# CompTIA Security\+ SY0\-701 Flashcards: Complete Objective Review ![Abstract network paths and learning nodes converging on a calm central gateway\.]() Study every current SY0\-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance\. 作者 [Flashcards Open Source App]() [免费学习这套卡组]() Nibomo 将打开，你可以立即开始学习。 ## 卡组详情 - 卡片: 744张卡片 - 版本: 1 - 发布日期: 2026年8月26日 - 最后更新: 2026年9月10日 - 许可证: Common knowledge · CC0 1\.0 - 受众语言: [en]() - 科目: Cybersecurity - 级别: Security\+ SY0\-701 - 标签: security\-plus\-701, governance\-risk, threats\-mitigations, general\-concepts, security\-architecture, security\-operations ## 关于这套卡组 Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026. ### What this deck covers * **General security concepts:** control functions, core principles, zero trust, change management, cryptography, certificates, and PKI. * **Threats, vulnerabilities, and mitigations:** threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices. * **Security architecture:** cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design. * **Security operations:** hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources. * **Program management and oversight:** governance, risk, third-party security, compliance, privacy, audits, and awareness. Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart. The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application. Scope was reconciled against [CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0](https://comptiacdn.azureedge.net/webcontent/docs/default-source/exam-objectives/comptia-security-sy0-701-exam-objectives-%286-0%29.pdf?sfvrsn=204179cc_6). Current certification requirements and exam-series status are on the [official CompTIA Security+ page](https://www.comptia.org/en-us/certifications/security/). This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied. ## 相似卡组 - [CompTIA A\+ 220\-1201 & 220\-1202 Flashcards: Core 1 and Core 2]() - [CompTIA Network\+ N10\-009 Flashcards: Concepts, Operations & Troubleshooting]() - [AWS Solutions Architect Associate SAA\-C03 Flashcards: Architecture Decisions & Trade\-Offs]() - [NREMT EMT Flashcards: Assessment, Treatment & Operations]() - [EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules]() - [CCSP 2026 Flashcards: August Exam Outline Review]() ## 这套卡组中的卡片 ### 卡片 1 **问题** What does an information security policy establish? **答案** Management's required direction, responsibilities, and high-level rules for protecting information and systems. ### 卡片 2 **问题** What is phishing? **答案** A deceptive message intended to make a target reveal information, open malware, or take an unsafe action. ### 卡片 3 **问题** What does a public-key certificate bind to an identity? **答案** A public key, together with identifying information and the issuer's signature. ### 卡片 4 **问题** What is data at rest? **答案** Data stored on media such as disks, databases, backups, or mobile devices. ### 卡片 5 **问题** How does policy-driven access control decide a zero-trust access request? **答案** Explicit policies or rules evaluate the access request and drive the allow-or-deny decision. ### 卡片 6 **问题** What does establishing a secure baseline produce? **答案** An approved, documented configuration that defines the required secure state for a class of computing resource. ### 卡片 7 **问题** What is hashing used to verify? **答案** Whether data has changed by comparing fixed-length digest values. ### 卡片 8 **问题** What is impersonation in social engineering? **答案** Pretending to be a trusted person or organization to obtain access, data, or action. ### 卡片 9 **问题** What is virtualization? **答案** Abstracting physical compute so multiple isolated guest systems can share a host. ### 卡片 10 **问题** What is chain of custody? **答案** A documented history of who collected, handled, transferred, stored, and examined evidence. ### 卡片 11 **问题** What is quantitative risk analysis? **答案** Estimating risk with numerical values such as money, frequency, or probability. ### 卡片 12 **问题** What is a phishing awareness campaign? **答案** A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior. ### 卡片 13 **问题** What is high availability? **答案** Designing a service to remain accessible despite expected component failures. ### 卡片 14 **问题** What is a network security zone? **答案** A group of systems with similar trust, function, or control requirements. ### 卡片 15 **问题** What is risk transfer? **答案** Shifting some financial or operational consequence to another party, such as through insurance or contract. ### 卡片 16 **问题** What is media sanitization? **答案** Making stored data infeasible to recover for the intended level of protection. ### 卡片 17 **问题** What does CVSS provide? **答案** A standardized way to describe a vulnerability's technical severity characteristics. ### 卡片 18 **问题** What does security alerting do? **答案** It turns matched events or behavior into a notification that the right responder can review. ### 卡片 19 **问题** What does a firewall rule enforce? **答案** A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions. ### 卡片 20 **问题** What is deprovisioning? **答案** Disabling or removing accounts, credentials, sessions, and access when they are no longer needed. ### 卡片 21 **问题** How does inline placement differ from a tap or monitor port? **答案** Inline traffic passes through the control; a tap or monitor receives a copy for observation. ### 卡片 22 **问题** What is asymmetric encryption? **答案** Encryption that uses a mathematically related public and private key pair. ### 卡片 23 **问题** What does SPF authorize? **答案** Which mail servers may send mail for a domain in the SMTP envelope. ### 卡片 24 **问题** What is a possession factor? **答案** Something the claimant has, such as a cryptographic authenticator. ### 卡片 25 **问题** What does ordinary TLS usually protect and authenticate? **答案** It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured. ### 卡片 26 **问题** What is single loss expectancy? **答案** The estimated loss from one occurrence of a risk event. ### 卡片 27 **问题** What does a certificate authority do? **答案** It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key. ### 卡片 28 **问题** What is a detective control meant to do? **答案** Identify that an unwanted event has happened or is happening. ### 卡片 29 **问题** What is the security purpose of change-control approval? **答案** Ensure authorized reviewers assess risk before the production change occurs. ### 卡片 30 **问题** What is shadow IT? **答案** Technology used for organizational work without required approval or oversight. ### 卡片 31 **问题** What is a buffer overflow vulnerability? **答案** A bounds-checking failure that lets input overwrite memory outside its intended buffer. ### 卡片 32 **问题** What is ransomware? **答案** Malware or an intrusion outcome that denies access to data or systems to extort the victim. ### 卡片 33 **问题** How does network segmentation limit an incident? **答案** It restricts communication paths and reduces lateral movement between zones. ### 卡片 34 **问题** How do load balancing and clustering support availability differently? **答案** Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure. ### 卡片 35 **问题** What is vendor due diligence? **答案** Evaluating a provider's security, capability, stability, and fit before commitment. ### 卡片 36 **问题** Who is a data subject? **答案** The person whose personal data is collected or processed. ### 卡片 37 **问题** What is attestation? **答案** A formal assertion or report about a subject matter, often supported by an independent examination. ### 卡片 38 **问题** What is a replay attack? **答案** Valid captured data is retransmitted to repeat an authenticated or authorized action. ### 卡片 39 **问题** What does a wireless site survey establish? **答案** Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment. ### 卡片 40 **问题** What is the time-of-check stage of a race-condition vulnerability? **答案** The application verifies a condition or resource state before acting on it. ### 卡片 41 **问题** What is a penetration test? **答案** An authorized attempt to exploit weaknesses and demonstrate practical impact. ### 卡片 42 **问题** What is a cold recovery site? **答案** A facility with basic space and utilities but little preinstalled technology or current data. ### 卡片 43 **问题** What is data in transit? **答案** Data moving between systems or across a network. ### 卡片 44 **问题** What is a vendor security questionnaire? **答案** A structured request for information about a provider's controls and practices. ### 卡片 45 **问题** How does an internal actor's starting position differ from an external actor's? **答案** An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access. ### 卡片 46 **问题** What can unexpected account lockouts indicate? **答案** Password guessing, credential stuffing, user error, or a broken client. ### 卡片 47 **问题** How do permissions enforce access control? **答案** They specify which actions a subject may perform on a particular resource. ### 卡片 48 **问题** What is log aggregation? **答案** Central collection of logs from multiple sources for search, correlation, and retention. ### 卡片 49 **问题** Why plan a service restart as part of a change? **答案** The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps. ### 卡片 50 **问题** What is infrastructure as code? **答案** Managing infrastructure through versioned, machine-readable definitions rather than manual configuration. ### 卡片 51 **问题** What should security-awareness program development start with? **答案** The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes. ### 卡片 52 **问题** What is a voice-based social-engineering attack called? **答案** Vishing. ### 卡片 53 **问题** What happens during incident-response preparation? **答案** Teams establish people, tools, access, communications, training, and procedures before an incident. ### 卡片 54 **问题** What does an offensive penetration-testing team do? **答案** It emulates authorized attacker behavior to discover and demonstrate exploitable paths. ### 卡片 55 **问题** What is federation? **答案** One security domain relies on identity assertions from another trusted domain. ### 卡片 56 **问题** What is asset classification? **答案** Grouping an asset by sensitivity, criticality, or required handling. ### 卡片 57 **问题** What is cross-site scripting? **答案** Injection of script-capable content that a browser executes in another site's security context. ### 卡片 58 **问题** What can IDS or IPS trends reveal? **答案** Changes in the frequency, source, target, or type of detected activity that one isolated event may not show. ### 卡片 59 **问题** What can unexpected resource inaccessibility indicate? **答案** Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage. ### 卡片 60 **问题** What is a corrective control meant to do? **答案** Limit damage and restore a secure state after an event. ### 卡片 61 **问题** How do containers differ from virtual machines? **答案** Containers share the host kernel; virtual machines normally run separate guest operating systems. ### 卡片 62 **问题** How does an active security device differ from a passive one? **答案** An active device can alter or block traffic; a passive device observes and reports without changing the flow. ### 卡片 63 **问题** Why is unsupported software a persistent attack surface? **答案** Known weaknesses may remain reachable because supported fixes and vendor help are no longer available. ### 卡片 64 **问题** What is annualized rate of occurrence? **答案** The estimated number of times a risk event occurs per year. ### 卡片 65 **问题** What is an inherence factor? **答案** A biometric characteristic of the claimant. ### 卡片 66 **问题** What do a threat actor's sophistication and capability describe? **答案** The technical skill, tools, knowledge, resources, and operational discipline the actor can apply. ### 卡片 67 **问题** What is a SIEM? **答案** A platform that centralizes security data and supports search, correlation, alerting, and investigation. ### 卡片 68 **问题** What is sideloading? **答案** Installing software from outside