CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.
Kuhusu fungu hili
Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.
What this deck covers
- General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
- Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
- Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
- Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
- Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.
Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.
The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.
Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.
This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.
Kadi za fungu hili
Kadi namba 1
Swali
What does an information security policy establish?
Jibu
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Kadi namba 2
Swali
What is phishing?
Jibu
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Kadi namba 3
Swali
What does a public-key certificate bind to an identity?
Jibu
A public key, together with identifying information and the issuer's signature.
Kadi namba 4
Swali
What is data at rest?
Jibu
Data stored on media such as disks, databases, backups, or mobile devices.
Kadi namba 5
Swali
How does policy-driven access control decide a zero-trust access request?
Jibu
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Kadi namba 6
Swali
What does establishing a secure baseline produce?
Jibu
An approved, documented configuration that defines the required secure state for a class of computing resource.
Kadi namba 7
Swali
What is hashing used to verify?
Jibu
Whether data has changed by comparing fixed-length digest values.
Kadi namba 8
Swali
What is impersonation in social engineering?
Jibu
Pretending to be a trusted person or organization to obtain access, data, or action.
Kadi namba 9
Swali
What is virtualization?
Jibu
Abstracting physical compute so multiple isolated guest systems can share a host.
Kadi namba 10
Swali
What is chain of custody?
Jibu
A documented history of who collected, handled, transferred, stored, and examined evidence.
Kadi namba 11
Swali
What is quantitative risk analysis?
Jibu
Estimating risk with numerical values such as money, frequency, or probability.
Kadi namba 12
Swali
What is a phishing awareness campaign?
Jibu
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Kadi namba 13
Swali
What is high availability?
Jibu
Designing a service to remain accessible despite expected component failures.
Kadi namba 14
Swali
What is a network security zone?
Jibu
A group of systems with similar trust, function, or control requirements.
Kadi namba 15
Swali
What is risk transfer?
Jibu
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Kadi namba 16
Swali
What is media sanitization?
Jibu
Making stored data infeasible to recover for the intended level of protection.
Kadi namba 17
Swali
What does CVSS provide?
Jibu
A standardized way to describe a vulnerability's technical severity characteristics.
Kadi namba 18
Swali
What does security alerting do?
Jibu
It turns matched events or behavior into a notification that the right responder can review.
Kadi namba 19
Swali
What does a firewall rule enforce?
Jibu
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Kadi namba 20
Swali
What is deprovisioning?
Jibu
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Kadi namba 21
Swali
How does inline placement differ from a tap or monitor port?
Jibu
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Kadi namba 22
Swali
What is asymmetric encryption?
Jibu
Encryption that uses a mathematically related public and private key pair.
Kadi namba 23
Swali
What does SPF authorize?
Jibu
Which mail servers may send mail for a domain in the SMTP envelope.
Kadi namba 24
Swali
What is a possession factor?
Jibu
Something the claimant has, such as a cryptographic authenticator.
Kadi namba 25
Swali
What does ordinary TLS usually protect and authenticate?
Jibu
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Kadi namba 26
Swali
What is single loss expectancy?
Jibu
The estimated loss from one occurrence of a risk event.
Kadi namba 27
Swali
What does a certificate authority do?
Jibu
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Kadi namba 28
Swali
What is a detective control meant to do?
Jibu
Identify that an unwanted event has happened or is happening.
Kadi namba 29
Swali
What is the security purpose of change-control approval?
Jibu
Ensure authorized reviewers assess risk before the production change occurs.
Kadi namba 30
Swali
What is shadow IT?
Jibu
Technology used for organizational work without required approval or oversight.
Kadi namba 31
Swali
What is a buffer overflow vulnerability?
Jibu
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Kadi namba 32
Swali
What is ransomware?
Jibu
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Kadi namba 33
Swali
How does network segmentation limit an incident?
Jibu
It restricts communication paths and reduces lateral movement between zones.
Kadi namba 34
Swali
How do load balancing and clustering support availability differently?
Jibu
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Kadi namba 35
Swali
What is vendor due diligence?
Jibu
Evaluating a provider's security, capability, stability, and fit before commitment.
Kadi namba 36
Swali
Who is a data subject?
Jibu
The person whose personal data is collected or processed.
Kadi namba 37
Swali
What is attestation?
Jibu
A formal assertion or report about a subject matter, often supported by an independent examination.
Kadi namba 38
Swali
What is a replay attack?
Jibu
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Kadi namba 39
Swali
What does a wireless site survey establish?
Jibu
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Kadi namba 40
Swali
What is the time-of-check stage of a race-condition vulnerability?
Jibu
The application verifies a condition or resource state before acting on it.
Kadi namba 41
Swali
What is a penetration test?
Jibu
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Kadi namba 42
Swali
What is a cold recovery site?
Jibu
A facility with basic space and utilities but little preinstalled technology or current data.
Kadi namba 43
Swali
What is data in transit?
Jibu
Data moving between systems or across a network.
Kadi namba 44
Swali
What is a vendor security questionnaire?
Jibu
A structured request for information about a provider's controls and practices.
Kadi namba 45
Swali
How does an internal actor's starting position differ from an external actor's?
Jibu
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Kadi namba 46
Swali
What can unexpected account lockouts indicate?
Jibu
Password guessing, credential stuffing, user error, or a broken client.
Kadi namba 47
Swali
How do permissions enforce access control?
Jibu
They specify which actions a subject may perform on a particular resource.
Kadi namba 48
Swali
What is log aggregation?
Jibu
Central collection of logs from multiple sources for search, correlation, and retention.
Kadi namba 49
Swali
Why plan a service restart as part of a change?
Jibu
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Kadi namba 50
Swali
What is infrastructure as code?
Jibu
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Kadi namba 51
Swali
What should security-awareness program development start with?
Jibu
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Kadi namba 52
Swali
What is a voice-based social-engineering attack called?
Jibu
Vishing.
Kadi namba 53
Swali
What happens during incident-response preparation?
Jibu
Teams establish people, tools, access, communications, training, and procedures before an incident.
Kadi namba 54
Swali
What does an offensive penetration-testing team do?
Jibu
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Kadi namba 55
Swali
What is federation?
Jibu
One security domain relies on identity assertions from another trusted domain.
Kadi namba 56
Swali
What is asset classification?
Jibu
Grouping an asset by sensitivity, criticality, or required handling.
Kadi namba 57
Swali
What is cross-site scripting?
Jibu
Injection of script-capable content that a browser executes in another site's security context.
Kadi namba 58
Swali
What can IDS or IPS trends reveal?
Jibu
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Kadi namba 59
Swali
What can unexpected resource inaccessibility indicate?
Jibu
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Kadi namba 60
Swali
What is a corrective control meant to do?
Jibu
Limit damage and restore a secure state after an event.
Kadi namba 61
Swali
How do containers differ from virtual machines?
Jibu
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Kadi namba 62
Swali
How does an active security device differ from a passive one?
Jibu
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Kadi namba 63
Swali
Why is unsupported software a persistent attack surface?
Jibu
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Kadi namba 64
Swali
What is annualized rate of occurrence?
Jibu
The estimated number of times a risk event occurs per year.
Kadi namba 65
Swali
What is an inherence factor?
Jibu
A biometric characteristic of the claimant.
Kadi namba 66
Swali
What do a threat actor's sophistication and capability describe?
Jibu
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Kadi namba 67
Swali
What is a SIEM?
Jibu
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Kadi namba 68
Swali
What is sideloading?
Jibu
Installing software from outside the platform's approved distribution path.
Kadi namba 69
Swali
What does an IDS or IPS signature match?
Jibu
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Kadi namba 70
Swali
Why are embedded systems often difficult to patch?
Jibu
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Kadi namba 71
Swali
What is a virtual private network?
Jibu
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Kadi namba 72
Swali
What should an initial security-awareness report establish?
Jibu
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Kadi namba 73
Swali
What is symmetric encryption?
Jibu
Encryption that uses the same secret key to encrypt and decrypt data.
Kadi namba 74
Swali
What happens during incident detection?
Jibu
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Kadi namba 75
Swali
What is recovery time objective?
Jibu
The target maximum time to restore a function after disruption.
Kadi namba 76
Swali
Why prioritize password length?
Jibu
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Kadi namba 77
Swali
What must sanitization accomplish before an asset leaves organizational control?
Jibu
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Kadi namba 78
Swali
What is a real-time operating system designed to provide?
Jibu
Predictable response timing for tasks with strict deadlines.
Kadi namba 79
Swali
What does fail-open behavior do when a control fails?
Jibu
It permits traffic or access to preserve availability.
Kadi namba 80
Swali
What is jailbreaking or rooting a mobile device?
Jibu
Removing platform restrictions to gain privileged control over the operating system.
Kadi namba 81
Swali
What does network access control enforce?
Jibu
Identity, device posture, and access policy at network connection time and during a session.
Kadi namba 82
Swali
What does data loss prevention do?
Jibu
Detects and may block sensitive data use or transfer that violates policy.
Kadi namba 83
Swali
What security property does a blockchain provide?
Jibu
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Kadi namba 84
Swali
What is recovery point objective?
Jibu
The target maximum acceptable data loss measured backward in time.
Kadi namba 85
Swali
How do ICS and SCADA relate?
Jibu
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Kadi namba 86
Swali
What does fail-closed behavior do when a control fails?
Jibu
It denies traffic or access to preserve security.
Kadi namba 87
Swali
Which keys create and verify a typical digital signature?
Jibu
The signer creates it with a private key, and others verify it with the corresponding public key.
Kadi namba 88
Swali
What is SQL injection?
Jibu
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Kadi namba 89
Swali
What does DKIM verify?
Jibu
That selected message content was signed by a domain and was not altered after signing.
