What does an information security policy establish?

Management's required direction, responsibilities, and high-level rules for protecting information and systems.

A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.

What does a public-key certificate bind to an identity?

A public key, together with identifying information and the issuer's signature.

What is data at rest?

Data stored on media such as disks, databases, backups, or mobile devices.

How does policy-driven access control decide a zero-trust access request?

Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.

What does establishing a secure baseline produce?

An approved, documented configuration that defines the required secure state for a class of computing resource.

What is hashing used to verify?

Whether data has changed by comparing fixed-length digest values.

What is impersonation in social engineering?

Pretending to be a trusted person or organization to obtain access, data, or action.

What is virtualization?

Abstracting physical compute so multiple isolated guest systems can share a host.

What is chain of custody?

A documented history of who collected, handled, transferred, stored, and examined evidence.

What is quantitative risk analysis?

Estimating risk with numerical values such as money, frequency, or probability.

What is a phishing awareness campaign?

A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.

What is high availability?

Designing a service to remain accessible despite expected component failures.

What is a network security zone?

A group of systems with similar trust, function, or control requirements.

What is risk transfer?

Shifting some financial or operational consequence to another party, such as through insurance or contract.

What is media sanitization?

Making stored data infeasible to recover for the intended level of protection.

What does CVSS provide?

A standardized way to describe a vulnerability's technical severity characteristics.

What does security alerting do?

It turns matched events or behavior into a notification that the right responder can review.

What does a firewall rule enforce?

A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.

What is deprovisioning?

Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.

How does inline placement differ from a tap or monitor port?

Inline traffic passes through the control; a tap or monitor receives a copy for observation.

What is asymmetric encryption?

Encryption that uses a mathematically related public and private key pair.

What does SPF authorize?

Which mail servers may send mail for a domain in the SMTP envelope.

What is a possession factor?

Something the claimant has, such as a cryptographic authenticator.

What does ordinary TLS usually protect and authenticate?

It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.

What is single loss expectancy?

The estimated loss from one occurrence of a risk event.

What does a certificate authority do?

It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.

What is a detective control meant to do?

Identify that an unwanted event has happened or is happening.

What is the security purpose of change-control approval?

Ensure authorized reviewers assess risk before the production change occurs.

Technology used for organizational work without required approval or oversight.

What is a buffer overflow vulnerability?

A bounds-checking failure that lets input overwrite memory outside its intended buffer.

Malware or an intrusion outcome that denies access to data or systems to extort the victim.

How does network segmentation limit an incident?

It restricts communication paths and reduces lateral movement between zones.

How do load balancing and clustering support availability differently?

Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.

What is vendor due diligence?

Evaluating a provider's security, capability, stability, and fit before commitment.

Who is a data subject?

The person whose personal data is collected or processed.

A formal assertion or report about a subject matter, often supported by an independent examination.

What is a replay attack?

Valid captured data is retransmitted to repeat an authenticated or authorized action.

What does a wireless site survey establish?

Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.

What is the time-of-check stage of a race-condition vulnerability?

The application verifies a condition or resource state before acting on it.

What is a penetration test?

An authorized attempt to exploit weaknesses and demonstrate practical impact.

What is a cold recovery site?

A facility with basic space and utilities but little preinstalled technology or current data.

What is data in transit?

Data moving between systems or across a network.

What is a vendor security questionnaire?

A structured request for information about a provider's controls and practices.

How does an internal actor's starting position differ from an external actor's?

An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.

What can unexpected account lockouts indicate?

Password guessing, credential stuffing, user error, or a broken client.

How do permissions enforce access control?

They specify which actions a subject may perform on a particular resource.

What is log aggregation?

Central collection of logs from multiple sources for search, correlation, and retention.

Why plan a service restart as part of a change?

The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.

What is infrastructure as code?

Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.

What should security-awareness program development start with?

The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.

CompTIA Security+ SY0-701 Flashcards: Complete Objective Review

Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.

Por Flashcards Open Source App

Sobre este baralho

Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.

What this deck covers

General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.

Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.

The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.

Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.

This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.

