CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.
על החפיסה הזו
Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.
What this deck covers
- General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
- Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
- Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
- Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
- Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.
Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.
The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.
Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.
This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.
הכרטיסים בחפיסה הזו
כרטיס 1
שאלה
What does an information security policy establish?
תשובה
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
כרטיס 2
שאלה
What is phishing?
תשובה
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
כרטיס 3
שאלה
What does a public-key certificate bind to an identity?
תשובה
A public key, together with identifying information and the issuer's signature.
כרטיס 4
שאלה
What is data at rest?
תשובה
Data stored on media such as disks, databases, backups, or mobile devices.
כרטיס 5
שאלה
How does policy-driven access control decide a zero-trust access request?
תשובה
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
כרטיס 6
שאלה
What does establishing a secure baseline produce?
תשובה
An approved, documented configuration that defines the required secure state for a class of computing resource.
כרטיס 7
שאלה
What is hashing used to verify?
תשובה
Whether data has changed by comparing fixed-length digest values.
כרטיס 8
שאלה
What is impersonation in social engineering?
תשובה
Pretending to be a trusted person or organization to obtain access, data, or action.
כרטיס 9
שאלה
What is virtualization?
תשובה
Abstracting physical compute so multiple isolated guest systems can share a host.
כרטיס 10
שאלה
What is chain of custody?
תשובה
A documented history of who collected, handled, transferred, stored, and examined evidence.
כרטיס 11
שאלה
What is quantitative risk analysis?
תשובה
Estimating risk with numerical values such as money, frequency, or probability.
כרטיס 12
שאלה
What is a phishing awareness campaign?
תשובה
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
כרטיס 13
שאלה
What is high availability?
תשובה
Designing a service to remain accessible despite expected component failures.
כרטיס 14
שאלה
What is a network security zone?
תשובה
A group of systems with similar trust, function, or control requirements.
כרטיס 15
שאלה
What is risk transfer?
תשובה
Shifting some financial or operational consequence to another party, such as through insurance or contract.
כרטיס 16
שאלה
What is media sanitization?
תשובה
Making stored data infeasible to recover for the intended level of protection.
כרטיס 17
שאלה
What does CVSS provide?
תשובה
A standardized way to describe a vulnerability's technical severity characteristics.
כרטיס 18
שאלה
What does security alerting do?
תשובה
It turns matched events or behavior into a notification that the right responder can review.
כרטיס 19
שאלה
What does a firewall rule enforce?
תשובה
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
כרטיס 20
שאלה
What is deprovisioning?
תשובה
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
כרטיס 21
שאלה
How does inline placement differ from a tap or monitor port?
תשובה
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
כרטיס 22
שאלה
What is asymmetric encryption?
תשובה
Encryption that uses a mathematically related public and private key pair.
כרטיס 23
שאלה
What does SPF authorize?
תשובה
Which mail servers may send mail for a domain in the SMTP envelope.
כרטיס 24
שאלה
What is a possession factor?
תשובה
Something the claimant has, such as a cryptographic authenticator.
כרטיס 25
שאלה
What does ordinary TLS usually protect and authenticate?
תשובה
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
כרטיס 26
שאלה
What is single loss expectancy?
תשובה
The estimated loss from one occurrence of a risk event.
כרטיס 27
שאלה
What does a certificate authority do?
תשובה
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
כרטיס 28
שאלה
What is a detective control meant to do?
תשובה
Identify that an unwanted event has happened or is happening.
כרטיס 29
שאלה
What is the security purpose of change-control approval?
תשובה
Ensure authorized reviewers assess risk before the production change occurs.
כרטיס 30
שאלה
What is shadow IT?
תשובה
Technology used for organizational work without required approval or oversight.
כרטיס 31
שאלה
What is a buffer overflow vulnerability?
תשובה
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
כרטיס 32
שאלה
What is ransomware?
תשובה
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
כרטיס 33
שאלה
How does network segmentation limit an incident?
תשובה
It restricts communication paths and reduces lateral movement between zones.
כרטיס 34
שאלה
How do load balancing and clustering support availability differently?
תשובה
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
כרטיס 35
שאלה
What is vendor due diligence?
תשובה
Evaluating a provider's security, capability, stability, and fit before commitment.
כרטיס 36
שאלה
Who is a data subject?
תשובה
The person whose personal data is collected or processed.
כרטיס 37
שאלה
What is attestation?
תשובה
A formal assertion or report about a subject matter, often supported by an independent examination.
כרטיס 38
שאלה
What is a replay attack?
תשובה
Valid captured data is retransmitted to repeat an authenticated or authorized action.
כרטיס 39
שאלה
What does a wireless site survey establish?
תשובה
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
כרטיס 40
שאלה
What is the time-of-check stage of a race-condition vulnerability?
תשובה
The application verifies a condition or resource state before acting on it.
כרטיס 41
שאלה
What is a penetration test?
תשובה
An authorized attempt to exploit weaknesses and demonstrate practical impact.
כרטיס 42
שאלה
What is a cold recovery site?
תשובה
A facility with basic space and utilities but little preinstalled technology or current data.
כרטיס 43
שאלה
What is data in transit?
תשובה
Data moving between systems or across a network.
כרטיס 44
שאלה
What is a vendor security questionnaire?
תשובה
A structured request for information about a provider's controls and practices.
כרטיס 45
שאלה
How does an internal actor's starting position differ from an external actor's?
תשובה
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
כרטיס 46
שאלה
What can unexpected account lockouts indicate?
תשובה
Password guessing, credential stuffing, user error, or a broken client.
כרטיס 47
שאלה
How do permissions enforce access control?
תשובה
They specify which actions a subject may perform on a particular resource.
כרטיס 48
שאלה
What is log aggregation?
תשובה
Central collection of logs from multiple sources for search, correlation, and retention.
כרטיס 49
שאלה
Why plan a service restart as part of a change?
תשובה
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
כרטיס 50
שאלה
What is infrastructure as code?
תשובה
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
כרטיס 51
שאלה
What should security-awareness program development start with?
תשובה
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
כרטיס 52
שאלה
What is a voice-based social-engineering attack called?
תשובה
Vishing.
כרטיס 53
שאלה
What happens during incident-response preparation?
תשובה
Teams establish people, tools, access, communications, training, and procedures before an incident.
כרטיס 54
שאלה
What does an offensive penetration-testing team do?
תשובה
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
כרטיס 55
שאלה
What is federation?
תשובה
One security domain relies on identity assertions from another trusted domain.
כרטיס 56
שאלה
What is asset classification?
תשובה
Grouping an asset by sensitivity, criticality, or required handling.
כרטיס 57
שאלה
What is cross-site scripting?
תשובה
Injection of script-capable content that a browser executes in another site's security context.
כרטיס 58
שאלה
What can IDS or IPS trends reveal?
תשובה
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
כרטיס 59
שאלה
What can unexpected resource inaccessibility indicate?
תשובה
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
כרטיס 60
שאלה
What is a corrective control meant to do?
תשובה
Limit damage and restore a secure state after an event.
כרטיס 61
שאלה
How do containers differ from virtual machines?
תשובה
Containers share the host kernel; virtual machines normally run separate guest operating systems.
כרטיס 62
שאלה
How does an active security device differ from a passive one?
תשובה
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
כרטיס 63
שאלה
Why is unsupported software a persistent attack surface?
תשובה
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
כרטיס 64
שאלה
What is annualized rate of occurrence?
תשובה
The estimated number of times a risk event occurs per year.
כרטיס 65
שאלה
What is an inherence factor?
תשובה
A biometric characteristic of the claimant.
כרטיס 66
שאלה
What do a threat actor's sophistication and capability describe?
תשובה
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
כרטיס 67
שאלה
What is a SIEM?
תשובה
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
כרטיס 68
שאלה
What is sideloading?
תשובה
Installing software from outside the platform's approved distribution path.
כרטיס 69
שאלה
What does an IDS or IPS signature match?
תשובה
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
כרטיס 70
שאלה
Why are embedded systems often difficult to patch?
תשובה
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
כרטיס 71
שאלה
What is a virtual private network?
תשובה
An encrypted logical connection that carries private traffic across an untrusted or shared network.
כרטיס 72
שאלה
What should an initial security-awareness report establish?
תשובה
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
כרטיס 73
שאלה
What is symmetric encryption?
תשובה
Encryption that uses the same secret key to encrypt and decrypt data.
כרטיס 74
שאלה
What happens during incident detection?
תשובה
Monitoring or a report identifies activity that may meet the organization's incident criteria.
כרטיס 75
שאלה
What is recovery time objective?
תשובה
The target maximum time to restore a function after disruption.
כרטיס 76
שאלה
Why prioritize password length?
תשובה
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
כרטיס 77
שאלה
What must sanitization accomplish before an asset leaves organizational control?
תשובה
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
כרטיס 78
שאלה
What is a real-time operating system designed to provide?
תשובה
Predictable response timing for tasks with strict deadlines.
כרטיס 79
שאלה
What does fail-open behavior do when a control fails?
תשובה
It permits traffic or access to preserve availability.
כרטיס 80
שאלה
What is jailbreaking or rooting a mobile device?
תשובה
Removing platform restrictions to gain privileged control over the operating system.
כרטיס 81
שאלה
What does network access control enforce?
תשובה
Identity, device posture, and access policy at network connection time and during a session.
כרטיס 82
שאלה
What does data loss prevention do?
תשובה
Detects and may block sensitive data use or transfer that violates policy.
כרטיס 83
שאלה
What security property does a blockchain provide?
תשובה
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
כרטיס 84
שאלה
What is recovery point objective?
תשובה
The target maximum acceptable data loss measured backward in time.
כרטיס 85
שאלה
How do ICS and SCADA relate?
תשובה
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
כרטיס 86
שאלה
What does fail-closed behavior do when a control fails?
תשובה
It denies traffic or access to preserve security.
כרטיס 87
שאלה
Which keys create and verify a typical digital signature?
תשובה
The signer creates it with a private key, and others verify it with the corresponding public key.
כרטיס 88
שאלה
What is SQL injection?
תשובה
Input that alters the structure or meaning of a database query because code and data were not safely separated.