Kadi namba 90
Swali
What is post-incident activity?
Jibu
Learning from the event and improving controls, plans, and recovery based on evidence.
Kadi namba 91
Swali
What characterizes an expansionary risk appetite?
Jibu
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Kadi namba 92
Swali
How do centralized and decentralized architectures differ?
Jibu
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Kadi namba 93
Swali
What does a certificate revocation list publish?
Jibu
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Kadi namba 94
Swali
What is a legal hold?
Jibu
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Kadi namba 95
Swali
What is exposure factor in quantitative risk analysis?
Jibu
The estimated percentage of an asset's value lost in one event.
Kadi namba 96
Swali
What is decentralized architecture?
Jibu
Control or service responsibility is distributed across multiple independent components or locations.
Kadi namba 97
Swali
What is tokenization?
Jibu
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Kadi namba 98
Swali
How can automation act as a workforce multiplier?
Jibu
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Kadi namba 99
Swali
What can endpoint process logs reveal?
Jibu
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Kadi namba 100
Swali
What does the CIA triad protect?
Jibu
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Kadi namba 101
Swali
How does data masking protect information?
Jibu
It hides selected values or characters while preserving a usable representation.
Kadi namba 102
Swali
How can a national requirement affect security governance?
Jibu
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Kadi namba 103
Swali
What do integrations and APIs provide to security orchestration?
Jibu
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Kadi namba 104
Swali
What makes a compliance report external?
Jibu
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Kadi namba 105
Swali
What does a cryptographic algorithm define?
Jibu
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Kadi namba 106
Swali
Why compare systems with a secure baseline regularly?
Jibu
To detect drift, unauthorized changes, and missing hardening.
Kadi namba 107
Swali
What does integrity protect?
Jibu
The accuracy and completeness of data and systems against unauthorized change.
Kadi namba 108
Swali
What does vulnerability classification organize?
Jibu
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Kadi namba 109
Swali
What does a password standard define?
Jibu
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Kadi namba 110
Swali
What technology capacity must a recovery design plan for?
Jibu
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Kadi namba 111
Swali
What does a confidential data classification indicate?
Jibu
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Kadi namba 112
Swali
What makes a vendor assessment independent?
Jibu
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Kadi namba 113
Swali
What lets a worm spread without attaching itself to another file?
Jibu
It is a standalone program that replicates across reachable systems or services.
Kadi namba 114
Swali
What is microsegmentation?
Jibu
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Kadi namba 115
Swali
What can application logs reveal?
Jibu
Transactions, errors, user actions, and application-specific security events.
Kadi namba 116
Swali
What does deploying a secure baseline require?
Jibu
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Kadi namba 117
Swali
How can resource-provisioning automation improve security?
Jibu
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Kadi namba 118
Swali
What does availability protect?
Jibu
Reliable, timely access to systems and data when authorized users need them.
Kadi namba 119
Swali
Why must a change request describe business impact?
Jibu
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Kadi namba 120
Swali
What does an authenticated vulnerability scan add?
Jibu
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Kadi namba 121
Swali
What does a change-management procedure specify?
Jibu
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Kadi namba 122
Swali
What is a sanction for noncompliance?
Jibu
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Kadi namba 123
Swali
How can email deliver a security attack?
Jibu
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Kadi namba 124
Swali
What is an internal compliance audit?
Jibu
An organization-led examination of whether selected operations and controls meet defined requirements.
Kadi namba 125
Swali
What is a Trojan?
Jibu
Malware disguised as legitimate or desirable software.
Kadi namba 126
Swali
What is clustering?
Jibu
Multiple systems work together to provide a service and tolerate member failure.
Kadi namba 127
Swali
What makes data regulated?
Jibu
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Kadi namba 128
Swali
What does a wireless heat map show?
Jibu
Measured or modeled signal strength and coverage across a physical area.
Kadi namba 129
Swali
How should vendor criticality affect due diligence?
Jibu
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Kadi namba 130
Swali
How can a digital signature support non-repudiation?
Jibu
It provides evidence that the holder of a private key signed specific data.
Kadi namba 131
Swali
What should vulnerability prioritization consider beyond severity?
Jibu
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Kadi namba 132
Swali
What is a security guideline?
Jibu
Recommended practice that allows judgment unless adopted as a requirement.
Kadi namba 133
Swali
What usually distinguishes a nation-state threat actor?
Jibu
Strategic objectives, substantial resources, patience, and advanced operational capability.
Kadi namba 134
Swali
What is spyware?
Jibu
Software that secretly collects information about a user or system.
Kadi namba 135
Swali
Why maintain an allow list for applications?
Jibu
Only explicitly approved software is permitted to execute.
Kadi namba 136
Swali
How can an image become an attack vector?
Jibu
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Kadi namba 137
Swali
What makes a security control technical?
Jibu
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Kadi namba 138
Swali
What is identity proofing?
Jibu
Establishing that a person is who they claim to be before issuing an account or credential.
Kadi namba 139
Swali
What is an automated security guardrail?
Jibu
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Kadi namba 140
Swali
Why assign an owner to a planned change?
Jibu
To make one party accountable for coordination, execution, and follow-through.
Kadi namba 141
Swali
How can national privacy law affect data handling?
Jibu
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Kadi namba 142
Swali
What is continuity of operations?
Jibu
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Kadi namba 143
Swali
What security tradeoff comes with BYOD?
Jibu
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Kadi namba 144
Swali
How should policies and handbooks support security training?
Jibu
They provide accessible, current rules and reporting steps that training can apply to real situations.
Kadi namba 145
Swali
What is a keylogger?
Jibu
A tool that records keystrokes to capture data such as credentials.
Kadi namba 146
Swali
What makes information a trade secret?
Jibu
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Kadi namba 147
Swali
What does authentication establish?
Jibu
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Kadi namba 148
Swali
What risk comes from an untrusted file attachment?
Jibu
Opening or parsing it can execute malicious code or expose data.
Kadi namba 149
Swali
How does risk tolerance affect vulnerability remediation?
Jibu
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Kadi namba 150
Swali
How can a global requirement affect security governance?
Jibu
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Kadi namba 151
Swali
Why should questionnaire answers be supported by evidence?
Jibu
Self-assertions alone may not prove that controls are designed or operating effectively.
Kadi namba 152
Swali
What is an independent third-party audit?
Jibu
An external party with suitable independence examines evidence against defined criteria.
Kadi namba 153
Swali
What do account provisioning and deprovisioning do?
Jibu
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Kadi namba 154
Swali
What is an unskilled attacker commonly called?
Jibu
A script kiddie: someone who relies on tools or instructions created by others.
Kadi namba 155
Swali
What is a rootkit?
Jibu
Software designed to maintain privileged, concealed access by altering or subverting the system.
Kadi namba 156
Swali
What does an access control list enforce?
Jibu
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Kadi namba 157
Swali
What should system security monitoring observe?
Jibu
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Kadi namba 158
Swali
What can operating-system security logs reveal?
Jibu
Authentication, privilege use, policy changes, services, and other host security events.
Kadi namba 159
Swali
Why isolate operational technology from general business networks?
Jibu
To limit attack paths into safety- and availability-critical processes.
Kadi namba 160
Swali
What is the COPE mobile deployment model?
Jibu
The organization owns the device but permits defined personal use while retaining management control.
Kadi namba 161
Swali
What security work belongs in asset acquisition and procurement?
Jibu
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Kadi namba 162
Swali
How can user-provisioning automation improve security?
Jibu
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Kadi namba 163
Swali
What people capacity must a continuity plan account for?
Jibu
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Kadi namba 164
Swali
What do authorization models define?
Jibu
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Kadi namba 165
Swali
Why are removable devices an attack vector?
Jibu
They can introduce malware or remove data while bypassing network controls.
Kadi namba 166
Swali
What should predeployment change-test results show?
Jibu
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Kadi namba 167
Swali
What is the time-of-use stage of a race-condition vulnerability?
Jibu
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Kadi namba 168
Swali
What is data in use?
Jibu
Data actively processed in memory or by an application.
Kadi namba 169
Swali
What does open-source vulnerability intelligence contribute?
Jibu
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Kadi namba 170
Swali
What can file-integrity monitoring detect?
Jibu
Unexpected changes to protected files, directories, or configuration.
Kadi namba 171
Swali
Why should deprovisioning be prompt?
Jibu
Former users or roles should not retain usable access.
Kadi namba 172
Swali
What is an acceptable use policy?
Jibu
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Kadi namba 173
Swali
What makes a compliance report internal?
Jibu
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Kadi namba 174
Swali
What is a logic bomb?
Jibu
Malicious code that activates when a specified condition or time is reached.
Kadi namba 175
Swali
What does a right-to-audit clause provide?
Jibu
Contractual authority to inspect or obtain evidence about agreed controls.
Kadi namba 176
Swali
Where should a forward proxy sit in an enterprise traffic path?
Jibu
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Kadi namba 177
Swali
Which cues should make a message look suspicious?
Jibu
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Kadi namba 178
Swali
What makes a security control managerial?
Jibu
It directs risk and governance through decisions such as policies, assessments, and oversight.
Kadi namba 179
Swali
What is the CYOD mobile deployment model?
Jibu
The user selects from organization-approved device options that remain subject to corporate security requirements.
Kadi namba 180
Swali
How does client-based vulnerable software differ from an agentless exposure?
Jibu
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Kadi namba 181
Swali
What makes a risk assessment recurring?
Jibu
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Kadi namba 182
Swali
What does a defensive penetration-testing team practice?
Jibu
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Kadi namba 183
Swali
In a zero-trust data plane, what can the subject or system represent?
Jibu
The user, device, workload, or service requesting access to a protected resource.
