réponse

     Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.

552. Carte 552

     Question

     What characterizes a neutral risk appetite?

     Réponse

     A balanced willingness to accept uncertainty when expected value and controls justify the exposure.

553. Carte 553

     Question

     What is passive reconnaissance?

     Réponse

     Gathering information without directly interacting with the target's systems.

554. Carte 554

     Question

     What does a philosophical motive mean for a threat actor?

     Réponse

     The actor acts to advance a belief or moral position rather than primarily for money.

555. Carte 555

     Question

     What does unexpected resource consumption indicate?

     Réponse

     Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.

556. Carte 556

     Question

     What does a host-based intrusion prevention system do?

     Réponse

     It monitors activity on one host and can block behavior that matches exploit or attack rules.

557. Carte 557

     Question

     How does agent-based monitoring differ from agentless monitoring?

     Réponse

     An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.

558. Carte 558

     Question

     What can network logs contribute to an investigation?

     Réponse

     Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.

559. Carte 559

     Question

     What is the purpose of a backup restore test?

     Réponse

     Demonstrate under tested conditions that required data and systems can be recovered within expectations.

560. Carte 560

     Question

     Why can obsolete hardware become a security risk?

     Réponse

     It may lack supported firmware, modern protections, or replacement parts.

561. Carte 561

     Question

     What does rescanning confirm after remediation?

     Réponse

     Whether the scanner can still detect the original finding on the affected asset.

562. Carte 562

     Question

     What should a secure transport method provide?

     Réponse

     Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.

563. Carte 563

     Question

     How can law affect security governance?

     Réponse

     It can impose mandatory duties based on jurisdiction, data, industry, or activity.

564. Carte 564

     Question

     What does resilience mean for a security architecture?

     Réponse

     The ability to withstand disruption, adapt, and recover while preserving essential functions.

565. Carte 565

     Question

     Why minimize an infrastructure's attack surface?

     Réponse

     Fewer exposed services and paths leave fewer opportunities for exploitation.

566. Carte 566

     Question

     What does executing a security-awareness program require?

     Réponse

     Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.

567. Carte 567

     Question

     What does an infrared security sensor detect?

     Réponse

     A change in infrared energy, often the heat pattern created by a person moving through its field of view.

568. Carte 568

     Question

     What is a knowledge factor?

     Réponse

     Something the claimant knows, such as a password.

569. Carte 569

     Question

     Why review allow-list and deny-list impact before a change?

     Réponse

     Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.

570. Carte 570

     Question

     What does partition-level encryption protect?

     Réponse

     One selected disk partition, leaving other partitions outside that encryption boundary.

571. Carte 571

     Question

     How can instant messaging deliver a security attack?

     Réponse

     It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.

572. Carte 572

     Question

     What can repeated blocked-content events indicate?

     Réponse

     Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.

573. Carte 573

     Question

     What should a server-hardening baseline reduce?

     Réponse

     Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.

574. Carte 574

     Question

     When is physical media destruction appropriate?

     Réponse

     When reuse is unnecessary or sanitization cannot provide adequate assurance.

575. Carte 575

     Question

     What is mean time to repair?

     Réponse

     The average time required to restore a failed component or service.

576. Carte 576

     Question

     Why disclose conflicts of interest during vendor selection?

     Réponse

     A personal or financial relationship can bias evaluation away from the organization's requirements.

577. Carte 577

     Question

     What is a fine for noncompliance?

     Réponse

     A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.

578. Carte 578

     Question

     What does a public data classification authorize?

     Réponse

     Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.

579. Carte 579

     Question

     What security benefit comes from standard infrastructure configurations?

     Réponse

     They reduce variation, make review repeatable, and let the same approved controls be applied across resources.

580. Carte 580

     Question

     How does horizontal scaling increase capacity?

     Réponse

     It adds more service instances and distributes work among them.

581. Carte 581

     Question

     Why can added connectivity weaken segmentation?

     Réponse

     Each allowed path can become a route for lateral movement or data escape.