the platform's approved distribution path. ### 卡片 69 **问题** What does an IDS or IPS signature match? **答案** A known pattern in traffic or behavior associated with a threat, exploit, or policy violation. ### 卡片 70 **问题** Why are embedded systems often difficult to patch? **答案** They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support. ### 卡片 71 **问题** What is a virtual private network? **答案** An encrypted logical connection that carries private traffic across an untrusted or shared network. ### 卡片 72 **问题** What should an initial security-awareness report establish? **答案** The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared. ### 卡片 73 **问题** What is symmetric encryption? **答案** Encryption that uses the same secret key to encrypt and decrypt data. ### 卡片 74 **问题** What happens during incident detection? **答案** Monitoring or a report identifies activity that may meet the organization's incident criteria. ### 卡片 75 **问题** What is recovery time objective? **答案** The target maximum time to restore a function after disruption. ### 卡片 76 **问题** Why prioritize password length? **答案** Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions. ### 卡片 77 **问题** What must sanitization accomplish before an asset leaves organizational control? **答案** It must make the retained data infeasible to recover with the method appropriate to the media and risk. ### 卡片 78 **问题** What is a real-time operating system designed to provide? **答案** Predictable response timing for tasks with strict deadlines. ### 卡片 79 **问题** What does fail-open behavior do when a control fails? **答案** It permits traffic or access to preserve availability. ### 卡片 80 **问题** What is jailbreaking or rooting a mobile device? **答案** Removing platform restrictions to gain privileged control over the operating system. ### 卡片 81 **问题** What does network access control enforce? **答案** Identity, device posture, and access policy at network connection time and during a session. ### 卡片 82 **问题** What does data loss prevention do? **答案** Detects and may block sensitive data use or transfer that violates policy. ### 卡片 83 **问题** What security property does a blockchain provide? **答案** A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links. ### 卡片 84 **问题** What is recovery point objective? **答案** The target maximum acceptable data loss measured backward in time. ### 卡片 85 **问题** How do ICS and SCADA relate? **答案** An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment. ### 卡片 86 **问题** What does fail-closed behavior do when a control fails? **答案** It denies traffic or access to preserve security. ### 卡片 87 **问题** Which keys create and verify a typical digital signature? **答案** The signer creates it with a private key, and others verify it with the corresponding public key. ### 卡片 88 **问题** What is SQL injection? **答案** Input that alters the structure or meaning of a database query because code and data were not safely separated. ### 卡片 89 **问题** What does DKIM verify? **答案** That selected message content was signed by a domain and was not altered after signing. ### 卡片 90 **问题** What is post-incident activity? **答案** Learning from the event and improving controls, plans, and recovery based on evidence. ### 卡片 91 **问题** What characterizes an expansionary risk appetite? **答案** A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity. ### 卡片 92 **问题** How do centralized and decentralized architectures differ? **答案** Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations. ### 卡片 93 **问题** What does a certificate revocation list publish? **答案** Certificate serial numbers that the issuer has invalidated before their scheduled expiration. ### 卡片 94 **问题** What is a legal hold? **答案** A directive to preserve potentially relevant information by suspending normal deletion or disposal. ### 卡片 95 **问题** What is exposure factor in quantitative risk analysis? **答案** The estimated percentage of an asset's value lost in one event. ### 卡片 96 **问题** What is decentralized architecture? **答案** Control or service responsibility is distributed across multiple independent components or locations. ### 卡片 97 **问题** What is tokenization? **答案** Replacing sensitive data with a non-sensitive token whose mapping is held separately. ### 卡片 98 **问题** How can automation act as a workforce multiplier? **答案** It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement. ### 卡片 99 **问题** What can endpoint process logs reveal? **答案** Which programs ran, their parent-child relationships, users, timing, and command details when captured. ### 卡片 100 **问题** What does the CIA triad protect? **答案** Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access. ### 卡片 101 **问题** How does data masking protect information? **答案** It hides selected values or characters while preserving a usable representation. ### 卡片 102 **问题** How can a national requirement affect security governance? **答案** It can impose country-level duties that policies, controls, records, and oversight must satisfy. ### 卡片 103 **问题** What do integrations and APIs provide to security orchestration? **答案** Defined interfaces for exchanging data and triggering actions across tools without manual handoffs. ### 卡片 104 **问题** What makes a compliance report external? **答案** It is prepared for a regulator, customer, auditor, partner, or other party outside the organization. ### 卡片 105 **问题** What does a cryptographic algorithm define? **答案** The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data. ### 卡片 106 **问题** Why compare systems with a secure baseline regularly? **答案** To detect drift, unauthorized changes, and missing hardening. ### 卡片 107 **问题** What does integrity protect? **答案** The accuracy and completeness of data and systems against unauthorized change. ### 卡片 108 **问题** What does vulnerability classification organize? **答案** Findings into meaningful types or categories so teams can route, compare, and remediate them consistently. ### 卡片 109 **问题** What does a password standard define? **答案** Mandatory, measurable requirements for creating, storing, using, and changing passwords. ### 卡片 110 **问题** What technology capacity must a recovery design plan for? **答案** The compute, storage, software, licenses, and supporting services needed to meet recovery demand. ### 卡片 111 **问题** What does a confidential data classification indicate? **答案** Disclosure is limited to authorized people because exposure could harm the organization or affected parties. ### 卡片 112 **问题** What makes a vendor assessment independent? **答案** The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria. ### 卡片 113 **问题** What lets a worm spread without attaching itself to another file? **答案** It is a standalone program that replicates across reachable systems or services. ### 卡片 114 **问题** What is microsegmentation? **答案** Fine-grained isolation of individual workloads or small groups with explicit communication policy. ### 卡片 115 **问题** What can application logs reveal? **答案** Transactions, errors, user actions, and application-specific security events. ### 卡片 116 **问题** What does deploying a secure baseline require? **答案** Applying the approved settings consistently to the intended resources and verifying the realized configuration. ### 卡片 117 **问题** How can resource-provisioning automation improve security? **答案** It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls. ### 卡片 118 **问题** What does availability protect? **答案** Reliable, timely access to systems and data when authorized users need them. ### 卡片 119 **问题** Why must a change request describe business impact? **答案** So approvers can weigh the benefit, risk, outage, and affected users before authorizing it. ### 卡片 120 **问题** What does an authenticated vulnerability scan add? **答案** Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss. ### 卡片 121 **问题** What does a change-management procedure specify? **答案** The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change. ### 卡片 122 **问题** What is a sanction for noncompliance? **答案** A formal penalty or restriction imposed by an authority for failing to meet a requirement. ### 卡片 123 **问题** How can email deliver a security attack? **答案** It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient. ### 卡片 124 **问题** What is an internal compliance audit? **答案** An organization-led examination of whether selected operations and controls meet defined requirements. ### 卡片 125 **问题** What is a Trojan? **答案** Malware disguised as legitimate or desirable software. ### 卡片 126 **问题** What is clustering? **答案** Multiple systems work together to provide a service and tolerate member failure. ### 卡片 127 **问题** What makes data regulated? **答案** A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties. ### 卡片 128 **问题** What does a wireless heat map show? **答案** Measured or modeled signal strength and coverage across a physical area. ### 卡片 129 **问题** How should vendor criticality affect due diligence? **答案** Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval. ### 卡片 130 **问题** How can a digital signature support non-repudiation? **答案** It provides evidence that the holder of a private key signed specific data. ### 卡片 131 **问题** What should vulnerability prioritization consider beyond severity? **答案** Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations. ### 卡片 132 **问题** What is a security guideline? **答案** Recommended practice that allows judgment unless adopted as a requirement. ### 卡片 133 **问题** What usually distinguishes a nation-state threat actor? **答案** Strategic objectives, substantial resources, patience, and advanced operational capability. ### 卡片 134 **问题** What is spyware? **答案** Software that secretly collects information about a user or system. ### 卡片 135 **问题** Why maintain an allow list for applications? **答案** Only explicitly approved software is permitted to execute. ### 卡片 136 **问题** How can an image become an attack vector? **答案** It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code. ### 卡片 137 **问题** What makes a security control technical? **答案** It is enforced mainly by technology, such as a firewall rule or endpoint policy. ### 卡片 138 **问题** What is identity proofing? **答案** Establishing that a person is who they claim to be before issuing an account or credential. ### 卡片 139 **问题** What is an automated security guardrail? **答案** A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group. ### 卡片 140 **问题** Why assign an owner to a planned change? **答案** To make one party accountable for coordination, execution, and follow-through. ### 卡片 141 **问题** How can national privacy law affect data handling? **答案** It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights. ### 卡片 142 **问题** What is continuity of operations? **答案** Maintaining essential functions during disruption and restoring supporting capabilities in a planned order. ### 卡片 143 **问题** What security tradeoff comes with BYOD? **答案** The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle. ### 卡片 144 **问题** How should policies and handbooks support security training? **答案** They provide accessible, current rules and reporting steps that training can apply to real situations. ### 卡片 145 **问题** What is a keylogger? **答案** A tool that records keystrokes to capture data such as credentials. ### 卡片 146 **问题** What makes information a trade secret? **答案** It provides business value because it is not generally known and is protected through reasonable secrecy measures. ### 卡片 147 **问题** What does authentication establish? **答案** It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim. ### 卡片 148 **问题** What risk comes from an untrusted file attachment? **答案** Opening or parsing it can execute malicious code or expose data. ### 卡片 149 **问题** How does risk tolerance affect vulnerability remediation? **答案** It sets how much residual exposure the organization will accept and how quickly a finding