Kadi namba 184
Swali
What primarily motivates a hacktivist?
Jibu
A political, social, or ideological cause.
Kadi namba 185
Swali
What is bloatware?
Jibu
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Kadi namba 186
Swali
Why keep endpoint-protection signatures and engines current?
Jibu
They need current detection logic to recognize newly identified malware and exploit behavior.
Kadi namba 187
Swali
What should application security monitoring observe?
Jibu
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Kadi namba 188
Swali
What is role-based access control?
Jibu
Permissions are assigned to roles, and identities receive access through their roles.
Kadi namba 189
Swali
What is geographic dispersal?
Jibu
Placing redundant resources in separate locations so one regional event does not affect all copies.
Kadi namba 190
Swali
What is a malicious update?
Jibu
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Kadi namba 191
Swali
What does static application analysis inspect?
Jibu
Source code, bytecode, or compiled code without executing the application.
Kadi namba 192
Swali
What does a firewall access list define?
Jibu
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Kadi namba 193
Swali
What does a disaster recovery policy establish?
Jibu
Management expectations for restoring technology and data after a disruptive event.
Kadi namba 194
Swali
How does logical segmentation separate workloads that share physical infrastructure?
Jibu
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Kadi namba 195
Swali
How should IDS and IPS placement differ?
Jibu
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Kadi namba 196
Swali
What should automated ticket creation capture?
Jibu
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Kadi namba 197
Swali
What makes information intellectual property?
Jibu
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Kadi namba 198
Swali
What is a backout plan?
Jibu
Predefined steps for safely reversing a failed or harmful change.
Kadi namba 199
Swali
Why is an unsecure wireless network an attack vector?
Jibu
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Kadi namba 200
Swali
What is physical brute force?
Jibu
Using force to defeat a lock, barrier, enclosure, or other physical control.
Kadi namba 201
Swali
What is application sandboxing?
Jibu
Running code in a constrained environment with limited access to the host and data.
Kadi namba 202
Swali
Why assign an asset owner?
Jibu
One accountable party must decide its use, protection, and lifecycle.
Kadi namba 203
Swali
What happens during risk identification?
Jibu
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Kadi namba 204
Swali
What should an SLA state about breach notification?
Jibu
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Kadi namba 205
Swali
How do due diligence and due care differ in compliance?
Jibu
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Kadi namba 206
Swali
What is attribute-based access control?
Jibu
Policy evaluates attributes of the subject, resource, action, and environment.
Kadi namba 207
Swali
What does a zero-trust policy engine do?
Jibu
It evaluates policy and signals to decide whether access should be allowed.
Kadi namba 208
Swali
How does a cloud responsibility matrix allocate security duties?
Jibu
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Kadi namba 209
Swali
Where should a load balancer sit in a service path?
Jibu
In front of service instances so it can route requests to healthy backends.
Kadi namba 210
Swali
What should the security team do with a reported suspicious message?
Jibu
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Kadi namba 211
Swali
What makes an operating-system vulnerability high impact?
Jibu
It can affect every application and security control that relies on the compromised OS.
Kadi namba 212
Swali
What does dynamic application analysis inspect?
Jibu
The behavior and externally visible weaknesses of a running application.
Kadi namba 213
Swali
How can false-positive trends affect IDS or IPS tuning?
Jibu
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Kadi namba 214
Swali
What does a business continuity policy establish?
Jibu
Management expectations for sustaining and restoring critical business functions.
Kadi namba 215
Swali
What is a hot recovery site?
Jibu
A ready, synchronized environment intended to take over quickly.
Kadi namba 216
Swali
What makes an insider threat distinct?
Jibu
The actor has legitimate access or organizational knowledge that can be misused.
Kadi namba 217
Swali
What is RFID cloning?
Jibu
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Kadi namba 218
Swali
Why apply vendor security updates promptly?
Jibu
They remove known weaknesses before attackers can exploit the unpatched exposure.
Kadi namba 219
Swali
What should infrastructure security monitoring observe?
Jibu
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Kadi namba 220
Swali
What can firewall logs reveal?
Jibu
Allowed or denied network connections across controlled boundaries.
Kadi namba 221
Swali
Why minimize open service ports?
Jibu
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Kadi namba 222
Swali
What is threat hunting?
Jibu
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Kadi namba 223
Swali
What triggers an ad hoc risk assessment?
Jibu
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Kadi namba 224
Swali
What makes an assessment external?
Jibu
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Kadi namba 225
Swali
What is data sovereignty?
Jibu
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Kadi namba 226
Swali
What security boundary does a cellular connection create for a mobile device?
Jibu
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Kadi namba 227
Swali
What makes a security control operational?
Jibu
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Kadi namba 228
Swali
What is discretionary access control?
Jibu
A resource owner can decide who receives access, within system policy.
Kadi namba 229
Swali
How can careful automation support employee retention?
Jibu
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Kadi namba 230
Swali
Why does ease of deployment matter in an architecture decision?
Jibu
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Kadi namba 231
Swali
What tradeoff comes with placing an NGFW inline?
Jibu
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Kadi namba 232
Swali
What does a zero-trust policy administrator do?
Jibu
It carries out the policy engine's decision, such as creating or ending a session.
Kadi namba 233
Swali
What should a master service agreement define for data return and deletion?
Jibu
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Kadi namba 234
Swali
What is an environmental physical attack?
Jibu
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Kadi namba 235
Swali
When should a maintenance window be chosen?
Jibu
When disruption and rollback can be managed with the least business impact.
Kadi namba 236
Swali
What is memory injection?
Jibu
Placing malicious code or data into another process's memory so it executes in that process's context.
Kadi namba 237
Swali
What does software composition analysis find?
Jibu
Known risks and license information in third-party dependencies.
Kadi namba 238
Swali
What is DNS filtering?
Jibu
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Kadi namba 239
Swali
What should an incident response policy establish?
Jibu
Authority, scope, reporting duties, and organizational commitment for incident handling.
Kadi namba 240
Swali
How can noncompliance cause reputational damage?
Jibu
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Kadi namba 241
Swali
What does full-disk encryption protect?
Jibu
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Kadi namba 242
Swali
Why are default credentials dangerous?
Jibu
They are widely known or easily discovered and often remain unchanged.
Kadi namba 243
Swali
What makes a risk assessment one-time?
Jibu
It evaluates a defined decision or scope once without an established repeating cadence.
Kadi namba 244
Swali
What is a warm recovery site?
Jibu
A partially equipped environment that needs some data restoration or configuration before use.
Kadi namba 245
Swali
What does application input validation do?
Jibu
It checks that input matches the expected type, length, range, and format before use.
Kadi namba 246
Swali
What should an asset inventory record besides a device name?
Jibu
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Kadi namba 247
Swali
What is mandatory access control?
Jibu
A central authority enforces access through labels and rules that ordinary owners cannot override.
Kadi namba 248
Swali
What security benefit does infrastructure as code provide?
Jibu
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Kadi namba 249
Swali
When should a public service control fail closed?
Jibu
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Kadi namba 250
Swali
What should users do with a suspicious message?
Jibu
Report it through the approved channel without interacting with its links or attachments.
Kadi namba 251
Swali
What usually motivates organized cybercrime?
Jibu
Financial gain through scalable or repeatable criminal activity.
Kadi namba 252
Swali
How can malicious code support a network attack?
Jibu
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Kadi namba 253
Swali
When is virtual patching useful?
Jibu
When a network or application control can block exploit traffic before the underlying system can be patched.
Kadi namba 254
Swali
What does security-monitoring reporting provide?
Jibu
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Kadi namba 255
Swali
What does data geolocation identify?
Jibu
The physical or legal location where data is stored, processed, or transmitted.
Kadi namba 256
Swali
What does a zero-trust policy enforcement point do?
Jibu
It enables, monitors, and terminates the connection between a subject and a resource.
Kadi namba 257
Swali
What is cryptographic key exchange?
Jibu
A method for parties to establish shared key material over an untrusted channel.
Kadi namba 258
Swali
How can a vendor become a supply-chain attack vector?
Jibu
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Kadi namba 259
Swali
Why can legacy hardware remain vulnerable?
Jibu
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Kadi namba 260
Swali
What can proprietary vulnerability intelligence add beyond open sources?
Jibu
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Kadi namba 261
Swali
How does a centralized proxy apply web filtering?
Jibu
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Kadi namba 262
Swali
How can continuous integration and testing improve security automation?
Jibu
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Kadi namba 263
Swali
What is containment?
Jibu
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Kadi namba 264
Swali
What is a software development lifecycle policy meant to ensure?
Jibu
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Kadi namba 265
Swali
What makes risk assessment continuous?
Jibu
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Kadi namba 266
Swali
What is a memorandum of agreement?
Jibu
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Kadi namba 267
Swali
What makes a penetration test integrated?
Jibu
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Kadi namba 268
Swali
How does a DNS amplification attack magnify traffic?
Jibu
It sends small spoofed queries that trigger larger replies toward the victim.
Kadi namba 269
Swali
Why does ease of recovery matter in an architecture decision?
Jibu
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Kadi namba 270
Swali
What does 802.1X control before a device receives normal network access?
Jibu
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Kadi namba 271
Swali
What is rule-based access control?
Jibu
System-wide rules grant or deny access based on conditions such as network, time, or action.
Kadi namba 272
Swali
What is mobile device management?
Jibu
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Kadi namba 273
Swali
What tradeoff comes with a cold recovery site?
Jibu
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Kadi namba 274
Swali
Why identify stakeholders before approving a security-sensitive change?
Jibu
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Kadi namba 275
Swali
How do attestation and acknowledgement differ?
Jibu
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Kadi namba 276
Swali
What does zero-trust adaptive identity mean?