כרטיס 89
שאלה
What does DKIM verify?
תשובה
That selected message content was signed by a domain and was not altered after signing.
כרטיס 90
שאלה
What is post-incident activity?
תשובה
Learning from the event and improving controls, plans, and recovery based on evidence.
כרטיס 91
שאלה
What characterizes an expansionary risk appetite?
תשובה
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
כרטיס 92
שאלה
How do centralized and decentralized architectures differ?
תשובה
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
כרטיס 93
שאלה
What does a certificate revocation list publish?
תשובה
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
כרטיס 94
שאלה
What is a legal hold?
תשובה
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
כרטיס 95
שאלה
What is exposure factor in quantitative risk analysis?
תשובה
The estimated percentage of an asset's value lost in one event.
כרטיס 96
שאלה
What is decentralized architecture?
תשובה
Control or service responsibility is distributed across multiple independent components or locations.
כרטיס 97
שאלה
What is tokenization?
תשובה
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
כרטיס 98
שאלה
How can automation act as a workforce multiplier?
תשובה
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
כרטיס 99
שאלה
What can endpoint process logs reveal?
תשובה
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
כרטיס 100
שאלה
What does the CIA triad protect?
תשובה
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
כרטיס 101
שאלה
How does data masking protect information?
תשובה
It hides selected values or characters while preserving a usable representation.
כרטיס 102
שאלה
How can a national requirement affect security governance?
תשובה
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
כרטיס 103
שאלה
What do integrations and APIs provide to security orchestration?
תשובה
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
כרטיס 104
שאלה
What makes a compliance report external?
תשובה
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
כרטיס 105
שאלה
What does a cryptographic algorithm define?
תשובה
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
כרטיס 106
שאלה
Why compare systems with a secure baseline regularly?
תשובה
To detect drift, unauthorized changes, and missing hardening.
כרטיס 107
שאלה
What does integrity protect?
תשובה
The accuracy and completeness of data and systems against unauthorized change.
כרטיס 108
שאלה
What does vulnerability classification organize?
תשובה
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
כרטיס 109
שאלה
What does a password standard define?
תשובה
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
כרטיס 110
שאלה
What technology capacity must a recovery design plan for?
תשובה
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
כרטיס 111
שאלה
What does a confidential data classification indicate?
תשובה
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
כרטיס 112
שאלה
What makes a vendor assessment independent?
תשובה
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
כרטיס 113
שאלה
What lets a worm spread without attaching itself to another file?
תשובה
It is a standalone program that replicates across reachable systems or services.
כרטיס 114
שאלה
What is microsegmentation?
תשובה
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
כרטיס 115
שאלה
What can application logs reveal?
תשובה
Transactions, errors, user actions, and application-specific security events.
כרטיס 116
שאלה
What does deploying a secure baseline require?
תשובה
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
כרטיס 117
שאלה
How can resource-provisioning automation improve security?
תשובה
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
כרטיס 118
שאלה
What does availability protect?
תשובה
Reliable, timely access to systems and data when authorized users need them.
כרטיס 119
שאלה
Why must a change request describe business impact?
תשובה
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
כרטיס 120
שאלה
What does an authenticated vulnerability scan add?
תשובה
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
כרטיס 121
שאלה
What does a change-management procedure specify?
תשובה
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
כרטיס 122
שאלה
What is a sanction for noncompliance?
תשובה
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
כרטיס 123
שאלה
How can email deliver a security attack?
תשובה
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
כרטיס 124
שאלה
What is an internal compliance audit?
תשובה
An organization-led examination of whether selected operations and controls meet defined requirements.
כרטיס 125
שאלה
What is a Trojan?
תשובה
Malware disguised as legitimate or desirable software.
כרטיס 126
שאלה
What is clustering?
תשובה
Multiple systems work together to provide a service and tolerate member failure.
כרטיס 127
שאלה
What makes data regulated?
תשובה
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
כרטיס 128
שאלה
What does a wireless heat map show?
תשובה
Measured or modeled signal strength and coverage across a physical area.
כרטיס 129
שאלה
How should vendor criticality affect due diligence?
תשובה
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
כרטיס 130
שאלה
How can a digital signature support non-repudiation?
תשובה
It provides evidence that the holder of a private key signed specific data.
כרטיס 131
שאלה
What should vulnerability prioritization consider beyond severity?
תשובה
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
כרטיס 132
שאלה
What is a security guideline?
תשובה
Recommended practice that allows judgment unless adopted as a requirement.
כרטיס 133
שאלה
What usually distinguishes a nation-state threat actor?
תשובה
Strategic objectives, substantial resources, patience, and advanced operational capability.
כרטיס 134
שאלה
What is spyware?
תשובה
Software that secretly collects information about a user or system.
כרטיס 135
שאלה
Why maintain an allow list for applications?
תשובה
Only explicitly approved software is permitted to execute.
כרטיס 136
שאלה
How can an image become an attack vector?
תשובה
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
כרטיס 137
שאלה
What makes a security control technical?
תשובה
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
כרטיס 138
שאלה
What is identity proofing?
תשובה
Establishing that a person is who they claim to be before issuing an account or credential.
כרטיס 139
שאלה
What is an automated security guardrail?
תשובה
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
כרטיס 140
שאלה
Why assign an owner to a planned change?
תשובה
To make one party accountable for coordination, execution, and follow-through.
כרטיס 141
שאלה
How can national privacy law affect data handling?
תשובה
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
כרטיס 142
שאלה
What is continuity of operations?
תשובה
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
כרטיס 143
שאלה
What security tradeoff comes with BYOD?
תשובה
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
כרטיס 144
שאלה
How should policies and handbooks support security training?
תשובה
They provide accessible, current rules and reporting steps that training can apply to real situations.
כרטיס 145
שאלה
What is a keylogger?
תשובה
A tool that records keystrokes to capture data such as credentials.
כרטיס 146
שאלה
What makes information a trade secret?
תשובה
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
כרטיס 147
שאלה
What does authentication establish?
תשובה
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
כרטיס 148
שאלה
What risk comes from an untrusted file attachment?
תשובה
Opening or parsing it can execute malicious code or expose data.
כרטיס 149
שאלה
How does risk tolerance affect vulnerability remediation?
תשובה
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
כרטיס 150
שאלה
How can a global requirement affect security governance?
תשובה
It can require a common control and oversight approach across multiple countries while local obligations still apply.
כרטיס 151
שאלה
Why should questionnaire answers be supported by evidence?
תשובה
Self-assertions alone may not prove that controls are designed or operating effectively.
כרטיס 152
שאלה
What is an independent third-party audit?
תשובה
An external party with suitable independence examines evidence against defined criteria.
כרטיס 153
שאלה
What do account provisioning and deprovisioning do?
תשובה
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
כרטיס 154
שאלה
What is an unskilled attacker commonly called?
תשובה
A script kiddie: someone who relies on tools or instructions created by others.
כרטיס 155
שאלה
What is a rootkit?
תשובה
Software designed to maintain privileged, concealed access by altering or subverting the system.
כרטיס 156
שאלה
What does an access control list enforce?
תשובה
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
כרטיס 157
שאלה
What should system security monitoring observe?
תשובה
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
כרטיס 158
שאלה
What can operating-system security logs reveal?
תשובה
Authentication, privilege use, policy changes, services, and other host security events.
כרטיס 159
שאלה
Why isolate operational technology from general business networks?
תשובה
To limit attack paths into safety- and availability-critical processes.
כרטיס 160
שאלה
What is the COPE mobile deployment model?
תשובה
The organization owns the device but permits defined personal use while retaining management control.
כרטיס 161
שאלה
What security work belongs in asset acquisition and procurement?
תשובה
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
כרטיס 162
שאלה
How can user-provisioning automation improve security?
תשובה
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
כרטיס 163
שאלה
What people capacity must a continuity plan account for?
תשובה
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
כרטיס 164
שאלה
What do authorization models define?
תשובה
How permissions are assigned to authenticated subjects and evaluated for requested actions.
כרטיס 165
שאלה
Why are removable devices an attack vector?
תשובה
They can introduce malware or remove data while bypassing network controls.
כרטיס 166
שאלה
What should predeployment change-test results show?
תשובה
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
כרטיס 167
שאלה
What is the time-of-use stage of a race-condition vulnerability?
תשובה
The application acts on a resource after the check, creating a gap in which another process may change the resource.
כרטיס 168
שאלה
What is data in use?
תשובה
Data actively processed in memory or by an application.
כרטיס 169
שאלה
What does open-source vulnerability intelligence contribute?
תשובה
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
כרטיס 170
שאלה
What can file-integrity monitoring detect?
תשובה
Unexpected changes to protected files, directories, or configuration.
כרטיס 171
שאלה
Why should deprovisioning be prompt?
תשובה
Former users or roles should not retain usable access.
כרטיס 172
שאלה
What is an acceptable use policy?
תשובה
Rules for permitted and prohibited use of organizational systems, accounts, and data.
כרטיס 173
שאלה
What makes a compliance report internal?
תשובה
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
כרטיס 174
שאלה
What is a logic bomb?
תשובה
Malicious code that activates when a specified condition or time is reached.
כרטיס 175
שאלה
What does a right-to-audit clause provide?
תשובה
Contractual authority to inspect or obtain evidence about agreed controls.
כרטיס 176
שאלה
Where should a forward proxy sit in an enterprise traffic path?
תשובה
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
כרטיס 177
שאלה
Which cues should make a message look suspicious?
תשובה
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
כרטיס 178
שאלה
What makes a security control managerial?
תשובה
It directs risk and governance through decisions such as policies, assessments, and oversight.
כרטיס 179
שאלה
What is the CYOD mobile deployment model?
תשובה
The user selects from organization-approved device options that remain subject to corporate security requirements.
כרטיס 180
שאלה
How does client-based vulnerable software differ from an agentless exposure?
תשובה
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
כרטיס 181
שאלה
What makes a risk assessment recurring?
תשובה
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
כרטיס 182
שאלה
What does a defensive penetration-testing team practice?
תשובה
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
כרטיס 183
שאלה
In a zero-trust data plane, what can the subject or system represent?
תשובה
The user, device, workload, or service requesting access to a protected resource.
