What does an information security policy establish?

Management's required direction, responsibilities, and high-level rules for protecting information and systems.

A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.

What does a public-key certificate bind to an identity?

A public key, together with identifying information and the issuer's signature.

What is data at rest?

Data stored on media such as disks, databases, backups, or mobile devices.

How does policy-driven access control decide a zero-trust access request?

Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.

What does establishing a secure baseline produce?

An approved, documented configuration that defines the required secure state for a class of computing resource.

What is hashing used to verify?

Whether data has changed by comparing fixed-length digest values.

What is impersonation in social engineering?

Pretending to be a trusted person or organization to obtain access, data, or action.

What is virtualization?

Abstracting physical compute so multiple isolated guest systems can share a host.

What is chain of custody?

A documented history of who collected, handled, transferred, stored, and examined evidence.

What is quantitative risk analysis?

Estimating risk with numerical values such as money, frequency, or probability.

What is a phishing awareness campaign?

A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.

What is high availability?

Designing a service to remain accessible despite expected component failures.

What is a network security zone?

A group of systems with similar trust, function, or control requirements.

What is risk transfer?

Shifting some financial or operational consequence to another party, such as through insurance or contract.

What is media sanitization?

Making stored data infeasible to recover for the intended level of protection.

What does CVSS provide?

A standardized way to describe a vulnerability's technical severity characteristics.

What does security alerting do?

It turns matched events or behavior into a notification that the right responder can review.

What does a firewall rule enforce?

A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.

What is deprovisioning?

Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.

How does inline placement differ from a tap or monitor port?

Inline traffic passes through the control; a tap or monitor receives a copy for observation.

What is asymmetric encryption?

Encryption that uses a mathematically related public and private key pair.

What does SPF authorize?

Which mail servers may send mail for a domain in the SMTP envelope.

What is a possession factor?

Something the claimant has, such as a cryptographic authenticator.

What does ordinary TLS usually protect and authenticate?

It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.

What is single loss expectancy?

The estimated loss from one occurrence of a risk event.

What does a certificate authority do?

It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.

What is a detective control meant to do?

Identify that an unwanted event has happened or is happening.

What is the security purpose of change-control approval?

Ensure authorized reviewers assess risk before the production change occurs.

Technology used for organizational work without required approval or oversight.

What is a buffer overflow vulnerability?

A bounds-checking failure that lets input overwrite memory outside its intended buffer.

Malware or an intrusion outcome that denies access to data or systems to extort the victim.

How does network segmentation limit an incident?

It restricts communication paths and reduces lateral movement between zones.

How do load balancing and clustering support availability differently?

Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.

What is vendor due diligence?

Evaluating a provider's security, capability, stability, and fit before commitment.

Who is a data subject?

The person whose personal data is collected or processed.

A formal assertion or report about a subject matter, often supported by an independent examination.

What is a replay attack?

Valid captured data is retransmitted to repeat an authenticated or authorized action.

What does a wireless site survey establish?

Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.

What is the time-of-check stage of a race-condition vulnerability?

The application verifies a condition or resource state before acting on it.

What is a penetration test?

An authorized attempt to exploit weaknesses and demonstrate practical impact.

What is a cold recovery site?

A facility with basic space and utilities but little preinstalled technology or current data.

What is data in transit?

Data moving between systems or across a network.

What is a vendor security questionnaire?

A structured request for information about a provider's controls and practices.

How does an internal actor's starting position differ from an external actor's?

An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.

What can unexpected account lockouts indicate?

Password guessing, credential stuffing, user error, or a broken client.

How do permissions enforce access control?

They specify which actions a subject may perform on a particular resource.

What is log aggregation?

Central collection of logs from multiple sources for search, correlation, and retention.

Why plan a service restart as part of a change?

The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.

What is infrastructure as code?

Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.

What should security-awareness program development start with?

The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.

CompTIA Security+ SY0-701 Flashcards: Complete Objective Review

Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.

Di Flashcards Open Source App

Informazioni su questo mazzo

Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.

What this deck covers

General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.

Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.

The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.

Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.

This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.