582. Carte 582

     Question

     What coding practice is central to preventing SQL injection?

     Réponse

     Use parameterized queries so untrusted values remain data rather than executable query syntax.

583. Carte 583

     Question

     When is a compensating control appropriate for a vulnerability?

     Réponse

     When timely removal or patching is infeasible and another control can reduce the risk.

584. Carte 584

     Question

     How does agent-based web filtering enforce policy?

     Réponse

     Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.

585. Carte 585

     Question

     How can regulation differ from an internal policy?

     Réponse

     Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.

586. Carte 586

     Question

     What is a storage snapshot?

     Réponse

     A point-in-time representation of data or system state, whose independence depends on how it is stored.

587. Carte 587

     Question

     What does password age measure?

     Réponse

     How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.

588. Carte 588

     Question

     What does an ethical motive mean in vulnerability research?

     Réponse

     The researcher intends to improve security, typically through authorized testing and responsible disclosure.

589. Carte 589

     Question

     What can missing security logs indicate?

     Réponse

     Logging failure, tampering, retention misconfiguration, or an inactive source.

590. Carte 590

     Question

     Why disable unused ports and protocols?

     Réponse

     They expose unnecessary communication paths and code that attackers can reach.

591. Carte 591

     Question

     What does antivirus contribute to monitoring?

     Réponse

     It scans files, memory, or behavior and reports suspected malicious code.

592. Carte 592

     Question

     What is a honeypot?

     Réponse

     A decoy system or service designed to attract and observe malicious activity.

593. Carte 593

     Question

     What does file-level encryption protect?

     Réponse

     Selected files independently of whether the rest of the disk or volume is encrypted.

594. Carte 594

     Question

     How can SMS deliver a security attack?

     Réponse

     A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.

595. Carte 595

     Question

     What happens during incident analysis?

     Réponse

     Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.

596. Carte 596

     Question

     What is mean time between failures?

     Réponse

     The average operating time between repairable failures.

597. Carte 597

     Question

     What is active reconnaissance?

     Réponse

     Probing or interacting with target systems to discover services and behavior.

598. Carte 598

     Question

     What constraint should guide ICS or SCADA hardening?

     Réponse

     Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.

599. Carte 599

     Question

     Which control function does restoring a clean system image provide?

     Réponse

     Correction; it returns the system to a known-good state.

600. Carte 600

     Question

     What does responsiveness mean in an architecture decision?

     Réponse

     How quickly the system and its operators can adapt to demand, failure, or attack.

601. Carte 601

     Question

     How does out-of-band access strengthen remote administration?

     Réponse

     It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.

602. Carte 602

     Question

     What makes user behavior unexpected?

     Réponse

     It differs materially from the person's normal role, timing, location, resource use, or established work pattern.

603. Carte 603

     Question

     What is a work order?

     Réponse

     A document authorizing a defined unit of work under an existing agreement.

604. Carte 604

     Question

     What can out-of-cycle logging indicate?

     Réponse

     Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.

605. Carte 605

     Question

     Why update a standard operating procedure after a change?

     Réponse

     It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.

606. Carte 606

     Question

     What coding practice limits cross-site scripting?

     Réponse

     Context-appropriate output encoding, supported by safe templating and input handling.

607. Carte 607

     Question

     What does a restricted data classification indicate?

     Réponse

     Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.

608. Carte 608

     Question

     How does a bug bounty support responsible disclosure?

     Réponse

     It defines eligible systems, rules, reporting, and possible rewards for external researchers.

609. Carte 609

     Question

     What does web-filter content categorization provide?

     Réponse

     A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.

610. Carte 610

     Question

     How do hard and soft authentication tokens differ?

     Réponse

     A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.

611. Carte 611

     Question

     How can industry requirements affect security governance?

     Réponse

     Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.

612. Carte 612

     Question

     How can noncompliance cause loss of a license?

     Réponse

     An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.

613. Carte 613

     Question

     What does volume-level encryption protect?