כרטיס 184
שאלה
What primarily motivates a hacktivist?
תשובה
A political, social, or ideological cause.
כרטיס 185
שאלה
What is bloatware?
תשובה
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
כרטיס 186
שאלה
Why keep endpoint-protection signatures and engines current?
תשובה
They need current detection logic to recognize newly identified malware and exploit behavior.
כרטיס 187
שאלה
What should application security monitoring observe?
תשובה
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
כרטיס 188
שאלה
What is role-based access control?
תשובה
Permissions are assigned to roles, and identities receive access through their roles.
כרטיס 189
שאלה
What is geographic dispersal?
תשובה
Placing redundant resources in separate locations so one regional event does not affect all copies.
כרטיס 190
שאלה
What is a malicious update?
תשובה
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
כרטיס 191
שאלה
What does static application analysis inspect?
תשובה
Source code, bytecode, or compiled code without executing the application.
כרטיס 192
שאלה
What does a firewall access list define?
תשובה
An ordered set of traffic-matching conditions and the action applied when a condition matches.
כרטיס 193
שאלה
What does a disaster recovery policy establish?
תשובה
Management expectations for restoring technology and data after a disruptive event.
כרטיס 194
שאלה
How does logical segmentation separate workloads that share physical infrastructure?
תשובה
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
כרטיס 195
שאלה
How should IDS and IPS placement differ?
תשובה
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
כרטיס 196
שאלה
What should automated ticket creation capture?
תשובה
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
כרטיס 197
שאלה
What makes information intellectual property?
תשובה
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
כרטיס 198
שאלה
What is a backout plan?
תשובה
Predefined steps for safely reversing a failed or harmful change.
כרטיס 199
שאלה
Why is an unsecure wireless network an attack vector?
תשובה
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
כרטיס 200
שאלה
What is physical brute force?
תשובה
Using force to defeat a lock, barrier, enclosure, or other physical control.
כרטיס 201
שאלה
What is application sandboxing?
תשובה
Running code in a constrained environment with limited access to the host and data.
כרטיס 202
שאלה
Why assign an asset owner?
תשובה
One accountable party must decide its use, protection, and lifecycle.
כרטיס 203
שאלה
What happens during risk identification?
תשובה
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
כרטיס 204
שאלה
What should an SLA state about breach notification?
תשובה
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
כרטיס 205
שאלה
How do due diligence and due care differ in compliance?
תשובה
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
כרטיס 206
שאלה
What is attribute-based access control?
תשובה
Policy evaluates attributes of the subject, resource, action, and environment.
כרטיס 207
שאלה
What does a zero-trust policy engine do?
תשובה
It evaluates policy and signals to decide whether access should be allowed.
כרטיס 208
שאלה
How does a cloud responsibility matrix allocate security duties?
תשובה
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
כרטיס 209
שאלה
Where should a load balancer sit in a service path?
תשובה
In front of service instances so it can route requests to healthy backends.
כרטיס 210
שאלה
What should the security team do with a reported suspicious message?
תשובה
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
כרטיס 211
שאלה
What makes an operating-system vulnerability high impact?
תשובה
It can affect every application and security control that relies on the compromised OS.
כרטיס 212
שאלה
What does dynamic application analysis inspect?
תשובה
The behavior and externally visible weaknesses of a running application.
כרטיס 213
שאלה
How can false-positive trends affect IDS or IPS tuning?
תשובה
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
כרטיס 214
שאלה
What does a business continuity policy establish?
תשובה
Management expectations for sustaining and restoring critical business functions.
כרטיס 215
שאלה
What is a hot recovery site?
תשובה
A ready, synchronized environment intended to take over quickly.
כרטיס 216
שאלה
What makes an insider threat distinct?
תשובה
The actor has legitimate access or organizational knowledge that can be misused.
כרטיס 217
שאלה
What is RFID cloning?
תשובה
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
כרטיס 218
שאלה
Why apply vendor security updates promptly?
תשובה
They remove known weaknesses before attackers can exploit the unpatched exposure.
כרטיס 219
שאלה
What should infrastructure security monitoring observe?
תשובה
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
כרטיס 220
שאלה
What can firewall logs reveal?
תשובה
Allowed or denied network connections across controlled boundaries.
כרטיס 221
שאלה
Why minimize open service ports?
תשובה
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
כרטיס 222
שאלה
What is threat hunting?
תשובה
A proactive search for evidence of malicious activity that existing detections have not confirmed.
כרטיס 223
שאלה
What triggers an ad hoc risk assessment?
תשובה
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
כרטיס 224
שאלה
What makes an assessment external?
תשובה
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
כרטיס 225
שאלה
What is data sovereignty?
תשובה
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
כרטיס 226
שאלה
What security boundary does a cellular connection create for a mobile device?
תשובה
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
כרטיס 227
שאלה
What makes a security control operational?
תשובה
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
כרטיס 228
שאלה
What is discretionary access control?
תשובה
A resource owner can decide who receives access, within system policy.
כרטיס 229
שאלה
How can careful automation support employee retention?
תשובה
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
כרטיס 230
שאלה
Why does ease of deployment matter in an architecture decision?
תשובה
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
כרטיס 231
שאלה
What tradeoff comes with placing an NGFW inline?
תשובה
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
כרטיס 232
שאלה
What does a zero-trust policy administrator do?
תשובה
It carries out the policy engine's decision, such as creating or ending a session.
כרטיס 233
שאלה
What should a master service agreement define for data return and deletion?
תשובה
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
כרטיס 234
שאלה
What is an environmental physical attack?
תשובה
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
כרטיס 235
שאלה
When should a maintenance window be chosen?
תשובה
When disruption and rollback can be managed with the least business impact.
כרטיס 236
שאלה
What is memory injection?
תשובה
Placing malicious code or data into another process's memory so it executes in that process's context.
כרטיס 237
שאלה
What does software composition analysis find?
תשובה
Known risks and license information in third-party dependencies.
כרטיס 238
שאלה
What is DNS filtering?
תשובה
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
כרטיס 239
שאלה
What should an incident response policy establish?
תשובה
Authority, scope, reporting duties, and organizational commitment for incident handling.
כרטיס 240
שאלה
How can noncompliance cause reputational damage?
תשובה
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
כרטיס 241
שאלה
What does full-disk encryption protect?
תשובה
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
כרטיס 242
שאלה
Why are default credentials dangerous?
תשובה
They are widely known or easily discovered and often remain unchanged.
כרטיס 243
שאלה
What makes a risk assessment one-time?
תשובה
It evaluates a defined decision or scope once without an established repeating cadence.
כרטיס 244
שאלה
What is a warm recovery site?
תשובה
A partially equipped environment that needs some data restoration or configuration before use.
כרטיס 245
שאלה
What does application input validation do?
תשובה
It checks that input matches the expected type, length, range, and format before use.
כרטיס 246
שאלה
What should an asset inventory record besides a device name?
תשובה
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
כרטיס 247
שאלה
What is mandatory access control?
תשובה
A central authority enforces access through labels and rules that ordinary owners cannot override.
כרטיס 248
שאלה
What security benefit does infrastructure as code provide?
תשובה
Repeatable, reviewable deployments that reduce undocumented configuration drift.
כרטיס 249
שאלה
When should a public service control fail closed?
תשובה
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
כרטיס 250
שאלה
What should users do with a suspicious message?
תשובה
Report it through the approved channel without interacting with its links or attachments.
כרטיס 251
שאלה
What usually motivates organized cybercrime?
תשובה
Financial gain through scalable or repeatable criminal activity.
כרטיס 252
שאלה
How can malicious code support a network attack?
תשובה
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
כרטיס 253
שאלה
When is virtual patching useful?
תשובה
When a network or application control can block exploit traffic before the underlying system can be patched.
כרטיס 254
שאלה
What does security-monitoring reporting provide?
תשובה
A summarized, audience-appropriate view of findings, trends, risk, and response status.
כרטיס 255
שאלה
What does data geolocation identify?
תשובה
The physical or legal location where data is stored, processed, or transmitted.
כרטיס 256
שאלה
What does a zero-trust policy enforcement point do?
תשובה
It enables, monitors, and terminates the connection between a subject and a resource.
כרטיס 257
שאלה
What is cryptographic key exchange?
תשובה
A method for parties to establish shared key material over an untrusted channel.
כרטיס 258
שאלה
How can a vendor become a supply-chain attack vector?
תשובה
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
כרטיס 259
שאלה
Why can legacy hardware remain vulnerable?
תשובה
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
כרטיס 260
שאלה
What can proprietary vulnerability intelligence add beyond open sources?
תשובה
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
כרטיס 261
שאלה
How does a centralized proxy apply web filtering?
תשובה
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
כרטיס 262
שאלה
How can continuous integration and testing improve security automation?
תשובה
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
כרטיס 263
שאלה
What is containment?
תשובה
Limiting an incident's spread or damage while preserving necessary operations and evidence.
כרטיס 264
שאלה
What is a software development lifecycle policy meant to ensure?
תשובה
Security requirements and checks are integrated throughout design, development, release, and maintenance.
כרטיס 265
שאלה
What makes risk assessment continuous?
תשובה
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
כרטיס 266
שאלה
What is a memorandum of agreement?
תשובה
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
כרטיס 267
שאלה
What makes a penetration test integrated?
תשובה
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
כרטיס 268
שאלה
How does a DNS amplification attack magnify traffic?
תשובה
It sends small spoofed queries that trigger larger replies toward the victim.
כרטיס 269
שאלה
Why does ease of recovery matter in an architecture decision?
תשובה
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
כרטיס 270
שאלה
What does 802.1X control before a device receives normal network access?
תשובה
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
כרטיס 271
שאלה
What is rule-based access control?
תשובה
System-wide rules grant or deny access based on conditions such as network, time, or action.
כרטיס 272
שאלה
What is mobile device management?
תשובה
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
כרטיס 273
שאלה
What tradeoff comes with a cold recovery site?
תשובה
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
כרטיס 274
שאלה
Why identify stakeholders before approving a security-sensitive change?
תשובה
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
כרטיס 275
שאלה
How do attestation and acknowledgement differ?