Carte in questo mazzo

Carta 1
Domanda
What does an information security policy establish?
Risposta
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Carta 2
Domanda
What is phishing?
Risposta
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Carta 3
Domanda
What does a public-key certificate bind to an identity?
Risposta
A public key, together with identifying information and the issuer's signature.
Carta 4
Domanda
What is data at rest?
Risposta
Data stored on media such as disks, databases, backups, or mobile devices.
Carta 5
Domanda
How does policy-driven access control decide a zero-trust access request?
Risposta
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Carta 6
Domanda
What does establishing a secure baseline produce?
Risposta
An approved, documented configuration that defines the required secure state for a class of computing resource.
Carta 7
Domanda
What is hashing used to verify?
Risposta
Whether data has changed by comparing fixed-length digest values.
Carta 8
Domanda
What is impersonation in social engineering?
Risposta
Pretending to be a trusted person or organization to obtain access, data, or action.
Carta 9
Domanda
What is virtualization?
Risposta
Abstracting physical compute so multiple isolated guest systems can share a host.
Carta 10
Domanda
What is chain of custody?
Risposta
A documented history of who collected, handled, transferred, stored, and examined evidence.
Carta 11
Domanda
What is quantitative risk analysis?
Risposta
Estimating risk with numerical values such as money, frequency, or probability.
Carta 12
Domanda
What is a phishing awareness campaign?
Risposta
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Carta 13
Domanda
What is high availability?
Risposta
Designing a service to remain accessible despite expected component failures.
Carta 14
Domanda
What is a network security zone?
Risposta
A group of systems with similar trust, function, or control requirements.
Carta 15
Domanda
What is risk transfer?
Risposta
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Carta 16
Domanda
What is media sanitization?
Risposta
Making stored data infeasible to recover for the intended level of protection.
Carta 17
Domanda
What does CVSS provide?
Risposta
A standardized way to describe a vulnerability's technical severity characteristics.
Carta 18
Domanda
What does security alerting do?
Risposta
It turns matched events or behavior into a notification that the right responder can review.
Carta 19
Domanda
What does a firewall rule enforce?
Risposta
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Carta 20
Domanda
What is deprovisioning?
Risposta
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Carta 21
Domanda
How does inline placement differ from a tap or monitor port?
Risposta
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Carta 22
Domanda
What is asymmetric encryption?
Risposta
Encryption that uses a mathematically related public and private key pair.
Carta 23
Domanda
What does SPF authorize?
Risposta
Which mail servers may send mail for a domain in the SMTP envelope.
Carta 24
Domanda
What is a possession factor?
Risposta
Something the claimant has, such as a cryptographic authenticator.
Carta 25
Domanda
What does ordinary TLS usually protect and authenticate?
Risposta
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Carta 26
Domanda
What is single loss expectancy?
Risposta
The estimated loss from one occurrence of a risk event.
Carta 27
Domanda
What does a certificate authority do?
Risposta
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Carta 28
Domanda
What is a detective control meant to do?
Risposta
Identify that an unwanted event has happened or is happening.
Carta 29
Domanda
What is the security purpose of change-control approval?
Risposta
Ensure authorized reviewers assess risk before the production change occurs.
Carta 30
Domanda
What is shadow IT?
Risposta
Technology used for organizational work without required approval or oversight.
Carta 31
Domanda
What is a buffer overflow vulnerability?
Risposta
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Carta 32
Domanda
What is ransomware?
Risposta
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Carta 33
Domanda
How does network segmentation limit an incident?
Risposta
It restricts communication paths and reduces lateral movement between zones.
Carta 34
Domanda
How do load balancing and clustering support availability differently?
Risposta
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Carta 35
Domanda
What is vendor due diligence?
Risposta
Evaluating a provider's security, capability, stability, and fit before commitment.
Carta 36
Domanda
Who is a data subject?
Risposta
The person whose personal data is collected or processed.
Carta 37
Domanda
What is attestation?
Risposta
A formal assertion or report about a subject matter, often supported by an independent examination.
Carta 38
Domanda
What is a replay attack?
Risposta
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Carta 39
Domanda
What does a wireless site survey establish?
Risposta
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Carta 40
Domanda
What is the time-of-check stage of a race-condition vulnerability?
Risposta
The application verifies a condition or resource state before acting on it.
Carta 41
Domanda
What is a penetration test?
Risposta
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Carta 42
Domanda
What is a cold recovery site?
Risposta
A facility with basic space and utilities but little preinstalled technology or current data.
Carta 43
Domanda
What is data in transit?
Risposta
Data moving between systems or across a network.
Carta 44
Domanda
What is a vendor security questionnaire?
Risposta
A structured request for information about a provider's controls and practices.
Carta 45
Domanda
How does an internal actor's starting position differ from an external actor's?
Risposta
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Carta 46
Domanda
What can unexpected account lockouts indicate?
Risposta
Password guessing, credential stuffing, user error, or a broken client.
Carta 47
Domanda
How do permissions enforce access control?
Risposta
They specify which actions a subject may perform on a particular resource.
Carta 48
Domanda
What is log aggregation?
Risposta
Central collection of logs from multiple sources for search, correlation, and retention.
Carta 49
Domanda
Why plan a service restart as part of a change?
Risposta
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Carta 50
Domanda
What is infrastructure as code?
Risposta
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Carta 51
Domanda
What should security-awareness program development start with?
Risposta
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Carta 52
Domanda
What is a voice-based social-engineering attack called?
Risposta
Vishing.
Carta 53
Domanda
What happens during incident-response preparation?
Risposta
Teams establish people, tools, access, communications, training, and procedures before an incident.
Carta 54
Domanda
What does an offensive penetration-testing team do?
Risposta
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Carta 55
Domanda
What is federation?
Risposta
One security domain relies on identity assertions from another trusted domain.
Carta 56
Domanda
What is asset classification?
Risposta
Grouping an asset by sensitivity, criticality, or required handling.
Carta 57
Domanda
What is cross-site scripting?
Risposta
Injection of script-capable content that a browser executes in another site's security context.
Carta 58
Domanda
What can IDS or IPS trends reveal?
Risposta
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Carta 59
Domanda
What can unexpected resource inaccessibility indicate?
Risposta
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Carta 60
Domanda
What is a corrective control meant to do?
Risposta
Limit damage and restore a secure state after an event.
Carta 61
Domanda
How do containers differ from virtual machines?
Risposta
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Carta 62
Domanda
How does an active security device differ from a passive one?
Risposta
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Carta 63
Domanda
Why is unsupported software a persistent attack surface?
Risposta
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Carta 64
Domanda
What is annualized rate of occurrence?
Risposta
The estimated number of times a risk event occurs per year.
Carta 65
Domanda
What is an inherence factor?
Risposta
A biometric characteristic of the claimant.
Carta 66
Domanda
What do a threat actor's sophistication and capability describe?
Risposta
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Carta 67
Domanda
What is a SIEM?
Risposta
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Carta 68
Domanda
What is sideloading?
Risposta
Installing software from outside the platform's approved distribution path.
Carta 69
Domanda
What does an IDS or IPS signature match?
Risposta
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Carta 70
Domanda
Why are embedded systems often difficult to patch?
Risposta
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Carta 71
Domanda
What is a virtual private network?
Risposta
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Carta 72
Domanda
What should an initial security-awareness report establish?
Risposta
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Carta 73
Domanda
What is symmetric encryption?
Risposta
Encryption that uses the same secret key to encrypt and decrypt data.
Carta 74
Domanda
What happens during incident detection?
Risposta
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Carta 75
Domanda
What is recovery time objective?
Risposta
The target maximum time to restore a function after disruption.
Carta 76
Domanda
Why prioritize password length?
Risposta
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Carta 77
Domanda
What must sanitization accomplish before an asset leaves organizational control?
Risposta
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Carta 78
Domanda
What is a real-time operating system designed to provide?
Risposta
Predictable response timing for tasks with strict deadlines.
Carta 79
Domanda
What does fail-open behavior do when a control fails?
Risposta
It permits traffic or access to preserve availability.
Carta 80
Domanda
What is jailbreaking or rooting a mobile device?
Risposta
Removing platform restrictions to gain privileged control over the operating system.
Carta 81
Domanda
What does network access control enforce?
Risposta
Identity, device posture, and access policy at network connection time and during a session.
Carta 82
Domanda
What does data loss prevention do?
Risposta
Detects and may block sensitive data use or transfer that violates policy.
Carta 83
Domanda
What security property does a blockchain provide?
Risposta
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Carta 84
Domanda
What is recovery point objective?
Risposta
The target maximum acceptable data loss measured backward in time.
Carta 85
Domanda
How do ICS and SCADA relate?
Risposta
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Carta 86
Domanda
What does fail-closed behavior do when a control fails?
Risposta
It denies traffic or access to preserve security.
Carta 87
Domanda
Which keys create and verify a typical digital signature?
Risposta
The signer creates it with a private key, and others verify it with the corresponding public key.
Carta 88
Domanda
What is SQL injection?
Risposta
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Carta 89
Domanda
What does DKIM verify?
Risposta
That selected message content was signed by a domain and was not altered after signing.
Carta 90
Domanda
What is post-incident activity?
Risposta
Learning from the event and improving controls, plans, and recovery based on evidence.
Carta 91
Domanda
What characterizes an expansionary risk appetite?
Risposta
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Carta 92
Domanda
How do centralized and decentralized architectures differ?
Risposta
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Carta 93
Domanda
What does a certificate revocation list publish?
Risposta
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Carta 94
Domanda
What is a legal hold?
Risposta
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Carta 95
Domanda
What is exposure factor in quantitative risk analysis?
Risposta
The estimated percentage of an asset's value lost in one event.
Carta 96
Domanda
What is decentralized architecture?
Risposta
Control or service responsibility is distributed across multiple independent components or locations.
Carta 97
Domanda
What is tokenization?
Risposta
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Carta 98
Domanda
How can automation act as a workforce multiplier?
Risposta
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Carta 99
Domanda
What can endpoint process logs reveal?
Risposta
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Carta 100
Domanda
What does the CIA triad protect?
Risposta
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Carta 101
Domanda
How does data masking protect information?
Risposta
It hides selected values or characters while preserving a usable representation.
Carta 102
Domanda
How can a national requirement affect security governance?
Risposta
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Carta 103
Domanda
What do integrations and APIs provide to security orchestration?
Risposta
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Carta 104
Domanda
What makes a compliance report external?
Risposta
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Carta 105
Domanda
What does a cryptographic algorithm define?
Risposta
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Carta 106
Domanda
Why compare systems with a secure baseline regularly?
Risposta
To detect drift, unauthorized changes, and missing hardening.
Carta 107
Domanda
What does integrity protect?
Risposta
The accuracy and completeness of data and systems against unauthorized change.
Carta 108
Domanda
What does vulnerability classification organize?
Risposta
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Carta 109
Domanda
What does a password standard define?
Risposta
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Carta 110
Domanda
What technology capacity must a recovery design plan for?
Risposta
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Carta 111
Domanda
What does a confidential data classification indicate?