Jibu
Access decisions adjust to current risk signals rather than relying only on a static login.
Kadi namba 277
Swali
What makes a security control physical?
Jibu
It protects facilities or equipment through a tangible barrier or mechanism.
Kadi namba 278
Swali
What is geo-fencing for data?
Jibu
Enforcing location-based boundaries on where data or services may be accessed or operated.
Kadi namba 279
Swali
What does a Trusted Platform Module protect?
Jibu
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Kadi namba 280
Swali
Why can a managed service provider amplify risk?
Jibu
Its privileged access and shared tooling can provide a path into many customers.
Kadi namba 281
Swali
What does probability express in risk analysis?
Jibu
A quantified chance that a defined event will occur within stated conditions or time.
Kadi namba 282
Swali
Why can shadow IT create a threat?
Jibu
It bypasses security review, inventory, monitoring, and supported configuration.
Kadi namba 283
Swali
What is on-path interception?
Jibu
An attacker positions between communicating parties to observe or alter traffic.
Kadi namba 284
Swali
Why include encryption in a system-hardening baseline?
Jibu
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Kadi namba 285
Swali
Why tune security alerts?
Jibu
To keep useful detections while reducing noise that wastes analyst attention.
Kadi namba 286
Swali
What can IPS or IDS logs contribute to an investigation?
Jibu
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Kadi namba 287
Swali
What is VM escape?
Jibu
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Kadi namba 288
Swali
How can segmentation reduce vulnerability exposure before a patch is available?
Jibu
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Kadi namba 289
Swali
Why should firewall policy name the required ports and protocols explicitly?
Jibu
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Kadi namba 290
Swali
What is a change management policy meant to control?
Jibu
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Kadi namba 291
Swali
What is a hybrid-cloud architecture?
Jibu
An environment that integrates private or on-premises resources with public cloud services.
Kadi namba 292
Swali
How do AH and ESP differ in the security services they can provide?
Jibu
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Kadi namba 293
Swali
What makes user behavior risky?
Jibu
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Kadi namba 294
Swali
What is least privilege?
Jibu
Granting only the access needed for the required task and no more.
Kadi namba 295
Swali
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Jibu
Transmission to HTTPS, script access, and cross-site sending, respectively.
Kadi namba 296
Swali
Why discover unmanaged assets?
Jibu
Unknown systems cannot be patched, monitored, or governed reliably.
Kadi namba 297
Swali
What is a service-level agreement?
Jibu
Measurable service commitments and remedies, such as availability or response targets.
Kadi namba 298
Swali
What should govern automated security escalation?
Jibu
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Kadi namba 299
Swali
What is platform diversity as a resilience strategy?
Jibu
Using different implementations so one common flaw or failure is less likely to affect every copy.
Kadi namba 300
Swali
How can replayed session material affect an application?
Jibu
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Kadi namba 301
Swali
What is an implicit trust zone in zero trust?
Jibu
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Kadi namba 302
Swali
What does salting a password hash accomplish?
Jibu
It makes identical passwords hash differently and defeats precomputed hash tables.
Kadi namba 303
Swali
What is spear phishing?
Jibu
Phishing tailored to a specific person, role, or organization.
Kadi namba 304
Swali
What is eradication?
Jibu
Removing the attacker's access, malicious artifacts, and exploited conditions.
Kadi namba 305
Swali
Who is a risk owner?
Jibu
The person accountable for deciding and monitoring how a specific risk is handled.
Kadi namba 306
Swali
What does a partially known penetration-test environment provide?
Jibu
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Kadi namba 307
Swali
What is a microservices architecture?
Jibu
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Kadi namba 308
Swali
What is a jump server?
Jibu
A hardened intermediary used to reach systems in a restricted management network.
Kadi namba 309
Swali
What can happen when a configuration change is made without dependency analysis?
Jibu
A downstream service can fail even when the changed component works.
Kadi namba 310
Swali
What is resource reuse exposure?
Jibu
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Kadi namba 311
Swali
Why does financial information require explicit protection?
Jibu
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Kadi namba 312
Swali
What does CVE provide?
Jibu
A common identifier for a publicly disclosed vulnerability.
Kadi namba 313
Swali
Where can DLP controls operate?
Jibu
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Kadi namba 314
Swali
What does privileged password vaulting protect?
Jibu
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Kadi namba 315
Swali
What does an access-control standard define?
Jibu
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Kadi namba 316
Swali
How can automation support compliance monitoring?
Jibu
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Kadi namba 317
Swali
What does static code analysis examine?
Jibu
Source or compiled code for weakness patterns without executing the application.
Kadi namba 318
Swali
What actor attribute describes funding, time, and personnel?
Jibu
Resources.
Kadi namba 319
Swali
What is DNS poisoning?
Jibu
Introducing false DNS data so names resolve to attacker-chosen destinations.
Kadi namba 320
Swali
Why change default credentials during hardening?
Jibu
Default secrets are predictable and commonly targeted.
Kadi namba 321
Swali
What does quarantine do after a security alert?
Jibu
It restricts a suspected asset or object while analysts validate and remediate the risk.
Kadi namba 322
Swali
What does key stretching do for stored passwords?
Jibu
It deliberately makes each password guess more computationally expensive.
Kadi namba 323
Swali
What is smishing?
Jibu
Phishing delivered through SMS or another text-messaging service.
Kadi namba 324
Swali
What is qualitative risk analysis?
Jibu
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Kadi namba 325
Swali
What is a master service agreement?
Jibu
An umbrella contract establishing general legal and commercial terms for ongoing work.
Kadi namba 326
Swali
What is threat scope reduction?
Jibu
Narrowing the systems, privileges, or paths an attacker can reach.
Kadi namba 327
Swali
Why use a third-party cloud service instead of building locally?
Jibu
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Kadi namba 328
Swali
What should determine security-device placement?
Jibu
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Kadi namba 329
Swali
What does situational awareness mean for a user?
Jibu
Notice the people, devices, requests, location, and context around a task before acting.
Kadi namba 330
Swali
What does a failover test validate?
Jibu
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Kadi namba 331
Swali
What is a preventive control meant to do?
Jibu
Stop an unwanted event before it succeeds.
Kadi namba 332
Swali
What is just-in-time privileged access?
Jibu
Elevated access is granted only when needed and expires after a short approved period.
Kadi namba 333
Swali
What safeguard should security-group automation enforce?
Jibu
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Kadi namba 334
Swali
How does a reflected DDoS attack hide and multiply sources?
Jibu
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Kadi namba 335
Swali
What is a security misconfiguration?
Jibu
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Kadi namba 336
Swali
Why can the same vulnerability have different organizational impact?
Jibu
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Kadi namba 337
Swali
What does URL scanning evaluate before a user opens a web destination?
Jibu
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Kadi namba 338
Swali
What is the board's security governance role?
Jibu
Provide oversight, set risk direction, and hold executives accountable.
Kadi namba 339
Swali
What does code signing establish?
Jibu
That code came from the holder of the signing key and has not changed since signing.
Kadi namba 340
Swali
How should an asset's classification affect security operations?
Jibu
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Kadi namba 341
Swali
How does encryption protect data?
Jibu
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Kadi namba 342
Swali
What is a secure enclave?
Jibu
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Kadi namba 343
Swali
What is business email compromise?
Jibu
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Kadi namba 344
Swali
What is recovery in incident response?
Jibu
Restoring services safely, monitoring them, and returning to normal operations.
Kadi namba 345
Swali
How is single loss expectancy commonly estimated?
Jibu
Asset value multiplied by the exposure factor.
Kadi namba 346
Swali
What does an unknown penetration-test environment provide?
Jibu
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Kadi namba 347
Swali
What security boundary does a hypervisor provide?
Jibu
It isolates virtual machines while controlling their access to shared hardware.
Kadi namba 348
Swali
Why does a TLS tunnel not protect a compromised endpoint?
Jibu
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Kadi namba 349
Swali
Why update diagrams after an infrastructure change?
Jibu
Operations and incident responders need the documentation to match the deployed environment.
Kadi namba 350
Swali
What does privacy ownership assign?
Jibu
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Kadi namba 351
Swali
What does a security control gap analysis compare?
Jibu
The controls required for the target state with the controls currently in place.
Kadi namba 352
Swali
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Jibu
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Kadi namba 353
Swali
What is application privilege escalation?
Jibu
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Kadi namba 354
Swali
What risk remains when unnecessary software is left installed?
Jibu
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Kadi namba 355
Swali
What does SCAP standardize?
Jibu
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Kadi namba 356
Swali
What can packet capture reveal?
Jibu
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Kadi namba 357
Swali
What makes a privileged credential ephemeral?
Jibu
It is created for a limited task or session and expires or is destroyed automatically after that use.
Kadi namba 358
Swali
How do a statement of work and a work order differ?
Jibu
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Kadi namba 359
Swali
Why might multi-cloud improve resilience?
Jibu
A provider-wide failure need not stop workloads that can run independently elsewhere.
Kadi namba 360
Swali
How can a service provider introduce a supply-chain vulnerability?
Jibu
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Kadi namba 361
Swali
What is a false positive in vulnerability scanning?
Jibu
A reported weakness that is not actually present or exploitable in the assessed context.
Kadi namba 362
Swali
How do EDR and XDR differ?
Jibu
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Kadi namba 363
Swali
What should onboarding and offboarding procedures coordinate?
Jibu
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Kadi namba 364
Swali
How should an organization harden managed mobile devices?
Jibu
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Kadi namba 365
Swali
What is a certificate signing request?
Jibu
A request containing a public key and subject information for a certificate authority to sign.
Kadi namba 366
Swali
What is pretexting?
Jibu
Using a fabricated role or situation to make a request seem legitimate.