תשובה
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
כרטיס 276
שאלה
What does zero-trust adaptive identity mean?
תשובה
Access decisions adjust to current risk signals rather than relying only on a static login.
כרטיס 277
שאלה
What makes a security control physical?
תשובה
It protects facilities or equipment through a tangible barrier or mechanism.
כרטיס 278
שאלה
What is geo-fencing for data?
תשובה
Enforcing location-based boundaries on where data or services may be accessed or operated.
כרטיס 279
שאלה
What does a Trusted Platform Module protect?
תשובה
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
כרטיס 280
שאלה
Why can a managed service provider amplify risk?
תשובה
Its privileged access and shared tooling can provide a path into many customers.
כרטיס 281
שאלה
What does probability express in risk analysis?
תשובה
A quantified chance that a defined event will occur within stated conditions or time.
כרטיס 282
שאלה
Why can shadow IT create a threat?
תשובה
It bypasses security review, inventory, monitoring, and supported configuration.
כרטיס 283
שאלה
What is on-path interception?
תשובה
An attacker positions between communicating parties to observe or alter traffic.
כרטיס 284
שאלה
Why include encryption in a system-hardening baseline?
תשובה
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
כרטיס 285
שאלה
Why tune security alerts?
תשובה
To keep useful detections while reducing noise that wastes analyst attention.
כרטיס 286
שאלה
What can IPS or IDS logs contribute to an investigation?
תשובה
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
כרטיס 287
שאלה
What is VM escape?
תשובה
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
כרטיס 288
שאלה
How can segmentation reduce vulnerability exposure before a patch is available?
תשובה
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
כרטיס 289
שאלה
Why should firewall policy name the required ports and protocols explicitly?
תשובה
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
כרטיס 290
שאלה
What is a change management policy meant to control?
תשובה
How changes are requested, assessed, approved, tested, implemented, and reviewed.
כרטיס 291
שאלה
What is a hybrid-cloud architecture?
תשובה
An environment that integrates private or on-premises resources with public cloud services.
כרטיס 292
שאלה
How do AH and ESP differ in the security services they can provide?
תשובה
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
כרטיס 293
שאלה
What makes user behavior risky?
תשובה
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
כרטיס 294
שאלה
What is least privilege?
תשובה
Granting only the access needed for the required task and no more.
כרטיס 295
שאלה
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
תשובה
Transmission to HTTPS, script access, and cross-site sending, respectively.
כרטיס 296
שאלה
Why discover unmanaged assets?
תשובה
Unknown systems cannot be patched, monitored, or governed reliably.
כרטיס 297
שאלה
What is a service-level agreement?
תשובה
Measurable service commitments and remedies, such as availability or response targets.
כרטיס 298
שאלה
What should govern automated security escalation?
תשובה
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
כרטיס 299
שאלה
What is platform diversity as a resilience strategy?
תשובה
Using different implementations so one common flaw or failure is less likely to affect every copy.
כרטיס 300
שאלה
How can replayed session material affect an application?
תשובה
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
כרטיס 301
שאלה
What is an implicit trust zone in zero trust?
תשובה
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
כרטיס 302
שאלה
What does salting a password hash accomplish?
תשובה
It makes identical passwords hash differently and defeats precomputed hash tables.
כרטיס 303
שאלה
What is spear phishing?
תשובה
Phishing tailored to a specific person, role, or organization.
כרטיס 304
שאלה
What is eradication?
תשובה
Removing the attacker's access, malicious artifacts, and exploited conditions.
כרטיס 305
שאלה
Who is a risk owner?
תשובה
The person accountable for deciding and monitoring how a specific risk is handled.
כרטיס 306
שאלה
What does a partially known penetration-test environment provide?
תשובה
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
כרטיס 307
שאלה
What is a microservices architecture?
תשובה
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
כרטיס 308
שאלה
What is a jump server?
תשובה
A hardened intermediary used to reach systems in a restricted management network.
כרטיס 309
שאלה
What can happen when a configuration change is made without dependency analysis?
תשובה
A downstream service can fail even when the changed component works.
כרטיס 310
שאלה
What is resource reuse exposure?
תשובה
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
כרטיס 311
שאלה
Why does financial information require explicit protection?
תשובה
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
כרטיס 312
שאלה
What does CVE provide?
תשובה
A common identifier for a publicly disclosed vulnerability.
כרטיס 313
שאלה
Where can DLP controls operate?
תשובה
On endpoints, networks, email, and cloud services, depending on the product and visibility.
כרטיס 314
שאלה
What does privileged password vaulting protect?
תשובה
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
כרטיס 315
שאלה
What does an access-control standard define?
תשובה
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
כרטיס 316
שאלה
How can automation support compliance monitoring?
תשובה
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
כרטיס 317
שאלה
What does static code analysis examine?
תשובה
Source or compiled code for weakness patterns without executing the application.
כרטיס 318
שאלה
What actor attribute describes funding, time, and personnel?
תשובה
Resources.
כרטיס 319
שאלה
What is DNS poisoning?
תשובה
Introducing false DNS data so names resolve to attacker-chosen destinations.
כרטיס 320
שאלה
Why change default credentials during hardening?
תשובה
Default secrets are predictable and commonly targeted.
כרטיס 321
שאלה
What does quarantine do after a security alert?
תשובה
It restricts a suspected asset or object while analysts validate and remediate the risk.
כרטיס 322
שאלה
What does key stretching do for stored passwords?
תשובה
It deliberately makes each password guess more computationally expensive.
כרטיס 323
שאלה
What is smishing?
תשובה
Phishing delivered through SMS or another text-messaging service.
כרטיס 324
שאלה
What is qualitative risk analysis?
תשובה
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
כרטיס 325
שאלה
What is a master service agreement?
תשובה
An umbrella contract establishing general legal and commercial terms for ongoing work.
כרטיס 326
שאלה
What is threat scope reduction?
תשובה
Narrowing the systems, privileges, or paths an attacker can reach.
כרטיס 327
שאלה
Why use a third-party cloud service instead of building locally?
תשובה
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
כרטיס 328
שאלה
What should determine security-device placement?
תשובה
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
כרטיס 329
שאלה
What does situational awareness mean for a user?
תשובה
Notice the people, devices, requests, location, and context around a task before acting.
כרטיס 330
שאלה
What does a failover test validate?
תשובה
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
כרטיס 331
שאלה
What is a preventive control meant to do?
תשובה
Stop an unwanted event before it succeeds.
כרטיס 332
שאלה
What is just-in-time privileged access?
תשובה
Elevated access is granted only when needed and expires after a short approved period.
כרטיס 333
שאלה
What safeguard should security-group automation enforce?
תשובה
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
כרטיס 334
שאלה
How does a reflected DDoS attack hide and multiply sources?
תשובה
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
כרטיס 335
שאלה
What is a security misconfiguration?
תשובה
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
כרטיס 336
שאלה
Why can the same vulnerability have different organizational impact?
תשובה
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
כרטיס 337
שאלה
What does URL scanning evaluate before a user opens a web destination?
תשובה
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
כרטיס 338
שאלה
What is the board's security governance role?
תשובה
Provide oversight, set risk direction, and hold executives accountable.
כרטיס 339
שאלה
What does code signing establish?
תשובה
That code came from the holder of the signing key and has not changed since signing.
כרטיס 340
שאלה
How should an asset's classification affect security operations?
תשובה
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
כרטיס 341
שאלה
How does encryption protect data?
תשובה
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
כרטיס 342
שאלה
What is a secure enclave?
תשובה
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
כרטיס 343
שאלה
What is business email compromise?
תשובה
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
כרטיס 344
שאלה
What is recovery in incident response?
תשובה
Restoring services safely, monitoring them, and returning to normal operations.
כרטיס 345
שאלה
How is single loss expectancy commonly estimated?
תשובה
Asset value multiplied by the exposure factor.
כרטיס 346
שאלה
What does an unknown penetration-test environment provide?
תשובה
The tester begins with little or no internal information, modeling an external attacker's discovery process.
כרטיס 347
שאלה
What security boundary does a hypervisor provide?
תשובה
It isolates virtual machines while controlling their access to shared hardware.
כרטיס 348
שאלה
Why does a TLS tunnel not protect a compromised endpoint?
תשובה
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
כרטיס 349
שאלה
Why update diagrams after an infrastructure change?
תשובה
Operations and incident responders need the documentation to match the deployed environment.
כרטיס 350
שאלה
What does privacy ownership assign?
תשובה
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
כרטיס 351
שאלה
What does a security control gap analysis compare?
תשובה
The controls required for the target state with the controls currently in place.
כרטיס 352
שאלה
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
תשובה
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
כרטיס 353
שאלה
What is application privilege escalation?
תשובה
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
כרטיס 354
שאלה
What risk remains when unnecessary software is left installed?
תשובה
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
כרטיס 355
שאלה
What does SCAP standardize?
תשובה
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
כרטיס 356
שאלה
What can packet capture reveal?
תשובה
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
כרטיס 357
שאלה
What makes a privileged credential ephemeral?
תשובה
It is created for a limited task or session and expires or is destroyed automatically after that use.
כרטיס 358
שאלה
How do a statement of work and a work order differ?
תשובה
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
כרטיס 359
שאלה
Why might multi-cloud improve resilience?
תשובה
A provider-wide failure need not stop workloads that can run independently elsewhere.
כרטיס 360
שאלה
How can a service provider introduce a supply-chain vulnerability?
תשובה
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
כרטיס 361
שאלה
What is a false positive in vulnerability scanning?
תשובה
A reported weakness that is not actually present or exploitable in the assessed context.
כרטיס 362
שאלה
How do EDR and XDR differ?
תשובה
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
כרטיס 363
שאלה
What should onboarding and offboarding procedures coordinate?
תשובה
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
כרטיס 364
שאלה
How should an organization harden managed mobile devices?
תשובה
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
כרטיס 365
שאלה
What is a certificate signing request?
תשובה
A request containing a public key and subject information for a certificate authority to sign.
כרטיס 366
שאלה
What is pretexting?
תשובה
Using a fabricated role or situation to make a request seem legitimate.