Cartões deste baralho

Cartão 1
Pergunta
What does an information security policy establish?
Resposta
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Cartão 2
Pergunta
What is phishing?
Resposta
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Cartão 3
Pergunta
What does a public-key certificate bind to an identity?
Resposta
A public key, together with identifying information and the issuer's signature.
Cartão 4
Pergunta
What is data at rest?
Resposta
Data stored on media such as disks, databases, backups, or mobile devices.
Cartão 5
Pergunta
How does policy-driven access control decide a zero-trust access request?
Resposta
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Cartão 6
Pergunta
What does establishing a secure baseline produce?
Resposta
An approved, documented configuration that defines the required secure state for a class of computing resource.
Cartão 7
Pergunta
What is hashing used to verify?
Resposta
Whether data has changed by comparing fixed-length digest values.
Cartão 8
Pergunta
What is impersonation in social engineering?
Resposta
Pretending to be a trusted person or organization to obtain access, data, or action.
Cartão 9
Pergunta
What is virtualization?
Resposta
Abstracting physical compute so multiple isolated guest systems can share a host.
Cartão 10
Pergunta
What is chain of custody?
Resposta
A documented history of who collected, handled, transferred, stored, and examined evidence.
Cartão 11
Pergunta
What is quantitative risk analysis?
Resposta
Estimating risk with numerical values such as money, frequency, or probability.
Cartão 12
Pergunta
What is a phishing awareness campaign?
Resposta
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Cartão 13
Pergunta
What is high availability?
Resposta
Designing a service to remain accessible despite expected component failures.
Cartão 14
Pergunta
What is a network security zone?
Resposta
A group of systems with similar trust, function, or control requirements.
Cartão 15
Pergunta
What is risk transfer?
Resposta
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Cartão 16
Pergunta
What is media sanitization?
Resposta
Making stored data infeasible to recover for the intended level of protection.
Cartão 17
Pergunta
What does CVSS provide?
Resposta
A standardized way to describe a vulnerability's technical severity characteristics.
Cartão 18
Pergunta
What does security alerting do?
Resposta
It turns matched events or behavior into a notification that the right responder can review.
Cartão 19
Pergunta
What does a firewall rule enforce?
Resposta
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Cartão 20
Pergunta
What is deprovisioning?
Resposta
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Cartão 21
Pergunta
How does inline placement differ from a tap or monitor port?
Resposta
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Cartão 22
Pergunta
What is asymmetric encryption?
Resposta
Encryption that uses a mathematically related public and private key pair.
Cartão 23
Pergunta
What does SPF authorize?
Resposta
Which mail servers may send mail for a domain in the SMTP envelope.
Cartão 24
Pergunta
What is a possession factor?
Resposta
Something the claimant has, such as a cryptographic authenticator.
Cartão 25
Pergunta
What does ordinary TLS usually protect and authenticate?
Resposta
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Cartão 26
Pergunta
What is single loss expectancy?
Resposta
The estimated loss from one occurrence of a risk event.
Cartão 27
Pergunta
What does a certificate authority do?
Resposta
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Cartão 28
Pergunta
What is a detective control meant to do?
Resposta
Identify that an unwanted event has happened or is happening.
Cartão 29
Pergunta
What is the security purpose of change-control approval?
Resposta
Ensure authorized reviewers assess risk before the production change occurs.
Cartão 30
Pergunta
What is shadow IT?
Resposta
Technology used for organizational work without required approval or oversight.
Cartão 31
Pergunta
What is a buffer overflow vulnerability?
Resposta
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Cartão 32
Pergunta
What is ransomware?
Resposta
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Cartão 33
Pergunta
How does network segmentation limit an incident?
Resposta
It restricts communication paths and reduces lateral movement between zones.
Cartão 34
Pergunta
How do load balancing and clustering support availability differently?
Resposta
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Cartão 35
Pergunta
What is vendor due diligence?
Resposta
Evaluating a provider's security, capability, stability, and fit before commitment.
Cartão 36
Pergunta
Who is a data subject?
Resposta
The person whose personal data is collected or processed.
Cartão 37
Pergunta
What is attestation?
Resposta
A formal assertion or report about a subject matter, often supported by an independent examination.
Cartão 38
Pergunta
What is a replay attack?
Resposta
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Cartão 39
Pergunta
What does a wireless site survey establish?
Resposta
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Cartão 40
Pergunta
What is the time-of-check stage of a race-condition vulnerability?
Resposta
The application verifies a condition or resource state before acting on it.
Cartão 41
Pergunta
What is a penetration test?
Resposta
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Cartão 42
Pergunta
What is a cold recovery site?
Resposta
A facility with basic space and utilities but little preinstalled technology or current data.
Cartão 43
Pergunta
What is data in transit?
Resposta
Data moving between systems or across a network.
Cartão 44
Pergunta
What is a vendor security questionnaire?
Resposta
A structured request for information about a provider's controls and practices.
Cartão 45
Pergunta
How does an internal actor's starting position differ from an external actor's?
Resposta
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Cartão 46
Pergunta
What can unexpected account lockouts indicate?
Resposta
Password guessing, credential stuffing, user error, or a broken client.
Cartão 47
Pergunta
How do permissions enforce access control?
Resposta
They specify which actions a subject may perform on a particular resource.
Cartão 48
Pergunta
What is log aggregation?
Resposta
Central collection of logs from multiple sources for search, correlation, and retention.
Cartão 49
Pergunta
Why plan a service restart as part of a change?
Resposta
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Cartão 50
Pergunta
What is infrastructure as code?
Resposta
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Cartão 51
Pergunta
What should security-awareness program development start with?
Resposta
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Cartão 52
Pergunta
What is a voice-based social-engineering attack called?
Resposta
Vishing.
Cartão 53
Pergunta
What happens during incident-response preparation?
Resposta
Teams establish people, tools, access, communications, training, and procedures before an incident.
Cartão 54
Pergunta
What does an offensive penetration-testing team do?
Resposta
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Cartão 55
Pergunta
What is federation?
Resposta
One security domain relies on identity assertions from another trusted domain.
Cartão 56
Pergunta
What is asset classification?
Resposta
Grouping an asset by sensitivity, criticality, or required handling.
Cartão 57
Pergunta
What is cross-site scripting?
Resposta
Injection of script-capable content that a browser executes in another site's security context.
Cartão 58
Pergunta
What can IDS or IPS trends reveal?
Resposta
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Cartão 59
Pergunta
What can unexpected resource inaccessibility indicate?
Resposta
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Cartão 60
Pergunta
What is a corrective control meant to do?
Resposta
Limit damage and restore a secure state after an event.
Cartão 61
Pergunta
How do containers differ from virtual machines?
Resposta
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Cartão 62
Pergunta
How does an active security device differ from a passive one?
Resposta
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Cartão 63
Pergunta
Why is unsupported software a persistent attack surface?
Resposta
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Cartão 64
Pergunta
What is annualized rate of occurrence?
Resposta
The estimated number of times a risk event occurs per year.
Cartão 65
Pergunta
What is an inherence factor?
Resposta
A biometric characteristic of the claimant.
Cartão 66
Pergunta
What do a threat actor's sophistication and capability describe?
Resposta
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Cartão 67
Pergunta
What is a SIEM?
Resposta
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Cartão 68
Pergunta
What is sideloading?
Resposta
Installing software from outside the platform's approved distribution path.
Cartão 69
Pergunta
What does an IDS or IPS signature match?
Resposta
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Cartão 70
Pergunta
Why are embedded systems often difficult to patch?
Resposta
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Cartão 71
Pergunta
What is a virtual private network?
Resposta
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Cartão 72
Pergunta
What should an initial security-awareness report establish?
Resposta
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Cartão 73
Pergunta
What is symmetric encryption?
Resposta
Encryption that uses the same secret key to encrypt and decrypt data.
Cartão 74
Pergunta
What happens during incident detection?
Resposta
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Cartão 75
Pergunta
What is recovery time objective?
Resposta
The target maximum time to restore a function after disruption.
Cartão 76
Pergunta
Why prioritize password length?
Resposta
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Cartão 77
Pergunta
What must sanitization accomplish before an asset leaves organizational control?
Resposta
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Cartão 78
Pergunta
What is a real-time operating system designed to provide?
Resposta
Predictable response timing for tasks with strict deadlines.
Cartão 79
Pergunta
What does fail-open behavior do when a control fails?
Resposta
It permits traffic or access to preserve availability.
Cartão 80
Pergunta
What is jailbreaking or rooting a mobile device?
Resposta
Removing platform restrictions to gain privileged control over the operating system.
Cartão 81
Pergunta
What does network access control enforce?
Resposta
Identity, device posture, and access policy at network connection time and during a session.
Cartão 82
Pergunta
What does data loss prevention do?
Resposta
Detects and may block sensitive data use or transfer that violates policy.
Cartão 83
Pergunta
What security property does a blockchain provide?
Resposta
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Cartão 84
Pergunta
What is recovery point objective?
Resposta
The target maximum acceptable data loss measured backward in time.
Cartão 85
Pergunta
How do ICS and SCADA relate?
Resposta
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Cartão 86
Pergunta
What does fail-closed behavior do when a control fails?
Resposta
It denies traffic or access to preserve security.
Cartão 87
Pergunta
Which keys create and verify a typical digital signature?
Resposta
The signer creates it with a private key, and others verify it with the corresponding public key.
Cartão 88
Pergunta
What is SQL injection?
Resposta
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Cartão 89
Pergunta
What does DKIM verify?
Resposta
That selected message content was signed by a domain and was not altered after signing.
Cartão 90
Pergunta
What is post-incident activity?
Resposta
Learning from the event and improving controls, plans, and recovery based on evidence.
Cartão 91
Pergunta
What characterizes an expansionary risk appetite?
Resposta
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Cartão 92
Pergunta
How do centralized and decentralized architectures differ?
Resposta
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Cartão 93
Pergunta
What does a certificate revocation list publish?
Resposta
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Cartão 94
Pergunta
What is a legal hold?
Resposta
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Cartão 95
Pergunta
What is exposure factor in quantitative risk analysis?
Resposta
The estimated percentage of an asset's value lost in one event.
Cartão 96
Pergunta
What is decentralized architecture?
Resposta
Control or service responsibility is distributed across multiple independent components or locations.
Cartão 97
Pergunta
What is tokenization?
Resposta
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Cartão 98
Pergunta
How can automation act as a workforce multiplier?
Resposta
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Cartão 99
Pergunta
What can endpoint process logs reveal?
Resposta
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Cartão 100
Pergunta
What does the CIA triad protect?
Resposta
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Cartão 101
Pergunta
How does data masking protect information?
Resposta
It hides selected values or characters while preserving a usable representation.
Cartão 102
Pergunta
How can a national requirement affect security governance?
Resposta
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Cartão 103
Pergunta
What do integrations and APIs provide to security orchestration?
Resposta
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Cartão 104
Pergunta
What makes a compliance report external?
Resposta
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Cartão 105
Pergunta
What does a cryptographic algorithm define?
Resposta
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Cartão 106
Pergunta
Why compare systems with a secure baseline regularly?
Resposta
To detect drift, unauthorized changes, and missing hardening.
Cartão 107
Pergunta
What does integrity protect?
Resposta
The accuracy and completeness of data and systems against unauthorized change.
Cartão 108
Pergunta
What does vulnerability classification organize?
Resposta
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Cartão 109
Pergunta
What does a password standard define?
Resposta
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Cartão 110
Pergunta
What technology capacity must a recovery design plan for?
Resposta
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Cartão 111
Pergunta