must be treated. ### 卡片 150 **问题** How can a global requirement affect security governance? **答案** It can require a common control and oversight approach across multiple countries while local obligations still apply. ### 卡片 151 **问题** Why should questionnaire answers be supported by evidence? **答案** Self-assertions alone may not prove that controls are designed or operating effectively. ### 卡片 152 **问题** What is an independent third-party audit? **答案** An external party with suitable independence examines evidence against defined criteria. ### 卡片 153 **问题** What do account provisioning and deprovisioning do? **答案** Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed. ### 卡片 154 **问题** What is an unskilled attacker commonly called? **答案** A script kiddie: someone who relies on tools or instructions created by others. ### 卡片 155 **问题** What is a rootkit? **答案** Software designed to maintain privileged, concealed access by altering or subverting the system. ### 卡片 156 **问题** What does an access control list enforce? **答案** Explicit permit or deny rules for subjects, traffic, or actions on a protected resource. ### 卡片 157 **问题** What should system security monitoring observe? **答案** Host state and behavior such as processes, authentication, configuration, resource use, and security events. ### 卡片 158 **问题** What can operating-system security logs reveal? **答案** Authentication, privilege use, policy changes, services, and other host security events. ### 卡片 159 **问题** Why isolate operational technology from general business networks? **答案** To limit attack paths into safety- and availability-critical processes. ### 卡片 160 **问题** What is the COPE mobile deployment model? **答案** The organization owns the device but permits defined personal use while retaining management control. ### 卡片 161 **问题** What security work belongs in asset acquisition and procurement? **答案** Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment. ### 卡片 162 **问题** How can user-provisioning automation improve security? **答案** It creates, changes, and removes access from authoritative identity events with consistent approvals and logging. ### 卡片 163 **问题** What people capacity must a continuity plan account for? **答案** Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services. ### 卡片 164 **问题** What do authorization models define? **答案** How permissions are assigned to authenticated subjects and evaluated for requested actions. ### 卡片 165 **问题** Why are removable devices an attack vector? **答案** They can introduce malware or remove data while bypassing network controls. ### 卡片 166 **问题** What should predeployment change-test results show? **答案** Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects. ### 卡片 167 **问题** What is the time-of-use stage of a race-condition vulnerability? **答案** The application acts on a resource after the check, creating a gap in which another process may change the resource. ### 卡片 168 **问题** What is data in use? **答案** Data actively processed in memory or by an application. ### 卡片 169 **问题** What does open-source vulnerability intelligence contribute? **答案** Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure. ### 卡片 170 **问题** What can file-integrity monitoring detect? **答案** Unexpected changes to protected files, directories, or configuration. ### 卡片 171 **问题** Why should deprovisioning be prompt? **答案** Former users or roles should not retain usable access. ### 卡片 172 **问题** What is an acceptable use policy? **答案** Rules for permitted and prohibited use of organizational systems, accounts, and data. ### 卡片 173 **问题** What makes a compliance report internal? **答案** It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action. ### 卡片 174 **问题** What is a logic bomb? **答案** Malicious code that activates when a specified condition or time is reached. ### 卡片 175 **问题** What does a right-to-audit clause provide? **答案** Contractual authority to inspect or obtain evidence about agreed controls. ### 卡片 176 **问题** Where should a forward proxy sit in an enterprise traffic path? **答案** Between clients and external services so outbound requests pass through policy and logging before reaching destinations. ### 卡片 177 **问题** Which cues should make a message look suspicious? **答案** Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment. ### 卡片 178 **问题** What makes a security control managerial? **答案** It directs risk and governance through decisions such as policies, assessments, and oversight. ### 卡片 179 **问题** What is the CYOD mobile deployment model? **答案** The user selects from organization-approved device options that remain subject to corporate security requirements. ### 卡片 180 **问题** How does client-based vulnerable software differ from an agentless exposure? **答案** Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent. ### 卡片 181 **问题** What makes a risk assessment recurring? **答案** It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated. ### 卡片 182 **问题** What does a defensive penetration-testing team practice? **答案** Detection, investigation, containment, and improvement while authorized offensive activity tests the environment. ### 卡片 183 **问题** In a zero-trust data plane, what can the subject or system represent? **答案** The user, device, workload, or service requesting access to a protected resource. ### 卡片 184 **问题** What primarily motivates a hacktivist? **答案** A political, social, or ideological cause. ### 卡片 185 **问题** What is bloatware? **答案** Unnecessary preinstalled software that consumes resources and can expand the attack surface. ### 卡片 186 **问题** Why keep endpoint-protection signatures and engines current? **答案** They need current detection logic to recognize newly identified malware and exploit behavior. ### 卡片 187 **问题** What should application security monitoring observe? **答案** Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise. ### 卡片 188 **问题** What is role-based access control? **答案** Permissions are assigned to roles, and identities receive access through their roles. ### 卡片 189 **问题** What is geographic dispersal? **答案** Placing redundant resources in separate locations so one regional event does not affect all copies. ### 卡片 190 **问题** What is a malicious update? **答案** An update that has been intentionally altered or distributed to install harmful code through a trusted update path. ### 卡片 191 **问题** What does static application analysis inspect? **答案** Source code, bytecode, or compiled code without executing the application. ### 卡片 192 **问题** What does a firewall access list define? **答案** An ordered set of traffic-matching conditions and the action applied when a condition matches. ### 卡片 193 **问题** What does a disaster recovery policy establish? **答案** Management expectations for restoring technology and data after a disruptive event. ### 卡片 194 **问题** How does logical segmentation separate workloads that share physical infrastructure? **答案** It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware. ### 卡片 195 **问题** How should IDS and IPS placement differ? **答案** An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic. ### 卡片 196 **问题** What should automated ticket creation capture? **答案** The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event. ### 卡片 197 **问题** What makes information intellectual property? **答案** It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret. ### 卡片 198 **问题** What is a backout plan? **答案** Predefined steps for safely reversing a failed or harmful change. ### 卡片 199 **问题** Why is an unsecure wireless network an attack vector? **答案** Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak. ### 卡片 200 **问题** What is physical brute force? **答案** Using force to defeat a lock, barrier, enclosure, or other physical control. ### 卡片 201 **问题** What is application sandboxing? **答案** Running code in a constrained environment with limited access to the host and data. ### 卡片 202 **问题** Why assign an asset owner? **答案** One accountable party must decide its use, protection, and lifecycle. ### 卡片 203 **问题** What happens during risk identification? **答案** Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm. ### 卡片 204 **问题** What should an SLA state about breach notification? **答案** The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties. ### 卡片 205 **问题** How do due diligence and due care differ in compliance? **答案** Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require. ### 卡片 206 **问题** What is attribute-based access control? **答案** Policy evaluates attributes of the subject, resource, action, and environment. ### 卡片 207 **问题** What does a zero-trust policy engine do? **答案** It evaluates policy and signals to decide whether access should be allowed. ### 卡片 208 **问题** How does a cloud responsibility matrix allocate security duties? **答案** It maps each security task to the provider, the customer, or both, according to the service model and agreement. ### 卡片 209 **问题** Where should a load balancer sit in a service path? **答案** In front of service instances so it can route requests to healthy backends. ### 卡片 210 **问题** What should the security team do with a reported suspicious message? **答案** Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take. ### 卡片 211 **问题** What makes an operating-system vulnerability high impact? **答案** It can affect every application and security control that relies on the compromised OS. ### 卡片 212 **问题** What does dynamic application analysis inspect? **答案** The behavior and externally visible weaknesses of a running application. ### 卡片 213 **问题** How can false-positive trends affect IDS or IPS tuning? **答案** Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic. ### 卡片 214 **问题** What does a business continuity policy establish? **答案** Management expectations for sustaining and restoring critical business functions. ### 卡片 215 **问题** What is a hot recovery site? **答案** A ready, synchronized environment intended to take over quickly. ### 卡片 216 **问题** What makes an insider threat distinct? **答案** The actor has legitimate access or organizational knowledge that can be misused. ### 卡片 217 **问题** What is RFID cloning? **答案** Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections. ### 卡片 218 **问题** Why apply vendor security updates promptly? **答案** They remove known weaknesses before attackers can exploit the unpatched exposure. ### 卡片 219 **问题** What should infrastructure security monitoring observe? **答案** Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity. ### 卡片 220 **问题** What can firewall logs reveal? **答案** Allowed or denied network connections across controlled boundaries. ### 卡片 221 **问题** Why minimize open service ports? **答案** Each reachable service adds code, configuration, and authentication paths an attacker can probe. ### 卡片 222 **问题** What is threat hunting? **答案** A proactive search for evidence of malicious activity that existing detections have not confirmed. ### 卡片 223 **问题** What triggers an ad hoc risk assessment? **答案** A specific change, incident, finding, or decision that requires evaluation outside the regular schedule. ### 卡片 224 **问题** What makes an assessment external? **答案** A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions. ### 卡片 225 **问题** What is data sovereignty? **答案** The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled. ### 卡片 226 **问题** What security boundary does a cellular connection create for a mobile device? **答案** It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy. ### 卡片 227 **问题** What makes a security control operational? **答案** It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures. ### 卡片 228 **问题** What is discretionary access control? **答案** A resource owner can decide who receives access, within system policy. ### 卡片 229 **问题** How can careful automation support employee retention? **答案** It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people. ### 卡片 230 **问题** Why does ease of deployment matter in an architecture decision? **答案** A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden. ### 卡片 231 **问题** What tradeoff comes with placing an NGFW inline? **答案** It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed. ### 卡片 232 **问题** What does a zero-trust policy administrator do? **答案** It carries out the policy engine's decision, such as creating or ending a session. ### 卡片 233 **问题** What should a master service agreement define for data return and deletion? **答案** The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends. ### 卡片 234 **问题** What is an environmental physical attack? **答案** Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities. ### 卡片 235 **问题** When should a maintenance window be chosen? **答案** When disruption and rollback can be managed with the least business impact. ### 卡片 236 **问题** What is memory injection? **答案** Placing malicious code or data into another process's memory so it executes in that process's context. ### 卡片 237 **问题** What does software composition analysis find? **答案** Known risks and license information in third-party dependencies. ### 卡片 238 **问题** What is DNS filtering? **答案** Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate. ### 卡片 239 **问题** What should an incident response policy establish? **答案** Authority, scope, reporting duties, and organizational commitment for incident handling. ### 卡片 240 **问题** How can noncompliance cause reputational damage? **答案** Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty. ### 卡片 241 **问题** What does full-disk encryption protect? **答案** All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection. ### 卡片 242 **问题** Why are default credentials dangerous? **答案** They are widely known or easily discovered and often remain unchanged. ### 卡片 243 **问题** What makes a risk assessment one-time? **答案** It evaluates a defined decision or scope once without an established repeating cadence. ### 卡片 244 **问题** What is a warm recovery site? **答案** A partially equipped environment that needs some data restoration or configuration before use. ### 卡片 245 **问题** What does application input validation do? **答案** It checks that input matches the expected type, length, range, and format before use. ### 卡片 246 **问题** What should an asset inventory record besides a device name? **答案** Identifiers, owner, location, status, classification, dependencies, and supported version as applicable. ### 卡片 247 **问题** What is mandatory access control? **答案** A central authority enforces access through labels and rules that ordinary owners cannot override. ### 卡片 248 **问题** What security benefit does infrastructure as code provide? **答案** Repeatable, reviewable deployments that reduce undocumented configuration drift. ### 卡片 249 **问题** When should a public service control fail closed? **答案** When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path. ### 卡片 250 **问题** What should users do with a suspicious message? **答案** Report it through the approved channel without interacting with its links or attachments. ### 卡片 251 **问题** What usually motivates organized cybercrime? **答案** Financial gain through scalable or repeatable criminal activity. ### 卡片 252 **问题** How can malicious code support a network attack? **答案** It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution. ### 卡片 253 **问题** When is virtual patching useful? **答案** When a network or application control can block exploit traffic before the underlying system can be patched. ### 卡片 254 **问题** What does security-monitoring reporting provide? **答案** A summarized, audience-appropriate view of findings, trends, risk, and response status. ### 卡片 255 **问题** What does data geolocation identify? **答案** The physical or legal location where data is stored, processed, or transmitted. ### 卡片 256 **问题** What does a zero-trust policy enforcement point do? **答案** It enables, monitors, and terminates the connection between a subject and a resource. ### 卡片 257 **问题** What is cryptographic key exchange? **答案** A method for parties to establish shared key material over an untrusted channel. ### 卡片 258 **问题** How can a vendor become a supply-chain attack vector? **答案** An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers. ### 卡片 259 **问题** Why can legacy hardware remain vulnerable? **答案** It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls. ### 卡片 260 **问题** What can proprietary vulnerability intelligence add beyond open sources? **答案** Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship. ### 卡片 261 **问题** How does a centralized proxy apply web filtering? **答案** It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic. ### 卡片 262 **问题** How can continuous integration and testing improve security automation? **答案** Changes receive repeatable checks before deployment instead of reaching production unvalidated. ### 卡片 263 **问题** What is containment? **答案** Limiting an incident's spread or damage while preserving necessary operations and evidence. ### 卡片 264 **问题** What is a software development lifecycle policy meant to ensure? **答案** Security requirements and checks are integrated throughout design, development, release, and maintenance. ### 卡片 265 **问题** What makes risk assessment continuous? **答案** Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review. ### 卡片 266 **问题** What is a memorandum of agreement? **答案** A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction. ### 卡片 267 **问题** What makes a penetration test integrated? **答案** Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response. ### 卡片 268 **问题** How does a DNS amplification attack magnify traffic? **答案** It sends small spoofed queries that trigger larger replies toward the victim. ### 卡片 269 **问题** Why does ease of recovery matter in an architecture decision? **答案** The design should let operators restore service and trusted state without fragile, slow, or undocumented steps. ### 卡片 270 **问题** What does 802.1X control before a device receives normal network access? **答案** Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed. ### 卡片 271 **问题** What is rule-based access control? **答案** System-wide rules grant or deny access based on conditions such as network, time, or action. ### 卡片 272 **问题** What is mobile device management? **答案** Central enrollment, configuration, monitoring, and enforcement for managed mobile devices. ### 卡片 273 **问题** What tradeoff comes with a cold recovery site? **答案** It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation. ### 卡片 274 **问题** Why identify stakeholders before approving a security-sensitive change? **答案** They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss. ### 卡片 275 **问题** How do attestation and acknowledgement differ? **答案** Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement. ### 卡片 276 **问题** What does zero-trust adaptive identity mean? **答案** Access decisions adjust to current risk signals rather than relying only on a static login. ### 卡片 277 **问题** What makes a security control physical? **答案** It protects facilities or equipment through a tangible barrier or mechanism. ### 卡片 278 **问题** What is geo-fencing for data? **答案** Enforcing location-based boundaries on where data or services may be accessed or operated. ### 卡片 279 **问题** What does a Trusted Platform Module protect? **答案** Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation. ### 卡片 280 **问题** Why can a managed service provider amplify risk? **答案** Its privileged access and shared tooling can provide a path into many customers. ### 卡片 281 **问题** What does probability express in risk analysis? **答案** A quantified chance that a defined event will occur within stated conditions or time. ### 卡片 282 **问题** Why can shadow IT create a threat? **答案** It bypasses security review, inventory, monitoring, and supported configuration. ### 卡片 283 **问题** What is on-path interception? **答案** An attacker positions between communicating parties to observe or alter traffic. ### 卡片 284 **问题** Why include encryption in a system-hardening baseline? **答案** It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary. ### 卡片 285 **问题** Why tune security alerts? **答案** To keep useful detections while reducing noise that wastes analyst attention. ### 卡片 286 **问题** What can IPS or IDS logs contribute to an investigation? **答案** The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity. ### 卡片 287 **问题** What is VM escape? **答案** A vulnerability that lets code break out of a virtual machine and affect the host or another guest. ### 卡片 288 **问题** How can segmentation reduce vulnerability exposure before a patch is available? **答案** It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement. ### 卡片 289 **问题** Why should firewall policy name the required ports and protocols explicitly? **答案** Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths. ### 卡片 290 **问题** What is a change management policy meant to control? **答案** How changes are requested, assessed, approved, tested, implemented, and reviewed. ### 卡片 291 **问题** What is a hybrid-cloud architecture? **答案** An environment that integrates private or on-premises resources with public cloud services. ### 卡片 292 **问题** How do AH and ESP differ in the security services they can provide? **答案** AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration. ### 卡片 293 **问题** What makes user behavior risky? **答案** It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths. ### 卡片 294 **问题** What is least privilege? **答案** Granting only the access needed for the required task and no more. ### 卡片 295 **问题** What do Secure, HttpOnly, and SameSite cookie attributes restrict? **答案** Transmission to HTTPS, script access, and cross-site sending, respectively. ### 卡片 296 **问题** Why discover unmanaged assets? **答案** Unknown systems cannot be patched, monitored, or governed reliably. ### 卡片 297 **问题** What is a service-level agreement? **答案** Measurable service commitments and remedies, such as availability or response targets. ### 卡片 298 **问题** What should govern automated security escalation? **答案** Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely. ### 卡片 299 **问题** What is platform diversity as a resilience strategy? **答案** Using different implementations so one common flaw or failure is less likely to affect every copy. ### 卡片 300 **问题** How can replayed session material affect an application? **答案** It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action. ### 卡片 301 **问题** What is an implicit trust zone in zero trust? **答案** A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement. ### 卡片 302 **问题** What does salting a password hash accomplish? **答案** It makes identical passwords hash differently and defeats precomputed hash tables. ### 卡片 303 **问题** What is spear phishing? **答案** Phishing tailored to a specific person, role, or organization. ### 卡片 304 **问题** What is eradication? **答案** Removing the attacker's access, malicious artifacts, and exploited conditions. ### 卡片 305 **问题** Who is a risk owner? **答案** The person accountable for deciding and monitoring how a specific risk is handled. ### 卡片 306 **问题** What does a partially known penetration-test environment provide? **答案** The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold. ### 卡片 307 **问题** What is a microservices architecture? **答案** An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries. ### 卡片 308 **问题** What is a jump server? **答案** A hardened intermediary used to reach systems in a restricted management network. ### 卡片 309 **问题** What can happen when a configuration change is made without dependency analysis? **答案** A downstream service can fail even when the changed component works. ### 卡片 310 **问题** What is resource reuse exposure? **答案** Sensitive data from a previous use remains accessible when storage or memory is reassigned. ### 卡片 311 **问题** Why does financial information