כרטיס 367
שאלה
How is annualized loss expectancy commonly estimated?
תשובה
Single loss expectancy multiplied by annualized rate of occurrence.
כרטיס 368
שאלה
What security consequence follows from containers sharing a kernel?
תשובה
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
כרטיס 369
שאלה
Where does 802.1X enforce a network admission decision?
תשובה
At the controlled switch port or wireless access point before normal network access is granted.
כרטיס 370
שאלה
What should insider-threat awareness teach?
תשובה
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
כרטיס 371
שאלה
What access action is suitable for careful automation?
תשובה
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
כרטיס 372
שאלה
What is an evil twin?
תשובה
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 כרטיסים
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
ללמוד את החפיסה הזו בחינםNibomo תיפתח כדי שתוכל להתחיל ללמוד.
כרטיס 373
שאלה
Does non-human-readable data need less protection?
תשובה
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
כרטיס 374
שאלה
What does authenticating a system establish?
תשובה
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
כרטיס 375
שאלה
What does LDAP provide in identity systems?
תשובה
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
כרטיס 376
שאלה
What is a deterrent control meant to do?
תשובה
Discourage an attacker from attempting an unwanted action.
כרטיס 377
שאלה
Why update procedures after changing a security control?
תשובה
Staff need accurate steps for operating, monitoring, and recovering the new control.
כרטיס 378
שאלה
How does OCSP differ from a certificate revocation list?
תשובה
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
כרטיס 379
שאלה
What is the goal of data exfiltration?
תשובה
Remove data from its authorized environment without permission.
כרטיס 380
שאלה
What is a watering-hole attack?
תשובה
Compromising a site frequented by the intended targets so their visits expose them.
כרטיס 381
שאלה
How can a hardware provider introduce a supply-chain vulnerability?
תשובה
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
כרטיס 382
שאלה
What is application forgery?
תשובה
Creating or altering a request, token, or object so the application treats it as authentic.
כרטיס 383
שאלה
How does least privilege mitigate compromise?
תשובה
It limits the actions and resources available to a compromised account or process.
כרטיס 384
שאלה
What is serverless computing?
תשובה
A model where the provider manages servers and the customer deploys event-driven code or functions.
כרטיס 385
שאלה
What makes an infrastructure control effective for a specific risk?
תשובה
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
כרטיס 386
שאלה
What does parallel recovery processing test?
תשובה
Whether primary and alternate environments can run together consistently before a controlled cutover.
כרטיס 387
שאלה
Which password-authentication method does WPA3-Personal use?
תשובה
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
כרטיס 388
שאלה
How does data retention affect asset disposal?
תשובה
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
כרטיס 389
שאלה
What is a false negative in vulnerability scanning?
תשובה
A real weakness that the assessment fails to report.
כרטיס 390
שאלה
What does recurring security scanning add to monitoring?
תשובה
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
כרטיס 391
שאלה
What should guide port selection for a secure protocol?
תשובה
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
כרטיס 392
שאלה
What does forensic acquisition create?
תשובה
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
כרטיס 393
שאלה
How do system owners and data owners divide security accountability?
תשובה
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
כרטיס 394
שאלה
What does likelihood express in risk analysis?
תשובה
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
כרטיס 395
שאלה
What is a memorandum of understanding?
תשובה
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
כרטיס 396
שאלה
What does the right to be forgotten generally require?
תשובה
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
כרטיס 397
שאלה
What does an audit committee oversee?
תשובה
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
כרטיס 398
שאלה
What does identity interoperability require?
תשובה
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
כרטיס 399
שאלה
How does a bollard protect a facility?
תשובה
It blocks or redirects vehicles before they can reach a protected area.
כרטיס 400
שאלה
How can hashing protect a downloaded file?
תשובה
A trusted digest lets the recipient detect whether the file changed.
כרטיס 401
שאלה
What is a credential replay attack?
תשובה
Using captured valid credentials or tokens again without needing to discover the secret.
כרטיס 402
שאלה
How can automation complexity create security risk?
תשובה
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
כרטיס 403
שאלה
What must an architecture provide when a component cannot be patched?
תשובה
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
כרטיס 404
שאלה
What makes remote access secure?
תשובה
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
כרטיס 405
שאלה
What should users verify before connecting removable media or a cable?
תשובה
That the device and connection are approved, expected, and handled under organizational policy.
כרטיס 406
שאלה
What is a self-signed certificate?
תשובה
A certificate signed by its own private key rather than by a separate trusted issuer.
כרטיס 407
שאלה
What is brand impersonation?
תשובה
Using a trusted organization's identity or look to deceive people.
כרטיס 408
שאלה
What characterizes a conservative risk appetite?
תשובה
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
כרטיס 409
שאלה
What should a managed mobile device verify before using Wi-Fi?
תשובה
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
כרטיס 410
שאלה
What is a zero-day vulnerability?
תשובה
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
כרטיס 411
שאלה
What does verification confirm after vulnerability remediation?
תשובה
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
כרטיס 412
שאלה
What is user and entity behavior analytics?
תשובה
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
כרטיס 413
שאלה
What does a physical security policy establish?
תשובה
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
כרטיס 414
שאלה
What does a UPS provide?
תשובה
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
כרטיס 415
שאלה
What is a nondisclosure agreement?
תשובה
A contract restricting use and disclosure of defined confidential information.
כרטיס 416
שאלה
What should be checked before assigning a user permission?
תשובה
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
כרטיס 417
שאלה
How does espionage differ from ordinary theft?
תשובה
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
כרטיס 418
שאלה
What is password spraying?
תשובה
Trying a small set of common passwords across many accounts to avoid lockouts.
כרטיס 419
שאלה
What is the purpose of system isolation during an incident?
תשובה
Stop harmful communication while preserving the system for response and investigation.
כרטיס 420
שאלה
What is a security benchmark?
תשובה
A documented set of recommended configuration checks for a platform or product.
כרטיס 421
שאלה
Which metadata fields give a log record investigative context?
תשובה
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
כרטיס 422
שאלה
What does an access-control vestibule prevent?
תשובה
It limits tailgating by allowing controlled passage through one door at a time.
כרטיס 423
שאלה
What is version control's security value for configuration?
תשובה
It preserves attributable history and enables review or rollback of changes.
כרטיס 424
שאלה
Why use both internal and external compliance monitoring?
תשובה
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
כרטיס 425
שאלה
What distinguishes on-premises architecture?
תשובה
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
כרטיס 426
שאלה
What risk can split tunneling add to a VPN?
תשובה
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
כרטיס 427
שאלה
What is a certificate root of trust?
תשובה
A trusted root certificate or key from which a client validates a certificate chain.
כרטיס 428
שאלה
What is typosquatting?
תשובה
Registering a look-alike domain based on common typing errors or visual similarity.
כרטיס 429
שאלה
What is root-cause analysis?
תשובה
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
כרטיס 430
שאלה
What is risk tolerance?
תשובה
The acceptable variation or boundary around a specific objective or risk area.
כרטיס 431
שאלה
What is a security self-assessment?
תשובה
A structured internal evaluation in which the organization measures its own controls against selected criteria.
כרטיס 432
שאלה
What does data masking change?
תשובה
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
כרטיס 433
שאלה
How do wireless authentication protocols let clients prove identity securely?
תשובה
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
כרטיס 434
שאלה
Why reconcile inventory with network discovery?
תשובה
Differences expose missing records, retired systems, or unauthorized devices.
כרטיס 435
שאלה
Why does sideloading raise mobile risk?
תשובה
It can bypass store review, signing policy, and managed application controls.
כרטיס 436
שאלה
What does an information-sharing organization add to vulnerability management?
תשובה
Sector or community intelligence about relevant threats, incidents, and defensive action.
כרטיס 437
שאלה
What does a web-filter block rule specify?
תשובה
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
כרטיס 438
שאלה
How do data custodians and data stewards differ?
תשובה
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
כרטיס 439
שאלה
What is a brute-force password attack?
תשובה
Systematically trying many candidate secrets against an account or protected value.
כרטיס 440
שאלה
What is a compensating control?
תשובה
An alternative safeguard used when the preferred control is impractical or unavailable.
כרטיס 441
שאלה
How can location act as an authentication factor?
תשובה
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
כרטיס 442
שאלה
Why must security automation remain supportable?
תשובה
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
כרטיס 443
שאלה
What does a standby generator provide?
תשובה
Longer-duration power during a utility outage, after a startup delay.
כרטיס 444
שאלה
What makes an architecture air-gapped?
תשובה
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
כרטיס 445
שאלה
What is a software-defined WAN?
תשובה
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
כרטיס 446
שאלה
What password-management behavior should awareness training reinforce?
תשובה
Use unique long passwords through an approved manager and report suspected compromise promptly.
כרטיס 447
שאלה
What security value does fencing provide?
תשובה
It defines and delays entry across a physical perimeter.
כרטיס 448
שאלה
What is a wildcard certificate?
תשובה
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
כרטיס 449
שאלה
How does misinformation differ from disinformation?
תשובה
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
כרטיס 450
שאלה
What is a risk threshold?
תשובה
A defined level that triggers escalation, treatment, or another required response.
כרטיס 451
שאלה
What does a vendor penetration test contribute to assessment?
תשובה
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
כרטיס 452
שאלה
What is the objective of a service-disruption attack?
תשובה
Make a system or business function unavailable or unreliable.
כרטיס 453
שאלה
What is directory traversal?
תשובה
Manipulating a file path to reach files outside the directory the application intended to expose.
כרטיס 454
שאלה
Why decommission an unsupported system?
תשובה
Removing it eliminates an exposure that can no longer be patched or securely maintained.
כרטיס 455
שאלה
Why archive security-monitoring data?
תשובה
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
כרטיס 456
שאלה
What role does RADIUS commonly play in enterprise Wi-Fi?
תשובה
It centralizes authentication, authorization information, and accounting for network access.
כרטיס 457
שאלה
Why separate the requester and approver of a high-risk change?
תשובה
To reduce error, fraud, and unilateral unauthorized modification.
כרטיס 458
שאלה
Why can a jailbroken device violate a security baseline?
תשובה
It weakens platform isolation and allows unapproved privileged changes.