     Réponse

     All data within a selected logical storage volume.

614. Carte 614

     Question

     How can impersonation exploit familiarity?

     Réponse

     The attacker imitates a known person or routine communication style so the request receives less scrutiny.

615. Carte 615

     Question

     How does RTO guide recovery design?

     Réponse

     It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.

616. Carte 616

     Question

     What is a honeynet?

     Réponse

     A network of decoy systems used to study or divert attackers.

617. Carte 617

     Question

     What does backup replication provide?

     Réponse

     Additional synchronized or copied recovery data in another system or location.

618. Carte 618

     Question

     What lets automation scale securely?

     Réponse

     Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.

619. Carte 619

     Question

     Why monitor a hardened computing resource continuously?

     Réponse

     New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.

620. Carte 620

     Question

     Why keep a certificate of destruction?

     Réponse

     It documents that a disposal provider handled specified media under the agreed process.

621. Carte 621

     Question

     Why consider patch availability before selecting a platform?

     Réponse

     Unsupported or difficult-to-update components accumulate known exposure.

622. Carte 622

     Question

     Why should remote administration use an encrypted, authenticated protocol?

     Réponse

     It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.

623. Carte 623

     Question

     How can revenge motivate an insider incident?

     Réponse

     A disgruntled person may damage systems or disclose data to punish the organization.

624. Carte 624

     Question

     What is a published or documented indicator of malicious activity?

     Réponse

     A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.

625. Carte 625

     Question

     Why monitor a system more closely when a mitigation exception is accepted?

     Réponse

     Monitoring can reveal exploitation or control failure while the documented exception remains open.

626. Carte 626

     Question

     What is an SNMP trap?

     Réponse

     An unsolicited device notification sent to a management system when a configured event occurs.

627. Carte 627

     Question

     How can an automated report support an investigation?

     Réponse

     It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.

628. Carte 628

     Question

     What is a security key?

     Réponse

     A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.

629. Carte 629

     Question

     What does database-level encryption protect?

     Réponse

     A database or selected database structures through controls managed at the database layer.

630. Carte 630

     Question

     How does brand impersonation exploit trust?

     Réponse

     It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.

631. Carte 631

     Question

     What browser-side impact can a cross-site scripting vulnerability create?

     Réponse

     It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.

632. Carte 632

     Question

     How can a system or process audit identify vulnerabilities?

     Réponse

     It compares evidence with required configuration and procedure to reveal control gaps.

633. Carte 633

     Question

     What security role can Group Policy provide?

     Réponse

     Centralized Windows configuration of account, application, audit, and system security settings.

634. Carte 634

     Question

     What should incident-response training prepare people to do?

     Réponse

     Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.

635. Carte 635

     Question

     Why must governance track local or regional requirements?

     Réponse

     They may impose location-specific duties that differ from national, global, industry, or contractual rules.

636. Carte 636

     Question

     How can a dependency become a useful key risk indicator?

     Réponse

     A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.

637. Carte 637

     Question

     What is a business partners agreement?

     Réponse

     An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.

638. Carte 638

     Question

     What makes an audit regulatory?

     Réponse

     It evaluates compliance with requirements established or enforced by a government or delegated authority.

639. Carte 639

     Question

     What is a honeyfile?

     Réponse

     A decoy file whose access can reveal unauthorized activity.

640. Carte 640

     Question

     Why does legal information require explicit protection?

     Réponse

     It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.

641. Carte 641

     Question

     Which indicator can mass file renaming and encryption produce?

     Réponse

     Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.

642. Carte 642

     Question

     What remains with an organization after transferring architecture risk?

     Réponse

     Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.

643. Carte 643

     Question

     When does local console placement provide useful administrative access?

     Réponse

     When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.

644. Carte 644

     Question

     What makes a harmful user action unintentional?

     Réponse

     The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.

645. Carte 645

     Question

     How should an organization harden workstations?

     Réponse

     Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.

646. Carte 646

     Question

     What is journaling in recovery?