Kadi namba 367
Swali
How is annualized loss expectancy commonly estimated?
Jibu
Single loss expectancy multiplied by annualized rate of occurrence.
Kadi namba 368
Swali
What security consequence follows from containers sharing a kernel?
Jibu
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Kadi namba 369
Swali
Where does 802.1X enforce a network admission decision?
Jibu
At the controlled switch port or wireless access point before normal network access is granted.
Kadi namba 370
Swali
What should insider-threat awareness teach?
Jibu
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Kadi namba 371
Swali
What access action is suitable for careful automation?
Jibu
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Kadi namba 372
Swali
What is an evil twin?
Jibu
A rogue wireless network made to resemble a legitimate one so users connect to it.
kadi 744
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Soma fungu hili bila malipoNibomo itafunguka ili uanze kusoma.
Kadi namba 373
Swali
Does non-human-readable data need less protection?
Jibu
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Kadi namba 374
Swali
What does authenticating a system establish?
Jibu
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Kadi namba 375
Swali
What does LDAP provide in identity systems?
Jibu
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Kadi namba 376
Swali
What is a deterrent control meant to do?
Jibu
Discourage an attacker from attempting an unwanted action.
Kadi namba 377
Swali
Why update procedures after changing a security control?
Jibu
Staff need accurate steps for operating, monitoring, and recovering the new control.
Kadi namba 378
Swali
How does OCSP differ from a certificate revocation list?
Jibu
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Kadi namba 379
Swali
What is the goal of data exfiltration?
Jibu
Remove data from its authorized environment without permission.
Kadi namba 380
Swali
What is a watering-hole attack?
Jibu
Compromising a site frequented by the intended targets so their visits expose them.
Kadi namba 381
Swali
How can a hardware provider introduce a supply-chain vulnerability?
Jibu
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Kadi namba 382
Swali
What is application forgery?
Jibu
Creating or altering a request, token, or object so the application treats it as authentic.
Kadi namba 383
Swali
How does least privilege mitigate compromise?
Jibu
It limits the actions and resources available to a compromised account or process.
Kadi namba 384
Swali
What is serverless computing?
Jibu
A model where the provider manages servers and the customer deploys event-driven code or functions.
Kadi namba 385
Swali
What makes an infrastructure control effective for a specific risk?
Jibu
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Kadi namba 386
Swali
What does parallel recovery processing test?
Jibu
Whether primary and alternate environments can run together consistently before a controlled cutover.
Kadi namba 387
Swali
Which password-authentication method does WPA3-Personal use?
Jibu
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Kadi namba 388
Swali
How does data retention affect asset disposal?
Jibu
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Kadi namba 389
Swali
What is a false negative in vulnerability scanning?
Jibu
A real weakness that the assessment fails to report.
Kadi namba 390
Swali
What does recurring security scanning add to monitoring?
Jibu
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Kadi namba 391
Swali
What should guide port selection for a secure protocol?
Jibu
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Kadi namba 392
Swali
What does forensic acquisition create?
Jibu
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Kadi namba 393
Swali
How do system owners and data owners divide security accountability?
Jibu
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Kadi namba 394
Swali
What does likelihood express in risk analysis?
Jibu
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Kadi namba 395
Swali
What is a memorandum of understanding?
Jibu
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Kadi namba 396
Swali
What does the right to be forgotten generally require?
Jibu
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Kadi namba 397
Swali
What does an audit committee oversee?
Jibu
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Kadi namba 398
Swali
What does identity interoperability require?
Jibu
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Kadi namba 399
Swali
How does a bollard protect a facility?
Jibu
It blocks or redirects vehicles before they can reach a protected area.
Kadi namba 400
Swali
How can hashing protect a downloaded file?
Jibu
A trusted digest lets the recipient detect whether the file changed.
Kadi namba 401
Swali
What is a credential replay attack?
Jibu
Using captured valid credentials or tokens again without needing to discover the secret.
Kadi namba 402
Swali
How can automation complexity create security risk?
Jibu
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Kadi namba 403
Swali
What must an architecture provide when a component cannot be patched?
Jibu
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Kadi namba 404
Swali
What makes remote access secure?
Jibu
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Kadi namba 405
Swali
What should users verify before connecting removable media or a cable?
Jibu
That the device and connection are approved, expected, and handled under organizational policy.
Kadi namba 406
Swali
What is a self-signed certificate?
Jibu
A certificate signed by its own private key rather than by a separate trusted issuer.
Kadi namba 407
Swali
What is brand impersonation?
Jibu
Using a trusted organization's identity or look to deceive people.
Kadi namba 408
Swali
What characterizes a conservative risk appetite?
Jibu
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Kadi namba 409
Swali
What should a managed mobile device verify before using Wi-Fi?
Jibu
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Kadi namba 410
Swali
What is a zero-day vulnerability?
Jibu
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Kadi namba 411
Swali
What does verification confirm after vulnerability remediation?
Jibu
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Kadi namba 412
Swali
What is user and entity behavior analytics?
Jibu
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Kadi namba 413
Swali
What does a physical security policy establish?
Jibu
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Kadi namba 414
Swali
What does a UPS provide?
Jibu
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Kadi namba 415
Swali
What is a nondisclosure agreement?
Jibu
A contract restricting use and disclosure of defined confidential information.
Kadi namba 416
Swali
What should be checked before assigning a user permission?
Jibu
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Kadi namba 417
Swali
How does espionage differ from ordinary theft?
Jibu
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Kadi namba 418
Swali
What is password spraying?
Jibu
Trying a small set of common passwords across many accounts to avoid lockouts.
Kadi namba 419
Swali
What is the purpose of system isolation during an incident?
Jibu
Stop harmful communication while preserving the system for response and investigation.
Kadi namba 420
Swali
What is a security benchmark?
Jibu
A documented set of recommended configuration checks for a platform or product.
Kadi namba 421
Swali
Which metadata fields give a log record investigative context?
Jibu
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Kadi namba 422
Swali
What does an access-control vestibule prevent?
Jibu
It limits tailgating by allowing controlled passage through one door at a time.
Kadi namba 423
Swali
What is version control's security value for configuration?
Jibu
It preserves attributable history and enables review or rollback of changes.
Kadi namba 424
Swali
Why use both internal and external compliance monitoring?
Jibu
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Kadi namba 425
Swali
What distinguishes on-premises architecture?
Jibu
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Kadi namba 426
Swali
What risk can split tunneling add to a VPN?
Jibu
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Kadi namba 427
Swali
What is a certificate root of trust?
Jibu
A trusted root certificate or key from which a client validates a certificate chain.
Kadi namba 428
Swali
What is typosquatting?
Jibu
Registering a look-alike domain based on common typing errors or visual similarity.
Kadi namba 429
Swali
What is root-cause analysis?
Jibu
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Kadi namba 430
Swali
What is risk tolerance?
Jibu
The acceptable variation or boundary around a specific objective or risk area.
Kadi namba 431
Swali
What is a security self-assessment?
Jibu
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Kadi namba 432
Swali
What does data masking change?
Jibu
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Kadi namba 433
Swali
How do wireless authentication protocols let clients prove identity securely?
Jibu
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Kadi namba 434
Swali
Why reconcile inventory with network discovery?
Jibu
Differences expose missing records, retired systems, or unauthorized devices.
Kadi namba 435
Swali
Why does sideloading raise mobile risk?
Jibu
It can bypass store review, signing policy, and managed application controls.
Kadi namba 436
Swali
What does an information-sharing organization add to vulnerability management?
Jibu
Sector or community intelligence about relevant threats, incidents, and defensive action.
Kadi namba 437
Swali
What does a web-filter block rule specify?
Jibu
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Kadi namba 438
Swali
How do data custodians and data stewards differ?
Jibu
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Kadi namba 439
Swali
What is a brute-force password attack?
Jibu
Systematically trying many candidate secrets against an account or protected value.
Kadi namba 440
Swali
What is a compensating control?
Jibu
An alternative safeguard used when the preferred control is impractical or unavailable.
Kadi namba 441
Swali
How can location act as an authentication factor?
Jibu
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Kadi namba 442
Swali
Why must security automation remain supportable?
Jibu
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Kadi namba 443
Swali
What does a standby generator provide?
Jibu
Longer-duration power during a utility outage, after a startup delay.
Kadi namba 444
Swali
What makes an architecture air-gapped?
Jibu
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Kadi namba 445
Swali
What is a software-defined WAN?
Jibu
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Kadi namba 446
Swali
What password-management behavior should awareness training reinforce?
Jibu
Use unique long passwords through an approved manager and report suspected compromise promptly.
Kadi namba 447
Swali
What security value does fencing provide?
Jibu
It defines and delays entry across a physical perimeter.
Kadi namba 448
Swali
What is a wildcard certificate?
Jibu
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Kadi namba 449
Swali
How does misinformation differ from disinformation?
Jibu
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Kadi namba 450
Swali
What is a risk threshold?
Jibu
A defined level that triggers escalation, treatment, or another required response.
Kadi namba 451
Swali
What does a vendor penetration test contribute to assessment?
Jibu
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Kadi namba 452
Swali
What is the objective of a service-disruption attack?
Jibu
Make a system or business function unavailable or unreliable.
Kadi namba 453
Swali
What is directory traversal?
Jibu
Manipulating a file path to reach files outside the directory the application intended to expose.
Kadi namba 454
Swali
Why decommission an unsupported system?
Jibu
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Kadi namba 455
Swali
Why archive security-monitoring data?
Jibu
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Kadi namba 456
Swali
What role does RADIUS commonly play in enterprise Wi-Fi?
Jibu
It centralizes authentication, authorization information, and accounting for network access.
Kadi namba 457
Swali
Why separate the requester and approver of a high-risk change?