require explicit protection? **答案** It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed. ### 卡片 312 **问题** What does CVE provide? **答案** A common identifier for a publicly disclosed vulnerability. ### 卡片 313 **问题** Where can DLP controls operate? **答案** On endpoints, networks, email, and cloud services, depending on the product and visibility. ### 卡片 314 **问题** What does privileged password vaulting protect? **答案** It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password. ### 卡片 315 **问题** What does an access-control standard define? **答案** Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access. ### 卡片 316 **问题** How can automation support compliance monitoring? **答案** It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context. ### 卡片 317 **问题** What does static code analysis examine? **答案** Source or compiled code for weakness patterns without executing the application. ### 卡片 318 **问题** What actor attribute describes funding, time, and personnel? **答案** Resources. ### 卡片 319 **问题** What is DNS poisoning? **答案** Introducing false DNS data so names resolve to attacker-chosen destinations. ### 卡片 320 **问题** Why change default credentials during hardening? **答案** Default secrets are predictable and commonly targeted. ### 卡片 321 **问题** What does quarantine do after a security alert? **答案** It restricts a suspected asset or object while analysts validate and remediate the risk. ### 卡片 322 **问题** What does key stretching do for stored passwords? **答案** It deliberately makes each password guess more computationally expensive. ### 卡片 323 **问题** What is smishing? **答案** Phishing delivered through SMS or another text-messaging service. ### 卡片 324 **问题** What is qualitative risk analysis? **答案** Using descriptive scales such as low, medium, and high to compare likelihood and impact. ### 卡片 325 **问题** What is a master service agreement? **答案** An umbrella contract establishing general legal and commercial terms for ongoing work. ### 卡片 326 **问题** What is threat scope reduction? **答案** Narrowing the systems, privileges, or paths an attacker can reach. ### 卡片 327 **问题** Why use a third-party cloud service instead of building locally? **答案** It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk. ### 卡片 328 **问题** What should determine security-device placement? **答案** The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs. ### 卡片 329 **问题** What does situational awareness mean for a user? **答案** Notice the people, devices, requests, location, and context around a task before acting. ### 卡片 330 **问题** What does a failover test validate? **答案** That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions. ### 卡片 331 **问题** What is a preventive control meant to do? **答案** Stop an unwanted event before it succeeds. ### 卡片 332 **问题** What is just-in-time privileged access? **答案** Elevated access is granted only when needed and expires after a short approved period. ### 卡片 333 **问题** What safeguard should security-group automation enforce? **答案** Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point. ### 卡片 334 **问题** How does a reflected DDoS attack hide and multiply sources? **答案** The attacker spoofs the victim's address so many third-party services send their replies to the victim. ### 卡片 335 **问题** What is a security misconfiguration? **答案** An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource. ### 卡片 336 **问题** Why can the same vulnerability have different organizational impact? **答案** Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation. ### 卡片 337 **问题** What does URL scanning evaluate before a user opens a web destination? **答案** The address, redirect chain, reputation, category, and known threat indicators associated with the destination. ### 卡片 338 **问题** What is the board's security governance role? **答案** Provide oversight, set risk direction, and hold executives accountable. ### 卡片 339 **问题** What does code signing establish? **答案** That code came from the holder of the signing key and has not changed since signing. ### 卡片 340 **问题** How should an asset's classification affect security operations? **答案** It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact. ### 卡片 341 **问题** How does encryption protect data? **答案** It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data. ### 卡片 342 **问题** What is a secure enclave? **答案** A hardware-isolated execution area intended to protect selected code and data from the rest of the system. ### 卡片 343 **问题** What is business email compromise? **答案** Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release. ### 卡片 344 **问题** What is recovery in incident response? **答案** Restoring services safely, monitoring them, and returning to normal operations. ### 卡片 345 **问题** How is single loss expectancy commonly estimated? **答案** Asset value multiplied by the exposure factor. ### 卡片 346 **问题** What does an unknown penetration-test environment provide? **答案** The tester begins with little or no internal information, modeling an external attacker's discovery process. ### 卡片 347 **问题** What security boundary does a hypervisor provide? **答案** It isolates virtual machines while controlling their access to shared hardware. ### 卡片 348 **问题** Why does a TLS tunnel not protect a compromised endpoint? **答案** TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption. ### 卡片 349 **问题** Why update diagrams after an infrastructure change? **答案** Operations and incident responders need the documentation to match the deployed environment. ### 卡片 350 **问题** What does privacy ownership assign? **答案** An accountable role for privacy decisions, obligations, data inventory, and corrective action. ### 卡片 351 **问题** What does a security control gap analysis compare? **答案** The controls required for the target state with the controls currently in place. ### 卡片 352 **问题** Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external? **答案** External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization. ### 卡片 353 **问题** What is application privilege escalation? **答案** Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted. ### 卡片 354 **问题** What risk remains when unnecessary software is left installed? **答案** Its code, services, dependencies, and privileges add attack surface even when users do not need it. ### 卡片 355 **问题** What does SCAP standardize? **答案** Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information. ### 卡片 356 **问题** What can packet capture reveal? **答案** Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized. ### 卡片 357 **问题** What makes a privileged credential ephemeral? **答案** It is created for a limited task or session and expires or is destroyed automatically after that use. ### 卡片 358 **问题** How do a statement of work and a work order differ? **答案** A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement. ### 卡片 359 **问题** Why might multi-cloud improve resilience? **答案** A provider-wide failure need not stop workloads that can run independently elsewhere. ### 卡片 360 **问题** How can a service provider introduce a supply-chain vulnerability? **答案** Its privileged access, hosted service, or compromised integration can expose customers that depend on it. ### 卡片 361 **问题** What is a false positive in vulnerability scanning? **答案** A reported weakness that is not actually present or exploitable in the assessed context. ### 卡片 362 **问题** How do EDR and XDR differ? **答案** EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains. ### 卡片 363 **问题** What should onboarding and offboarding procedures coordinate? **答案** Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship. ### 卡片 364 **问题** How should an organization harden managed mobile devices? **答案** Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe. ### 卡片 365 **问题** What is a certificate signing request? **答案** A request containing a public key and subject information for a certificate authority to sign. ### 卡片 366 **问题** What is pretexting? **答案** Using a fabricated role or situation to make a request seem legitimate. ### 卡片 367 **问题** How is annualized loss expectancy commonly estimated? **答案** Single loss expectancy multiplied by annualized rate of occurrence. ### 卡片 368 **问题** What security consequence follows from containers sharing a kernel? **答案** A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter. ### 卡片 369 **问题** Where does 802.1X enforce a network admission decision? **答案** At the controlled switch port or wireless access point before normal network access is granted. ### 卡片 370 **问题** What should insider-threat awareness teach? **答案** Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels. ### 卡片 371 **问题** What access action is suitable for careful automation? **答案** Enabling or disabling a defined service or account from an approved lifecycle or incident event. ### 卡片 372 **问题** What is an evil twin? **答案** A rogue wireless network made to resemble a legitimate one so users connect to it. ### 卡片 373 **问题** Does non-human-readable data need less protection? **答案** No. Encoded or machine-readable data can carry the same sensitive meaning and impact. ### 卡片 374 **问题** What does authenticating a system establish? **答案** It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents. ### 卡片 375 **问题** What does LDAP provide in identity systems? **答案** A standard protocol for querying and modifying directory entries such as users, groups, and attributes. ### 卡片 376 **问题** What is a deterrent control meant to do? **答案** Discourage an attacker from attempting an unwanted action. ### 卡片 377 **问题** Why update procedures after changing a security control? **答案** Staff need accurate steps for operating, monitoring, and recovering the new control. ### 卡片 378 **问题** How does OCSP differ from a certificate revocation list? **答案** OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers. ### 卡片 379 **问题** What is the goal of data exfiltration? **答案** Remove data from its authorized environment without permission. ### 卡片 380 **问题** What is a watering-hole attack? **答案** Compromising a site frequented by the intended targets so their visits expose them. ### 卡片 381 **问题** How can a hardware provider introduce a supply-chain vulnerability? **答案** A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment. ### 卡片 382 **问题** What is application forgery? **答案** Creating or altering a request, token, or object so the application treats it as authentic. ### 卡片 383 **问题** How does least privilege mitigate compromise? **答案** It limits the actions and resources available to a compromised account or process. ### 卡片 384 **问题** What is serverless computing? **答案** A model where the provider manages servers and the customer deploys event-driven code or functions. ### 卡片 385 **问题** What makes an infrastructure control effective for a specific risk? **答案** Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat. ### 卡片 386 **问题** What does parallel recovery processing test? **答案** Whether primary and alternate environments can run together consistently before a controlled cutover. ### 卡片 387 **问题** Which password-authentication method does WPA3-Personal use? **答案** Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing. ### 卡片 388 **问题** How does data retention affect asset disposal? **答案** Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction. ### 卡片 389 **问题** What is a false negative in vulnerability scanning? **答案** A real weakness that the assessment fails to report. ### 卡片 390 **问题** What does recurring security scanning add to monitoring? **答案** Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes. ### 卡片 391 **问题** What should guide port selection for a secure protocol? **答案** Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths. ### 卡片 392 **问题** What does forensic acquisition create? **答案** A controlled, documented copy or collection of relevant evidence while preserving its integrity and context. ### 卡片 393 **问题** How do system owners and data owners divide security accountability? **答案** A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements. ### 卡片 394 **问题** What does likelihood express in risk analysis? **答案** A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable. ### 卡片 395 **问题** What is a memorandum of understanding? **答案** A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction. ### 卡片 396 **问题** What does the right to be forgotten generally require? **答案** Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies. ### 卡片 397 **问题** What does an audit committee oversee? **答案** Audit independence, plans, significant findings, management responses, and corrective-action follow-through. ### 卡片 398 **问题** What does identity interoperability require? **答案** Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems. ### 卡片 399 **问题** How does a bollard protect a facility? **答案** It blocks or redirects vehicles before they can reach a protected area. ### 卡片 400 **问题** How can hashing protect a downloaded file? **答案** A trusted digest lets the recipient detect whether the file changed. ### 卡片 401 **问题** What is a credential replay attack? **答案** Using captured valid credentials or tokens again without needing to discover the secret. ### 卡片 402 **问题** How can automation complexity create security risk? **答案** Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse. ### 卡片 403 **问题** What must an architecture provide when a component cannot be patched? **答案** Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired. ### 卡片 404 **问题** What makes remote access secure? **答案** Controlled, authenticated, encrypted access to a private resource from outside its local trusted network. ### 卡片 405 **问题** What should users verify before connecting removable media or a cable? **答案** That the device and connection are approved, expected, and handled under organizational policy. ### 卡片 406 **问题** What is a self-signed certificate? **答案** A certificate signed by its own private key rather than by a separate trusted issuer. ### 卡片 407 **问题** What is brand impersonation? **答案** Using a trusted organization's identity or look to deceive people. ### 卡片 408 **问题** What characterizes a conservative risk appetite? **答案** A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity. ### 卡片 409 **问题** What should a managed mobile device verify before using Wi-Fi? **答案** The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic. ### 卡片 410 **问题** What is a zero-day vulnerability? **答案** A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw. ### 卡片 411 **问题** What does verification confirm after vulnerability remediation? **答案** Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope. ### 卡片 412 **问题** What is user and entity behavior analytics? **答案** Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services. ### 卡片 413 **问题** What does a physical security policy establish? **答案** Required protection for facilities, people, equipment, entry, monitoring, and response to physical events. ### 卡片 414 **问题** What does a UPS provide? **答案** Immediate short-term power and power conditioning while systems shut down or alternate power starts. ### 卡片 415 **问题** What is a nondisclosure agreement? **答案** A contract restricting use and disclosure of defined confidential information. ### 卡片 416 **问题** What should be checked before assigning a user permission? **答案** The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused. ### 卡片 417 **问题** How does espionage differ from ordinary theft? **答案** It seeks confidential intelligence for strategic advantage, often while remaining hidden. ### 卡片 418 **问题** What is password spraying? **答案** Trying a small set of common passwords across many accounts to avoid lockouts. ### 卡片 419 **问题** What is the purpose of system isolation during an incident? **答案** Stop harmful communication while preserving the system for response and investigation. ### 卡片 420 **问题** What is a security benchmark? **答案** A documented set of recommended configuration checks for a platform or product. ### 卡片 421 **问题** Which metadata fields give a log record investigative context? **答案** Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID. ### 卡片 422 **问题** What does an access-control vestibule prevent? **答案** It limits tailgating by allowing controlled passage through one door at a time. ### 卡片 423 **问题** What is version control's security value for configuration? **答案** It preserves attributable history and enables review or rollback of changes. ### 卡片 424 **问题** Why use both internal and external compliance monitoring? **答案** Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny. ### 卡片 425 **问题** What distinguishes on-premises architecture? **答案** The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties. ### 卡片 426 **问题** What risk can split tunneling add to a VPN? **答案** The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection. ### 卡片 427 **问题** What is a certificate root of trust? **答案** A trusted root certificate or key from which a client validates a certificate chain. ### 卡片 428 **问题** What is typosquatting? **答案** Registering a look-alike domain based on common typing errors or visual similarity. ### 卡片 429 **问题** What is root-cause analysis? **答案** Identifying the underlying conditions that allowed an incident, not just its visible symptoms. ### 卡片 430 **问题** What is risk tolerance? **答案** The acceptable variation or boundary around a specific objective or risk area. ### 卡片 431 **问题** What is a security self-assessment? **答案** A structured internal evaluation in which the organization measures its own controls against selected criteria. ### 卡片 432 **问题** What does data masking change? **答案** It replaces sensitive values with altered but usable representations, often preserving format for testing or display. ### 卡片 433 **问题** How do wireless authentication protocols let clients prove identity securely? **答案** They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange. ### 卡片 434 **问题** Why reconcile inventory with network discovery? **答案** Differences expose missing records, retired systems, or unauthorized devices. ### 卡片 435 **问题** Why does sideloading raise mobile risk? **答案** It can bypass store review, signing policy, and managed application controls. ### 卡片 436 **问题** What does an information-sharing organization add to vulnerability management? **答案** Sector or community intelligence about relevant threats, incidents, and defensive action. ### 卡片 437 **问题** What does a web-filter block rule specify? **答案** The URL, domain, category, reputation, content, user, or context that should prevent a web request. ### 卡片 438 **问题** How do data custodians and data stewards differ? **答案** Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction. ### 卡片 439 **问题** What is a brute-force password attack? **答案** Systematically trying many candidate secrets against an account or protected value. ### 卡片 440 **问题** What is a compensating control? **答案** An alternative safeguard used when the preferred control is impractical or unavailable. ### 卡片 441 **问题** How can location act as an authentication factor? **答案** A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone. ### 卡片 442 **问题** Why must security automation remain supportable? **答案** Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change. ### 卡片 443 **问题** What does a standby generator provide? **答案** Longer-duration power during a utility outage, after a startup delay. ### 卡片 444 **问题** What makes an architecture air-gapped? **答案** It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary. ### 卡片 445 **问题** What is a software-defined WAN? **答案** A centrally managed overlay that selects wide-area paths by policy across underlying network links. ### 卡片 446 **问题** What password-management behavior should awareness training reinforce? **答案** Use unique long passwords through an approved manager and report suspected compromise promptly. ### 卡片 447 **问题** What security value does fencing provide? **答案** It defines and delays entry across a physical perimeter. ### 卡片 448 **问题** What is a wildcard certificate? **答案** A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain. ### 卡片 449 **问题** How does misinformation differ from disinformation? **答案** Misinformation is false regardless of intent; disinformation is deliberately false or misleading. ### 卡片 450 **问题** What is a risk threshold? **答案** A defined level that triggers escalation, treatment, or another required response. ### 卡片 451 **问题** What does a vendor penetration test contribute to assessment? **答案** Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope. ### 卡片 452 **问题** What is the objective of a service-disruption attack? **答案** Make a system or business function unavailable or unreliable. ### 卡片 453 **问题** What is directory traversal? **答案** Manipulating a file path to reach files outside the directory the application intended to expose. ### 卡片 454 **问题** Why decommission an unsupported system? **答案** Removing it eliminates an exposure that can no longer be patched or securely maintained. ### 卡片 455 **问题** Why archive security-monitoring data? **答案** To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system. ### 卡片 456 **问题** What role does RADIUS commonly play in enterprise Wi-Fi? **答案** It centralizes authentication, authorization information, and accounting for network access. ### 卡片 457 **问题** Why separate the requester and approver of a high-risk change? **答案** To reduce error, fraud, and unilateral unauthorized modification. ### 卡片 458 **问题** Why can a jailbroken device violate a security baseline? **答案** It weakens platform isolation and allows unapproved privileged changes. ### 卡片 459 **问题** When is tokenization especially useful? **答案** When a system needs a surrogate value without retaining the original sensitive value in that workflow. ### 卡片 460 **问题** Why can dark-web intelligence affect vulnerability priority? **答案** Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated. ### 卡片 461 **问题** What firewall policy should govern traffic from a screened subnet to internal systems? **答案** Deny it by default and allow only explicitly required flows. ### 卡片 462 **问题** What does SAML commonly carry? **答案** XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity. ### 卡片 463 **问题** What does a security governance committee do? **答案** It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter. ### 卡片 464 **问题** How can global privacy requirements affect one data process? **答案** A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located. ### 卡片 465 **问题** What characterizes an IoT device? **答案** It combines sensing or actuation with network connectivity, often under tight resource and update constraints. ### 卡片 466 **问题** What is a unified threat management appliance? **答案** One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection. ### 卡片 467 **问题** What does a hardware security module provide? **答案** A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys. ### 卡片 468 **问题** A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains? **答案** Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client. ### 卡片 469 **问题** What is a tabletop exercise? **答案** A discussion-based walkthrough of a scenario to test decisions, roles, and procedures. ### 卡片 470 **问题** What does a risk exemption authorize? **答案** A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration. ### 卡片 471 **问题** What is a regulatory examination? **答案** An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements. ### 卡片 472 **问题** What does physical video surveillance primarily provide? **答案** Detection and evidence of activity in monitored areas. ### 卡片 473 **问题** What is a birthday attack against a hash? **答案** Using collision probability to find any two matching digests much faster than targeting one exact preimage. ### 卡片 474 **问题** Why keep backups both