     Réponse

     Recording ordered changes so data can be replayed or restored to a consistent point.

647. Carte 647

     Question

     What downtime must a change plan account for?

     Réponse

     The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.

648. Carte 648

     Question

     Why must a privacy program map local or regional law to data flows?

     Réponse

     The applicable duties can change with the location of the person, organization, processing, or stored data.

649. Carte 649

     Question

     Why combine independent preventive controls at different layers?

     Réponse

     A failure at one layer does not automatically let the same attack succeed at the next layer.

650. Carte 650

     Question

     What is passwordless authentication?

     Réponse

     A flow that does not require the user to enter a memorized password, often using public-key credentials.

651. Carte 651

     Question

     How can automation improve security reaction time?

     Réponse

     It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.

652. Carte 652

     Question

     What does record-level encryption protect?

     Réponse

     Individual records or fields, allowing finer protection than encrypting the entire database.

653. Carte 653

     Question

     How can business email compromise misuse urgency?

     Réponse

     It pressures an employee to bypass normal verification for a payment, credential, or data request.

654. Carte 654

     Question

     What does impact measure in risk analysis?

     Réponse

     The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.

655. Carte 655

     Question

     What makes cyber activity part of warfare?

     Réponse

     It supports military or state conflict objectives such as disruption, intelligence, or influence.

656. Carte 656

     Question

     Which indicator can a newly created privileged account produce outside the normal change window?

     Réponse

     Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.

657. Carte 657

     Question

     How can configuration enforcement validate a deployed mitigation?

     Réponse

     It compares the realized settings with the approved state and corrects or reports drift.

658. Carte 658

     Question

     How does validating an alert improve alert tuning?

     Réponse

     The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.

659. Carte 659

     Question

     What data-layer impact can a SQL injection vulnerability create?

     Réponse

     It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.

660. Carte 660

     Question

     What environmental variables can change vulnerability priority?

     Réponse

     Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.

661. Carte 661

     Question

     What security role does SELinux provide?

     Réponse

     Mandatory access controls that confine processes according to centrally defined policy.

662. Carte 662

     Question

     Why review governance documents periodically?

     Réponse

     Business, technology, threats, and external obligations change.

663. Carte 663

     Question

     Why evaluate power requirements for a system design?

     Réponse

     Power capacity and redundancy constrain availability and recovery.

664. Carte 664

     Question

     When is IPsec a better tunnel choice than TLS?

     Réponse

     Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.

665. Carte 665

     Question

     What is a honeytoken?

     Réponse

     A fake credential or data element that generates a high-confidence alert when used.

666. Carte 666

     Question

     What should embedded-system hardening prioritize?

     Réponse

     Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.

667. Carte 667

     Question

     Why must sanitization address data remanence?

     Réponse

     Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.

668. Carte 668

     Question

     Why require rules of engagement for vendor testing?

     Réponse

     Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.

669. Carte 669

     Question

     What does a private data classification indicate?

     Réponse

     The information concerns an individual or limited internal audience and should not be exposed publicly.

670. Carte 670

     Question

     What does a tabletop recovery exercise test?

     Réponse

     Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.

671. Carte 671

     Question

     Why prevent password reuse?

     Réponse

     One compromised password should not unlock other accounts or services.

672. Carte 672

     Question

     Which malicious-activity indicator is unexplained sustained CPU or memory use?

     Réponse

     Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.

673. Carte 673

     Question

     What does transport encryption protect?

     Réponse

     It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.

674. Carte 674

     Question

     How can a voice call become an attack vector?

     Réponse

     An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.

675. Carte 675

     Question

     What should a digital-forensics report document?

     Réponse

     The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.

676. Carte 676

     Question

     What tradeoff comes with an expansionary risk appetite?

     Réponse

     It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.

677. Carte 677

     Question

     What does a known penetration-test environment provide?

     Réponse

     The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.

678. Carte 678

     Question

     Why evaluate compute requirements before deployment?

     Réponse

     Insufficient resources can cause failure, while excessive resources increase cost and attack surface.