Jibu
To reduce error, fraud, and unilateral unauthorized modification.
Kadi namba 458
Swali
Why can a jailbroken device violate a security baseline?
Jibu
It weakens platform isolation and allows unapproved privileged changes.
Kadi namba 459
Swali
When is tokenization especially useful?
Jibu
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Kadi namba 460
Swali
Why can dark-web intelligence affect vulnerability priority?
Jibu
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Kadi namba 461
Swali
What firewall policy should govern traffic from a screened subnet to internal systems?
Jibu
Deny it by default and allow only explicitly required flows.
Kadi namba 462
Swali
What does SAML commonly carry?
Jibu
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Kadi namba 463
Swali
What does a security governance committee do?
Jibu
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Kadi namba 464
Swali
How can global privacy requirements affect one data process?
Jibu
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Kadi namba 465
Swali
What characterizes an IoT device?
Jibu
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Kadi namba 466
Swali
What is a unified threat management appliance?
Jibu
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Kadi namba 467
Swali
What does a hardware security module provide?
Jibu
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Kadi namba 468
Swali
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Jibu
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Kadi namba 469
Swali
What is a tabletop exercise?
Jibu
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Kadi namba 470
Swali
What does a risk exemption authorize?
Jibu
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Kadi namba 471
Swali
What is a regulatory examination?
Jibu
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Kadi namba 472
Swali
What does physical video surveillance primarily provide?
Jibu
Detection and evidence of activity in monitored areas.
Kadi namba 473
Swali
What is a birthday attack against a hash?
Jibu
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Kadi namba 474
Swali
Why keep backups both onsite and offsite?
Jibu
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Kadi namba 475
Swali
How does technical debt affect security automation?
Jibu
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Kadi namba 476
Swali
What should switch hardening restrict first?
Jibu
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Kadi namba 477
Swali
What should happen when an asset changes owners?
Jibu
Inventory, access, support responsibility, and data handling should be updated.
Kadi namba 478
Swali
What does evidence of a vendor's internal audits contribute?
Jibu
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Kadi namba 479
Swali
What is identity attestation?
Jibu
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Kadi namba 480
Swali
Why can standard enterprise patching be unsafe for an RTOS device?
Jibu
A change can disrupt timing guarantees or certified operational behavior.
Kadi namba 481
Swali
What is secure access service edge?
Jibu
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Kadi namba 482
Swali
What social-engineering habit should awareness training reinforce?
Jibu
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Kadi namba 483
Swali
How can a software provider introduce a supply-chain vulnerability?
Jibu
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Kadi namba 484
Swali
Why include internet exposure in remediation priority?
Jibu
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Kadi namba 485
Swali
What does a mail gateway inspect?
Jibu
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Kadi namba 486
Swali
What is a data controller?
Jibu
The entity that determines why and how personal data is processed.
Kadi namba 487
Swali
How does blackmail motivate a cyberattack?
Jibu
The attacker threatens disclosure or harm unless the victim complies.
Kadi namba 488
Swali
What is a downgrade attack?
Jibu
Forcing parties to use an older or weaker protocol or security mode.
Kadi namba 489
Swali
How does encryption mitigate data exposure?
Jibu
It makes captured data unreadable without the required key.
Kadi namba 490
Swali
How do network and web vulnerability scanners differ?
Jibu
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Kadi namba 491
Swali
How can vulnerability-scan data support an investigation?
Jibu
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Kadi namba 492
Swali
What is key escrow?
Jibu
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Kadi namba 493
Swali
Which human vector commonly uses a fake sign-in page to harvest credentials?
Jibu
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Kadi namba 494
Swali
What is risk avoidance?
Jibu
Stopping or not starting the activity that creates the risk.
Kadi namba 495
Swali
What is data obfuscation?
Jibu
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Kadi namba 496
Swali
What is a directive control?
Jibu
A safeguard that tells people what behavior or action is required.
Kadi namba 497
Swali
What does a security guard add that a camera cannot?
Jibu
Human judgment and an immediate physical response.
Kadi namba 498
Swali
Why define restricted activities in change management?
Jibu
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Kadi namba 499
Swali
What contractual impact can noncompliance create?
Jibu
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Kadi namba 500
Swali
What should determine backup frequency?
Jibu
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Kadi namba 501
Swali
What should router hardening protect?
Jibu
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Kadi namba 502
Swali
What problem does OAuth 2.0 address?
Jibu
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Kadi namba 503
Swali
What does SCADA do?
Jibu
It provides supervisory monitoring and control across distributed industrial equipment.
Kadi namba 504
Swali
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Jibu
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Kadi namba 505
Swali
What distinguishes a computer virus?
Jibu
It attaches to a host file or program and spreads when that infected host executes or is shared.
Kadi namba 506
Swali
What does a key management system coordinate?
Jibu
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Kadi namba 507
Swali
How can an unsecure wired network expose traffic?
Jibu
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Kadi namba 508
Swali
Why is vulnerable device firmware hard to remediate?
Jibu
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Kadi namba 509
Swali
What does patching change in vulnerability remediation?
Jibu
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Kadi namba 510
Swali
What does DMARC add to SPF and DKIM?
Jibu
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Kadi namba 511
Swali
How does automation improve security efficiency?
Jibu
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Kadi namba 512
Swali
What is a simulation exercise?
Jibu
A more realistic practice in which participants respond to injected events using operational processes.
Kadi namba 513
Swali
What is a data processor?
Jibu
An entity that processes personal data on behalf of a controller.
Kadi namba 514
Swali
What is risk mitigation?
Jibu
Reducing likelihood, impact, or both through controls or process changes.
Kadi namba 515
Swali
Why monitor a vendor after onboarding?
Jibu
Security posture, ownership, services, incidents, and dependencies can change.
Kadi namba 516
Swali
What does a physical penetration test assess?
Jibu
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Kadi namba 517
Swali
Why use access badges at a facility?
Jibu
To associate entry attempts with authorized identities and enforce access rules.
Kadi namba 518
Swali
How does permission restriction protect data?
Jibu
Only authorized identities receive the actions and scope their roles require.
Kadi namba 519
Swali
What is the usual objective of ransomware extortion?
Jibu
Force payment by denying access, threatening disclosure, or both.
Kadi namba 520
Swali
What does impossible travel indicate?
Jibu
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Kadi namba 521
Swali
What is configuration enforcement?
Jibu
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Kadi namba 522
Swali
What does a web vulnerability scanner inspect?
Jibu
Running web behavior for issues such as unsafe input handling and insecure configuration.
Kadi namba 523
Swali
How does cost affect an architecture choice?
Jibu
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Kadi namba 524
Swali
What does EAP provide with 802.1X?
Jibu
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Kadi namba 525
Swali
What should operational-security training help users protect?
Jibu
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Kadi namba 526
Swali
What does a time-of-day access rule do?
Jibu
Allows or denies a requested action according to an approved schedule.
Kadi namba 527
Swali
What should cloud infrastructure hardening establish?
Jibu
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Kadi namba 528
Swali
What should an asset owner ensure during offboarding?
Jibu
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Kadi namba 529
Swali
Why encrypt backups?
Jibu
Backup media and transfers can expose the same sensitive data as production systems.
Kadi namba 530
Swali
What is steganography?
Jibu
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Kadi namba 531
Swali
Which human vector uses a fabricated authority role to justify a sensitive request?
Jibu
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Kadi namba 532
Swali
Why does risk transfer not remove accountability?
Jibu
The organization can retain legal, reputational, operational, and oversight consequences.
Kadi namba 533
Swali
Why validate a change after deployment?
Jibu
To confirm the intended result occurred without introducing unacceptable side effects.
Kadi namba 534
Swali
What makes end-of-life hardware a security vulnerability?
Jibu
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Kadi namba 535
Swali
What does an audit add to remediation validation?
Jibu
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Kadi namba 536
Swali
Why can SPF pass while a message still impersonates a brand?
Jibu
SPF checks the envelope domain, which may differ from the visible From domain.
Kadi namba 537
Swali
What role can a government entity have in security governance?
Jibu
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Kadi namba 538
Swali
How do data inventory and retention support privacy governance?
Jibu
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Kadi namba 539
Swali
What can concurrent sessions from distant regions indicate?
Jibu
A stolen account or shared credential, subject to VPN and proxy context.
Kadi namba 540
Swali
What does supply-chain analysis examine?
Jibu
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Kadi namba 541
Swali
What is the purpose of facility lighting as a control?
Jibu
Deter covert activity and improve observation of people and areas.
Kadi namba 542
Swali
What architecture quality keeps a service usable during component failure?
Jibu
Availability.
Kadi namba 543
Swali
When is fail-open behavior preferable to fail-closed behavior?
Jibu
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Kadi namba 544
Swali
Which control function does a login-failure alert provide?
Jibu
Detection; it reveals suspicious authentication activity.
Kadi namba 545
Swali
What does a biometric MFA implementation verify?
Jibu
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Kadi namba 546
Swali
How can automation enforce a security baseline?
Jibu
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Kadi namba 547
Swali
How do wireless cryptographic protocols protect network traffic?
Jibu
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Kadi namba 548
Swali
Why segment sensitive data stores?
Jibu
It limits reachable paths and separates them from lower-trust workloads.
Kadi namba 549
Swali
What must remain secret in an asymmetric key pair?
Jibu
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Kadi namba 550
Swali
How can a supplier become a supply-chain attack vector?
Jibu
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Kadi namba 551
Swali
What is e-discovery?
Jibu
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Kadi namba 552
Swali
What characterizes a neutral risk appetite?
Jibu
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Kadi namba 553
Swali
What is passive reconnaissance?
Jibu
Gathering information without directly interacting with the target's systems.