onsite and offsite? **答案** Onsite copies support fast recovery, while offsite copies survive a site-wide loss. ### 卡片 475 **问题** How does technical debt affect security automation? **答案** Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely. ### 卡片 476 **问题** What should switch hardening restrict first? **答案** Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration. ### 卡片 477 **问题** What should happen when an asset changes owners? **答案** Inventory, access, support responsibility, and data handling should be updated. ### 卡片 478 **问题** What does evidence of a vendor's internal audits contribute? **答案** It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure. ### 卡片 479 **问题** What is identity attestation? **答案** Evidence that an identity, device, authenticator, or claim has been verified by a trusted process. ### 卡片 480 **问题** Why can standard enterprise patching be unsafe for an RTOS device? **答案** A change can disrupt timing guarantees or certified operational behavior. ### 卡片 481 **问题** What is secure access service edge? **答案** A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources. ### 卡片 482 **问题** What social-engineering habit should awareness training reinforce? **答案** Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity. ### 卡片 483 **问题** How can a software provider introduce a supply-chain vulnerability? **答案** A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers. ### 卡片 484 **问题** Why include internet exposure in remediation priority? **答案** A reachable vulnerable service usually has more attack opportunity than an isolated one. ### 卡片 485 **问题** What does a mail gateway inspect? **答案** Inbound and outbound email for threats, policy violations, spoofing, and sensitive data. ### 卡片 486 **问题** What is a data controller? **答案** The entity that determines why and how personal data is processed. ### 卡片 487 **问题** How does blackmail motivate a cyberattack? **答案** The attacker threatens disclosure or harm unless the victim complies. ### 卡片 488 **问题** What is a downgrade attack? **答案** Forcing parties to use an older or weaker protocol or security mode. ### 卡片 489 **问题** How does encryption mitigate data exposure? **答案** It makes captured data unreadable without the required key. ### 卡片 490 **问题** How do network and web vulnerability scanners differ? **答案** Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses. ### 卡片 491 **问题** How can vulnerability-scan data support an investigation? **答案** It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline. ### 卡片 492 **问题** What is key escrow? **答案** Controlled storage of a recoverable copy of a cryptographic key by an authorized party. ### 卡片 493 **问题** Which human vector commonly uses a fake sign-in page to harvest credentials? **答案** Phishing; the message sends the target to an imitation service that captures the submitted credentials. ### 卡片 494 **问题** What is risk avoidance? **答案** Stopping or not starting the activity that creates the risk. ### 卡片 495 **问题** What is data obfuscation? **答案** Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy. ### 卡片 496 **问题** What is a directive control? **答案** A safeguard that tells people what behavior or action is required. ### 卡片 497 **问题** What does a security guard add that a camera cannot? **答案** Human judgment and an immediate physical response. ### 卡片 498 **问题** Why define restricted activities in change management? **答案** High-risk actions can then require extra authorization, separation of duties, or a prohibited window. ### 卡片 499 **问题** What contractual impact can noncompliance create? **答案** It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach. ### 卡片 500 **问题** What should determine backup frequency? **答案** The recovery point objective, data-change rate, business impact, and available replication or storage capacity. ### 卡片 501 **问题** What should router hardening protect? **答案** Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy. ### 卡片 502 **问题** What problem does OAuth 2.0 address? **答案** Delegated authorization: a client obtains limited access to a resource without receiving the user's password. ### 卡片 503 **问题** What does SCADA do? **答案** It provides supervisory monitoring and control across distributed industrial equipment. ### 卡片 504 **问题** How does a Layer 3/4 firewall rule differ from a Layer 7 rule? **答案** Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions. ### 卡片 505 **问题** What distinguishes a computer virus? **答案** It attaches to a host file or program and spreads when that infected host executes or is shared. ### 卡片 506 **问题** What does a key management system coordinate? **答案** Secure key creation, storage, access, rotation, revocation, recovery, and destruction. ### 卡片 507 **问题** How can an unsecure wired network expose traffic? **答案** An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak. ### 卡片 508 **问题** Why is vulnerable device firmware hard to remediate? **答案** Firmware updates may be rare, vendor-dependent, or impossible after support ends. ### 卡片 509 **问题** What does patching change in vulnerability remediation? **答案** It installs the vendor's corrected code or configuration to remove the underlying software weakness. ### 卡片 510 **问题** What does DMARC add to SPF and DKIM? **答案** Domain alignment, receiver policy, and reporting for messages claiming the visible From domain. ### 卡片 511 **问题** How does automation improve security efficiency? **答案** It performs repeatable actions quickly and consistently while reducing manual handoffs and rework. ### 卡片 512 **问题** What is a simulation exercise? **答案** A more realistic practice in which participants respond to injected events using operational processes. ### 卡片 513 **问题** What is a data processor? **答案** An entity that processes personal data on behalf of a controller. ### 卡片 514 **问题** What is risk mitigation? **答案** Reducing likelihood, impact, or both through controls or process changes. ### 卡片 515 **问题** Why monitor a vendor after onboarding? **答案** Security posture, ownership, services, incidents, and dependencies can change. ### 卡片 516 **问题** What does a physical penetration test assess? **答案** Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules. ### 卡片 517 **问题** Why use access badges at a facility? **答案** To associate entry attempts with authorized identities and enforce access rules. ### 卡片 518 **问题** How does permission restriction protect data? **答案** Only authorized identities receive the actions and scope their roles require. ### 卡片 519 **问题** What is the usual objective of ransomware extortion? **答案** Force payment by denying access, threatening disclosure, or both. ### 卡片 520 **问题** What does impossible travel indicate? **答案** One identity appears to authenticate from distant locations too quickly for legitimate travel. ### 卡片 521 **问题** What is configuration enforcement? **答案** Continuously applying or restoring approved settings so systems do not remain in an insecure state. ### 卡片 522 **问题** What does a web vulnerability scanner inspect? **答案** Running web behavior for issues such as unsafe input handling and insecure configuration. ### 卡片 523 **问题** How does cost affect an architecture choice? **答案** It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life. ### 卡片 524 **问题** What does EAP provide with 802.1X? **答案** A framework for carrying an authentication method between the supplicant and authentication infrastructure. ### 卡片 525 **问题** What should operational-security training help users protect? **答案** Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence. ### 卡片 526 **问题** What does a time-of-day access rule do? **答案** Allows or denies a requested action according to an approved schedule. ### 卡片 527 **问题** What should cloud infrastructure hardening establish? **答案** Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift. ### 卡片 528 **问题** What should an asset owner ensure during offboarding? **答案** Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process. ### 卡片 529 **问题** Why encrypt backups? **答案** Backup media and transfers can expose the same sensitive data as production systems. ### 卡片 530 **问题** What is steganography? **答案** Hiding the existence of data inside another medium rather than merely encrypting its contents. ### 卡片 531 **问题** Which human vector uses a fabricated authority role to justify a sensitive request? **答案** Pretexting; the attacker invents a credible role and situation to make the request seem legitimate. ### 卡片 532 **问题** Why does risk transfer not remove accountability? **答案** The organization can retain legal, reputational, operational, and oversight consequences. ### 卡片 533 **问题** Why validate a change after deployment? **答案** To confirm the intended result occurred without introducing unacceptable side effects. ### 卡片 534 **问题** What makes end-of-life hardware a security vulnerability? **答案** The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path. ### 卡片 535 **问题** What does an audit add to remediation validation? **答案** Independent evidence that the approved fix, process, and documentation were completed and remain effective. ### 卡片 536 **问题** Why can SPF pass while a message still impersonates a brand? **答案** SPF checks the envelope domain, which may differ from the visible From domain. ### 卡片 537 **问题** What role can a government entity have in security governance? **答案** It can establish, enforce, or oversee legal and regulatory requirements within its authority. ### 卡片 538 **问题** How do data inventory and retention support privacy governance? **答案** The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized. ### 卡片 539 **问题** What can concurrent sessions from distant regions indicate? **答案** A stolen account or shared credential, subject to VPN and proxy context. ### 卡片 540 **问题** What does supply-chain analysis examine? **答案** Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service. ### 卡片 541 **问题** What is the purpose of facility lighting as a control? **答案** Deter covert activity and improve observation of people and areas. ### 卡片 542 **问题** What architecture quality keeps a service usable during component failure? **答案** Availability. ### 卡片 543 **问题** When is fail-open behavior preferable to fail-closed behavior? **答案** When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision. ### 卡片 544 **问题** Which control function does a login-failure alert provide? **答案** Detection; it reveals suspicious authentication activity. ### 卡片 545 **问题** What does a biometric MFA implementation verify? **答案** A measured physical or behavioral characteristic presented by the user, matched against an enrolled template. ### 卡片 546 **问题** How can automation enforce a security baseline? **答案** It compares realized settings with the approved state and reports or corrects unauthorized drift. ### 卡片 547 **问题** How do wireless cryptographic protocols protect network traffic? **答案** They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used. ### 卡片 548 **问题** Why segment sensitive data stores? **答案** It limits reachable paths and separates them from lower-trust workloads. ### 卡片 549 **问题** What must remain secret in an asymmetric key pair? **答案** The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use. ### 卡片 550 **问题** How can a supplier become a supply-chain attack vector? **答案** A compromised material, component, credential, or delivery process can weaken products before they reach the organization. ### 卡片 551 **问题** What is e-discovery? **答案** Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter. ### 卡片 552 **问题** What characterizes a neutral risk appetite? **答案** A balanced willingness to accept uncertainty when expected value and controls justify the exposure. ### 卡片 553 **问题** What is passive reconnaissance? **答案** Gathering information without directly interacting with the target's systems. ### 卡片 554 **问题** What does a philosophical motive mean for a threat actor? **答案** The