What does a confidential data classification indicate?
Resposta
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Cartão 112
Pergunta
What makes a vendor assessment independent?
Resposta
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Cartão 113
Pergunta
What lets a worm spread without attaching itself to another file?
Resposta
It is a standalone program that replicates across reachable systems or services.
Cartão 114
Pergunta
What is microsegmentation?
Resposta
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Cartão 115
Pergunta
What can application logs reveal?
Resposta
Transactions, errors, user actions, and application-specific security events.
Cartão 116
Pergunta
What does deploying a secure baseline require?
Resposta
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Cartão 117
Pergunta
How can resource-provisioning automation improve security?
Resposta
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Cartão 118
Pergunta
What does availability protect?
Resposta
Reliable, timely access to systems and data when authorized users need them.
Cartão 119
Pergunta
Why must a change request describe business impact?
Resposta
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Cartão 120
Pergunta
What does an authenticated vulnerability scan add?
Resposta
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Cartão 121
Pergunta
What does a change-management procedure specify?
Resposta
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Cartão 122
Pergunta
What is a sanction for noncompliance?
Resposta
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Cartão 123
Pergunta
How can email deliver a security attack?
Resposta
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Cartão 124
Pergunta
What is an internal compliance audit?
Resposta
An organization-led examination of whether selected operations and controls meet defined requirements.
Cartão 125
Pergunta
What is a Trojan?
Resposta
Malware disguised as legitimate or desirable software.
Cartão 126
Pergunta
What is clustering?
Resposta
Multiple systems work together to provide a service and tolerate member failure.
Cartão 127
Pergunta
What makes data regulated?
Resposta
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Cartão 128
Pergunta
What does a wireless heat map show?
Resposta
Measured or modeled signal strength and coverage across a physical area.
Cartão 129
Pergunta
How should vendor criticality affect due diligence?
Resposta
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Cartão 130
Pergunta
How can a digital signature support non-repudiation?
Resposta
It provides evidence that the holder of a private key signed specific data.
Cartão 131
Pergunta
What should vulnerability prioritization consider beyond severity?
Resposta
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Cartão 132
Pergunta
What is a security guideline?
Resposta
Recommended practice that allows judgment unless adopted as a requirement.
Cartão 133
Pergunta
What usually distinguishes a nation-state threat actor?
Resposta
Strategic objectives, substantial resources, patience, and advanced operational capability.
Cartão 134
Pergunta
What is spyware?
Resposta
Software that secretly collects information about a user or system.
Cartão 135
Pergunta
Why maintain an allow list for applications?
Resposta
Only explicitly approved software is permitted to execute.
Cartão 136
Pergunta
How can an image become an attack vector?
Resposta
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Cartão 137
Pergunta
What makes a security control technical?
Resposta
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Cartão 138
Pergunta
What is identity proofing?
Resposta
Establishing that a person is who they claim to be before issuing an account or credential.
Cartão 139
Pergunta
What is an automated security guardrail?
Resposta
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Cartão 140
Pergunta
Why assign an owner to a planned change?
Resposta
To make one party accountable for coordination, execution, and follow-through.
Cartão 141
Pergunta
How can national privacy law affect data handling?
Resposta
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Cartão 142
Pergunta
What is continuity of operations?
Resposta
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Cartão 143
Pergunta
What security tradeoff comes with BYOD?
Resposta
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Cartão 144
Pergunta
How should policies and handbooks support security training?
Resposta
They provide accessible, current rules and reporting steps that training can apply to real situations.
Cartão 145
Pergunta
What is a keylogger?
Resposta
A tool that records keystrokes to capture data such as credentials.
Cartão 146
Pergunta
What makes information a trade secret?
Resposta
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Cartão 147
Pergunta
What does authentication establish?
Resposta
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Cartão 148
Pergunta
What risk comes from an untrusted file attachment?
Resposta
Opening or parsing it can execute malicious code or expose data.
Cartão 149
Pergunta
How does risk tolerance affect vulnerability remediation?
Resposta
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Cartão 150
Pergunta
How can a global requirement affect security governance?
Resposta
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Cartão 151
Pergunta
Why should questionnaire answers be supported by evidence?
Resposta
Self-assertions alone may not prove that controls are designed or operating effectively.
Cartão 152
Pergunta
What is an independent third-party audit?
Resposta
An external party with suitable independence examines evidence against defined criteria.
Cartão 153
Pergunta
What do account provisioning and deprovisioning do?
Resposta
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Cartão 154
Pergunta
What is an unskilled attacker commonly called?
Resposta
A script kiddie: someone who relies on tools or instructions created by others.
Cartão 155
Pergunta
What is a rootkit?
Resposta
Software designed to maintain privileged, concealed access by altering or subverting the system.
Cartão 156
Pergunta
What does an access control list enforce?
Resposta
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Cartão 157
Pergunta
What should system security monitoring observe?
Resposta
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Cartão 158
Pergunta
What can operating-system security logs reveal?
Resposta
Authentication, privilege use, policy changes, services, and other host security events.
Cartão 159
Pergunta
Why isolate operational technology from general business networks?
Resposta
To limit attack paths into safety- and availability-critical processes.
Cartão 160
Pergunta
What is the COPE mobile deployment model?
Resposta
The organization owns the device but permits defined personal use while retaining management control.
Cartão 161
Pergunta
What security work belongs in asset acquisition and procurement?
Resposta
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Cartão 162
Pergunta
How can user-provisioning automation improve security?
Resposta
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Cartão 163
Pergunta
What people capacity must a continuity plan account for?
Resposta
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Cartão 164
Pergunta
What do authorization models define?
Resposta
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Cartão 165
Pergunta
Why are removable devices an attack vector?
Resposta
They can introduce malware or remove data while bypassing network controls.
Cartão 166
Pergunta
What should predeployment change-test results show?
Resposta
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Cartão 167
Pergunta
What is the time-of-use stage of a race-condition vulnerability?
Resposta
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Cartão 168
Pergunta
What is data in use?
Resposta
Data actively processed in memory or by an application.
Cartão 169
Pergunta
What does open-source vulnerability intelligence contribute?
Resposta
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Cartão 170
Pergunta
What can file-integrity monitoring detect?
Resposta
Unexpected changes to protected files, directories, or configuration.
Cartão 171
Pergunta
Why should deprovisioning be prompt?
Resposta
Former users or roles should not retain usable access.
Cartão 172
Pergunta
What is an acceptable use policy?
Resposta
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Cartão 173
Pergunta
What makes a compliance report internal?
Resposta
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Cartão 174
Pergunta
What is a logic bomb?
Resposta
Malicious code that activates when a specified condition or time is reached.
Cartão 175
Pergunta
What does a right-to-audit clause provide?
Resposta
Contractual authority to inspect or obtain evidence about agreed controls.
Cartão 176
Pergunta
Where should a forward proxy sit in an enterprise traffic path?
Resposta
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Cartão 177
Pergunta
Which cues should make a message look suspicious?
Resposta
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Cartão 178
Pergunta
What makes a security control managerial?
Resposta
It directs risk and governance through decisions such as policies, assessments, and oversight.
Cartão 179
Pergunta
What is the CYOD mobile deployment model?
Resposta
The user selects from organization-approved device options that remain subject to corporate security requirements.
Cartão 180
Pergunta
How does client-based vulnerable software differ from an agentless exposure?
Resposta
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Cartão 181
Pergunta
What makes a risk assessment recurring?
Resposta
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Cartão 182
Pergunta
What does a defensive penetration-testing team practice?
Resposta
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Cartão 183
Pergunta
In a zero-trust data plane, what can the subject or system represent?
Resposta
The user, device, workload, or service requesting access to a protected resource.
Cartão 184
Pergunta
What primarily motivates a hacktivist?
Resposta
A political, social, or ideological cause.
Cartão 185
Pergunta
What is bloatware?
Resposta
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Cartão 186
Pergunta
Why keep endpoint-protection signatures and engines current?
Resposta
They need current detection logic to recognize newly identified malware and exploit behavior.
Cartão 187
Pergunta
What should application security monitoring observe?
Resposta
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Cartão 188
Pergunta
What is role-based access control?
Resposta
Permissions are assigned to roles, and identities receive access through their roles.
Cartão 189
Pergunta
What is geographic dispersal?
Resposta
Placing redundant resources in separate locations so one regional event does not affect all copies.
Cartão 190
Pergunta
What is a malicious update?
Resposta
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Cartão 191
Pergunta
What does static application analysis inspect?
Resposta
Source code, bytecode, or compiled code without executing the application.
Cartão 192
Pergunta
What does a firewall access list define?
Resposta
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Cartão 193
Pergunta
What does a disaster recovery policy establish?
Resposta
Management expectations for restoring technology and data after a disruptive event.
Cartão 194
Pergunta
How does logical segmentation separate workloads that share physical infrastructure?
Resposta
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Cartão 195
Pergunta
How should IDS and IPS placement differ?
Resposta
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Cartão 196
Pergunta
What should automated ticket creation capture?
Resposta
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Cartão 197
Pergunta
What makes information intellectual property?
Resposta
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Cartão 198
Pergunta
What is a backout plan?
Resposta
Predefined steps for safely reversing a failed or harmful change.
Cartão 199
Pergunta
Why is an unsecure wireless network an attack vector?
Resposta
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Cartão 200
Pergunta
What is physical brute force?
Resposta
Using force to defeat a lock, barrier, enclosure, or other physical control.
Cartão 201
Pergunta
What is application sandboxing?
Resposta
Running code in a constrained environment with limited access to the host and data.
Cartão 202
Pergunta
Why assign an asset owner?
Resposta
One accountable party must decide its use, protection, and lifecycle.
Cartão 203
Pergunta
What happens during risk identification?
Resposta
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Cartão 204
Pergunta
What should an SLA state about breach notification?
Resposta
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Cartão 205
Pergunta
How do due diligence and due care differ in compliance?
Resposta
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Cartão 206
Pergunta
What is attribute-based access control?
Resposta
Policy evaluates attributes of the subject, resource, action, and environment.
Cartão 207
Pergunta
What does a zero-trust policy engine do?
Resposta
It evaluates policy and signals to decide whether access should be allowed.
Cartão 208
Pergunta
How does a cloud responsibility matrix allocate security duties?
Resposta
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Cartão 209
Pergunta
Where should a load balancer sit in a service path?
Resposta
In front of service instances so it can route requests to healthy backends.
Cartão 210
Pergunta
What should the security team do with a reported suspicious message?
Resposta
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Cartão 211
Pergunta
What makes an operating-system vulnerability high impact?
Resposta
It can affect every application and security control that relies on the compromised OS.
Cartão 212
Pergunta
What does dynamic application analysis inspect?
Resposta
The behavior and externally visible weaknesses of a running application.
Cartão 213
Pergunta
How can false-positive trends affect IDS or IPS tuning?
Resposta
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Cartão 214
Pergunta
What does a business continuity policy establish?
Resposta
Management expectations for sustaining and restoring critical business functions.
Cartão 215
Pergunta
What is a hot recovery site?
Resposta
A ready, synchronized environment intended to take over quickly.
Cartão 216
Pergunta
What makes an insider threat distinct?
Resposta
The actor has legitimate access or organizational knowledge that can be misused.