Risposta
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Carta 112
Domanda
What makes a vendor assessment independent?
Risposta
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Carta 113
Domanda
What lets a worm spread without attaching itself to another file?
Risposta
It is a standalone program that replicates across reachable systems or services.
Carta 114
Domanda
What is microsegmentation?
Risposta
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Carta 115
Domanda
What can application logs reveal?
Risposta
Transactions, errors, user actions, and application-specific security events.
Carta 116
Domanda
What does deploying a secure baseline require?
Risposta
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Carta 117
Domanda
How can resource-provisioning automation improve security?
Risposta
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Carta 118
Domanda
What does availability protect?
Risposta
Reliable, timely access to systems and data when authorized users need them.
Carta 119
Domanda
Why must a change request describe business impact?
Risposta
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Carta 120
Domanda
What does an authenticated vulnerability scan add?
Risposta
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Carta 121
Domanda
What does a change-management procedure specify?
Risposta
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Carta 122
Domanda
What is a sanction for noncompliance?
Risposta
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Carta 123
Domanda
How can email deliver a security attack?
Risposta
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Carta 124
Domanda
What is an internal compliance audit?
Risposta
An organization-led examination of whether selected operations and controls meet defined requirements.
Carta 125
Domanda
What is a Trojan?
Risposta
Malware disguised as legitimate or desirable software.
Carta 126
Domanda
What is clustering?
Risposta
Multiple systems work together to provide a service and tolerate member failure.
Carta 127
Domanda
What makes data regulated?
Risposta
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Carta 128
Domanda
What does a wireless heat map show?
Risposta
Measured or modeled signal strength and coverage across a physical area.
Carta 129
Domanda
How should vendor criticality affect due diligence?
Risposta
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Carta 130
Domanda
How can a digital signature support non-repudiation?
Risposta
It provides evidence that the holder of a private key signed specific data.
Carta 131
Domanda
What should vulnerability prioritization consider beyond severity?
Risposta
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Carta 132
Domanda
What is a security guideline?
Risposta
Recommended practice that allows judgment unless adopted as a requirement.
Carta 133
Domanda
What usually distinguishes a nation-state threat actor?
Risposta
Strategic objectives, substantial resources, patience, and advanced operational capability.
Carta 134
Domanda
What is spyware?
Risposta
Software that secretly collects information about a user or system.
Carta 135
Domanda
Why maintain an allow list for applications?
Risposta
Only explicitly approved software is permitted to execute.
Carta 136
Domanda
How can an image become an attack vector?
Risposta
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Carta 137
Domanda
What makes a security control technical?
Risposta
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Carta 138
Domanda
What is identity proofing?
Risposta
Establishing that a person is who they claim to be before issuing an account or credential.
Carta 139
Domanda
What is an automated security guardrail?
Risposta
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Carta 140
Domanda
Why assign an owner to a planned change?
Risposta
To make one party accountable for coordination, execution, and follow-through.
Carta 141
Domanda
How can national privacy law affect data handling?
Risposta
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Carta 142
Domanda
What is continuity of operations?
Risposta
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Carta 143
Domanda
What security tradeoff comes with BYOD?
Risposta
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Carta 144
Domanda
How should policies and handbooks support security training?
Risposta
They provide accessible, current rules and reporting steps that training can apply to real situations.
Carta 145
Domanda
What is a keylogger?
Risposta
A tool that records keystrokes to capture data such as credentials.
Carta 146
Domanda
What makes information a trade secret?
Risposta
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Carta 147
Domanda
What does authentication establish?
Risposta
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Carta 148
Domanda
What risk comes from an untrusted file attachment?
Risposta
Opening or parsing it can execute malicious code or expose data.
Carta 149
Domanda
How does risk tolerance affect vulnerability remediation?
Risposta
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Carta 150
Domanda
How can a global requirement affect security governance?
Risposta
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Carta 151
Domanda
Why should questionnaire answers be supported by evidence?
Risposta
Self-assertions alone may not prove that controls are designed or operating effectively.
Carta 152
Domanda
What is an independent third-party audit?
Risposta
An external party with suitable independence examines evidence against defined criteria.
Carta 153
Domanda
What do account provisioning and deprovisioning do?
Risposta
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Carta 154
Domanda
What is an unskilled attacker commonly called?
Risposta
A script kiddie: someone who relies on tools or instructions created by others.
Carta 155
Domanda
What is a rootkit?
Risposta
Software designed to maintain privileged, concealed access by altering or subverting the system.
Carta 156
Domanda
What does an access control list enforce?
Risposta
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Carta 157
Domanda
What should system security monitoring observe?
Risposta
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Carta 158
Domanda
What can operating-system security logs reveal?
Risposta
Authentication, privilege use, policy changes, services, and other host security events.
Carta 159
Domanda
Why isolate operational technology from general business networks?
Risposta
To limit attack paths into safety- and availability-critical processes.
Carta 160
Domanda
What is the COPE mobile deployment model?
Risposta
The organization owns the device but permits defined personal use while retaining management control.
Carta 161
Domanda
What security work belongs in asset acquisition and procurement?
Risposta
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Carta 162
Domanda
How can user-provisioning automation improve security?
Risposta
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Carta 163
Domanda
What people capacity must a continuity plan account for?
Risposta
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Carta 164
Domanda
What do authorization models define?
Risposta
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Carta 165
Domanda
Why are removable devices an attack vector?
Risposta
They can introduce malware or remove data while bypassing network controls.
Carta 166
Domanda
What should predeployment change-test results show?
Risposta
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Carta 167
Domanda
What is the time-of-use stage of a race-condition vulnerability?
Risposta
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Carta 168
Domanda
What is data in use?
Risposta
Data actively processed in memory or by an application.
Carta 169
Domanda
What does open-source vulnerability intelligence contribute?
Risposta
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Carta 170
Domanda
What can file-integrity monitoring detect?
Risposta
Unexpected changes to protected files, directories, or configuration.
Carta 171
Domanda
Why should deprovisioning be prompt?
Risposta
Former users or roles should not retain usable access.
Carta 172
Domanda
What is an acceptable use policy?
Risposta
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Carta 173
Domanda
What makes a compliance report internal?
Risposta
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Carta 174
Domanda
What is a logic bomb?
Risposta
Malicious code that activates when a specified condition or time is reached.
Carta 175
Domanda
What does a right-to-audit clause provide?
Risposta
Contractual authority to inspect or obtain evidence about agreed controls.
Carta 176
Domanda
Where should a forward proxy sit in an enterprise traffic path?
Risposta
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Carta 177
Domanda
Which cues should make a message look suspicious?
Risposta
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Carta 178
Domanda
What makes a security control managerial?
Risposta
It directs risk and governance through decisions such as policies, assessments, and oversight.
Carta 179
Domanda
What is the CYOD mobile deployment model?
Risposta
The user selects from organization-approved device options that remain subject to corporate security requirements.
Carta 180
Domanda
How does client-based vulnerable software differ from an agentless exposure?
Risposta
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Carta 181
Domanda
What makes a risk assessment recurring?
Risposta
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Carta 182
Domanda
What does a defensive penetration-testing team practice?
Risposta
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Carta 183
Domanda
In a zero-trust data plane, what can the subject or system represent?
Risposta
The user, device, workload, or service requesting access to a protected resource.
Carta 184
Domanda
What primarily motivates a hacktivist?
Risposta
A political, social, or ideological cause.
Carta 185
Domanda
What is bloatware?
Risposta
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Carta 186
Domanda
Why keep endpoint-protection signatures and engines current?
Risposta
They need current detection logic to recognize newly identified malware and exploit behavior.
Carta 187
Domanda
What should application security monitoring observe?
Risposta
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Carta 188
Domanda
What is role-based access control?
Risposta
Permissions are assigned to roles, and identities receive access through their roles.
Carta 189
Domanda
What is geographic dispersal?
Risposta
Placing redundant resources in separate locations so one regional event does not affect all copies.
Carta 190
Domanda
What is a malicious update?
Risposta
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Carta 191
Domanda
What does static application analysis inspect?
Risposta
Source code, bytecode, or compiled code without executing the application.
Carta 192
Domanda
What does a firewall access list define?
Risposta
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Carta 193
Domanda
What does a disaster recovery policy establish?
Risposta
Management expectations for restoring technology and data after a disruptive event.
Carta 194
Domanda
How does logical segmentation separate workloads that share physical infrastructure?
Risposta
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Carta 195
Domanda
How should IDS and IPS placement differ?
Risposta
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Carta 196
Domanda
What should automated ticket creation capture?
Risposta
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Carta 197
Domanda
What makes information intellectual property?
Risposta
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Carta 198
Domanda
What is a backout plan?
Risposta
Predefined steps for safely reversing a failed or harmful change.
Carta 199
Domanda
Why is an unsecure wireless network an attack vector?
Risposta
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Carta 200
Domanda
What is physical brute force?
Risposta
Using force to defeat a lock, barrier, enclosure, or other physical control.
Carta 201
Domanda
What is application sandboxing?
Risposta
Running code in a constrained environment with limited access to the host and data.
Carta 202
Domanda
Why assign an asset owner?
Risposta
One accountable party must decide its use, protection, and lifecycle.
Carta 203
Domanda
What happens during risk identification?
Risposta
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Carta 204
Domanda
What should an SLA state about breach notification?
Risposta
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Carta 205
Domanda
How do due diligence and due care differ in compliance?
Risposta
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Carta 206
Domanda
What is attribute-based access control?
Risposta
Policy evaluates attributes of the subject, resource, action, and environment.
Carta 207
Domanda
What does a zero-trust policy engine do?
Risposta
It evaluates policy and signals to decide whether access should be allowed.
Carta 208
Domanda
How does a cloud responsibility matrix allocate security duties?
Risposta
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Carta 209
Domanda
Where should a load balancer sit in a service path?
Risposta
In front of service instances so it can route requests to healthy backends.
Carta 210
Domanda
What should the security team do with a reported suspicious message?
Risposta
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Carta 211
Domanda
What makes an operating-system vulnerability high impact?
Risposta
It can affect every application and security control that relies on the compromised OS.
Carta 212
Domanda
What does dynamic application analysis inspect?
Risposta
The behavior and externally visible weaknesses of a running application.
Carta 213
Domanda
How can false-positive trends affect IDS or IPS tuning?
Risposta
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Carta 214
Domanda
What does a business continuity policy establish?
Risposta
Management expectations for sustaining and restoring critical business functions.
Carta 215
Domanda
What is a hot recovery site?
Risposta
A ready, synchronized environment intended to take over quickly.
Carta 216
Domanda
What makes an insider threat distinct?
Risposta
The actor has legitimate access or organizational knowledge that can be misused.