כרטיס 459
שאלה
When is tokenization especially useful?
תשובה
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
כרטיס 460
שאלה
Why can dark-web intelligence affect vulnerability priority?
תשובה
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
כרטיס 461
שאלה
What firewall policy should govern traffic from a screened subnet to internal systems?
תשובה
Deny it by default and allow only explicitly required flows.
כרטיס 462
שאלה
What does SAML commonly carry?
תשובה
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
כרטיס 463
שאלה
What does a security governance committee do?
תשובה
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
כרטיס 464
שאלה
How can global privacy requirements affect one data process?
תשובה
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
כרטיס 465
שאלה
What characterizes an IoT device?
תשובה
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
כרטיס 466
שאלה
What is a unified threat management appliance?
תשובה
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
כרטיס 467
שאלה
What does a hardware security module provide?
תשובה
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
כרטיס 468
שאלה
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
תשובה
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
כרטיס 469
שאלה
What is a tabletop exercise?
תשובה
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
כרטיס 470
שאלה
What does a risk exemption authorize?
תשובה
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
כרטיס 471
שאלה
What is a regulatory examination?
תשובה
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
כרטיס 472
שאלה
What does physical video surveillance primarily provide?
תשובה
Detection and evidence of activity in monitored areas.
כרטיס 473
שאלה
What is a birthday attack against a hash?
תשובה
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
כרטיס 474
שאלה
Why keep backups both onsite and offsite?
תשובה
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
כרטיס 475
שאלה
How does technical debt affect security automation?
תשובה
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
כרטיס 476
שאלה
What should switch hardening restrict first?
תשובה
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
כרטיס 477
שאלה
What should happen when an asset changes owners?
תשובה
Inventory, access, support responsibility, and data handling should be updated.
כרטיס 478
שאלה
What does evidence of a vendor's internal audits contribute?
תשובה
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
כרטיס 479
שאלה
What is identity attestation?
תשובה
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
כרטיס 480
שאלה
Why can standard enterprise patching be unsafe for an RTOS device?
תשובה
A change can disrupt timing guarantees or certified operational behavior.
כרטיס 481
שאלה
What is secure access service edge?
תשובה
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
כרטיס 482
שאלה
What social-engineering habit should awareness training reinforce?
תשובה
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
כרטיס 483
שאלה
How can a software provider introduce a supply-chain vulnerability?
תשובה
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
כרטיס 484
שאלה
Why include internet exposure in remediation priority?
תשובה
A reachable vulnerable service usually has more attack opportunity than an isolated one.
כרטיס 485
שאלה
What does a mail gateway inspect?
תשובה
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
כרטיס 486
שאלה
What is a data controller?
תשובה
The entity that determines why and how personal data is processed.
כרטיס 487
שאלה
How does blackmail motivate a cyberattack?
תשובה
The attacker threatens disclosure or harm unless the victim complies.
כרטיס 488
שאלה
What is a downgrade attack?
תשובה
Forcing parties to use an older or weaker protocol or security mode.
כרטיס 489
שאלה
How does encryption mitigate data exposure?
תשובה
It makes captured data unreadable without the required key.
כרטיס 490
שאלה
How do network and web vulnerability scanners differ?
תשובה
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
כרטיס 491
שאלה
How can vulnerability-scan data support an investigation?
תשובה
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
כרטיס 492
שאלה
What is key escrow?
תשובה
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
כרטיס 493
שאלה
Which human vector commonly uses a fake sign-in page to harvest credentials?
תשובה
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
כרטיס 494
שאלה
What is risk avoidance?
תשובה
Stopping or not starting the activity that creates the risk.
כרטיס 495
שאלה
What is data obfuscation?
תשובה
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
כרטיס 496
שאלה
What is a directive control?
תשובה
A safeguard that tells people what behavior or action is required.
כרטיס 497
שאלה
What does a security guard add that a camera cannot?
תשובה
Human judgment and an immediate physical response.
כרטיס 498
שאלה
Why define restricted activities in change management?
תשובה
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
כרטיס 499
שאלה
What contractual impact can noncompliance create?
תשובה
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
כרטיס 500
שאלה
What should determine backup frequency?
תשובה
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
כרטיס 501
שאלה
What should router hardening protect?
תשובה
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
כרטיס 502
שאלה
What problem does OAuth 2.0 address?
תשובה
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
כרטיס 503
שאלה
What does SCADA do?
תשובה
It provides supervisory monitoring and control across distributed industrial equipment.
כרטיס 504
שאלה
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
תשובה
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
כרטיס 505
שאלה
What distinguishes a computer virus?
תשובה
It attaches to a host file or program and spreads when that infected host executes or is shared.
כרטיס 506
שאלה
What does a key management system coordinate?
תשובה
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
כרטיס 507
שאלה
How can an unsecure wired network expose traffic?
תשובה
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
כרטיס 508
שאלה
Why is vulnerable device firmware hard to remediate?
תשובה
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
כרטיס 509
שאלה
What does patching change in vulnerability remediation?
תשובה
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
כרטיס 510
שאלה
What does DMARC add to SPF and DKIM?
תשובה
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
כרטיס 511
שאלה
How does automation improve security efficiency?
תשובה
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
כרטיס 512
שאלה
What is a simulation exercise?
תשובה
A more realistic practice in which participants respond to injected events using operational processes.
כרטיס 513
שאלה
What is a data processor?
תשובה
An entity that processes personal data on behalf of a controller.
כרטיס 514
שאלה
What is risk mitigation?
תשובה
Reducing likelihood, impact, or both through controls or process changes.
כרטיס 515
שאלה
Why monitor a vendor after onboarding?
תשובה
Security posture, ownership, services, incidents, and dependencies can change.
כרטיס 516
שאלה
What does a physical penetration test assess?
תשובה
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
כרטיס 517
שאלה
Why use access badges at a facility?
תשובה
To associate entry attempts with authorized identities and enforce access rules.
כרטיס 518
שאלה
How does permission restriction protect data?
תשובה
Only authorized identities receive the actions and scope their roles require.
כרטיס 519
שאלה
What is the usual objective of ransomware extortion?
תשובה
Force payment by denying access, threatening disclosure, or both.
כרטיס 520
שאלה
What does impossible travel indicate?
תשובה
One identity appears to authenticate from distant locations too quickly for legitimate travel.
כרטיס 521
שאלה
What is configuration enforcement?
תשובה
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
כרטיס 522
שאלה
What does a web vulnerability scanner inspect?
תשובה
Running web behavior for issues such as unsafe input handling and insecure configuration.
כרטיס 523
שאלה
How does cost affect an architecture choice?
תשובה
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
כרטיס 524
שאלה
What does EAP provide with 802.1X?
תשובה
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
כרטיס 525
שאלה
What should operational-security training help users protect?
תשובה
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
כרטיס 526
שאלה
What does a time-of-day access rule do?
תשובה
Allows or denies a requested action according to an approved schedule.
כרטיס 527
שאלה
What should cloud infrastructure hardening establish?
תשובה
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
כרטיס 528
שאלה
What should an asset owner ensure during offboarding?
תשובה
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
כרטיס 529
שאלה
Why encrypt backups?
תשובה
Backup media and transfers can expose the same sensitive data as production systems.
כרטיס 530
שאלה
What is steganography?
תשובה
Hiding the existence of data inside another medium rather than merely encrypting its contents.
כרטיס 531
שאלה
Which human vector uses a fabricated authority role to justify a sensitive request?
תשובה
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
כרטיס 532
שאלה
Why does risk transfer not remove accountability?
תשובה
The organization can retain legal, reputational, operational, and oversight consequences.
כרטיס 533
שאלה
Why validate a change after deployment?
תשובה
To confirm the intended result occurred without introducing unacceptable side effects.
כרטיס 534
שאלה
What makes end-of-life hardware a security vulnerability?
תשובה
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
כרטיס 535
שאלה
What does an audit add to remediation validation?
תשובה
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
כרטיס 536
שאלה
Why can SPF pass while a message still impersonates a brand?
תשובה
SPF checks the envelope domain, which may differ from the visible From domain.
כרטיס 537
שאלה
What role can a government entity have in security governance?
תשובה
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
כרטיס 538
שאלה
How do data inventory and retention support privacy governance?
תשובה
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
כרטיס 539
שאלה
What can concurrent sessions from distant regions indicate?
תשובה
A stolen account or shared credential, subject to VPN and proxy context.
כרטיס 540
שאלה
What does supply-chain analysis examine?
תשובה
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
כרטיס 541
שאלה
What is the purpose of facility lighting as a control?
תשובה
Deter covert activity and improve observation of people and areas.
כרטיס 542
שאלה
What architecture quality keeps a service usable during component failure?
תשובה
Availability.
כרטיס 543
שאלה
When is fail-open behavior preferable to fail-closed behavior?
תשובה
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
כרטיס 544
שאלה
Which control function does a login-failure alert provide?
תשובה
Detection; it reveals suspicious authentication activity.
כרטיס 545
שאלה
What does a biometric MFA implementation verify?
תשובה
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
כרטיס 546
שאלה
How can automation enforce a security baseline?
תשובה
It compares realized settings with the approved state and reports or corrects unauthorized drift.
כרטיס 547
שאלה
How do wireless cryptographic protocols protect network traffic?
תשובה
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
כרטיס 548
שאלה
Why segment sensitive data stores?
תשובה
It limits reachable paths and separates them from lower-trust workloads.
כרטיס 549
שאלה
What must remain secret in an asymmetric key pair?
תשובה
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
כרטיס 550
שאלה
How can a supplier become a supply-chain attack vector?
תשובה
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
כרטיס 551
שאלה
What is e-discovery?
תשובה
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
כרטיס 552
שאלה
What characterizes a neutral risk appetite?
תשובה
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
כרטיס 553
שאלה
What is passive reconnaissance?
תשובה
Gathering information without directly interacting with the target's systems.
כרטיס 554
שאלה
What does a philosophical motive mean for a threat actor?
תשובה
The actor acts to advance a belief or moral position rather than primarily for money.
כרטיס 555
שאלה
What does unexpected resource consumption indicate?
תשובה
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
כרטיס 556
שאלה
What does a host-based intrusion prevention system do?