Cartão 217
Pergunta
What is RFID cloning?
Resposta
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Cartão 218
Pergunta
Why apply vendor security updates promptly?
Resposta
They remove known weaknesses before attackers can exploit the unpatched exposure.
Cartão 219
Pergunta
What should infrastructure security monitoring observe?
Resposta
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Cartão 220
Pergunta
What can firewall logs reveal?
Resposta
Allowed or denied network connections across controlled boundaries.
Cartão 221
Pergunta
Why minimize open service ports?
Resposta
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Cartão 222
Pergunta
What is threat hunting?
Resposta
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Cartão 223
Pergunta
What triggers an ad hoc risk assessment?
Resposta
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Cartão 224
Pergunta
What makes an assessment external?
Resposta
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Cartão 225
Pergunta
What is data sovereignty?
Resposta
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Cartão 226
Pergunta
What security boundary does a cellular connection create for a mobile device?
Resposta
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Cartão 227
Pergunta
What makes a security control operational?
Resposta
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Cartão 228
Pergunta
What is discretionary access control?
Resposta
A resource owner can decide who receives access, within system policy.
Cartão 229
Pergunta
How can careful automation support employee retention?
Resposta
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Cartão 230
Pergunta
Why does ease of deployment matter in an architecture decision?
Resposta
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Cartão 231
Pergunta
What tradeoff comes with placing an NGFW inline?
Resposta
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Cartão 232
Pergunta
What does a zero-trust policy administrator do?
Resposta
It carries out the policy engine's decision, such as creating or ending a session.
Cartão 233
Pergunta
What should a master service agreement define for data return and deletion?
Resposta
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Cartão 234
Pergunta
What is an environmental physical attack?
Resposta
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Cartão 235
Pergunta
When should a maintenance window be chosen?
Resposta
When disruption and rollback can be managed with the least business impact.
Cartão 236
Pergunta
What is memory injection?
Resposta
Placing malicious code or data into another process's memory so it executes in that process's context.
Cartão 237
Pergunta
What does software composition analysis find?
Resposta
Known risks and license information in third-party dependencies.
Cartão 238
Pergunta
What is DNS filtering?
Resposta
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Cartão 239
Pergunta
What should an incident response policy establish?
Resposta
Authority, scope, reporting duties, and organizational commitment for incident handling.
Cartão 240
Pergunta
How can noncompliance cause reputational damage?
Resposta
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Cartão 241
Pergunta
What does full-disk encryption protect?
Resposta
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Cartão 242
Pergunta
Why are default credentials dangerous?
Resposta
They are widely known or easily discovered and often remain unchanged.
Cartão 243
Pergunta
What makes a risk assessment one-time?
Resposta
It evaluates a defined decision or scope once without an established repeating cadence.
Cartão 244
Pergunta
What is a warm recovery site?
Resposta
A partially equipped environment that needs some data restoration or configuration before use.
Cartão 245
Pergunta
What does application input validation do?
Resposta
It checks that input matches the expected type, length, range, and format before use.
Cartão 246
Pergunta
What should an asset inventory record besides a device name?
Resposta
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Cartão 247
Pergunta
What is mandatory access control?
Resposta
A central authority enforces access through labels and rules that ordinary owners cannot override.
Cartão 248
Pergunta
What security benefit does infrastructure as code provide?
Resposta
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Cartão 249
Pergunta
When should a public service control fail closed?
Resposta
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Cartão 250
Pergunta
What should users do with a suspicious message?
Resposta
Report it through the approved channel without interacting with its links or attachments.
Cartão 251
Pergunta
What usually motivates organized cybercrime?
Resposta
Financial gain through scalable or repeatable criminal activity.
Cartão 252
Pergunta
How can malicious code support a network attack?
Resposta
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Cartão 253
Pergunta
When is virtual patching useful?
Resposta
When a network or application control can block exploit traffic before the underlying system can be patched.
Cartão 254
Pergunta
What does security-monitoring reporting provide?
Resposta
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Cartão 255
Pergunta
What does data geolocation identify?
Resposta
The physical or legal location where data is stored, processed, or transmitted.
Cartão 256
Pergunta
What does a zero-trust policy enforcement point do?
Resposta
It enables, monitors, and terminates the connection between a subject and a resource.
Cartão 257
Pergunta
What is cryptographic key exchange?
Resposta
A method for parties to establish shared key material over an untrusted channel.
Cartão 258
Pergunta
How can a vendor become a supply-chain attack vector?
Resposta
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Cartão 259
Pergunta
Why can legacy hardware remain vulnerable?
Resposta
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Cartão 260
Pergunta
What can proprietary vulnerability intelligence add beyond open sources?
Resposta
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Cartão 261
Pergunta
How does a centralized proxy apply web filtering?
Resposta
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Cartão 262
Pergunta
How can continuous integration and testing improve security automation?
Resposta
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Cartão 263
Pergunta
What is containment?
Resposta
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Cartão 264
Pergunta
What is a software development lifecycle policy meant to ensure?
Resposta
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Cartão 265
Pergunta
What makes risk assessment continuous?
Resposta
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Cartão 266
Pergunta
What is a memorandum of agreement?
Resposta
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Cartão 267
Pergunta
What makes a penetration test integrated?
Resposta
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Cartão 268
Pergunta
How does a DNS amplification attack magnify traffic?
Resposta
It sends small spoofed queries that trigger larger replies toward the victim.
Cartão 269
Pergunta
Why does ease of recovery matter in an architecture decision?
Resposta
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Cartão 270
Pergunta
What does 802.1X control before a device receives normal network access?
Resposta
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Cartão 271
Pergunta
What is rule-based access control?
Resposta
System-wide rules grant or deny access based on conditions such as network, time, or action.
Cartão 272
Pergunta
What is mobile device management?
Resposta
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Cartão 273
Pergunta
What tradeoff comes with a cold recovery site?
Resposta
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Cartão 274
Pergunta
Why identify stakeholders before approving a security-sensitive change?
Resposta
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Cartão 275
Pergunta
How do attestation and acknowledgement differ?
Resposta
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Cartão 276
Pergunta
What does zero-trust adaptive identity mean?
Resposta
Access decisions adjust to current risk signals rather than relying only on a static login.
Cartão 277
Pergunta
What makes a security control physical?
Resposta
It protects facilities or equipment through a tangible barrier or mechanism.
Cartão 278
Pergunta
What is geo-fencing for data?
Resposta
Enforcing location-based boundaries on where data or services may be accessed or operated.
Cartão 279
Pergunta
What does a Trusted Platform Module protect?
Resposta
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Cartão 280
Pergunta
Why can a managed service provider amplify risk?
Resposta
Its privileged access and shared tooling can provide a path into many customers.
Cartão 281
Pergunta
What does probability express in risk analysis?
Resposta
A quantified chance that a defined event will occur within stated conditions or time.
Cartão 282
Pergunta
Why can shadow IT create a threat?
Resposta
It bypasses security review, inventory, monitoring, and supported configuration.
Cartão 283
Pergunta
What is on-path interception?
Resposta
An attacker positions between communicating parties to observe or alter traffic.
Cartão 284
Pergunta
Why include encryption in a system-hardening baseline?
Resposta
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Cartão 285
Pergunta
Why tune security alerts?
Resposta
To keep useful detections while reducing noise that wastes analyst attention.
Cartão 286
Pergunta
What can IPS or IDS logs contribute to an investigation?
Resposta
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Cartão 287
Pergunta
What is VM escape?
Resposta
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Cartão 288
Pergunta
How can segmentation reduce vulnerability exposure before a patch is available?
Resposta
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Cartão 289
Pergunta
Why should firewall policy name the required ports and protocols explicitly?
Resposta
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Cartão 290
Pergunta
What is a change management policy meant to control?
Resposta
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Cartão 291
Pergunta
What is a hybrid-cloud architecture?
Resposta
An environment that integrates private or on-premises resources with public cloud services.
Cartão 292
Pergunta
How do AH and ESP differ in the security services they can provide?
Resposta
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Cartão 293
Pergunta
What makes user behavior risky?
Resposta
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Cartão 294
Pergunta
What is least privilege?
Resposta
Granting only the access needed for the required task and no more.
Cartão 295
Pergunta
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Resposta
Transmission to HTTPS, script access, and cross-site sending, respectively.
Cartão 296
Pergunta
Why discover unmanaged assets?
Resposta
Unknown systems cannot be patched, monitored, or governed reliably.
Cartão 297
Pergunta
What is a service-level agreement?
Resposta
Measurable service commitments and remedies, such as availability or response targets.
Cartão 298
Pergunta
What should govern automated security escalation?
Resposta
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Cartão 299
Pergunta
What is platform diversity as a resilience strategy?
Resposta
Using different implementations so one common flaw or failure is less likely to affect every copy.
Cartão 300
Pergunta
How can replayed session material affect an application?
Resposta
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Cartão 301
Pergunta
What is an implicit trust zone in zero trust?
Resposta
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Cartão 302
Pergunta
What does salting a password hash accomplish?
Resposta
It makes identical passwords hash differently and defeats precomputed hash tables.
Cartão 303
Pergunta
What is spear phishing?
Resposta
Phishing tailored to a specific person, role, or organization.
Cartão 304
Pergunta
What is eradication?
Resposta
Removing the attacker's access, malicious artifacts, and exploited conditions.
Cartão 305
Pergunta
Who is a risk owner?
Resposta
The person accountable for deciding and monitoring how a specific risk is handled.
Cartão 306
Pergunta
What does a partially known penetration-test environment provide?
Resposta
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Cartão 307
Pergunta
What is a microservices architecture?
Resposta
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Cartão 308
Pergunta
What is a jump server?
Resposta
A hardened intermediary used to reach systems in a restricted management network.
Cartão 309
Pergunta
What can happen when a configuration change is made without dependency analysis?
Resposta
A downstream service can fail even when the changed component works.
Cartão 310
Pergunta
What is resource reuse exposure?
Resposta
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Cartão 311
Pergunta
Why does financial information require explicit protection?
Resposta
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Cartão 312
Pergunta
What does CVE provide?
Resposta
A common identifier for a publicly disclosed vulnerability.
Cartão 313
Pergunta
Where can DLP controls operate?
Resposta
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Cartão 314
Pergunta
What does privileged password vaulting protect?
Resposta
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Cartão 315
Pergunta
What does an access-control standard define?
Resposta
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Cartão 316
Pergunta
How can automation support compliance monitoring?
Resposta
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Cartão 317
Pergunta
What does static code analysis examine?
Resposta
Source or compiled code for weakness patterns without executing the application.
Cartão 318
Pergunta
What actor attribute describes funding, time, and personnel?
Resposta
Resources.
Cartão 319
Pergunta
What is DNS poisoning?
Resposta
Introducing false DNS data so names resolve to attacker-chosen destinations.
Cartão 320
Pergunta
Why change default credentials during hardening?
Resposta
Default secrets are predictable and commonly targeted.
Cartão 321
Pergunta
What does quarantine do after a security alert?
Resposta
It restricts a suspected asset or object while analysts validate and remediate the risk.
Cartão 322
Pergunta
What does key stretching do for stored passwords?
Resposta
It deliberately makes each password guess more computationally expensive.
Cartão 323