Carta 217
Domanda
What is RFID cloning?
Risposta
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Carta 218
Domanda
Why apply vendor security updates promptly?
Risposta
They remove known weaknesses before attackers can exploit the unpatched exposure.
Carta 219
Domanda
What should infrastructure security monitoring observe?
Risposta
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Carta 220
Domanda
What can firewall logs reveal?
Risposta
Allowed or denied network connections across controlled boundaries.
Carta 221
Domanda
Why minimize open service ports?
Risposta
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Carta 222
Domanda
What is threat hunting?
Risposta
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Carta 223
Domanda
What triggers an ad hoc risk assessment?
Risposta
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Carta 224
Domanda
What makes an assessment external?
Risposta
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Carta 225
Domanda
What is data sovereignty?
Risposta
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Carta 226
Domanda
What security boundary does a cellular connection create for a mobile device?
Risposta
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Carta 227
Domanda
What makes a security control operational?
Risposta
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Carta 228
Domanda
What is discretionary access control?
Risposta
A resource owner can decide who receives access, within system policy.
Carta 229
Domanda
How can careful automation support employee retention?
Risposta
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Carta 230
Domanda
Why does ease of deployment matter in an architecture decision?
Risposta
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Carta 231
Domanda
What tradeoff comes with placing an NGFW inline?
Risposta
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Carta 232
Domanda
What does a zero-trust policy administrator do?
Risposta
It carries out the policy engine's decision, such as creating or ending a session.
Carta 233
Domanda
What should a master service agreement define for data return and deletion?
Risposta
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Carta 234
Domanda
What is an environmental physical attack?
Risposta
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Carta 235
Domanda
When should a maintenance window be chosen?
Risposta
When disruption and rollback can be managed with the least business impact.
Carta 236
Domanda
What is memory injection?
Risposta
Placing malicious code or data into another process's memory so it executes in that process's context.
Carta 237
Domanda
What does software composition analysis find?
Risposta
Known risks and license information in third-party dependencies.
Carta 238
Domanda
What is DNS filtering?
Risposta
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Carta 239
Domanda
What should an incident response policy establish?
Risposta
Authority, scope, reporting duties, and organizational commitment for incident handling.
Carta 240
Domanda
How can noncompliance cause reputational damage?
Risposta
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Carta 241
Domanda
What does full-disk encryption protect?
Risposta
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Carta 242
Domanda
Why are default credentials dangerous?
Risposta
They are widely known or easily discovered and often remain unchanged.
Carta 243
Domanda
What makes a risk assessment one-time?
Risposta
It evaluates a defined decision or scope once without an established repeating cadence.
Carta 244
Domanda
What is a warm recovery site?
Risposta
A partially equipped environment that needs some data restoration or configuration before use.
Carta 245
Domanda
What does application input validation do?
Risposta
It checks that input matches the expected type, length, range, and format before use.
Carta 246
Domanda
What should an asset inventory record besides a device name?
Risposta
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Carta 247
Domanda
What is mandatory access control?
Risposta
A central authority enforces access through labels and rules that ordinary owners cannot override.
Carta 248
Domanda
What security benefit does infrastructure as code provide?
Risposta
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Carta 249
Domanda
When should a public service control fail closed?
Risposta
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Carta 250
Domanda
What should users do with a suspicious message?
Risposta
Report it through the approved channel without interacting with its links or attachments.
Carta 251
Domanda
What usually motivates organized cybercrime?
Risposta
Financial gain through scalable or repeatable criminal activity.
Carta 252
Domanda
How can malicious code support a network attack?
Risposta
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Carta 253
Domanda
When is virtual patching useful?
Risposta
When a network or application control can block exploit traffic before the underlying system can be patched.
Carta 254
Domanda
What does security-monitoring reporting provide?
Risposta
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Carta 255
Domanda
What does data geolocation identify?
Risposta
The physical or legal location where data is stored, processed, or transmitted.
Carta 256
Domanda
What does a zero-trust policy enforcement point do?
Risposta
It enables, monitors, and terminates the connection between a subject and a resource.
Carta 257
Domanda
What is cryptographic key exchange?
Risposta
A method for parties to establish shared key material over an untrusted channel.
Carta 258
Domanda
How can a vendor become a supply-chain attack vector?
Risposta
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Carta 259
Domanda
Why can legacy hardware remain vulnerable?
Risposta
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Carta 260
Domanda
What can proprietary vulnerability intelligence add beyond open sources?
Risposta
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Carta 261
Domanda
How does a centralized proxy apply web filtering?
Risposta
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Carta 262
Domanda
How can continuous integration and testing improve security automation?
Risposta
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Carta 263
Domanda
What is containment?
Risposta
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Carta 264
Domanda
What is a software development lifecycle policy meant to ensure?
Risposta
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Carta 265
Domanda
What makes risk assessment continuous?
Risposta
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Carta 266
Domanda
What is a memorandum of agreement?
Risposta
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Carta 267
Domanda
What makes a penetration test integrated?
Risposta
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Carta 268
Domanda
How does a DNS amplification attack magnify traffic?
Risposta
It sends small spoofed queries that trigger larger replies toward the victim.
Carta 269
Domanda
Why does ease of recovery matter in an architecture decision?
Risposta
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Carta 270
Domanda
What does 802.1X control before a device receives normal network access?
Risposta
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Carta 271
Domanda
What is rule-based access control?
Risposta
System-wide rules grant or deny access based on conditions such as network, time, or action.
Carta 272
Domanda
What is mobile device management?
Risposta
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Carta 273
Domanda
What tradeoff comes with a cold recovery site?
Risposta
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Carta 274
Domanda
Why identify stakeholders before approving a security-sensitive change?
Risposta
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Carta 275
Domanda
How do attestation and acknowledgement differ?
Risposta
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Carta 276
Domanda
What does zero-trust adaptive identity mean?
Risposta
Access decisions adjust to current risk signals rather than relying only on a static login.
Carta 277
Domanda
What makes a security control physical?
Risposta
It protects facilities or equipment through a tangible barrier or mechanism.
Carta 278
Domanda
What is geo-fencing for data?
Risposta
Enforcing location-based boundaries on where data or services may be accessed or operated.
Carta 279
Domanda
What does a Trusted Platform Module protect?
Risposta
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Carta 280
Domanda
Why can a managed service provider amplify risk?
Risposta
Its privileged access and shared tooling can provide a path into many customers.
Carta 281
Domanda
What does probability express in risk analysis?
Risposta
A quantified chance that a defined event will occur within stated conditions or time.
Carta 282
Domanda
Why can shadow IT create a threat?
Risposta
It bypasses security review, inventory, monitoring, and supported configuration.
Carta 283
Domanda
What is on-path interception?
Risposta
An attacker positions between communicating parties to observe or alter traffic.
Carta 284
Domanda
Why include encryption in a system-hardening baseline?
Risposta
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Carta 285
Domanda
Why tune security alerts?
Risposta
To keep useful detections while reducing noise that wastes analyst attention.
Carta 286
Domanda
What can IPS or IDS logs contribute to an investigation?
Risposta
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Carta 287
Domanda
What is VM escape?
Risposta
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Carta 288
Domanda
How can segmentation reduce vulnerability exposure before a patch is available?
Risposta
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Carta 289
Domanda
Why should firewall policy name the required ports and protocols explicitly?
Risposta
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Carta 290
Domanda
What is a change management policy meant to control?
Risposta
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Carta 291
Domanda
What is a hybrid-cloud architecture?
Risposta
An environment that integrates private or on-premises resources with public cloud services.
Carta 292
Domanda
How do AH and ESP differ in the security services they can provide?
Risposta
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Carta 293
Domanda
What makes user behavior risky?
Risposta
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Carta 294
Domanda
What is least privilege?
Risposta
Granting only the access needed for the required task and no more.
Carta 295
Domanda
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Risposta
Transmission to HTTPS, script access, and cross-site sending, respectively.
Carta 296
Domanda
Why discover unmanaged assets?
Risposta
Unknown systems cannot be patched, monitored, or governed reliably.
Carta 297
Domanda
What is a service-level agreement?
Risposta
Measurable service commitments and remedies, such as availability or response targets.
Carta 298
Domanda
What should govern automated security escalation?
Risposta
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Carta 299
Domanda
What is platform diversity as a resilience strategy?
Risposta
Using different implementations so one common flaw or failure is less likely to affect every copy.
Carta 300
Domanda
How can replayed session material affect an application?
Risposta
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Carta 301
Domanda
What is an implicit trust zone in zero trust?
Risposta
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Carta 302
Domanda
What does salting a password hash accomplish?
Risposta
It makes identical passwords hash differently and defeats precomputed hash tables.
Carta 303
Domanda
What is spear phishing?
Risposta
Phishing tailored to a specific person, role, or organization.
Carta 304
Domanda
What is eradication?
Risposta
Removing the attacker's access, malicious artifacts, and exploited conditions.
Carta 305
Domanda
Who is a risk owner?
Risposta
The person accountable for deciding and monitoring how a specific risk is handled.
Carta 306
Domanda
What does a partially known penetration-test environment provide?
Risposta
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Carta 307
Domanda
What is a microservices architecture?
Risposta
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Carta 308
Domanda
What is a jump server?
Risposta
A hardened intermediary used to reach systems in a restricted management network.
Carta 309
Domanda
What can happen when a configuration change is made without dependency analysis?
Risposta
A downstream service can fail even when the changed component works.
Carta 310
Domanda
What is resource reuse exposure?
Risposta
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Carta 311
Domanda
Why does financial information require explicit protection?
Risposta
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Carta 312
Domanda
What does CVE provide?
Risposta
A common identifier for a publicly disclosed vulnerability.
Carta 313
Domanda
Where can DLP controls operate?
Risposta
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Carta 314
Domanda
What does privileged password vaulting protect?
Risposta
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Carta 315
Domanda
What does an access-control standard define?
Risposta
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Carta 316
Domanda
How can automation support compliance monitoring?
Risposta
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Carta 317
Domanda
What does static code analysis examine?
Risposta
Source or compiled code for weakness patterns without executing the application.
Carta 318
Domanda
What actor attribute describes funding, time, and personnel?
Risposta
Resources.
Carta 319
Domanda
What is DNS poisoning?
Risposta
Introducing false DNS data so names resolve to attacker-chosen destinations.
Carta 320
Domanda
Why change default credentials during hardening?
Risposta
Default secrets are predictable and commonly targeted.
Carta 321
Domanda
What does quarantine do after a security alert?
Risposta
It restricts a suspected asset or object while analysts validate and remediate the risk.
Carta 322
Domanda
What does key stretching do for stored passwords?
Risposta
It deliberately makes each password guess more computationally expensive.