תשובה
It monitors activity on one host and can block behavior that matches exploit or attack rules.
כרטיס 557
שאלה
How does agent-based monitoring differ from agentless monitoring?
תשובה
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
כרטיס 558
שאלה
What can network logs contribute to an investigation?
תשובה
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
כרטיס 559
שאלה
What is the purpose of a backup restore test?
תשובה
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
כרטיס 560
שאלה
Why can obsolete hardware become a security risk?
תשובה
It may lack supported firmware, modern protections, or replacement parts.
כרטיס 561
שאלה
What does rescanning confirm after remediation?
תשובה
Whether the scanner can still detect the original finding on the affected asset.
כרטיס 562
שאלה
What should a secure transport method provide?
תשובה
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
כרטיס 563
שאלה
How can law affect security governance?
תשובה
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
כרטיס 564
שאלה
What does resilience mean for a security architecture?
תשובה
The ability to withstand disruption, adapt, and recover while preserving essential functions.
כרטיס 565
שאלה
Why minimize an infrastructure's attack surface?
תשובה
Fewer exposed services and paths leave fewer opportunities for exploitation.
כרטיס 566
שאלה
What does executing a security-awareness program require?
תשובה
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
כרטיס 567
שאלה
What does an infrared security sensor detect?
תשובה
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
כרטיס 568
שאלה
What is a knowledge factor?
תשובה
Something the claimant knows, such as a password.
כרטיס 569
שאלה
Why review allow-list and deny-list impact before a change?
תשובה
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
כרטיס 570
שאלה
What does partition-level encryption protect?
תשובה
One selected disk partition, leaving other partitions outside that encryption boundary.
כרטיס 571
שאלה
How can instant messaging deliver a security attack?
תשובה
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
כרטיס 572
שאלה
What can repeated blocked-content events indicate?
תשובה
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
כרטיס 573
שאלה
What should a server-hardening baseline reduce?
תשובה
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
כרטיס 574
שאלה
When is physical media destruction appropriate?
תשובה
When reuse is unnecessary or sanitization cannot provide adequate assurance.
כרטיס 575
שאלה
What is mean time to repair?
תשובה
The average time required to restore a failed component or service.
כרטיס 576
שאלה
Why disclose conflicts of interest during vendor selection?
תשובה
A personal or financial relationship can bias evaluation away from the organization's requirements.
כרטיס 577
שאלה
What is a fine for noncompliance?
תשובה
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
כרטיס 578
שאלה
What does a public data classification authorize?
תשובה
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
כרטיס 579
שאלה
What security benefit comes from standard infrastructure configurations?
תשובה
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
כרטיס 580
שאלה
How does horizontal scaling increase capacity?
תשובה
It adds more service instances and distributes work among them.
כרטיס 581
שאלה
Why can added connectivity weaken segmentation?
תשובה
Each allowed path can become a route for lateral movement or data escape.
כרטיס 582
שאלה
What coding practice is central to preventing SQL injection?
תשובה
Use parameterized queries so untrusted values remain data rather than executable query syntax.
כרטיס 583
שאלה
When is a compensating control appropriate for a vulnerability?
תשובה
When timely removal or patching is infeasible and another control can reduce the risk.
כרטיס 584
שאלה
How does agent-based web filtering enforce policy?
תשובה
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
כרטיס 585
שאלה
How can regulation differ from an internal policy?
תשובה
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
כרטיס 586
שאלה
What is a storage snapshot?
תשובה
A point-in-time representation of data or system state, whose independence depends on how it is stored.
כרטיס 587
שאלה
What does password age measure?
תשובה
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
כרטיס 588
שאלה
What does an ethical motive mean in vulnerability research?
תשובה
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
כרטיס 589
שאלה
What can missing security logs indicate?
תשובה
Logging failure, tampering, retention misconfiguration, or an inactive source.
כרטיס 590
שאלה
Why disable unused ports and protocols?
תשובה
They expose unnecessary communication paths and code that attackers can reach.
כרטיס 591
שאלה
What does antivirus contribute to monitoring?
תשובה
It scans files, memory, or behavior and reports suspected malicious code.
כרטיס 592
שאלה
What is a honeypot?
תשובה
A decoy system or service designed to attract and observe malicious activity.
כרטיס 593
שאלה
What does file-level encryption protect?
תשובה
Selected files independently of whether the rest of the disk or volume is encrypted.
כרטיס 594
שאלה
How can SMS deliver a security attack?
תשובה
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
כרטיס 595
שאלה
What happens during incident analysis?
תשובה
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
כרטיס 596
שאלה
What is mean time between failures?
תשובה
The average operating time between repairable failures.
כרטיס 597
שאלה
What is active reconnaissance?
תשובה
Probing or interacting with target systems to discover services and behavior.
כרטיס 598
שאלה
What constraint should guide ICS or SCADA hardening?
תשובה
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
כרטיס 599
שאלה
Which control function does restoring a clean system image provide?
תשובה
Correction; it returns the system to a known-good state.
כרטיס 600
שאלה
What does responsiveness mean in an architecture decision?
תשובה
How quickly the system and its operators can adapt to demand, failure, or attack.
כרטיס 601
שאלה
How does out-of-band access strengthen remote administration?
תשובה
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
כרטיס 602
שאלה
What makes user behavior unexpected?
תשובה
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
כרטיס 603
שאלה
What is a work order?
תשובה
A document authorizing a defined unit of work under an existing agreement.
כרטיס 604
שאלה
What can out-of-cycle logging indicate?
תשובה
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
כרטיס 605
שאלה
Why update a standard operating procedure after a change?
תשובה
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
כרטיס 606
שאלה
What coding practice limits cross-site scripting?
תשובה
Context-appropriate output encoding, supported by safe templating and input handling.
כרטיס 607
שאלה
What does a restricted data classification indicate?
תשובה
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
כרטיס 608
שאלה
How does a bug bounty support responsible disclosure?
תשובה
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
כרטיס 609
שאלה
What does web-filter content categorization provide?
תשובה
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
כרטיס 610
שאלה
How do hard and soft authentication tokens differ?
תשובה
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
כרטיס 611
שאלה
How can industry requirements affect security governance?
תשובה
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
כרטיס 612
שאלה
How can noncompliance cause loss of a license?
תשובה
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
כרטיס 613
שאלה
What does volume-level encryption protect?
תשובה
All data within a selected logical storage volume.
כרטיס 614
שאלה
How can impersonation exploit familiarity?
תשובה
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
כרטיס 615
שאלה
How does RTO guide recovery design?
תשובה
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
כרטיס 616
שאלה
What is a honeynet?
תשובה
A network of decoy systems used to study or divert attackers.
כרטיס 617
שאלה
What does backup replication provide?
תשובה
Additional synchronized or copied recovery data in another system or location.
כרטיס 618
שאלה
What lets automation scale securely?
תשובה
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
כרטיס 619
שאלה
Why monitor a hardened computing resource continuously?
תשובה
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
כרטיס 620
שאלה
Why keep a certificate of destruction?
תשובה
It documents that a disposal provider handled specified media under the agreed process.
כרטיס 621
שאלה
Why consider patch availability before selecting a platform?
תשובה
Unsupported or difficult-to-update components accumulate known exposure.
כרטיס 622
שאלה
Why should remote administration use an encrypted, authenticated protocol?
תשובה
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
כרטיס 623
שאלה
How can revenge motivate an insider incident?
תשובה
A disgruntled person may damage systems or disclose data to punish the organization.
כרטיס 624
שאלה
What is a published or documented indicator of malicious activity?
תשובה
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
כרטיס 625
שאלה
Why monitor a system more closely when a mitigation exception is accepted?
תשובה
Monitoring can reveal exploitation or control failure while the documented exception remains open.
כרטיס 626
שאלה
What is an SNMP trap?
תשובה
An unsolicited device notification sent to a management system when a configured event occurs.
כרטיס 627
שאלה
How can an automated report support an investigation?
תשובה
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
כרטיס 628
שאלה
What is a security key?
תשובה
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
כרטיס 629
שאלה
What does database-level encryption protect?
תשובה
A database or selected database structures through controls managed at the database layer.
כרטיס 630
שאלה
How does brand impersonation exploit trust?
תשובה
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
כרטיס 631
שאלה
What browser-side impact can a cross-site scripting vulnerability create?
תשובה
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
כרטיס 632
שאלה
How can a system or process audit identify vulnerabilities?
תשובה
It compares evidence with required configuration and procedure to reveal control gaps.
כרטיס 633
שאלה
What security role can Group Policy provide?
תשובה
Centralized Windows configuration of account, application, audit, and system security settings.
כרטיס 634
שאלה
What should incident-response training prepare people to do?
תשובה
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
כרטיס 635
שאלה
Why must governance track local or regional requirements?
תשובה
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
כרטיס 636
שאלה
How can a dependency become a useful key risk indicator?
תשובה
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
כרטיס 637
שאלה
What is a business partners agreement?
תשובה
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
כרטיס 638
שאלה
What makes an audit regulatory?
תשובה
It evaluates compliance with requirements established or enforced by a government or delegated authority.
כרטיס 639
שאלה
What is a honeyfile?
תשובה
A decoy file whose access can reveal unauthorized activity.
כרטיס 640
שאלה
Why does legal information require explicit protection?
תשובה
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
כרטיס 641
שאלה
Which indicator can mass file renaming and encryption produce?
תשובה
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
כרטיס 642
שאלה
What remains with an organization after transferring architecture risk?
תשובה
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
כרטיס 643
שאלה
When does local console placement provide useful administrative access?
תשובה
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
כרטיס 644
שאלה
What makes a harmful user action unintentional?
תשובה
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
כרטיס 645
שאלה
How should an organization harden workstations?
תשובה
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
כרטיס 646
שאלה
What is journaling in recovery?
תשובה
Recording ordered changes so data can be replayed or restored to a consistent point.
כרטיס 647
שאלה
What downtime must a change plan account for?
תשובה
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
כרטיס 648
שאלה
Why must a privacy program map local or regional law to data flows?
תשובה
The applicable duties can change with the location of the person, organization, processing, or stored data.