Pergunta
What is smishing?
Resposta
Phishing delivered through SMS or another text-messaging service.
Cartão 324
Pergunta
What is qualitative risk analysis?
Resposta
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Cartão 325
Pergunta
What is a master service agreement?
Resposta
An umbrella contract establishing general legal and commercial terms for ongoing work.
Cartão 326
Pergunta
What is threat scope reduction?
Resposta
Narrowing the systems, privileges, or paths an attacker can reach.
Cartão 327
Pergunta
Why use a third-party cloud service instead of building locally?
Resposta
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Cartão 328
Pergunta
What should determine security-device placement?
Resposta
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Cartão 329
Pergunta
What does situational awareness mean for a user?
Resposta
Notice the people, devices, requests, location, and context around a task before acting.
Cartão 330
Pergunta
What does a failover test validate?
Resposta
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Cartão 331
Pergunta
What is a preventive control meant to do?
Resposta
Stop an unwanted event before it succeeds.
Cartão 332
Pergunta
What is just-in-time privileged access?
Resposta
Elevated access is granted only when needed and expires after a short approved period.
Cartão 333
Pergunta
What safeguard should security-group automation enforce?
Resposta
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Cartão 334
Pergunta
How does a reflected DDoS attack hide and multiply sources?
Resposta
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Cartão 335
Pergunta
What is a security misconfiguration?
Resposta
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Cartão 336
Pergunta
Why can the same vulnerability have different organizational impact?
Resposta
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Cartão 337
Pergunta
What does URL scanning evaluate before a user opens a web destination?
Resposta
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Cartão 338
Pergunta
What is the board's security governance role?
Resposta
Provide oversight, set risk direction, and hold executives accountable.
Cartão 339
Pergunta
What does code signing establish?
Resposta
That code came from the holder of the signing key and has not changed since signing.
Cartão 340
Pergunta
How should an asset's classification affect security operations?
Resposta
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Cartão 341
Pergunta
How does encryption protect data?
Resposta
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Cartão 342
Pergunta
What is a secure enclave?
Resposta
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Cartão 343
Pergunta
What is business email compromise?
Resposta
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Cartão 344
Pergunta
What is recovery in incident response?
Resposta
Restoring services safely, monitoring them, and returning to normal operations.
Cartão 345
Pergunta
How is single loss expectancy commonly estimated?
Resposta
Asset value multiplied by the exposure factor.
Cartão 346
Pergunta
What does an unknown penetration-test environment provide?
Resposta
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Cartão 347
Pergunta
What security boundary does a hypervisor provide?
Resposta
It isolates virtual machines while controlling their access to shared hardware.
Cartão 348
Pergunta
Why does a TLS tunnel not protect a compromised endpoint?
Resposta
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Cartão 349
Pergunta
Why update diagrams after an infrastructure change?
Resposta
Operations and incident responders need the documentation to match the deployed environment.
Cartão 350
Pergunta
What does privacy ownership assign?
Resposta
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Cartão 351
Pergunta
What does a security control gap analysis compare?
Resposta
The controls required for the target state with the controls currently in place.
Cartão 352
Pergunta
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Resposta
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Cartão 353
Pergunta
What is application privilege escalation?
Resposta
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Cartão 354
Pergunta
What risk remains when unnecessary software is left installed?
Resposta
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Cartão 355
Pergunta
What does SCAP standardize?
Resposta
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Cartão 356
Pergunta
What can packet capture reveal?
Resposta
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Cartão 357
Pergunta
What makes a privileged credential ephemeral?
Resposta
It is created for a limited task or session and expires or is destroyed automatically after that use.
Cartão 358
Pergunta
How do a statement of work and a work order differ?
Resposta
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Cartão 359
Pergunta
Why might multi-cloud improve resilience?
Resposta
A provider-wide failure need not stop workloads that can run independently elsewhere.
Cartão 360
Pergunta
How can a service provider introduce a supply-chain vulnerability?
Resposta
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Cartão 361
Pergunta
What is a false positive in vulnerability scanning?
Resposta
A reported weakness that is not actually present or exploitable in the assessed context.
Cartão 362
Pergunta
How do EDR and XDR differ?
Resposta
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Cartão 363
Pergunta
What should onboarding and offboarding procedures coordinate?
Resposta
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Cartão 364
Pergunta
How should an organization harden managed mobile devices?
Resposta
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Cartão 365
Pergunta
What is a certificate signing request?
Resposta
A request containing a public key and subject information for a certificate authority to sign.
Cartão 366
Pergunta
What is pretexting?
Resposta
Using a fabricated role or situation to make a request seem legitimate.
Cartão 367
Pergunta
How is annualized loss expectancy commonly estimated?
Resposta
Single loss expectancy multiplied by annualized rate of occurrence.
Cartão 368
Pergunta
What security consequence follows from containers sharing a kernel?
Resposta
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Cartão 369
Pergunta
Where does 802.1X enforce a network admission decision?
Resposta
At the controlled switch port or wireless access point before normal network access is granted.
Cartão 370
Pergunta
What should insider-threat awareness teach?
Resposta
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Cartão 371
Pergunta
What access action is suitable for careful automation?
Resposta
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Cartão 372
Pergunta
What is an evil twin?
Resposta
A rogue wireless network made to resemble a legitimate one so users connect to it.
744 cartões
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Estude este baralho de graça
O Nibomo abre para você começar a estudar.
Cartão 373
Pergunta
Does non-human-readable data need less protection?
Resposta
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Cartão 374
Pergunta
What does authenticating a system establish?
Resposta
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Cartão 375
Pergunta
What does LDAP provide in identity systems?
Resposta
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Cartão 376
Pergunta
What is a deterrent control meant to do?
Resposta
Discourage an attacker from attempting an unwanted action.
Cartão 377
Pergunta
Why update procedures after changing a security control?
Resposta
Staff need accurate steps for operating, monitoring, and recovering the new control.
Cartão 378
Pergunta
How does OCSP differ from a certificate revocation list?
Resposta
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Cartão 379
Pergunta
What is the goal of data exfiltration?
Resposta
Remove data from its authorized environment without permission.
Cartão 380
Pergunta
What is a watering-hole attack?
Resposta
Compromising a site frequented by the intended targets so their visits expose them.
Cartão 381
Pergunta
How can a hardware provider introduce a supply-chain vulnerability?
Resposta
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Cartão 382
Pergunta
What is application forgery?
Resposta
Creating or altering a request, token, or object so the application treats it as authentic.
Cartão 383
Pergunta
How does least privilege mitigate compromise?
Resposta
It limits the actions and resources available to a compromised account or process.
Cartão 384
Pergunta
What is serverless computing?
Resposta
A model where the provider manages servers and the customer deploys event-driven code or functions.
Cartão 385
Pergunta
What makes an infrastructure control effective for a specific risk?
Resposta
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Cartão 386
Pergunta
What does parallel recovery processing test?
Resposta
Whether primary and alternate environments can run together consistently before a controlled cutover.
Cartão 387
Pergunta
Which password-authentication method does WPA3-Personal use?
Resposta
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Cartão 388
Pergunta
How does data retention affect asset disposal?
Resposta
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Cartão 389
Pergunta
What is a false negative in vulnerability scanning?
Resposta
A real weakness that the assessment fails to report.
Cartão 390
Pergunta
What does recurring security scanning add to monitoring?
Resposta
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Cartão 391
Pergunta
What should guide port selection for a secure protocol?
Resposta
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Cartão 392
Pergunta
What does forensic acquisition create?
Resposta
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Cartão 393
Pergunta
How do system owners and data owners divide security accountability?
Resposta
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Cartão 394
Pergunta
What does likelihood express in risk analysis?
Resposta
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Cartão 395
Pergunta
What is a memorandum of understanding?
Resposta
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Cartão 396
Pergunta
What does the right to be forgotten generally require?
Resposta
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Cartão 397
Pergunta
What does an audit committee oversee?
Resposta
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Cartão 398
Pergunta
What does identity interoperability require?
Resposta
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Cartão 399
Pergunta
How does a bollard protect a facility?
Resposta
It blocks or redirects vehicles before they can reach a protected area.
Cartão 400
Pergunta
How can hashing protect a downloaded file?
Resposta
A trusted digest lets the recipient detect whether the file changed.
Cartão 401
Pergunta
What is a credential replay attack?
Resposta
Using captured valid credentials or tokens again without needing to discover the secret.
Cartão 402
Pergunta
How can automation complexity create security risk?
Resposta
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Cartão 403
Pergunta
What must an architecture provide when a component cannot be patched?
Resposta
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Cartão 404
Pergunta
What makes remote access secure?
Resposta
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Cartão 405
Pergunta
What should users verify before connecting removable media or a cable?
Resposta
That the device and connection are approved, expected, and handled under organizational policy.
Cartão 406
Pergunta
What is a self-signed certificate?
Resposta
A certificate signed by its own private key rather than by a separate trusted issuer.
Cartão 407
Pergunta
What is brand impersonation?
Resposta
Using a trusted organization's identity or look to deceive people.
Cartão 408
Pergunta
What characterizes a conservative risk appetite?
Resposta
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Cartão 409
Pergunta
What should a managed mobile device verify before using Wi-Fi?
Resposta
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Cartão 410
Pergunta
What is a zero-day vulnerability?
Resposta
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Cartão 411
Pergunta
What does verification confirm after vulnerability remediation?
Resposta
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Cartão 412
Pergunta
What is user and entity behavior analytics?
Resposta
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Cartão 413
Pergunta
What does a physical security policy establish?
Resposta
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Cartão 414
Pergunta
What does a UPS provide?
Resposta
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Cartão 415
Pergunta
What is a nondisclosure agreement?
Resposta
A contract restricting use and disclosure of defined confidential information.
Cartão 416
Pergunta
What should be checked before assigning a user permission?
Resposta
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Cartão 417
Pergunta
How does espionage differ from ordinary theft?
Resposta
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Cartão 418
Pergunta
What is password spraying?
Resposta
Trying a small set of common passwords across many accounts to avoid lockouts.
Cartão 419
Pergunta
What is the purpose of system isolation during an incident?
Resposta
Stop harmful communication while preserving the system for response and investigation.
Cartão 420
Pergunta
What is a security benchmark?
Resposta
A documented set of recommended configuration checks for a platform or product.
Cartão 421
Pergunta
Which metadata fields give a log record investigative context?
Resposta
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Cartão 422
Pergunta
What does an access-control vestibule prevent?
Resposta
It limits tailgating by allowing controlled passage through one door at a time.
Cartão 423
Pergunta
What is version control's security value for configuration?
Resposta
It preserves attributable history and enables review or rollback of changes.
Cartão 424
Pergunta
Why use both internal and external compliance monitoring?
Resposta
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Cartão 425
Pergunta
What distinguishes on-premises architecture?
Resposta
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Cartão 426
Pergunta
What risk can split tunneling add to a VPN?
Resposta
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Cartão 427
Pergunta
What is a certificate root of trust?
Resposta