Carta 323
Domanda
What is smishing?
Risposta
Phishing delivered through SMS or another text-messaging service.
Carta 324
Domanda
What is qualitative risk analysis?
Risposta
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Carta 325
Domanda
What is a master service agreement?
Risposta
An umbrella contract establishing general legal and commercial terms for ongoing work.
Carta 326
Domanda
What is threat scope reduction?
Risposta
Narrowing the systems, privileges, or paths an attacker can reach.
Carta 327
Domanda
Why use a third-party cloud service instead of building locally?
Risposta
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Carta 328
Domanda
What should determine security-device placement?
Risposta
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Carta 329
Domanda
What does situational awareness mean for a user?
Risposta
Notice the people, devices, requests, location, and context around a task before acting.
Carta 330
Domanda
What does a failover test validate?
Risposta
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Carta 331
Domanda
What is a preventive control meant to do?
Risposta
Stop an unwanted event before it succeeds.
Carta 332
Domanda
What is just-in-time privileged access?
Risposta
Elevated access is granted only when needed and expires after a short approved period.
Carta 333
Domanda
What safeguard should security-group automation enforce?
Risposta
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Carta 334
Domanda
How does a reflected DDoS attack hide and multiply sources?
Risposta
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Carta 335
Domanda
What is a security misconfiguration?
Risposta
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Carta 336
Domanda
Why can the same vulnerability have different organizational impact?
Risposta
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Carta 337
Domanda
What does URL scanning evaluate before a user opens a web destination?
Risposta
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Carta 338
Domanda
What is the board's security governance role?
Risposta
Provide oversight, set risk direction, and hold executives accountable.
Carta 339
Domanda
What does code signing establish?
Risposta
That code came from the holder of the signing key and has not changed since signing.
Carta 340
Domanda
How should an asset's classification affect security operations?
Risposta
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Carta 341
Domanda
How does encryption protect data?
Risposta
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Carta 342
Domanda
What is a secure enclave?
Risposta
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Carta 343
Domanda
What is business email compromise?
Risposta
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Carta 344
Domanda
What is recovery in incident response?
Risposta
Restoring services safely, monitoring them, and returning to normal operations.
Carta 345
Domanda
How is single loss expectancy commonly estimated?
Risposta
Asset value multiplied by the exposure factor.
Carta 346
Domanda
What does an unknown penetration-test environment provide?
Risposta
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Carta 347
Domanda
What security boundary does a hypervisor provide?
Risposta
It isolates virtual machines while controlling their access to shared hardware.
Carta 348
Domanda
Why does a TLS tunnel not protect a compromised endpoint?
Risposta
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Carta 349
Domanda
Why update diagrams after an infrastructure change?
Risposta
Operations and incident responders need the documentation to match the deployed environment.
Carta 350
Domanda
What does privacy ownership assign?
Risposta
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Carta 351
Domanda
What does a security control gap analysis compare?
Risposta
The controls required for the target state with the controls currently in place.
Carta 352
Domanda
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Risposta
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Carta 353
Domanda
What is application privilege escalation?
Risposta
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Carta 354
Domanda
What risk remains when unnecessary software is left installed?
Risposta
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Carta 355
Domanda
What does SCAP standardize?
Risposta
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Carta 356
Domanda
What can packet capture reveal?
Risposta
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Carta 357
Domanda
What makes a privileged credential ephemeral?
Risposta
It is created for a limited task or session and expires or is destroyed automatically after that use.
Carta 358
Domanda
How do a statement of work and a work order differ?
Risposta
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Carta 359
Domanda
Why might multi-cloud improve resilience?
Risposta
A provider-wide failure need not stop workloads that can run independently elsewhere.
Carta 360
Domanda
How can a service provider introduce a supply-chain vulnerability?
Risposta
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Carta 361
Domanda
What is a false positive in vulnerability scanning?
Risposta
A reported weakness that is not actually present or exploitable in the assessed context.
Carta 362
Domanda
How do EDR and XDR differ?
Risposta
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Carta 363
Domanda
What should onboarding and offboarding procedures coordinate?
Risposta
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Carta 364
Domanda
How should an organization harden managed mobile devices?
Risposta
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Carta 365
Domanda
What is a certificate signing request?
Risposta
A request containing a public key and subject information for a certificate authority to sign.
Carta 366
Domanda
What is pretexting?
Risposta
Using a fabricated role or situation to make a request seem legitimate.
Carta 367
Domanda
How is annualized loss expectancy commonly estimated?
Risposta
Single loss expectancy multiplied by annualized rate of occurrence.
Carta 368
Domanda
What security consequence follows from containers sharing a kernel?
Risposta
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Carta 369
Domanda
Where does 802.1X enforce a network admission decision?
Risposta
At the controlled switch port or wireless access point before normal network access is granted.
Carta 370
Domanda
What should insider-threat awareness teach?
Risposta
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Carta 371
Domanda
What access action is suitable for careful automation?
Risposta
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Carta 372
Domanda
What is an evil twin?
Risposta
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 carte
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Studia questo mazzo gratis
Nibomo si apre e puoi iniziare a studiare.
Carta 373
Domanda
Does non-human-readable data need less protection?
Risposta
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Carta 374
Domanda
What does authenticating a system establish?
Risposta
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Carta 375
Domanda
What does LDAP provide in identity systems?
Risposta
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Carta 376
Domanda
What is a deterrent control meant to do?
Risposta
Discourage an attacker from attempting an unwanted action.
Carta 377
Domanda
Why update procedures after changing a security control?
Risposta
Staff need accurate steps for operating, monitoring, and recovering the new control.
Carta 378
Domanda
How does OCSP differ from a certificate revocation list?
Risposta
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Carta 379
Domanda
What is the goal of data exfiltration?
Risposta
Remove data from its authorized environment without permission.
Carta 380
Domanda
What is a watering-hole attack?
Risposta
Compromising a site frequented by the intended targets so their visits expose them.
Carta 381
Domanda
How can a hardware provider introduce a supply-chain vulnerability?
Risposta
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Carta 382
Domanda
What is application forgery?
Risposta
Creating or altering a request, token, or object so the application treats it as authentic.
Carta 383
Domanda
How does least privilege mitigate compromise?
Risposta
It limits the actions and resources available to a compromised account or process.
Carta 384
Domanda
What is serverless computing?
Risposta
A model where the provider manages servers and the customer deploys event-driven code or functions.
Carta 385
Domanda
What makes an infrastructure control effective for a specific risk?
Risposta
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Carta 386
Domanda
What does parallel recovery processing test?
Risposta
Whether primary and alternate environments can run together consistently before a controlled cutover.
Carta 387
Domanda
Which password-authentication method does WPA3-Personal use?
Risposta
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Carta 388
Domanda
How does data retention affect asset disposal?
Risposta
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Carta 389
Domanda
What is a false negative in vulnerability scanning?
Risposta
A real weakness that the assessment fails to report.
Carta 390
Domanda
What does recurring security scanning add to monitoring?
Risposta
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Carta 391
Domanda
What should guide port selection for a secure protocol?
Risposta
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Carta 392
Domanda
What does forensic acquisition create?
Risposta
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Carta 393
Domanda
How do system owners and data owners divide security accountability?
Risposta
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Carta 394
Domanda
What does likelihood express in risk analysis?
Risposta
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Carta 395
Domanda
What is a memorandum of understanding?
Risposta
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Carta 396
Domanda
What does the right to be forgotten generally require?
Risposta
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Carta 397
Domanda
What does an audit committee oversee?
Risposta
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Carta 398
Domanda
What does identity interoperability require?
Risposta
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Carta 399
Domanda
How does a bollard protect a facility?
Risposta
It blocks or redirects vehicles before they can reach a protected area.
Carta 400
Domanda
How can hashing protect a downloaded file?
Risposta
A trusted digest lets the recipient detect whether the file changed.
Carta 401
Domanda
What is a credential replay attack?
Risposta
Using captured valid credentials or tokens again without needing to discover the secret.
Carta 402
Domanda
How can automation complexity create security risk?
Risposta
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Carta 403
Domanda
What must an architecture provide when a component cannot be patched?
Risposta
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Carta 404
Domanda
What makes remote access secure?
Risposta
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Carta 405
Domanda
What should users verify before connecting removable media or a cable?
Risposta
That the device and connection are approved, expected, and handled under organizational policy.
Carta 406
Domanda
What is a self-signed certificate?
Risposta
A certificate signed by its own private key rather than by a separate trusted issuer.
Carta 407
Domanda
What is brand impersonation?
Risposta
Using a trusted organization's identity or look to deceive people.
Carta 408
Domanda
What characterizes a conservative risk appetite?
Risposta
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Carta 409
Domanda
What should a managed mobile device verify before using Wi-Fi?
Risposta
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Carta 410
Domanda
What is a zero-day vulnerability?
Risposta
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Carta 411
Domanda
What does verification confirm after vulnerability remediation?
Risposta
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Carta 412
Domanda
What is user and entity behavior analytics?
Risposta
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Carta 413
Domanda
What does a physical security policy establish?
Risposta
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Carta 414
Domanda
What does a UPS provide?
Risposta
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Carta 415
Domanda
What is a nondisclosure agreement?
Risposta
A contract restricting use and disclosure of defined confidential information.
Carta 416
Domanda
What should be checked before assigning a user permission?
Risposta
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Carta 417
Domanda
How does espionage differ from ordinary theft?
Risposta
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Carta 418
Domanda
What is password spraying?
Risposta
Trying a small set of common passwords across many accounts to avoid lockouts.
Carta 419
Domanda
What is the purpose of system isolation during an incident?
Risposta
Stop harmful communication while preserving the system for response and investigation.
Carta 420
Domanda
What is a security benchmark?
Risposta
A documented set of recommended configuration checks for a platform or product.
Carta 421
Domanda
Which metadata fields give a log record investigative context?
Risposta
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Carta 422
Domanda
What does an access-control vestibule prevent?
Risposta
It limits tailgating by allowing controlled passage through one door at a time.
Carta 423
Domanda
What is version control's security value for configuration?
Risposta
It preserves attributable history and enables review or rollback of changes.
Carta 424
Domanda
Why use both internal and external compliance monitoring?
Risposta
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Carta 425
Domanda
What distinguishes on-premises architecture?
Risposta
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Carta 426
Domanda
What risk can split tunneling add to a VPN?
Risposta
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Carta 427
Domanda
What is a certificate root of trust?
Risposta