Kadi namba 554
Swali
What does a philosophical motive mean for a threat actor?
Jibu
The actor acts to advance a belief or moral position rather than primarily for money.
Kadi namba 555
Swali
What does unexpected resource consumption indicate?
Jibu
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Kadi namba 556
Swali
What does a host-based intrusion prevention system do?
Jibu
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Kadi namba 557
Swali
How does agent-based monitoring differ from agentless monitoring?
Jibu
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Kadi namba 558
Swali
What can network logs contribute to an investigation?
Jibu
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Kadi namba 559
Swali
What is the purpose of a backup restore test?
Jibu
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Kadi namba 560
Swali
Why can obsolete hardware become a security risk?
Jibu
It may lack supported firmware, modern protections, or replacement parts.
Kadi namba 561
Swali
What does rescanning confirm after remediation?
Jibu
Whether the scanner can still detect the original finding on the affected asset.
Kadi namba 562
Swali
What should a secure transport method provide?
Jibu
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Kadi namba 563
Swali
How can law affect security governance?
Jibu
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Kadi namba 564
Swali
What does resilience mean for a security architecture?
Jibu
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Kadi namba 565
Swali
Why minimize an infrastructure's attack surface?
Jibu
Fewer exposed services and paths leave fewer opportunities for exploitation.
Kadi namba 566
Swali
What does executing a security-awareness program require?
Jibu
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Kadi namba 567
Swali
What does an infrared security sensor detect?
Jibu
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Kadi namba 568
Swali
What is a knowledge factor?
Jibu
Something the claimant knows, such as a password.
Kadi namba 569
Swali
Why review allow-list and deny-list impact before a change?
Jibu
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Kadi namba 570
Swali
What does partition-level encryption protect?
Jibu
One selected disk partition, leaving other partitions outside that encryption boundary.
Kadi namba 571
Swali
How can instant messaging deliver a security attack?
Jibu
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Kadi namba 572
Swali
What can repeated blocked-content events indicate?
Jibu
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Kadi namba 573
Swali
What should a server-hardening baseline reduce?
Jibu
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Kadi namba 574
Swali
When is physical media destruction appropriate?
Jibu
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Kadi namba 575
Swali
What is mean time to repair?
Jibu
The average time required to restore a failed component or service.
Kadi namba 576
Swali
Why disclose conflicts of interest during vendor selection?
Jibu
A personal or financial relationship can bias evaluation away from the organization's requirements.
Kadi namba 577
Swali
What is a fine for noncompliance?
Jibu
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Kadi namba 578
Swali
What does a public data classification authorize?
Jibu
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Kadi namba 579
Swali
What security benefit comes from standard infrastructure configurations?
Jibu
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Kadi namba 580
Swali
How does horizontal scaling increase capacity?
Jibu
It adds more service instances and distributes work among them.
Kadi namba 581
Swali
Why can added connectivity weaken segmentation?
Jibu
Each allowed path can become a route for lateral movement or data escape.
Kadi namba 582
Swali
What coding practice is central to preventing SQL injection?
Jibu
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Kadi namba 583
Swali
When is a compensating control appropriate for a vulnerability?
Jibu
When timely removal or patching is infeasible and another control can reduce the risk.
Kadi namba 584
Swali
How does agent-based web filtering enforce policy?
Jibu
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Kadi namba 585
Swali
How can regulation differ from an internal policy?
Jibu
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Kadi namba 586
Swali
What is a storage snapshot?
Jibu
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Kadi namba 587
Swali
What does password age measure?
Jibu
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Kadi namba 588
Swali
What does an ethical motive mean in vulnerability research?
Jibu
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Kadi namba 589
Swali
What can missing security logs indicate?
Jibu
Logging failure, tampering, retention misconfiguration, or an inactive source.
Kadi namba 590
Swali
Why disable unused ports and protocols?
Jibu
They expose unnecessary communication paths and code that attackers can reach.
Kadi namba 591
Swali
What does antivirus contribute to monitoring?
Jibu
It scans files, memory, or behavior and reports suspected malicious code.
Kadi namba 592
Swali
What is a honeypot?
Jibu
A decoy system or service designed to attract and observe malicious activity.
Kadi namba 593
Swali
What does file-level encryption protect?
Jibu
Selected files independently of whether the rest of the disk or volume is encrypted.
Kadi namba 594
Swali
How can SMS deliver a security attack?
Jibu
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Kadi namba 595
Swali
What happens during incident analysis?
Jibu
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Kadi namba 596
Swali
What is mean time between failures?
Jibu
The average operating time between repairable failures.
Kadi namba 597
Swali
What is active reconnaissance?
Jibu
Probing or interacting with target systems to discover services and behavior.
Kadi namba 598
Swali
What constraint should guide ICS or SCADA hardening?
Jibu
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Kadi namba 599
Swali
Which control function does restoring a clean system image provide?
Jibu
Correction; it returns the system to a known-good state.
Kadi namba 600
Swali
What does responsiveness mean in an architecture decision?
Jibu
How quickly the system and its operators can adapt to demand, failure, or attack.
Kadi namba 601
Swali
How does out-of-band access strengthen remote administration?
Jibu
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Kadi namba 602
Swali
What makes user behavior unexpected?
Jibu
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Kadi namba 603
Swali
What is a work order?
Jibu
A document authorizing a defined unit of work under an existing agreement.
Kadi namba 604
Swali
What can out-of-cycle logging indicate?
Jibu
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Kadi namba 605
Swali
Why update a standard operating procedure after a change?
Jibu
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Kadi namba 606
Swali
What coding practice limits cross-site scripting?
Jibu
Context-appropriate output encoding, supported by safe templating and input handling.
Kadi namba 607
Swali
What does a restricted data classification indicate?
Jibu
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Kadi namba 608
Swali
How does a bug bounty support responsible disclosure?
Jibu
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Kadi namba 609
Swali
What does web-filter content categorization provide?
Jibu
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Kadi namba 610
Swali
How do hard and soft authentication tokens differ?
Jibu
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Kadi namba 611
Swali
How can industry requirements affect security governance?
Jibu
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Kadi namba 612
Swali
How can noncompliance cause loss of a license?
Jibu
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Kadi namba 613
Swali
What does volume-level encryption protect?
Jibu
All data within a selected logical storage volume.
Kadi namba 614
Swali
How can impersonation exploit familiarity?
Jibu
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Kadi namba 615
Swali
How does RTO guide recovery design?
Jibu
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Kadi namba 616
Swali
What is a honeynet?
Jibu
A network of decoy systems used to study or divert attackers.
Kadi namba 617
Swali
What does backup replication provide?
Jibu
Additional synchronized or copied recovery data in another system or location.
Kadi namba 618
Swali
What lets automation scale securely?
Jibu
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Kadi namba 619
Swali
Why monitor a hardened computing resource continuously?
Jibu
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Kadi namba 620
Swali
Why keep a certificate of destruction?
Jibu
It documents that a disposal provider handled specified media under the agreed process.
Kadi namba 621
Swali
Why consider patch availability before selecting a platform?
Jibu
Unsupported or difficult-to-update components accumulate known exposure.
Kadi namba 622
Swali
Why should remote administration use an encrypted, authenticated protocol?
Jibu
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Kadi namba 623
Swali
How can revenge motivate an insider incident?
Jibu
A disgruntled person may damage systems or disclose data to punish the organization.
Kadi namba 624
Swali
What is a published or documented indicator of malicious activity?
Jibu
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Kadi namba 625
Swali
Why monitor a system more closely when a mitigation exception is accepted?
Jibu
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Kadi namba 626
Swali
What is an SNMP trap?
Jibu
An unsolicited device notification sent to a management system when a configured event occurs.
Kadi namba 627
Swali
How can an automated report support an investigation?
Jibu
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Kadi namba 628
Swali
What is a security key?
Jibu
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Kadi namba 629
Swali
What does database-level encryption protect?
Jibu
A database or selected database structures through controls managed at the database layer.
Kadi namba 630
Swali
How does brand impersonation exploit trust?
Jibu
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Kadi namba 631
Swali
What browser-side impact can a cross-site scripting vulnerability create?
Jibu
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Kadi namba 632
Swali
How can a system or process audit identify vulnerabilities?
Jibu
It compares evidence with required configuration and procedure to reveal control gaps.
Kadi namba 633
Swali
What security role can Group Policy provide?
Jibu
Centralized Windows configuration of account, application, audit, and system security settings.
Kadi namba 634
Swali
What should incident-response training prepare people to do?
Jibu
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Kadi namba 635
Swali
Why must governance track local or regional requirements?
Jibu
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Kadi namba 636
Swali
How can a dependency become a useful key risk indicator?
Jibu
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Kadi namba 637
Swali
What is a business partners agreement?
Jibu
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Kadi namba 638
Swali
What makes an audit regulatory?
Jibu
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Kadi namba 639
Swali
What is a honeyfile?
Jibu
A decoy file whose access can reveal unauthorized activity.
Kadi namba 640
Swali
Why does legal information require explicit protection?
Jibu
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Kadi namba 641
Swali
Which indicator can mass file renaming and encryption produce?
Jibu
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Kadi namba 642
Swali
What remains with an organization after transferring architecture risk?
Jibu
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Kadi namba 643
Swali
When does local console placement provide useful administrative access?
Jibu
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Kadi namba 644
Swali
What makes a harmful user action unintentional?
Jibu
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Kadi namba 645
Swali
How should an organization harden workstations?
Jibu
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Kadi namba 646
Swali
What is journaling in recovery?
Jibu
Recording ordered changes so data can be replayed or restored to a consistent point.
Kadi namba 647
Swali
What downtime must a change plan account for?