A trusted root certificate or key from which a client validates a certificate chain.
Cartão 428
Pergunta
What is typosquatting?
Resposta
Registering a look-alike domain based on common typing errors or visual similarity.
Cartão 429
Pergunta
What is root-cause analysis?
Resposta
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Cartão 430
Pergunta
What is risk tolerance?
Resposta
The acceptable variation or boundary around a specific objective or risk area.
Cartão 431
Pergunta
What is a security self-assessment?
Resposta
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Cartão 432
Pergunta
What does data masking change?
Resposta
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Cartão 433
Pergunta
How do wireless authentication protocols let clients prove identity securely?
Resposta
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Cartão 434
Pergunta
Why reconcile inventory with network discovery?
Resposta
Differences expose missing records, retired systems, or unauthorized devices.
Cartão 435
Pergunta
Why does sideloading raise mobile risk?
Resposta
It can bypass store review, signing policy, and managed application controls.
Cartão 436
Pergunta
What does an information-sharing organization add to vulnerability management?
Resposta
Sector or community intelligence about relevant threats, incidents, and defensive action.
Cartão 437
Pergunta
What does a web-filter block rule specify?
Resposta
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Cartão 438
Pergunta
How do data custodians and data stewards differ?
Resposta
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Cartão 439
Pergunta
What is a brute-force password attack?
Resposta
Systematically trying many candidate secrets against an account or protected value.
Cartão 440
Pergunta
What is a compensating control?
Resposta
An alternative safeguard used when the preferred control is impractical or unavailable.
Cartão 441
Pergunta
How can location act as an authentication factor?
Resposta
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Cartão 442
Pergunta
Why must security automation remain supportable?
Resposta
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Cartão 443
Pergunta
What does a standby generator provide?
Resposta
Longer-duration power during a utility outage, after a startup delay.
Cartão 444
Pergunta
What makes an architecture air-gapped?
Resposta
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Cartão 445
Pergunta
What is a software-defined WAN?
Resposta
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Cartão 446
Pergunta
What password-management behavior should awareness training reinforce?
Resposta
Use unique long passwords through an approved manager and report suspected compromise promptly.
Cartão 447
Pergunta
What security value does fencing provide?
Resposta
It defines and delays entry across a physical perimeter.
Cartão 448
Pergunta
What is a wildcard certificate?
Resposta
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Cartão 449
Pergunta
How does misinformation differ from disinformation?
Resposta
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Cartão 450
Pergunta
What is a risk threshold?
Resposta
A defined level that triggers escalation, treatment, or another required response.
Cartão 451
Pergunta
What does a vendor penetration test contribute to assessment?
Resposta
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Cartão 452
Pergunta
What is the objective of a service-disruption attack?
Resposta
Make a system or business function unavailable or unreliable.
Cartão 453
Pergunta
What is directory traversal?
Resposta
Manipulating a file path to reach files outside the directory the application intended to expose.
Cartão 454
Pergunta
Why decommission an unsupported system?
Resposta
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Cartão 455
Pergunta
Why archive security-monitoring data?
Resposta
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Cartão 456
Pergunta
What role does RADIUS commonly play in enterprise Wi-Fi?
Resposta
It centralizes authentication, authorization information, and accounting for network access.
Cartão 457
Pergunta
Why separate the requester and approver of a high-risk change?
Resposta
To reduce error, fraud, and unilateral unauthorized modification.
Cartão 458
Pergunta
Why can a jailbroken device violate a security baseline?
Resposta
It weakens platform isolation and allows unapproved privileged changes.
Cartão 459
Pergunta
When is tokenization especially useful?
Resposta
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Cartão 460
Pergunta
Why can dark-web intelligence affect vulnerability priority?
Resposta
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Cartão 461
Pergunta
What firewall policy should govern traffic from a screened subnet to internal systems?
Resposta
Deny it by default and allow only explicitly required flows.
Cartão 462
Pergunta
What does SAML commonly carry?
Resposta
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Cartão 463
Pergunta
What does a security governance committee do?
Resposta
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Cartão 464
Pergunta
How can global privacy requirements affect one data process?
Resposta
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Cartão 465
Pergunta
What characterizes an IoT device?
Resposta
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Cartão 466
Pergunta
What is a unified threat management appliance?
Resposta
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Cartão 467
Pergunta
What does a hardware security module provide?
Resposta
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Cartão 468
Pergunta
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Resposta
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Cartão 469
Pergunta
What is a tabletop exercise?
Resposta
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Cartão 470
Pergunta
What does a risk exemption authorize?
Resposta
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Cartão 471
Pergunta
What is a regulatory examination?
Resposta
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Cartão 472
Pergunta
What does physical video surveillance primarily provide?
Resposta
Detection and evidence of activity in monitored areas.
Cartão 473
Pergunta
What is a birthday attack against a hash?
Resposta
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Cartão 474
Pergunta
Why keep backups both onsite and offsite?
Resposta
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Cartão 475
Pergunta
How does technical debt affect security automation?
Resposta
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Cartão 476
Pergunta
What should switch hardening restrict first?
Resposta
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Cartão 477
Pergunta
What should happen when an asset changes owners?
Resposta
Inventory, access, support responsibility, and data handling should be updated.
Cartão 478
Pergunta
What does evidence of a vendor's internal audits contribute?
Resposta
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Cartão 479
Pergunta
What is identity attestation?
Resposta
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Cartão 480
Pergunta
Why can standard enterprise patching be unsafe for an RTOS device?
Resposta
A change can disrupt timing guarantees or certified operational behavior.
Cartão 481
Pergunta
What is secure access service edge?
Resposta
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Cartão 482
Pergunta
What social-engineering habit should awareness training reinforce?
Resposta
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Cartão 483
Pergunta
How can a software provider introduce a supply-chain vulnerability?
Resposta
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Cartão 484
Pergunta
Why include internet exposure in remediation priority?
Resposta
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Cartão 485
Pergunta
What does a mail gateway inspect?
Resposta
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Cartão 486
Pergunta
What is a data controller?
Resposta
The entity that determines why and how personal data is processed.
Cartão 487
Pergunta
How does blackmail motivate a cyberattack?
Resposta
The attacker threatens disclosure or harm unless the victim complies.
Cartão 488
Pergunta
What is a downgrade attack?
Resposta
Forcing parties to use an older or weaker protocol or security mode.
Cartão 489
Pergunta
How does encryption mitigate data exposure?
Resposta
It makes captured data unreadable without the required key.
Cartão 490
Pergunta
How do network and web vulnerability scanners differ?
Resposta
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Cartão 491
Pergunta
How can vulnerability-scan data support an investigation?
Resposta
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Cartão 492
Pergunta
What is key escrow?
Resposta
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Cartão 493
Pergunta
Which human vector commonly uses a fake sign-in page to harvest credentials?
Resposta
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Cartão 494
Pergunta
What is risk avoidance?
Resposta
Stopping or not starting the activity that creates the risk.
Cartão 495
Pergunta
What is data obfuscation?
Resposta
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Cartão 496
Pergunta
What is a directive control?
Resposta
A safeguard that tells people what behavior or action is required.
Cartão 497
Pergunta
What does a security guard add that a camera cannot?
Resposta
Human judgment and an immediate physical response.
Cartão 498
Pergunta
Why define restricted activities in change management?
Resposta
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Cartão 499
Pergunta
What contractual impact can noncompliance create?
Resposta
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Cartão 500
Pergunta
What should determine backup frequency?
Resposta
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Cartão 501
Pergunta
What should router hardening protect?
Resposta
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Cartão 502
Pergunta
What problem does OAuth 2.0 address?
Resposta
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Cartão 503
Pergunta
What does SCADA do?
Resposta
It provides supervisory monitoring and control across distributed industrial equipment.
Cartão 504
Pergunta
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Resposta
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Cartão 505
Pergunta
What distinguishes a computer virus?
Resposta
It attaches to a host file or program and spreads when that infected host executes or is shared.
Cartão 506
Pergunta
What does a key management system coordinate?
Resposta
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Cartão 507
Pergunta
How can an unsecure wired network expose traffic?
Resposta
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Cartão 508
Pergunta
Why is vulnerable device firmware hard to remediate?
Resposta
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Cartão 509
Pergunta
What does patching change in vulnerability remediation?
Resposta
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Cartão 510
Pergunta
What does DMARC add to SPF and DKIM?
Resposta
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Cartão 511
Pergunta
How does automation improve security efficiency?
Resposta
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Cartão 512
Pergunta
What is a simulation exercise?
Resposta
A more realistic practice in which participants respond to injected events using operational processes.
Cartão 513
Pergunta
What is a data processor?
Resposta
An entity that processes personal data on behalf of a controller.
Cartão 514
Pergunta
What is risk mitigation?
Resposta
Reducing likelihood, impact, or both through controls or process changes.
Cartão 515
Pergunta
Why monitor a vendor after onboarding?
Resposta
Security posture, ownership, services, incidents, and dependencies can change.
Cartão 516
Pergunta
What does a physical penetration test assess?
Resposta
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Cartão 517
Pergunta
Why use access badges at a facility?
Resposta
To associate entry attempts with authorized identities and enforce access rules.
Cartão 518
Pergunta
How does permission restriction protect data?
Resposta
Only authorized identities receive the actions and scope their roles require.
Cartão 519
Pergunta
What is the usual objective of ransomware extortion?
Resposta
Force payment by denying access, threatening disclosure, or both.
Cartão 520
Pergunta
What does impossible travel indicate?
Resposta
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Cartão 521
Pergunta
What is configuration enforcement?
Resposta
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Cartão 522
Pergunta
What does a web vulnerability scanner inspect?
Resposta
Running web behavior for issues such as unsafe input handling and insecure configuration.
Cartão 523
Pergunta
How does cost affect an architecture choice?
Resposta
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Cartão 524
Pergunta
What does EAP provide with 802.1X?
Resposta
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Cartão 525
Pergunta
What should operational-security training help users protect?
Resposta
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Cartão 526
Pergunta
What does a time-of-day access rule do?
Resposta
Allows or denies a requested action according to an approved schedule.
Cartão 527
Pergunta
What should cloud infrastructure hardening establish?
Resposta
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Cartão 528
Pergunta
What should an asset owner ensure during offboarding?
Resposta
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Cartão 529
Pergunta
Why encrypt backups?
Resposta
Backup media and transfers can expose the same sensitive data as production systems.
Cartão 530
Pergunta
What is steganography?
Resposta
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Cartão 531
Pergunta
Which human vector uses a fabricated authority role to justify a sensitive request?
Resposta
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Cartão 532
Pergunta
Why does risk transfer not remove accountability?
Resposta
The organization can retain legal, reputational, operational, and oversight consequences.
Cartão 533
Pergunta
Why validate a change after deployment?
Resposta
To confirm the intended result occurred without introducing unacceptable side effects.
Cartão 534
Pergunta
What makes end-of-life hardware a security vulnerability?
Resposta
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Cartão 535
Pergunta
What does an audit add to remediation validation?
Resposta
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Cartão 536