A trusted root certificate or key from which a client validates a certificate chain.
Carta 428
Domanda
What is typosquatting?
Risposta
Registering a look-alike domain based on common typing errors or visual similarity.
Carta 429
Domanda
What is root-cause analysis?
Risposta
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Carta 430
Domanda
What is risk tolerance?
Risposta
The acceptable variation or boundary around a specific objective or risk area.
Carta 431
Domanda
What is a security self-assessment?
Risposta
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Carta 432
Domanda
What does data masking change?
Risposta
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Carta 433
Domanda
How do wireless authentication protocols let clients prove identity securely?
Risposta
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Carta 434
Domanda
Why reconcile inventory with network discovery?
Risposta
Differences expose missing records, retired systems, or unauthorized devices.
Carta 435
Domanda
Why does sideloading raise mobile risk?
Risposta
It can bypass store review, signing policy, and managed application controls.
Carta 436
Domanda
What does an information-sharing organization add to vulnerability management?
Risposta
Sector or community intelligence about relevant threats, incidents, and defensive action.
Carta 437
Domanda
What does a web-filter block rule specify?
Risposta
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Carta 438
Domanda
How do data custodians and data stewards differ?
Risposta
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Carta 439
Domanda
What is a brute-force password attack?
Risposta
Systematically trying many candidate secrets against an account or protected value.
Carta 440
Domanda
What is a compensating control?
Risposta
An alternative safeguard used when the preferred control is impractical or unavailable.
Carta 441
Domanda
How can location act as an authentication factor?
Risposta
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Carta 442
Domanda
Why must security automation remain supportable?
Risposta
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Carta 443
Domanda
What does a standby generator provide?
Risposta
Longer-duration power during a utility outage, after a startup delay.
Carta 444
Domanda
What makes an architecture air-gapped?
Risposta
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Carta 445
Domanda
What is a software-defined WAN?
Risposta
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Carta 446
Domanda
What password-management behavior should awareness training reinforce?
Risposta
Use unique long passwords through an approved manager and report suspected compromise promptly.
Carta 447
Domanda
What security value does fencing provide?
Risposta
It defines and delays entry across a physical perimeter.
Carta 448
Domanda
What is a wildcard certificate?
Risposta
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Carta 449
Domanda
How does misinformation differ from disinformation?
Risposta
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Carta 450
Domanda
What is a risk threshold?
Risposta
A defined level that triggers escalation, treatment, or another required response.
Carta 451
Domanda
What does a vendor penetration test contribute to assessment?
Risposta
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Carta 452
Domanda
What is the objective of a service-disruption attack?
Risposta
Make a system or business function unavailable or unreliable.
Carta 453
Domanda
What is directory traversal?
Risposta
Manipulating a file path to reach files outside the directory the application intended to expose.
Carta 454
Domanda
Why decommission an unsupported system?
Risposta
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Carta 455
Domanda
Why archive security-monitoring data?
Risposta
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Carta 456
Domanda
What role does RADIUS commonly play in enterprise Wi-Fi?
Risposta
It centralizes authentication, authorization information, and accounting for network access.
Carta 457
Domanda
Why separate the requester and approver of a high-risk change?
Risposta
To reduce error, fraud, and unilateral unauthorized modification.
Carta 458
Domanda
Why can a jailbroken device violate a security baseline?
Risposta
It weakens platform isolation and allows unapproved privileged changes.
Carta 459
Domanda
When is tokenization especially useful?
Risposta
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Carta 460
Domanda
Why can dark-web intelligence affect vulnerability priority?
Risposta
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Carta 461
Domanda
What firewall policy should govern traffic from a screened subnet to internal systems?
Risposta
Deny it by default and allow only explicitly required flows.
Carta 462
Domanda
What does SAML commonly carry?
Risposta
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Carta 463
Domanda
What does a security governance committee do?
Risposta
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Carta 464
Domanda
How can global privacy requirements affect one data process?
Risposta
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Carta 465
Domanda
What characterizes an IoT device?
Risposta
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Carta 466
Domanda
What is a unified threat management appliance?
Risposta
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Carta 467
Domanda
What does a hardware security module provide?
Risposta
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Carta 468
Domanda
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Risposta
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Carta 469
Domanda
What is a tabletop exercise?
Risposta
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Carta 470
Domanda
What does a risk exemption authorize?
Risposta
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Carta 471
Domanda
What is a regulatory examination?
Risposta
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Carta 472
Domanda
What does physical video surveillance primarily provide?
Risposta
Detection and evidence of activity in monitored areas.
Carta 473
Domanda
What is a birthday attack against a hash?
Risposta
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Carta 474
Domanda
Why keep backups both onsite and offsite?
Risposta
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Carta 475
Domanda
How does technical debt affect security automation?
Risposta
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Carta 476
Domanda
What should switch hardening restrict first?
Risposta
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Carta 477
Domanda
What should happen when an asset changes owners?
Risposta
Inventory, access, support responsibility, and data handling should be updated.
Carta 478
Domanda
What does evidence of a vendor's internal audits contribute?
Risposta
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Carta 479
Domanda
What is identity attestation?
Risposta
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Carta 480
Domanda
Why can standard enterprise patching be unsafe for an RTOS device?
Risposta
A change can disrupt timing guarantees or certified operational behavior.
Carta 481
Domanda
What is secure access service edge?
Risposta
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Carta 482
Domanda
What social-engineering habit should awareness training reinforce?
Risposta
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Carta 483
Domanda
How can a software provider introduce a supply-chain vulnerability?
Risposta
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Carta 484
Domanda
Why include internet exposure in remediation priority?
Risposta
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Carta 485
Domanda
What does a mail gateway inspect?
Risposta
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Carta 486
Domanda
What is a data controller?
Risposta
The entity that determines why and how personal data is processed.
Carta 487
Domanda
How does blackmail motivate a cyberattack?
Risposta
The attacker threatens disclosure or harm unless the victim complies.
Carta 488
Domanda
What is a downgrade attack?
Risposta
Forcing parties to use an older or weaker protocol or security mode.
Carta 489
Domanda
How does encryption mitigate data exposure?
Risposta
It makes captured data unreadable without the required key.
Carta 490
Domanda
How do network and web vulnerability scanners differ?
Risposta
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Carta 491
Domanda
How can vulnerability-scan data support an investigation?
Risposta
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Carta 492
Domanda
What is key escrow?
Risposta
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Carta 493
Domanda
Which human vector commonly uses a fake sign-in page to harvest credentials?
Risposta
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Carta 494
Domanda
What is risk avoidance?
Risposta
Stopping or not starting the activity that creates the risk.
Carta 495
Domanda
What is data obfuscation?
Risposta
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Carta 496
Domanda
What is a directive control?
Risposta
A safeguard that tells people what behavior or action is required.
Carta 497
Domanda
What does a security guard add that a camera cannot?
Risposta
Human judgment and an immediate physical response.
Carta 498
Domanda
Why define restricted activities in change management?
Risposta
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Carta 499
Domanda
What contractual impact can noncompliance create?
Risposta
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Carta 500
Domanda
What should determine backup frequency?
Risposta
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Carta 501
Domanda
What should router hardening protect?
Risposta
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Carta 502
Domanda
What problem does OAuth 2.0 address?
Risposta
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Carta 503
Domanda
What does SCADA do?
Risposta
It provides supervisory monitoring and control across distributed industrial equipment.
Carta 504
Domanda
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Risposta
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Carta 505
Domanda
What distinguishes a computer virus?
Risposta
It attaches to a host file or program and spreads when that infected host executes or is shared.
Carta 506
Domanda
What does a key management system coordinate?
Risposta
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Carta 507
Domanda
How can an unsecure wired network expose traffic?
Risposta
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Carta 508
Domanda
Why is vulnerable device firmware hard to remediate?
Risposta
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Carta 509
Domanda
What does patching change in vulnerability remediation?
Risposta
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Carta 510
Domanda
What does DMARC add to SPF and DKIM?
Risposta
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Carta 511
Domanda
How does automation improve security efficiency?
Risposta
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Carta 512
Domanda
What is a simulation exercise?
Risposta
A more realistic practice in which participants respond to injected events using operational processes.
Carta 513
Domanda
What is a data processor?
Risposta
An entity that processes personal data on behalf of a controller.
Carta 514
Domanda
What is risk mitigation?
Risposta
Reducing likelihood, impact, or both through controls or process changes.
Carta 515
Domanda
Why monitor a vendor after onboarding?
Risposta
Security posture, ownership, services, incidents, and dependencies can change.
Carta 516
Domanda
What does a physical penetration test assess?
Risposta
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Carta 517
Domanda
Why use access badges at a facility?
Risposta
To associate entry attempts with authorized identities and enforce access rules.
Carta 518
Domanda
How does permission restriction protect data?
Risposta
Only authorized identities receive the actions and scope their roles require.
Carta 519
Domanda
What is the usual objective of ransomware extortion?
Risposta
Force payment by denying access, threatening disclosure, or both.
Carta 520
Domanda
What does impossible travel indicate?
Risposta
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Carta 521
Domanda
What is configuration enforcement?
Risposta
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Carta 522
Domanda
What does a web vulnerability scanner inspect?
Risposta
Running web behavior for issues such as unsafe input handling and insecure configuration.
Carta 523
Domanda
How does cost affect an architecture choice?
Risposta
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Carta 524
Domanda
What does EAP provide with 802.1X?
Risposta
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Carta 525
Domanda
What should operational-security training help users protect?
Risposta
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Carta 526
Domanda
What does a time-of-day access rule do?
Risposta
Allows or denies a requested action according to an approved schedule.
Carta 527
Domanda
What should cloud infrastructure hardening establish?
Risposta
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Carta 528
Domanda
What should an asset owner ensure during offboarding?
Risposta
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Carta 529
Domanda
Why encrypt backups?
Risposta
Backup media and transfers can expose the same sensitive data as production systems.
Carta 530
Domanda
What is steganography?
Risposta
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Carta 531
Domanda
Which human vector uses a fabricated authority role to justify a sensitive request?
Risposta
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Carta 532
Domanda
Why does risk transfer not remove accountability?
Risposta
The organization can retain legal, reputational, operational, and oversight consequences.
Carta 533
Domanda
Why validate a change after deployment?
Risposta
To confirm the intended result occurred without introducing unacceptable side effects.
Carta 534
Domanda
What makes end-of-life hardware a security vulnerability?
Risposta
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Carta 535
Domanda
What does an audit add to remediation validation?
Risposta
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Carta 536
Domanda