679. Carte 679

     Question

     Why place sensors at network choke points?

     Réponse

     They can observe traffic crossing important trust boundaries.

680. Carte 680

     Question

     What should hybrid or remote-work security training emphasize?

     Réponse

     Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.

681. Carte 681

     Question

     Why plan an application restart separately from a service restart?

     Réponse

     The application may need its own state handling, user coordination, health checks, and rollback point.

682. Carte 682

     Question

     What is a cryptographic vulnerability?

     Réponse

     A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.

683. Carte 683

     Question

     Why report findings by asset owner?

     Réponse

     Owners need clear accountability and a prioritized remediation queue.

684. Carte 684

     Question

     What should guide selection of a secure protocol?

     Réponse

     The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.

685. Carte 685

     Question

     How do centralized and decentralized governance structures differ?

     Réponse

     Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.

686. Carte 686

     Question

     How does privacy-aware design limit data retention?

     Réponse

     It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.

687. Carte 687

     Question

     What does a pressure security sensor detect?

     Réponse

     Force or weight applied to a protected surface, such as a floor mat or fence line.

688. Carte 688

     Question

     What automation costs should a security team plan for?

     Réponse

     Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.

689. Carte 689

     Question

     What should RTOS hardening preserve while reducing attack surface?

     Réponse

     Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.

690. Carte 690

     Question

     What is the goal of disruption-for-chaos activity?

     Réponse

     Create instability or damage itself rather than pursue a clear financial or intelligence return.

691. Carte 691

     Question

     Which indicator can repeated password guessing produce?

     Réponse

     Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.

692. Carte 692

     Question

     How does removing unnecessary software harden a system?

     Réponse

     It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.

693. Carte 693

     Question

     What does NetFlow provide?

     Réponse

     Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.

694. Carte 694

     Question

     How can a dashboard support an investigation?

     Réponse

     It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.

695. Carte 695

     Question

     When should a password be expired?

     Réponse

     When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.

696. Carte 696

     Question

     Why does cryptographic key length matter?

     Réponse

     It affects the work required to search the key space, although security also depends on the algorithm and implementation.

697. Carte 697

     Question

     How can an unsecure Bluetooth connection become an attack vector?

     Réponse

     Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.

698. Carte 698

     Question

     What is a key risk indicator?

     Réponse

     A metric that signals changing exposure or increasing likelihood of an adverse outcome.

699. Carte 699

     Question

     What should vendor monitoring verify when a contract ends?

     Réponse

     Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.

700. Carte 700

     Question

     What does a sensitive data classification indicate?

     Réponse

     The information needs safeguards because unauthorized access, change, or loss could cause harm.

701. Carte 701

     Question

     What does software-defined networking separate?

     Réponse

     The control plane that decides traffic behavior from the data plane that forwards traffic.

702. Carte 702

     Question

     Where should a web application firewall be placed?

     Réponse

     In the path of web requests before they reach the protected application.

703. Carte 703

     Question

     What does a simulated recovery exercise test?

     Réponse

     Participants perform realistic response actions in a controlled environment without disrupting production.

704. Carte 704

     Question

     How can a team verify that a detective control is effective?

     Réponse

     Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.

705. Carte 705

     Question

     How should defenders apply a published or documented indicator to telemetry and validate it before escalating?

     Réponse

     Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.

706. Carte 706

     Question

     What makes a vulnerability cloud-specific?

     Réponse

     It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.

707. Carte 707

     Question

     How can insurance respond to vulnerability risk?

     Réponse

     It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.

708. Carte 708

     Question

     How does reputation improve web filtering?

     Réponse

     It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.

709. Carte 709

     Question

     What does an encryption policy establish?

     Réponse

     Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.

710. Carte 710

     Question

     How does a microwave security sensor detect movement?

     Réponse

     It emits microwave energy and detects changes in the reflected signal caused by motion.

711. Carte 711

     Question

     What should IoT-device hardening change before deployment?

     Réponse

     Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.