כרטיס 649
שאלה
Why combine independent preventive controls at different layers?
תשובה
A failure at one layer does not automatically let the same attack succeed at the next layer.
כרטיס 650
שאלה
What is passwordless authentication?
תשובה
A flow that does not require the user to enter a memorized password, often using public-key credentials.
כרטיס 651
שאלה
How can automation improve security reaction time?
תשובה
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
כרטיס 652
שאלה
What does record-level encryption protect?
תשובה
Individual records or fields, allowing finer protection than encrypting the entire database.
כרטיס 653
שאלה
How can business email compromise misuse urgency?
תשובה
It pressures an employee to bypass normal verification for a payment, credential, or data request.
כרטיס 654
שאלה
What does impact measure in risk analysis?
תשובה
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
כרטיס 655
שאלה
What makes cyber activity part of warfare?
תשובה
It supports military or state conflict objectives such as disruption, intelligence, or influence.
כרטיס 656
שאלה
Which indicator can a newly created privileged account produce outside the normal change window?
תשובה
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
כרטיס 657
שאלה
How can configuration enforcement validate a deployed mitigation?
תשובה
It compares the realized settings with the approved state and corrects or reports drift.
כרטיס 658
שאלה
How does validating an alert improve alert tuning?
תשובה
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
כרטיס 659
שאלה
What data-layer impact can a SQL injection vulnerability create?
תשובה
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
כרטיס 660
שאלה
What environmental variables can change vulnerability priority?
תשובה
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
כרטיס 661
שאלה
What security role does SELinux provide?
תשובה
Mandatory access controls that confine processes according to centrally defined policy.
כרטיס 662
שאלה
Why review governance documents periodically?
תשובה
Business, technology, threats, and external obligations change.
כרטיס 663
שאלה
Why evaluate power requirements for a system design?
תשובה
Power capacity and redundancy constrain availability and recovery.
כרטיס 664
שאלה
When is IPsec a better tunnel choice than TLS?
תשובה
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
כרטיס 665
שאלה
What is a honeytoken?
תשובה
A fake credential or data element that generates a high-confidence alert when used.
כרטיס 666
שאלה
What should embedded-system hardening prioritize?
תשובה
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
כרטיס 667
שאלה
Why must sanitization address data remanence?
תשובה
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
כרטיס 668
שאלה
Why require rules of engagement for vendor testing?
תשובה
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
כרטיס 669
שאלה
What does a private data classification indicate?
תשובה
The information concerns an individual or limited internal audience and should not be exposed publicly.
כרטיס 670
שאלה
What does a tabletop recovery exercise test?
תשובה
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
כרטיס 671
שאלה
Why prevent password reuse?
תשובה
One compromised password should not unlock other accounts or services.
כרטיס 672
שאלה
Which malicious-activity indicator is unexplained sustained CPU or memory use?
תשובה
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
כרטיס 673
שאלה
What does transport encryption protect?
תשובה
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
כרטיס 674
שאלה
How can a voice call become an attack vector?
תשובה
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
כרטיס 675
שאלה
What should a digital-forensics report document?
תשובה
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
כרטיס 676
שאלה
What tradeoff comes with an expansionary risk appetite?
תשובה
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
כרטיס 677
שאלה
What does a known penetration-test environment provide?
תשובה
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
כרטיס 678
שאלה
Why evaluate compute requirements before deployment?
תשובה
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
כרטיס 679
שאלה
Why place sensors at network choke points?
תשובה
They can observe traffic crossing important trust boundaries.
כרטיס 680
שאלה
What should hybrid or remote-work security training emphasize?
תשובה
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
כרטיס 681
שאלה
Why plan an application restart separately from a service restart?
תשובה
The application may need its own state handling, user coordination, health checks, and rollback point.
כרטיס 682
שאלה
What is a cryptographic vulnerability?
תשובה
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
כרטיס 683
שאלה
Why report findings by asset owner?
תשובה
Owners need clear accountability and a prioritized remediation queue.
כרטיס 684
שאלה
What should guide selection of a secure protocol?
תשובה
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
כרטיס 685
שאלה
How do centralized and decentralized governance structures differ?
תשובה
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
כרטיס 686
שאלה
How does privacy-aware design limit data retention?
תשובה
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
כרטיס 687
שאלה
What does a pressure security sensor detect?
תשובה
Force or weight applied to a protected surface, such as a floor mat or fence line.
כרטיס 688
שאלה
What automation costs should a security team plan for?
תשובה
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
כרטיס 689
שאלה
What should RTOS hardening preserve while reducing attack surface?
תשובה
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
כרטיס 690
שאלה
What is the goal of disruption-for-chaos activity?
תשובה
Create instability or damage itself rather than pursue a clear financial or intelligence return.
כרטיס 691
שאלה
Which indicator can repeated password guessing produce?
תשובה
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
כרטיס 692
שאלה
How does removing unnecessary software harden a system?
תשובה
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
כרטיס 693
שאלה
What does NetFlow provide?
תשובה
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
כרטיס 694
שאלה
How can a dashboard support an investigation?
תשובה
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
כרטיס 695
שאלה
When should a password be expired?
תשובה
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
כרטיס 696
שאלה
Why does cryptographic key length matter?
תשובה
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
כרטיס 697
שאלה
How can an unsecure Bluetooth connection become an attack vector?
תשובה
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
כרטיס 698
שאלה
What is a key risk indicator?
תשובה
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
כרטיס 699
שאלה
What should vendor monitoring verify when a contract ends?
תשובה
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
כרטיס 700
שאלה
What does a sensitive data classification indicate?
תשובה
The information needs safeguards because unauthorized access, change, or loss could cause harm.
כרטיס 701
שאלה
What does software-defined networking separate?
תשובה
The control plane that decides traffic behavior from the data plane that forwards traffic.
כרטיס 702
שאלה
Where should a web application firewall be placed?
תשובה
In the path of web requests before they reach the protected application.
כרטיס 703
שאלה
What does a simulated recovery exercise test?
תשובה
Participants perform realistic response actions in a controlled environment without disrupting production.
כרטיס 704
שאלה
How can a team verify that a detective control is effective?
תשובה
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
כרטיס 705
שאלה
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
תשובה
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
כרטיס 706
שאלה
What makes a vulnerability cloud-specific?
תשובה
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
כרטיס 707
שאלה
How can insurance respond to vulnerability risk?
תשובה
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
כרטיס 708
שאלה
How does reputation improve web filtering?
תשובה
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
כרטיס 709
שאלה
What does an encryption policy establish?
תשובה
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
כרטיס 710
שאלה
How does a microwave security sensor detect movement?
תשובה
It emits microwave energy and detects changes in the reflected signal caused by motion.
כרטיס 711
שאלה
What should IoT-device hardening change before deployment?
תשובה
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
כרטיס 712
שאלה
Why track software licenses as assets?
תשובה
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
כרטיס 713
שאלה
What does a password manager improve?
תשובה
It can generate and store unique long passwords so users do not memorize or reuse them.
כרטיס 714
שאלה
What makes a ledger open and public?
תשובה
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
כרטיס 715
שאלה
What should a payment-change request trigger?
תשובה
Independent verification through a known channel before any account or payment detail is changed.
כרטיס 716
שאלה
What does preserving digital evidence require?
תשובה
Protecting its integrity, context, access history, and availability from collection through final disposition.
כרטיס 717
שאלה
What should a risk report tell decision-makers?
תשובה
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
כרטיס 718
שאלה
What should an external assessment report provide?
תשובה
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
כרטיס 719
שאלה
What is a centralized design's main resilience risk?
תשובה
A central dependency can become a bottleneck or single point of failure.
כרטיס 720
שאלה
What does mutual TLS add to a TLS-protected service connection?
תשובה
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
כרטיס 721
שאלה
What should recurring security-awareness reporting show?
תשובה
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
כרטיס 722
שאלה
Why do legacy applications require extra change planning?
תשובה
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
כרטיס 723
שאלה
How do a data controller and a data processor differ?
תשובה
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
כרטיס 724
שאלה
How can orchestration become a single point of failure?
תשובה
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
כרטיס 725
שאלה
Why should defenses account for a threat actor's sophistication and capability?
תשובה
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
כרטיס 726
שאלה
How does an injection attack make an application execute unintended instructions?
תשובה
It sends crafted input that an interpreter treats as code or commands instead of data.
כרטיס 727
שאלה
What does a host-based firewall control?
תשובה
Inbound and outbound network traffic for one endpoint according to local rules.
כרטיס 728
שאלה
Why revise alerting after an incident?
תשובה
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
כרטיס 729
שאלה
Why include security duties in procurement criteria?
תשובה
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
כרטיס 730
שאלה
What does a critical data classification indicate?
תשובה
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
כרטיס 731
שאלה
What infrastructure capacity must support failover?
תשובה
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
כרטיס 732
שאלה
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
תשובה
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
כרטיס 733
שאלה
How does a remediation exemption differ from an exception?
תשובה
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
כרטיס 734
שאלה
Why should automated EDR or XDR blocking have an exception and rollback path?
תשובה
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
כרטיס 735
שאלה
What does a security playbook provide?
תשובה
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
כרטיס 736
שאלה
How does an ultrasonic security sensor detect movement?
תשובה
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
כרטיס 737
שאלה
What should a managed mobile device require for Bluetooth connections?
תשובה
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
כרטיס 738
שאלה
How do password complexity rules differ from password length?
תשובה
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
כרטיס 739
שאלה
What makes a certificate third-party trusted?
תשובה
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
כרטיס 740
שאלה
Why is an out-of-band check effective against impersonation?
תשובה
It verifies the request through a separate, previously trusted communication path.
כרטיס 741
שאלה
What does a risk exception authorize?
תשובה
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
כרטיס 742
שאלה
What security challenge grows in a decentralized design?
תשובה
Consistent policy, inventory, monitoring, and patching become harder.
כרטיס 743
שאלה
How should controls be selected for an unused network path?
תשובה
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
כרטיס 744
שאלה
How can a buffer-overflow attack affect an application?
תשובה
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.
744 כרטיסים
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Nibomo תיפתח כדי שתוכל להתחיל ללמוד.