Why can SPF pass while a message still impersonates a brand?
Risposta
SPF checks the envelope domain, which may differ from the visible From domain.
Carta 537
Domanda
What role can a government entity have in security governance?
Risposta
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Carta 538
Domanda
How do data inventory and retention support privacy governance?
Risposta
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Carta 539
Domanda
What can concurrent sessions from distant regions indicate?
Risposta
A stolen account or shared credential, subject to VPN and proxy context.
Carta 540
Domanda
What does supply-chain analysis examine?
Risposta
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Carta 541
Domanda
What is the purpose of facility lighting as a control?
Risposta
Deter covert activity and improve observation of people and areas.
Carta 542
Domanda
What architecture quality keeps a service usable during component failure?
Risposta
Availability.
Carta 543
Domanda
When is fail-open behavior preferable to fail-closed behavior?
Risposta
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Carta 544
Domanda
Which control function does a login-failure alert provide?
Risposta
Detection; it reveals suspicious authentication activity.
Carta 545
Domanda
What does a biometric MFA implementation verify?
Risposta
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Carta 546
Domanda
How can automation enforce a security baseline?
Risposta
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Carta 547
Domanda
How do wireless cryptographic protocols protect network traffic?
Risposta
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Carta 548
Domanda
Why segment sensitive data stores?
Risposta
It limits reachable paths and separates them from lower-trust workloads.
Carta 549
Domanda
What must remain secret in an asymmetric key pair?
Risposta
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Carta 550
Domanda
How can a supplier become a supply-chain attack vector?
Risposta
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Carta 551
Domanda
What is e-discovery?
Risposta
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Carta 552
Domanda
What characterizes a neutral risk appetite?
Risposta
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Carta 553
Domanda
What is passive reconnaissance?
Risposta
Gathering information without directly interacting with the target's systems.
Carta 554
Domanda
What does a philosophical motive mean for a threat actor?
Risposta
The actor acts to advance a belief or moral position rather than primarily for money.
Carta 555
Domanda
What does unexpected resource consumption indicate?
Risposta
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Carta 556
Domanda
What does a host-based intrusion prevention system do?
Risposta
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Carta 557
Domanda
How does agent-based monitoring differ from agentless monitoring?
Risposta
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Carta 558
Domanda
What can network logs contribute to an investigation?
Risposta
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Carta 559
Domanda
What is the purpose of a backup restore test?
Risposta
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Carta 560
Domanda
Why can obsolete hardware become a security risk?
Risposta
It may lack supported firmware, modern protections, or replacement parts.
Carta 561
Domanda
What does rescanning confirm after remediation?
Risposta
Whether the scanner can still detect the original finding on the affected asset.
Carta 562
Domanda
What should a secure transport method provide?
Risposta
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Carta 563
Domanda
How can law affect security governance?
Risposta
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Carta 564
Domanda
What does resilience mean for a security architecture?
Risposta
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Carta 565
Domanda
Why minimize an infrastructure's attack surface?
Risposta
Fewer exposed services and paths leave fewer opportunities for exploitation.
Carta 566
Domanda
What does executing a security-awareness program require?
Risposta
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Carta 567
Domanda
What does an infrared security sensor detect?
Risposta
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Carta 568
Domanda
What is a knowledge factor?
Risposta
Something the claimant knows, such as a password.
Carta 569
Domanda
Why review allow-list and deny-list impact before a change?
Risposta
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Carta 570
Domanda
What does partition-level encryption protect?
Risposta
One selected disk partition, leaving other partitions outside that encryption boundary.
Carta 571
Domanda
How can instant messaging deliver a security attack?
Risposta
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Carta 572
Domanda
What can repeated blocked-content events indicate?
Risposta
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Carta 573
Domanda
What should a server-hardening baseline reduce?
Risposta
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Carta 574
Domanda
When is physical media destruction appropriate?
Risposta
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Carta 575
Domanda
What is mean time to repair?
Risposta
The average time required to restore a failed component or service.
Carta 576
Domanda
Why disclose conflicts of interest during vendor selection?
Risposta
A personal or financial relationship can bias evaluation away from the organization's requirements.
Carta 577
Domanda
What is a fine for noncompliance?
Risposta
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Carta 578
Domanda
What does a public data classification authorize?
Risposta
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Carta 579
Domanda
What security benefit comes from standard infrastructure configurations?
Risposta
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Carta 580
Domanda
How does horizontal scaling increase capacity?
Risposta
It adds more service instances and distributes work among them.
Carta 581
Domanda
Why can added connectivity weaken segmentation?
Risposta
Each allowed path can become a route for lateral movement or data escape.
Carta 582
Domanda
What coding practice is central to preventing SQL injection?
Risposta
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Carta 583
Domanda
When is a compensating control appropriate for a vulnerability?
Risposta
When timely removal or patching is infeasible and another control can reduce the risk.
Carta 584
Domanda
How does agent-based web filtering enforce policy?
Risposta
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Carta 585
Domanda
How can regulation differ from an internal policy?
Risposta
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Carta 586
Domanda
What is a storage snapshot?
Risposta
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Carta 587
Domanda
What does password age measure?
Risposta
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Carta 588
Domanda
What does an ethical motive mean in vulnerability research?
Risposta
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Carta 589
Domanda
What can missing security logs indicate?
Risposta
Logging failure, tampering, retention misconfiguration, or an inactive source.
Carta 590
Domanda
Why disable unused ports and protocols?
Risposta
They expose unnecessary communication paths and code that attackers can reach.
Carta 591
Domanda
What does antivirus contribute to monitoring?
Risposta
It scans files, memory, or behavior and reports suspected malicious code.
Carta 592
Domanda
What is a honeypot?
Risposta
A decoy system or service designed to attract and observe malicious activity.
Carta 593
Domanda
What does file-level encryption protect?
Risposta
Selected files independently of whether the rest of the disk or volume is encrypted.
Carta 594
Domanda
How can SMS deliver a security attack?
Risposta
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Carta 595
Domanda
What happens during incident analysis?
Risposta
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Carta 596
Domanda
What is mean time between failures?
Risposta
The average operating time between repairable failures.
Carta 597
Domanda
What is active reconnaissance?
Risposta
Probing or interacting with target systems to discover services and behavior.
Carta 598
Domanda
What constraint should guide ICS or SCADA hardening?
Risposta
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Carta 599
Domanda
Which control function does restoring a clean system image provide?
Risposta
Correction; it returns the system to a known-good state.
Carta 600
Domanda
What does responsiveness mean in an architecture decision?
Risposta
How quickly the system and its operators can adapt to demand, failure, or attack.
Carta 601
Domanda
How does out-of-band access strengthen remote administration?
Risposta
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Carta 602
Domanda
What makes user behavior unexpected?
Risposta
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Carta 603
Domanda
What is a work order?
Risposta
A document authorizing a defined unit of work under an existing agreement.
Carta 604
Domanda
What can out-of-cycle logging indicate?
Risposta
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Carta 605
Domanda
Why update a standard operating procedure after a change?
Risposta
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Carta 606
Domanda
What coding practice limits cross-site scripting?
Risposta
Context-appropriate output encoding, supported by safe templating and input handling.
Carta 607
Domanda
What does a restricted data classification indicate?
Risposta
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Carta 608
Domanda
How does a bug bounty support responsible disclosure?
Risposta
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Carta 609
Domanda
What does web-filter content categorization provide?
Risposta
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Carta 610
Domanda
How do hard and soft authentication tokens differ?
Risposta
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Carta 611
Domanda
How can industry requirements affect security governance?
Risposta
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Carta 612
Domanda
How can noncompliance cause loss of a license?
Risposta
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Carta 613
Domanda
What does volume-level encryption protect?
Risposta
All data within a selected logical storage volume.
Carta 614
Domanda
How can impersonation exploit familiarity?
Risposta
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Carta 615
Domanda
How does RTO guide recovery design?
Risposta
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Carta 616
Domanda
What is a honeynet?
Risposta
A network of decoy systems used to study or divert attackers.
Carta 617
Domanda
What does backup replication provide?
Risposta
Additional synchronized or copied recovery data in another system or location.
Carta 618
Domanda
What lets automation scale securely?
Risposta
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Carta 619
Domanda
Why monitor a hardened computing resource continuously?
Risposta
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Carta 620
Domanda
Why keep a certificate of destruction?
Risposta
It documents that a disposal provider handled specified media under the agreed process.
Carta 621
Domanda
Why consider patch availability before selecting a platform?
Risposta
Unsupported or difficult-to-update components accumulate known exposure.
Carta 622
Domanda
Why should remote administration use an encrypted, authenticated protocol?
Risposta
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Carta 623
Domanda
How can revenge motivate an insider incident?
Risposta
A disgruntled person may damage systems or disclose data to punish the organization.
Carta 624
Domanda
What is a published or documented indicator of malicious activity?
Risposta
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Carta 625
Domanda
Why monitor a system more closely when a mitigation exception is accepted?
Risposta
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Carta 626
Domanda
What is an SNMP trap?
Risposta
An unsolicited device notification sent to a management system when a configured event occurs.
Carta 627
Domanda
How can an automated report support an investigation?
Risposta
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Carta 628
Domanda
What is a security key?
Risposta
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Carta 629
Domanda
What does database-level encryption protect?
Risposta
A database or selected database structures through controls managed at the database layer.
Carta 630
Domanda
How does brand impersonation exploit trust?
Risposta
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Carta 631
Domanda
What browser-side impact can a cross-site scripting vulnerability create?
Risposta
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Carta 632
Domanda
How can a system or process audit identify vulnerabilities?
Risposta
It compares evidence with required configuration and procedure to reveal control gaps.
Carta 633
Domanda
What security role can Group Policy provide?
Risposta
Centralized Windows configuration of account, application, audit, and system security settings.
Carta 634
Domanda
What should incident-response training prepare people to do?
Risposta
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Carta 635
Domanda
Why must governance track local or regional requirements?
Risposta
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Carta 636
Domanda
How can a dependency become a useful key risk indicator?
Risposta
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Carta 637
Domanda
What is a business partners agreement?
Risposta
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Carta 638
Domanda
What makes an audit regulatory?
Risposta
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Carta 639
Domanda
What is a honeyfile?
Risposta
A decoy file whose access can reveal unauthorized activity.
Carta 640
Domanda
Why does legal information require explicit protection?
Risposta
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Carta 641
Domanda
Which indicator can mass file renaming and encryption produce?
Risposta
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Carta 642
Domanda