Jibu
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Kadi namba 648
Swali
Why must a privacy program map local or regional law to data flows?
Jibu
The applicable duties can change with the location of the person, organization, processing, or stored data.
Kadi namba 649
Swali
Why combine independent preventive controls at different layers?
Jibu
A failure at one layer does not automatically let the same attack succeed at the next layer.
Kadi namba 650
Swali
What is passwordless authentication?
Jibu
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Kadi namba 651
Swali
How can automation improve security reaction time?
Jibu
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Kadi namba 652
Swali
What does record-level encryption protect?
Jibu
Individual records or fields, allowing finer protection than encrypting the entire database.
Kadi namba 653
Swali
How can business email compromise misuse urgency?
Jibu
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Kadi namba 654
Swali
What does impact measure in risk analysis?
Jibu
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Kadi namba 655
Swali
What makes cyber activity part of warfare?
Jibu
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Kadi namba 656
Swali
Which indicator can a newly created privileged account produce outside the normal change window?
Jibu
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Kadi namba 657
Swali
How can configuration enforcement validate a deployed mitigation?
Jibu
It compares the realized settings with the approved state and corrects or reports drift.
Kadi namba 658
Swali
How does validating an alert improve alert tuning?
Jibu
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Kadi namba 659
Swali
What data-layer impact can a SQL injection vulnerability create?
Jibu
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Kadi namba 660
Swali
What environmental variables can change vulnerability priority?
Jibu
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Kadi namba 661
Swali
What security role does SELinux provide?
Jibu
Mandatory access controls that confine processes according to centrally defined policy.
Kadi namba 662
Swali
Why review governance documents periodically?
Jibu
Business, technology, threats, and external obligations change.
Kadi namba 663
Swali
Why evaluate power requirements for a system design?
Jibu
Power capacity and redundancy constrain availability and recovery.
Kadi namba 664
Swali
When is IPsec a better tunnel choice than TLS?
Jibu
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Kadi namba 665
Swali
What is a honeytoken?
Jibu
A fake credential or data element that generates a high-confidence alert when used.
Kadi namba 666
Swali
What should embedded-system hardening prioritize?
Jibu
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Kadi namba 667
Swali
Why must sanitization address data remanence?
Jibu
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Kadi namba 668
Swali
Why require rules of engagement for vendor testing?
Jibu
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Kadi namba 669
Swali
What does a private data classification indicate?
Jibu
The information concerns an individual or limited internal audience and should not be exposed publicly.
Kadi namba 670
Swali
What does a tabletop recovery exercise test?
Jibu
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Kadi namba 671
Swali
Why prevent password reuse?
Jibu
One compromised password should not unlock other accounts or services.
Kadi namba 672
Swali
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Jibu
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Kadi namba 673
Swali
What does transport encryption protect?
Jibu
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Kadi namba 674
Swali
How can a voice call become an attack vector?
Jibu
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Kadi namba 675
Swali
What should a digital-forensics report document?
Jibu
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Kadi namba 676
Swali
What tradeoff comes with an expansionary risk appetite?
Jibu
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Kadi namba 677
Swali
What does a known penetration-test environment provide?
Jibu
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Kadi namba 678
Swali
Why evaluate compute requirements before deployment?
Jibu
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Kadi namba 679
Swali
Why place sensors at network choke points?
Jibu
They can observe traffic crossing important trust boundaries.
Kadi namba 680
Swali
What should hybrid or remote-work security training emphasize?
Jibu
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Kadi namba 681
Swali
Why plan an application restart separately from a service restart?
Jibu
The application may need its own state handling, user coordination, health checks, and rollback point.
Kadi namba 682
Swali
What is a cryptographic vulnerability?
Jibu
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Kadi namba 683
Swali
Why report findings by asset owner?
Jibu
Owners need clear accountability and a prioritized remediation queue.
Kadi namba 684
Swali
What should guide selection of a secure protocol?
Jibu
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Kadi namba 685
Swali
How do centralized and decentralized governance structures differ?
Jibu
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Kadi namba 686
Swali
How does privacy-aware design limit data retention?
Jibu
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Kadi namba 687
Swali
What does a pressure security sensor detect?
Jibu
Force or weight applied to a protected surface, such as a floor mat or fence line.
Kadi namba 688
Swali
What automation costs should a security team plan for?
Jibu
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Kadi namba 689
Swali
What should RTOS hardening preserve while reducing attack surface?
Jibu
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Kadi namba 690
Swali
What is the goal of disruption-for-chaos activity?
Jibu
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Kadi namba 691
Swali
Which indicator can repeated password guessing produce?
Jibu
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Kadi namba 692
Swali
How does removing unnecessary software harden a system?
Jibu
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Kadi namba 693
Swali
What does NetFlow provide?
Jibu
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Kadi namba 694
Swali
How can a dashboard support an investigation?
Jibu
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Kadi namba 695
Swali
When should a password be expired?
Jibu
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Kadi namba 696
Swali
Why does cryptographic key length matter?
Jibu
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Kadi namba 697
Swali
How can an unsecure Bluetooth connection become an attack vector?
Jibu
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Kadi namba 698
Swali
What is a key risk indicator?
Jibu
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Kadi namba 699
Swali
What should vendor monitoring verify when a contract ends?
Jibu
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Kadi namba 700
Swali
What does a sensitive data classification indicate?
Jibu
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Kadi namba 701
Swali
What does software-defined networking separate?
Jibu
The control plane that decides traffic behavior from the data plane that forwards traffic.
Kadi namba 702
Swali
Where should a web application firewall be placed?
Jibu
In the path of web requests before they reach the protected application.
Kadi namba 703
Swali
What does a simulated recovery exercise test?
Jibu
Participants perform realistic response actions in a controlled environment without disrupting production.
Kadi namba 704
Swali
How can a team verify that a detective control is effective?
Jibu
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Kadi namba 705
Swali
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Jibu
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Kadi namba 706
Swali
What makes a vulnerability cloud-specific?
Jibu
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Kadi namba 707
Swali
How can insurance respond to vulnerability risk?
Jibu
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Kadi namba 708
Swali
How does reputation improve web filtering?
Jibu
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Kadi namba 709
Swali
What does an encryption policy establish?
Jibu
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Kadi namba 710
Swali
How does a microwave security sensor detect movement?
Jibu
It emits microwave energy and detects changes in the reflected signal caused by motion.
Kadi namba 711
Swali
What should IoT-device hardening change before deployment?
Jibu
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Kadi namba 712
Swali
Why track software licenses as assets?
Jibu
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Kadi namba 713
Swali
What does a password manager improve?
Jibu
It can generate and store unique long passwords so users do not memorize or reuse them.
Kadi namba 714
Swali
What makes a ledger open and public?
Jibu
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Kadi namba 715
Swali
What should a payment-change request trigger?
Jibu
Independent verification through a known channel before any account or payment detail is changed.
Kadi namba 716
Swali
What does preserving digital evidence require?
Jibu
Protecting its integrity, context, access history, and availability from collection through final disposition.
Kadi namba 717
Swali
What should a risk report tell decision-makers?
Jibu
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Kadi namba 718
Swali
What should an external assessment report provide?
Jibu
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Kadi namba 719
Swali
What is a centralized design's main resilience risk?
Jibu
A central dependency can become a bottleneck or single point of failure.
Kadi namba 720
Swali
What does mutual TLS add to a TLS-protected service connection?
Jibu
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Kadi namba 721
Swali
What should recurring security-awareness reporting show?
Jibu
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Kadi namba 722
Swali
Why do legacy applications require extra change planning?
Jibu
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Kadi namba 723
Swali
How do a data controller and a data processor differ?
Jibu
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Kadi namba 724
Swali
How can orchestration become a single point of failure?
Jibu
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Kadi namba 725
Swali
Why should defenses account for a threat actor's sophistication and capability?
Jibu
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Kadi namba 726
Swali
How does an injection attack make an application execute unintended instructions?
Jibu
It sends crafted input that an interpreter treats as code or commands instead of data.
Kadi namba 727
Swali
What does a host-based firewall control?
Jibu
Inbound and outbound network traffic for one endpoint according to local rules.
Kadi namba 728
Swali
Why revise alerting after an incident?
Jibu
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Kadi namba 729
Swali
Why include security duties in procurement criteria?
Jibu
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Kadi namba 730
Swali
What does a critical data classification indicate?
Jibu
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Kadi namba 731
Swali
What infrastructure capacity must support failover?
Jibu
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Kadi namba 732
Swali
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Jibu
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Kadi namba 733
Swali
How does a remediation exemption differ from an exception?
Jibu
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Kadi namba 734
Swali
Why should automated EDR or XDR blocking have an exception and rollback path?
Jibu
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Kadi namba 735
Swali
What does a security playbook provide?
Jibu
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Kadi namba 736
Swali
How does an ultrasonic security sensor detect movement?
Jibu
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Kadi namba 737
Swali
What should a managed mobile device require for Bluetooth connections?
Jibu
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Kadi namba 738
Swali
How do password complexity rules differ from password length?
Jibu
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Kadi namba 739
Swali
What makes a certificate third-party trusted?
Jibu
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Kadi namba 740
Swali
Why is an out-of-band check effective against impersonation?
Jibu
It verifies the request through a separate, previously trusted communication path.
Kadi namba 741
Swali
What does a risk exception authorize?
Jibu
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Kadi namba 742
Swali
What security challenge grows in a decentralized design?
Jibu
Consistent policy, inventory, monitoring, and patching become harder.
Kadi namba 743
Swali
How should controls be selected for an unused network path?
Jibu
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Kadi namba 744
Swali
How can a buffer-overflow attack affect an application?
Jibu
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.
kadi 744
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Nibomo itafunguka ili uanze kusoma.