Pergunta
Why can SPF pass while a message still impersonates a brand?
Resposta
SPF checks the envelope domain, which may differ from the visible From domain.
Cartão 537
Pergunta
What role can a government entity have in security governance?
Resposta
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Cartão 538
Pergunta
How do data inventory and retention support privacy governance?
Resposta
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Cartão 539
Pergunta
What can concurrent sessions from distant regions indicate?
Resposta
A stolen account or shared credential, subject to VPN and proxy context.
Cartão 540
Pergunta
What does supply-chain analysis examine?
Resposta
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Cartão 541
Pergunta
What is the purpose of facility lighting as a control?
Resposta
Deter covert activity and improve observation of people and areas.
Cartão 542
Pergunta
What architecture quality keeps a service usable during component failure?
Resposta
Availability.
Cartão 543
Pergunta
When is fail-open behavior preferable to fail-closed behavior?
Resposta
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Cartão 544
Pergunta
Which control function does a login-failure alert provide?
Resposta
Detection; it reveals suspicious authentication activity.
Cartão 545
Pergunta
What does a biometric MFA implementation verify?
Resposta
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Cartão 546
Pergunta
How can automation enforce a security baseline?
Resposta
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Cartão 547
Pergunta
How do wireless cryptographic protocols protect network traffic?
Resposta
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Cartão 548
Pergunta
Why segment sensitive data stores?
Resposta
It limits reachable paths and separates them from lower-trust workloads.
Cartão 549
Pergunta
What must remain secret in an asymmetric key pair?
Resposta
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Cartão 550
Pergunta
How can a supplier become a supply-chain attack vector?
Resposta
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Cartão 551
Pergunta
What is e-discovery?
Resposta
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Cartão 552
Pergunta
What characterizes a neutral risk appetite?
Resposta
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Cartão 553
Pergunta
What is passive reconnaissance?
Resposta
Gathering information without directly interacting with the target's systems.
Cartão 554
Pergunta
What does a philosophical motive mean for a threat actor?
Resposta
The actor acts to advance a belief or moral position rather than primarily for money.
Cartão 555
Pergunta
What does unexpected resource consumption indicate?
Resposta
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Cartão 556
Pergunta
What does a host-based intrusion prevention system do?
Resposta
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Cartão 557
Pergunta
How does agent-based monitoring differ from agentless monitoring?
Resposta
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Cartão 558
Pergunta
What can network logs contribute to an investigation?
Resposta
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Cartão 559
Pergunta
What is the purpose of a backup restore test?
Resposta
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Cartão 560
Pergunta
Why can obsolete hardware become a security risk?
Resposta
It may lack supported firmware, modern protections, or replacement parts.
Cartão 561
Pergunta
What does rescanning confirm after remediation?
Resposta
Whether the scanner can still detect the original finding on the affected asset.
Cartão 562
Pergunta
What should a secure transport method provide?
Resposta
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Cartão 563
Pergunta
How can law affect security governance?
Resposta
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Cartão 564
Pergunta
What does resilience mean for a security architecture?
Resposta
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Cartão 565
Pergunta
Why minimize an infrastructure's attack surface?
Resposta
Fewer exposed services and paths leave fewer opportunities for exploitation.
Cartão 566
Pergunta
What does executing a security-awareness program require?
Resposta
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Cartão 567
Pergunta
What does an infrared security sensor detect?
Resposta
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Cartão 568
Pergunta
What is a knowledge factor?
Resposta
Something the claimant knows, such as a password.
Cartão 569
Pergunta
Why review allow-list and deny-list impact before a change?
Resposta
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Cartão 570
Pergunta
What does partition-level encryption protect?
Resposta
One selected disk partition, leaving other partitions outside that encryption boundary.
Cartão 571
Pergunta
How can instant messaging deliver a security attack?
Resposta
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Cartão 572
Pergunta
What can repeated blocked-content events indicate?
Resposta
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Cartão 573
Pergunta
What should a server-hardening baseline reduce?
Resposta
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Cartão 574
Pergunta
When is physical media destruction appropriate?
Resposta
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Cartão 575
Pergunta
What is mean time to repair?
Resposta
The average time required to restore a failed component or service.
Cartão 576
Pergunta
Why disclose conflicts of interest during vendor selection?
Resposta
A personal or financial relationship can bias evaluation away from the organization's requirements.
Cartão 577
Pergunta
What is a fine for noncompliance?
Resposta
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Cartão 578
Pergunta
What does a public data classification authorize?
Resposta
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Cartão 579
Pergunta
What security benefit comes from standard infrastructure configurations?
Resposta
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Cartão 580
Pergunta
How does horizontal scaling increase capacity?
Resposta
It adds more service instances and distributes work among them.
Cartão 581
Pergunta
Why can added connectivity weaken segmentation?
Resposta
Each allowed path can become a route for lateral movement or data escape.
Cartão 582
Pergunta
What coding practice is central to preventing SQL injection?
Resposta
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Cartão 583
Pergunta
When is a compensating control appropriate for a vulnerability?
Resposta
When timely removal or patching is infeasible and another control can reduce the risk.
Cartão 584
Pergunta
How does agent-based web filtering enforce policy?
Resposta
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Cartão 585
Pergunta
How can regulation differ from an internal policy?
Resposta
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Cartão 586
Pergunta
What is a storage snapshot?
Resposta
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Cartão 587
Pergunta
What does password age measure?
Resposta
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Cartão 588
Pergunta
What does an ethical motive mean in vulnerability research?
Resposta
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Cartão 589
Pergunta
What can missing security logs indicate?
Resposta
Logging failure, tampering, retention misconfiguration, or an inactive source.
Cartão 590
Pergunta
Why disable unused ports and protocols?
Resposta
They expose unnecessary communication paths and code that attackers can reach.
Cartão 591
Pergunta
What does antivirus contribute to monitoring?
Resposta
It scans files, memory, or behavior and reports suspected malicious code.
Cartão 592
Pergunta
What is a honeypot?
Resposta
A decoy system or service designed to attract and observe malicious activity.
Cartão 593
Pergunta
What does file-level encryption protect?
Resposta
Selected files independently of whether the rest of the disk or volume is encrypted.
Cartão 594
Pergunta
How can SMS deliver a security attack?
Resposta
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Cartão 595
Pergunta
What happens during incident analysis?
Resposta
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Cartão 596
Pergunta
What is mean time between failures?
Resposta
The average operating time between repairable failures.
Cartão 597
Pergunta
What is active reconnaissance?
Resposta
Probing or interacting with target systems to discover services and behavior.
Cartão 598
Pergunta
What constraint should guide ICS or SCADA hardening?
Resposta
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Cartão 599
Pergunta
Which control function does restoring a clean system image provide?
Resposta
Correction; it returns the system to a known-good state.
Cartão 600
Pergunta
What does responsiveness mean in an architecture decision?
Resposta
How quickly the system and its operators can adapt to demand, failure, or attack.
Cartão 601
Pergunta
How does out-of-band access strengthen remote administration?
Resposta
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Cartão 602
Pergunta
What makes user behavior unexpected?
Resposta
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Cartão 603
Pergunta
What is a work order?
Resposta
A document authorizing a defined unit of work under an existing agreement.
Cartão 604
Pergunta
What can out-of-cycle logging indicate?
Resposta
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Cartão 605
Pergunta
Why update a standard operating procedure after a change?
Resposta
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Cartão 606
Pergunta
What coding practice limits cross-site scripting?
Resposta
Context-appropriate output encoding, supported by safe templating and input handling.
Cartão 607
Pergunta
What does a restricted data classification indicate?
Resposta
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Cartão 608
Pergunta
How does a bug bounty support responsible disclosure?
Resposta
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Cartão 609
Pergunta
What does web-filter content categorization provide?
Resposta
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Cartão 610
Pergunta
How do hard and soft authentication tokens differ?
Resposta
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Cartão 611
Pergunta
How can industry requirements affect security governance?
Resposta
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Cartão 612
Pergunta
How can noncompliance cause loss of a license?
Resposta
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Cartão 613
Pergunta
What does volume-level encryption protect?
Resposta
All data within a selected logical storage volume.
Cartão 614
Pergunta
How can impersonation exploit familiarity?
Resposta
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Cartão 615
Pergunta
How does RTO guide recovery design?
Resposta
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Cartão 616
Pergunta
What is a honeynet?
Resposta
A network of decoy systems used to study or divert attackers.
Cartão 617
Pergunta
What does backup replication provide?
Resposta
Additional synchronized or copied recovery data in another system or location.
Cartão 618
Pergunta
What lets automation scale securely?
Resposta
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Cartão 619
Pergunta
Why monitor a hardened computing resource continuously?
Resposta
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Cartão 620
Pergunta
Why keep a certificate of destruction?
Resposta
It documents that a disposal provider handled specified media under the agreed process.
Cartão 621
Pergunta
Why consider patch availability before selecting a platform?
Resposta
Unsupported or difficult-to-update components accumulate known exposure.
Cartão 622
Pergunta
Why should remote administration use an encrypted, authenticated protocol?
Resposta
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Cartão 623
Pergunta
How can revenge motivate an insider incident?
Resposta
A disgruntled person may damage systems or disclose data to punish the organization.
Cartão 624
Pergunta
What is a published or documented indicator of malicious activity?
Resposta
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Cartão 625
Pergunta
Why monitor a system more closely when a mitigation exception is accepted?
Resposta
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Cartão 626
Pergunta
What is an SNMP trap?
Resposta
An unsolicited device notification sent to a management system when a configured event occurs.
Cartão 627
Pergunta
How can an automated report support an investigation?
Resposta
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Cartão 628
Pergunta
What is a security key?
Resposta
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Cartão 629
Pergunta
What does database-level encryption protect?
Resposta
A database or selected database structures through controls managed at the database layer.
Cartão 630
Pergunta
How does brand impersonation exploit trust?
Resposta
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Cartão 631
Pergunta
What browser-side impact can a cross-site scripting vulnerability create?
Resposta
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Cartão 632
Pergunta
How can a system or process audit identify vulnerabilities?
Resposta
It compares evidence with required configuration and procedure to reveal control gaps.
Cartão 633
Pergunta
What security role can Group Policy provide?
Resposta
Centralized Windows configuration of account, application, audit, and system security settings.
Cartão 634
Pergunta
What should incident-response training prepare people to do?
Resposta
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Cartão 635
Pergunta
Why must governance track local or regional requirements?
Resposta
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Cartão 636
Pergunta
How can a dependency become a useful key risk indicator?
Resposta
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Cartão 637
Pergunta
What is a business partners agreement?
Resposta
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Cartão 638
Pergunta
What makes an audit regulatory?
Resposta
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Cartão 639
Pergunta
What is a honeyfile?
Resposta
A decoy file whose access can reveal unauthorized activity.
Cartão 640
Pergunta
Why does legal information require explicit protection?
Resposta
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Cartão 641
Pergunta
Which indicator can mass file renaming and encryption produce?
Resposta
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Cartão 642