712. Carte 712

     Question

     Why track software licenses as assets?

     Réponse

     License ownership, permitted use, updates, and end-of-support status affect compliance and risk.

713. Carte 713

     Question

     What does a password manager improve?

     Réponse

     It can generate and store unique long passwords so users do not memorize or reuse them.

714. Carte 714

     Question

     What makes a ledger open and public?

     Réponse

     Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.

715. Carte 715

     Question

     What should a payment-change request trigger?

     Réponse

     Independent verification through a known channel before any account or payment detail is changed.

716. Carte 716

     Question

     What does preserving digital evidence require?

     Réponse

     Protecting its integrity, context, access history, and availability from collection through final disposition.

717. Carte 717

     Question

     What should a risk report tell decision-makers?

     Réponse

     The risk, uncertainty, business impact, owner, treatment, trend, and decision required.

718. Carte 718

     Question

     What should an external assessment report provide?

     Réponse

     Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.

719. Carte 719

     Question

     What is a centralized design's main resilience risk?

     Réponse

     A central dependency can become a bottleneck or single point of failure.

720. Carte 720

     Question

     What does mutual TLS add to a TLS-protected service connection?

     Réponse

     It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.

721. Carte 721

     Question

     What should recurring security-awareness reporting show?

     Réponse

     Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.

722. Carte 722

     Question

     Why do legacy applications require extra change planning?

     Réponse

     They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.

723. Carte 723

     Question

     How do a data controller and a data processor differ?

     Réponse

     A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.

724. Carte 724

     Question

     How can orchestration become a single point of failure?

     Réponse

     Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.

725. Carte 725

     Question

     Why should defenses account for a threat actor's sophistication and capability?

     Réponse

     Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.

726. Carte 726

     Question

     How does an injection attack make an application execute unintended instructions?

     Réponse

     It sends crafted input that an interpreter treats as code or commands instead of data.

727. Carte 727

     Question

     What does a host-based firewall control?

     Réponse

     Inbound and outbound network traffic for one endpoint according to local rules.

728. Carte 728

     Question

     Why revise alerting after an incident?

     Réponse

     The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.

729. Carte 729

     Question

     Why include security duties in procurement criteria?

     Réponse

     Security is easier to require before selection than to retrofit after dependency and data transfer begin.

730. Carte 730

     Question

     What does a critical data classification indicate?

     Réponse

     The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.

731. Carte 731

     Question

     What infrastructure capacity must support failover?

     Réponse

     The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.

732. Carte 732

     Question

     Why does shared cloud context matter when evaluating a cloud-specific vulnerability?

     Réponse

     The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.

733. Carte 733

     Question

     How does a remediation exemption differ from an exception?

     Réponse

     Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.

734. Carte 734

     Question

     Why should automated EDR or XDR blocking have an exception and rollback path?

     Réponse

     A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.

735. Carte 735

     Question

     What does a security playbook provide?

     Réponse

     A repeatable set of roles, decisions, and actions for handling a defined operational scenario.

736. Carte 736

     Question

     How does an ultrasonic security sensor detect movement?

     Réponse

     It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.

737. Carte 737

     Question

     What should a managed mobile device require for Bluetooth connections?

     Réponse

     Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.

738. Carte 738

     Question

     How do password complexity rules differ from password length?

     Réponse

     Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.

739. Carte 739

     Question

     What makes a certificate third-party trusted?

     Réponse

     A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.

740. Carte 740

     Question

     Why is an out-of-band check effective against impersonation?

     Réponse

     It verifies the request through a separate, previously trusted communication path.

741. Carte 741

     Question

     What does a risk exception authorize?

     Réponse

     A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.

742. Carte 742

     Question

     What security challenge grows in a decentralized design?

     Réponse

     Consistent policy, inventory, monitoring, and patching become harder.

743. Carte 743

     Question

     How should controls be selected for an unused network path?

     Réponse

     Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.

744. Carte 744

     Question

     How can a buffer-overflow attack affect an application?

     Réponse

     It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.