What remains with an organization after transferring architecture risk?
Risposta
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Carta 643
Domanda
When does local console placement provide useful administrative access?
Risposta
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Carta 644
Domanda
What makes a harmful user action unintentional?
Risposta
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Carta 645
Domanda
How should an organization harden workstations?
Risposta
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Carta 646
Domanda
What is journaling in recovery?
Risposta
Recording ordered changes so data can be replayed or restored to a consistent point.
Carta 647
Domanda
What downtime must a change plan account for?
Risposta
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Carta 648
Domanda
Why must a privacy program map local or regional law to data flows?
Risposta
The applicable duties can change with the location of the person, organization, processing, or stored data.
Carta 649
Domanda
Why combine independent preventive controls at different layers?
Risposta
A failure at one layer does not automatically let the same attack succeed at the next layer.
Carta 650
Domanda
What is passwordless authentication?
Risposta
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Carta 651
Domanda
How can automation improve security reaction time?
Risposta
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Carta 652
Domanda
What does record-level encryption protect?
Risposta
Individual records or fields, allowing finer protection than encrypting the entire database.
Carta 653
Domanda
How can business email compromise misuse urgency?
Risposta
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Carta 654
Domanda
What does impact measure in risk analysis?
Risposta
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Carta 655
Domanda
What makes cyber activity part of warfare?
Risposta
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Carta 656
Domanda
Which indicator can a newly created privileged account produce outside the normal change window?
Risposta
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Carta 657
Domanda
How can configuration enforcement validate a deployed mitigation?
Risposta
It compares the realized settings with the approved state and corrects or reports drift.
Carta 658
Domanda
How does validating an alert improve alert tuning?
Risposta
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Carta 659
Domanda
What data-layer impact can a SQL injection vulnerability create?
Risposta
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Carta 660
Domanda
What environmental variables can change vulnerability priority?
Risposta
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Carta 661
Domanda
What security role does SELinux provide?
Risposta
Mandatory access controls that confine processes according to centrally defined policy.
Carta 662
Domanda
Why review governance documents periodically?
Risposta
Business, technology, threats, and external obligations change.
Carta 663
Domanda
Why evaluate power requirements for a system design?
Risposta
Power capacity and redundancy constrain availability and recovery.
Carta 664
Domanda
When is IPsec a better tunnel choice than TLS?
Risposta
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Carta 665
Domanda
What is a honeytoken?
Risposta
A fake credential or data element that generates a high-confidence alert when used.
Carta 666
Domanda
What should embedded-system hardening prioritize?
Risposta
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Carta 667
Domanda
Why must sanitization address data remanence?
Risposta
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Carta 668
Domanda
Why require rules of engagement for vendor testing?
Risposta
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Carta 669
Domanda
What does a private data classification indicate?
Risposta
The information concerns an individual or limited internal audience and should not be exposed publicly.
Carta 670
Domanda
What does a tabletop recovery exercise test?
Risposta
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Carta 671
Domanda
Why prevent password reuse?
Risposta
One compromised password should not unlock other accounts or services.
Carta 672
Domanda
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Risposta
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Carta 673
Domanda
What does transport encryption protect?
Risposta
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Carta 674
Domanda
How can a voice call become an attack vector?
Risposta
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Carta 675
Domanda
What should a digital-forensics report document?
Risposta
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Carta 676
Domanda
What tradeoff comes with an expansionary risk appetite?
Risposta
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Carta 677
Domanda
What does a known penetration-test environment provide?
Risposta
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Carta 678
Domanda
Why evaluate compute requirements before deployment?
Risposta
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Carta 679
Domanda
Why place sensors at network choke points?
Risposta
They can observe traffic crossing important trust boundaries.
Carta 680
Domanda
What should hybrid or remote-work security training emphasize?
Risposta
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Carta 681
Domanda
Why plan an application restart separately from a service restart?
Risposta
The application may need its own state handling, user coordination, health checks, and rollback point.
Carta 682
Domanda
What is a cryptographic vulnerability?
Risposta
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Carta 683
Domanda
Why report findings by asset owner?
Risposta
Owners need clear accountability and a prioritized remediation queue.
Carta 684
Domanda
What should guide selection of a secure protocol?
Risposta
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Carta 685
Domanda
How do centralized and decentralized governance structures differ?
Risposta
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Carta 686
Domanda
How does privacy-aware design limit data retention?
Risposta
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Carta 687
Domanda
What does a pressure security sensor detect?
Risposta
Force or weight applied to a protected surface, such as a floor mat or fence line.
Carta 688
Domanda
What automation costs should a security team plan for?
Risposta
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Carta 689
Domanda
What should RTOS hardening preserve while reducing attack surface?
Risposta
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Carta 690
Domanda
What is the goal of disruption-for-chaos activity?
Risposta
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Carta 691
Domanda
Which indicator can repeated password guessing produce?
Risposta
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Carta 692
Domanda
How does removing unnecessary software harden a system?
Risposta
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Carta 693
Domanda
What does NetFlow provide?
Risposta
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Carta 694
Domanda
How can a dashboard support an investigation?
Risposta
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Carta 695
Domanda
When should a password be expired?
Risposta
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Carta 696
Domanda
Why does cryptographic key length matter?
Risposta
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Carta 697
Domanda
How can an unsecure Bluetooth connection become an attack vector?
Risposta
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Carta 698
Domanda
What is a key risk indicator?
Risposta
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Carta 699
Domanda
What should vendor monitoring verify when a contract ends?
Risposta
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Carta 700
Domanda
What does a sensitive data classification indicate?
Risposta
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Carta 701
Domanda
What does software-defined networking separate?
Risposta
The control plane that decides traffic behavior from the data plane that forwards traffic.
Carta 702
Domanda
Where should a web application firewall be placed?
Risposta
In the path of web requests before they reach the protected application.
Carta 703
Domanda
What does a simulated recovery exercise test?
Risposta
Participants perform realistic response actions in a controlled environment without disrupting production.
Carta 704
Domanda
How can a team verify that a detective control is effective?
Risposta
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Carta 705
Domanda
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Risposta
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Carta 706
Domanda
What makes a vulnerability cloud-specific?
Risposta
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Carta 707
Domanda
How can insurance respond to vulnerability risk?
Risposta
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Carta 708
Domanda
How does reputation improve web filtering?
Risposta
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Carta 709
Domanda
What does an encryption policy establish?
Risposta
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Carta 710
Domanda
How does a microwave security sensor detect movement?
Risposta
It emits microwave energy and detects changes in the reflected signal caused by motion.
Carta 711
Domanda
What should IoT-device hardening change before deployment?
Risposta
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Carta 712
Domanda
Why track software licenses as assets?
Risposta
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Carta 713
Domanda
What does a password manager improve?
Risposta
It can generate and store unique long passwords so users do not memorize or reuse them.
Carta 714
Domanda
What makes a ledger open and public?
Risposta
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Carta 715
Domanda
What should a payment-change request trigger?
Risposta
Independent verification through a known channel before any account or payment detail is changed.
Carta 716
Domanda
What does preserving digital evidence require?
Risposta
Protecting its integrity, context, access history, and availability from collection through final disposition.
Carta 717
Domanda
What should a risk report tell decision-makers?
Risposta
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Carta 718
Domanda
What should an external assessment report provide?
Risposta
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Carta 719
Domanda
What is a centralized design's main resilience risk?
Risposta
A central dependency can become a bottleneck or single point of failure.
Carta 720
Domanda
What does mutual TLS add to a TLS-protected service connection?
Risposta
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Carta 721
Domanda
What should recurring security-awareness reporting show?
Risposta
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Carta 722
Domanda
Why do legacy applications require extra change planning?
Risposta
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Carta 723
Domanda
How do a data controller and a data processor differ?
Risposta
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Carta 724
Domanda
How can orchestration become a single point of failure?
Risposta
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Carta 725
Domanda
Why should defenses account for a threat actor's sophistication and capability?
Risposta
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Carta 726
Domanda
How does an injection attack make an application execute unintended instructions?
Risposta
It sends crafted input that an interpreter treats as code or commands instead of data.
Carta 727
Domanda
What does a host-based firewall control?
Risposta
Inbound and outbound network traffic for one endpoint according to local rules.
Carta 728
Domanda
Why revise alerting after an incident?
Risposta
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Carta 729
Domanda
Why include security duties in procurement criteria?
Risposta
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Carta 730
Domanda
What does a critical data classification indicate?
Risposta
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Carta 731
Domanda
What infrastructure capacity must support failover?
Risposta
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Carta 732
Domanda
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Risposta
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Carta 733
Domanda
How does a remediation exemption differ from an exception?
Risposta
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Carta 734
Domanda
Why should automated EDR or XDR blocking have an exception and rollback path?
Risposta
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Carta 735
Domanda
What does a security playbook provide?
Risposta
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Carta 736
Domanda
How does an ultrasonic security sensor detect movement?
Risposta
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Carta 737
Domanda
What should a managed mobile device require for Bluetooth connections?
Risposta
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Carta 738
Domanda
How do password complexity rules differ from password length?
Risposta
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Carta 739
Domanda
What makes a certificate third-party trusted?
Risposta
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Carta 740
Domanda
Why is an out-of-band check effective against impersonation?
Risposta
It verifies the request through a separate, previously trusted communication path.
Carta 741
Domanda
What does a risk exception authorize?
Risposta
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Carta 742
Domanda
What security challenge grows in a decentralized design?
Risposta
Consistent policy, inventory, monitoring, and patching become harder.
Carta 743
Domanda
How should controls be selected for an unused network path?
Risposta
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Carta 744
Domanda
How can a buffer-overflow attack affect an application?
Risposta
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.

Abstract network paths and learning nodes converging on a calm central gateway.

744 carte