Pergunta
What remains with an organization after transferring architecture risk?
Resposta
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Cartão 643
Pergunta
When does local console placement provide useful administrative access?
Resposta
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Cartão 644
Pergunta
What makes a harmful user action unintentional?
Resposta
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Cartão 645
Pergunta
How should an organization harden workstations?
Resposta
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Cartão 646
Pergunta
What is journaling in recovery?
Resposta
Recording ordered changes so data can be replayed or restored to a consistent point.
Cartão 647
Pergunta
What downtime must a change plan account for?
Resposta
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Cartão 648
Pergunta
Why must a privacy program map local or regional law to data flows?
Resposta
The applicable duties can change with the location of the person, organization, processing, or stored data.
Cartão 649
Pergunta
Why combine independent preventive controls at different layers?
Resposta
A failure at one layer does not automatically let the same attack succeed at the next layer.
Cartão 650
Pergunta
What is passwordless authentication?
Resposta
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Cartão 651
Pergunta
How can automation improve security reaction time?
Resposta
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Cartão 652
Pergunta
What does record-level encryption protect?
Resposta
Individual records or fields, allowing finer protection than encrypting the entire database.
Cartão 653
Pergunta
How can business email compromise misuse urgency?
Resposta
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Cartão 654
Pergunta
What does impact measure in risk analysis?
Resposta
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Cartão 655
Pergunta
What makes cyber activity part of warfare?
Resposta
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Cartão 656
Pergunta
Which indicator can a newly created privileged account produce outside the normal change window?
Resposta
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Cartão 657
Pergunta
How can configuration enforcement validate a deployed mitigation?
Resposta
It compares the realized settings with the approved state and corrects or reports drift.
Cartão 658
Pergunta
How does validating an alert improve alert tuning?
Resposta
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Cartão 659
Pergunta
What data-layer impact can a SQL injection vulnerability create?
Resposta
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Cartão 660
Pergunta
What environmental variables can change vulnerability priority?
Resposta
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Cartão 661
Pergunta
What security role does SELinux provide?
Resposta
Mandatory access controls that confine processes according to centrally defined policy.
Cartão 662
Pergunta
Why review governance documents periodically?
Resposta
Business, technology, threats, and external obligations change.
Cartão 663
Pergunta
Why evaluate power requirements for a system design?
Resposta
Power capacity and redundancy constrain availability and recovery.
Cartão 664
Pergunta
When is IPsec a better tunnel choice than TLS?
Resposta
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Cartão 665
Pergunta
What is a honeytoken?
Resposta
A fake credential or data element that generates a high-confidence alert when used.
Cartão 666
Pergunta
What should embedded-system hardening prioritize?
Resposta
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Cartão 667
Pergunta
Why must sanitization address data remanence?
Resposta
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Cartão 668
Pergunta
Why require rules of engagement for vendor testing?
Resposta
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Cartão 669
Pergunta
What does a private data classification indicate?
Resposta
The information concerns an individual or limited internal audience and should not be exposed publicly.
Cartão 670
Pergunta
What does a tabletop recovery exercise test?
Resposta
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Cartão 671
Pergunta
Why prevent password reuse?
Resposta
One compromised password should not unlock other accounts or services.
Cartão 672
Pergunta
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Resposta
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Cartão 673
Pergunta
What does transport encryption protect?
Resposta
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Cartão 674
Pergunta
How can a voice call become an attack vector?
Resposta
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Cartão 675
Pergunta
What should a digital-forensics report document?
Resposta
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Cartão 676
Pergunta
What tradeoff comes with an expansionary risk appetite?
Resposta
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Cartão 677
Pergunta
What does a known penetration-test environment provide?
Resposta
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Cartão 678
Pergunta
Why evaluate compute requirements before deployment?
Resposta
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Cartão 679
Pergunta
Why place sensors at network choke points?
Resposta
They can observe traffic crossing important trust boundaries.
Cartão 680
Pergunta
What should hybrid or remote-work security training emphasize?
Resposta
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Cartão 681
Pergunta
Why plan an application restart separately from a service restart?
Resposta
The application may need its own state handling, user coordination, health checks, and rollback point.
Cartão 682
Pergunta
What is a cryptographic vulnerability?
Resposta
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Cartão 683
Pergunta
Why report findings by asset owner?
Resposta
Owners need clear accountability and a prioritized remediation queue.
Cartão 684
Pergunta
What should guide selection of a secure protocol?
Resposta
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Cartão 685
Pergunta
How do centralized and decentralized governance structures differ?
Resposta
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Cartão 686
Pergunta
How does privacy-aware design limit data retention?
Resposta
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Cartão 687
Pergunta
What does a pressure security sensor detect?
Resposta
Force or weight applied to a protected surface, such as a floor mat or fence line.
Cartão 688
Pergunta
What automation costs should a security team plan for?
Resposta
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Cartão 689
Pergunta
What should RTOS hardening preserve while reducing attack surface?
Resposta
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Cartão 690
Pergunta
What is the goal of disruption-for-chaos activity?
Resposta
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Cartão 691
Pergunta
Which indicator can repeated password guessing produce?
Resposta
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Cartão 692
Pergunta
How does removing unnecessary software harden a system?
Resposta
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Cartão 693
Pergunta
What does NetFlow provide?
Resposta
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Cartão 694
Pergunta
How can a dashboard support an investigation?
Resposta
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Cartão 695
Pergunta
When should a password be expired?
Resposta
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Cartão 696
Pergunta
Why does cryptographic key length matter?
Resposta
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Cartão 697
Pergunta
How can an unsecure Bluetooth connection become an attack vector?
Resposta
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Cartão 698
Pergunta
What is a key risk indicator?
Resposta
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Cartão 699
Pergunta
What should vendor monitoring verify when a contract ends?
Resposta
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Cartão 700
Pergunta
What does a sensitive data classification indicate?
Resposta
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Cartão 701
Pergunta
What does software-defined networking separate?
Resposta
The control plane that decides traffic behavior from the data plane that forwards traffic.
Cartão 702
Pergunta
Where should a web application firewall be placed?
Resposta
In the path of web requests before they reach the protected application.
Cartão 703
Pergunta
What does a simulated recovery exercise test?
Resposta
Participants perform realistic response actions in a controlled environment without disrupting production.
Cartão 704
Pergunta
How can a team verify that a detective control is effective?
Resposta
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Cartão 705
Pergunta
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Resposta
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Cartão 706
Pergunta
What makes a vulnerability cloud-specific?
Resposta
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Cartão 707
Pergunta
How can insurance respond to vulnerability risk?
Resposta
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Cartão 708
Pergunta
How does reputation improve web filtering?
Resposta
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Cartão 709
Pergunta
What does an encryption policy establish?
Resposta
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Cartão 710
Pergunta
How does a microwave security sensor detect movement?
Resposta
It emits microwave energy and detects changes in the reflected signal caused by motion.
Cartão 711
Pergunta
What should IoT-device hardening change before deployment?
Resposta
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Cartão 712
Pergunta
Why track software licenses as assets?
Resposta
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Cartão 713
Pergunta
What does a password manager improve?
Resposta
It can generate and store unique long passwords so users do not memorize or reuse them.
Cartão 714
Pergunta
What makes a ledger open and public?
Resposta
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Cartão 715
Pergunta
What should a payment-change request trigger?
Resposta
Independent verification through a known channel before any account or payment detail is changed.
Cartão 716
Pergunta
What does preserving digital evidence require?
Resposta
Protecting its integrity, context, access history, and availability from collection through final disposition.
Cartão 717
Pergunta
What should a risk report tell decision-makers?
Resposta
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Cartão 718
Pergunta
What should an external assessment report provide?
Resposta
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Cartão 719
Pergunta
What is a centralized design's main resilience risk?
Resposta
A central dependency can become a bottleneck or single point of failure.
Cartão 720
Pergunta
What does mutual TLS add to a TLS-protected service connection?
Resposta
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Cartão 721
Pergunta
What should recurring security-awareness reporting show?
Resposta
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Cartão 722
Pergunta
Why do legacy applications require extra change planning?
Resposta
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Cartão 723
Pergunta
How do a data controller and a data processor differ?
Resposta
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Cartão 724
Pergunta
How can orchestration become a single point of failure?
Resposta
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Cartão 725
Pergunta
Why should defenses account for a threat actor's sophistication and capability?
Resposta
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Cartão 726
Pergunta
How does an injection attack make an application execute unintended instructions?
Resposta
It sends crafted input that an interpreter treats as code or commands instead of data.
Cartão 727
Pergunta
What does a host-based firewall control?
Resposta
Inbound and outbound network traffic for one endpoint according to local rules.
Cartão 728
Pergunta
Why revise alerting after an incident?
Resposta
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Cartão 729
Pergunta
Why include security duties in procurement criteria?
Resposta
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Cartão 730
Pergunta
What does a critical data classification indicate?
Resposta
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Cartão 731
Pergunta
What infrastructure capacity must support failover?
Resposta
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Cartão 732
Pergunta
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Resposta
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Cartão 733
Pergunta
How does a remediation exemption differ from an exception?
Resposta
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Cartão 734
Pergunta
Why should automated EDR or XDR blocking have an exception and rollback path?
Resposta
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Cartão 735
Pergunta
What does a security playbook provide?
Resposta
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Cartão 736
Pergunta
How does an ultrasonic security sensor detect movement?
Resposta
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Cartão 737
Pergunta
What should a managed mobile device require for Bluetooth connections?
Resposta
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Cartão 738
Pergunta
How do password complexity rules differ from password length?
Resposta
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Cartão 739
Pergunta
What makes a certificate third-party trusted?
Resposta
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Cartão 740
Pergunta
Why is an out-of-band check effective against impersonation?
Resposta
It verifies the request through a separate, previously trusted communication path.
Cartão 741
Pergunta
What does a risk exception authorize?
Resposta
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Cartão 742
Pergunta
What security challenge grows in a decentralized design?
Resposta
Consistent policy, inventory, monitoring, and patching become harder.
Cartão 743
Pergunta
How should controls be selected for an unused network path?
Resposta
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Cartão 744
Pergunta
How can a buffer-overflow attack affect an application?
Resposta
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.

Abstract network paths and learning nodes converging on a calm central gateway.

744 cartões