actor acts to advance a belief or moral position rather than primarily for money. ### 卡片 555 **问题** What does unexpected resource consumption indicate? **答案** Possible malware, denial of service, cryptomining, or a malfunction that needs investigation. ### 卡片 556 **问题** What does a host-based intrusion prevention system do? **答案** It monitors activity on one host and can block behavior that matches exploit or attack rules. ### 卡片 557 **问题** How does agent-based monitoring differ from agentless monitoring? **答案** An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility. ### 卡片 558 **问题** What can network logs contribute to an investigation? **答案** Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment. ### 卡片 559 **问题** What is the purpose of a backup restore test? **答案** Demonstrate under tested conditions that required data and systems can be recovered within expectations. ### 卡片 560 **问题** Why can obsolete hardware become a security risk? **答案** It may lack supported firmware, modern protections, or replacement parts. ### 卡片 561 **问题** What does rescanning confirm after remediation? **答案** Whether the scanner can still detect the original finding on the affected asset. ### 卡片 562 **问题** What should a secure transport method provide? **答案** Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic. ### 卡片 563 **问题** How can law affect security governance? **答案** It can impose mandatory duties based on jurisdiction, data, industry, or activity. ### 卡片 564 **问题** What does resilience mean for a security architecture? **答案** The ability to withstand disruption, adapt, and recover while preserving essential functions. ### 卡片 565 **问题** Why minimize an infrastructure's attack surface? **答案** Fewer exposed services and paths leave fewer opportunities for exploitation. ### 卡片 566 **问题** What does executing a security-awareness program require? **答案** Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes. ### 卡片 567 **问题** What does an infrared security sensor detect? **答案** A change in infrared energy, often the heat pattern created by a person moving through its field of view. ### 卡片 568 **问题** What is a knowledge factor? **答案** Something the claimant knows, such as a password. ### 卡片 569 **问题** Why review allow-list and deny-list impact before a change? **答案** Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies. ### 卡片 570 **问题** What does partition-level encryption protect? **答案** One selected disk partition, leaving other partitions outside that encryption boundary. ### 卡片 571 **问题** How can instant messaging deliver a security attack? **答案** It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel. ### 卡片 572 **问题** What can repeated blocked-content events indicate? **答案** Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources. ### 卡片 573 **问题** What should a server-hardening baseline reduce? **答案** Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change. ### 卡片 574 **问题** When is physical media destruction appropriate? **答案** When reuse is unnecessary or sanitization cannot provide adequate assurance. ### 卡片 575 **问题** What is mean time to repair? **答案** The average time required to restore a failed component or service. ### 卡片 576 **问题** Why disclose conflicts of interest during vendor selection? **答案** A personal or financial relationship can bias evaluation away from the organization's requirements. ### 卡片 577 **问题** What is a fine for noncompliance? **答案** A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement. ### 卡片 578 **问题** What does a public data classification authorize? **答案** Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply. ### 卡片 579 **问题** What security benefit comes from standard infrastructure configurations? **答案** They reduce variation, make review repeatable, and let the same approved controls be applied across resources. ### 卡片 580 **问题** How does horizontal scaling increase capacity? **答案** It adds more service instances and distributes work among them. ### 卡片 581 **问题** Why can added connectivity weaken segmentation? **答案** Each allowed path can become a route for lateral movement or data escape. ### 卡片 582 **问题** What coding practice is central to preventing SQL injection? **答案** Use parameterized queries so untrusted values remain data rather than executable query syntax. ### 卡片 583 **问题** When is a compensating control appropriate for a vulnerability? **答案** When timely removal or patching is infeasible and another control can reduce the risk. ### 卡片 584 **问题** How does agent-based web filtering enforce policy? **答案** Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy. ### 卡片 585 **问题** How can regulation differ from an internal policy? **答案** Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties. ### 卡片 586 **问题** What is a storage snapshot? **答案** A point-in-time representation of data or system state, whose independence depends on how it is stored. ### 卡片 587 **问题** What does password age measure? **答案** How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change. ### 卡片 588 **问题** What does an ethical motive mean in vulnerability research? **答案** The researcher intends to improve security, typically through authorized testing and responsible disclosure. ### 卡片 589 **问题** What can missing security logs indicate? **答案** Logging failure, tampering, retention misconfiguration, or an inactive source. ### 卡片 590 **问题** Why disable unused ports and protocols? **答案** They expose unnecessary communication paths and code that attackers can reach. ### 卡片 591 **问题** What does antivirus contribute to monitoring? **答案** It scans files, memory, or behavior and reports suspected malicious code. ### 卡片 592 **问题** What is a honeypot? **答案** A decoy system or service designed to attract and observe malicious activity. ### 卡片 593 **问题** What does file-level encryption protect? **答案** Selected files independently of whether the rest of the disk or volume is encrypted. ### 卡片 594 **问题** How can SMS deliver a security attack? **答案** A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel. ### 卡片 595 **问题** What happens during incident analysis? **答案** Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved. ### 卡片 596 **问题** What is mean time between failures? **答案** The average operating time between repairable failures. ### 卡片 597 **问题** What is active reconnaissance? **答案** Probing or interacting with target systems to discover services and behavior. ### 卡片 598 **问题** What constraint should guide ICS or SCADA hardening? **答案** Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled. ### 卡片 599 **问题** Which control function does restoring a clean system image provide? **答案** Correction; it returns the system to a known-good state. ### 卡片 600 **问题** What does responsiveness mean in an architecture decision? **答案** How quickly the system and its operators can adapt to demand, failure, or attack. ### 卡片 601 **问题** How does out-of-band access strengthen remote administration? **答案** It uses a management path separate from production traffic, preserving controlled access during an outage or compromise. ### 卡片 602 **问题** What makes user behavior unexpected? **答案** It differs materially from the person's normal role, timing, location, resource use, or established work pattern. ### 卡片 603 **问题** What is a work order? **答案** A document authorizing a defined unit of work under an existing agreement. ### 卡片 604 **问题** What can out-of-cycle logging indicate? **答案** Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job. ### 卡片 605 **问题** Why update a standard operating procedure after a change? **答案** It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution. ### 卡片 606 **问题** What coding practice limits cross-site scripting? **答案** Context-appropriate output encoding, supported by safe templating and input handling. ### 卡片 607 **问题** What does a restricted data classification indicate? **答案** Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm. ### 卡片 608 **问题** How does a bug bounty support responsible disclosure? **答案** It defines eligible systems, rules, reporting, and possible rewards for external researchers. ### 卡片 609 **问题** What does web-filter content categorization provide? **答案** A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently. ### 卡片 610 **问题** How do hard and soft authentication tokens differ? **答案** A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device. ### 卡片 611 **问题** How can industry requirements affect security governance? **答案** Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls. ### 卡片 612 **问题** How can noncompliance cause loss of a license? **答案** An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work. ### 卡片 613 **问题** What does volume-level encryption protect? **答案** All data within a selected logical storage volume. ### 卡片 614 **问题** How can impersonation exploit familiarity? **答案** The attacker imitates a known person or routine communication style so the request receives less scrutiny. ### 卡片 615 **问题** How does RTO guide recovery design? **答案** It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices. ### 卡片 616 **问题** What is a honeynet? **答案** A network of decoy systems used to study or divert attackers. ### 卡片 617 **问题** What does backup replication provide? **答案** Additional synchronized or copied recovery data in another system or location. ### 卡片 618 **问题** What lets automation scale securely? **答案** Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource. ### 卡片 619 **问题** Why monitor a hardened computing resource continuously? **答案** New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed. ### 卡片 620 **问题** Why keep a certificate of destruction? **答案** It documents that a disposal provider handled specified media under the agreed process. ### 卡片 621 **问题** Why consider patch availability before selecting a platform? **答案** Unsupported or difficult-to-update components accumulate known exposure. ### 卡片 622 **问题** Why should remote administration use an encrypted, authenticated protocol? **答案** It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint. ### 卡片 623 **问题** How can revenge motivate an insider incident? **答案** A disgruntled person may damage systems or disclose data to punish the organization. ### 卡片 624 **问题** What is a published or documented indicator of malicious activity? **答案** A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity. ### 卡片 625 **问题** Why monitor a system more closely when a mitigation exception is accepted? **答案** Monitoring can reveal exploitation or control failure while the documented exception remains open. ### 卡片 626 **问题** What is an SNMP trap? **答案** An unsolicited device notification sent to a management system when a configured event occurs. ### 卡片 627 **问题** How can an automated report support an investigation? **答案** It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline. ### 卡片 628 **问题** What is a security key? **答案** A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin. ### 卡片 629 **问题** What does database-level encryption protect? **答案** A database or selected database structures through controls managed at the database layer. ### 卡片 630 **问题** How does brand impersonation exploit trust? **答案** It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate. ### 卡片 631 **问题** What browser-side impact can a cross-site scripting vulnerability create? **答案** It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session. ### 卡片 632 **问题** How can a system or process audit identify vulnerabilities? **答案** It compares evidence with required configuration and procedure to reveal control gaps. ### 卡片 633 **问题** What security role can Group Policy provide? **答案** Centralized Windows configuration of account, application, audit, and system security settings. ### 卡片 634 **问题** What should incident-response training prepare people to do? **答案** Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions. ### 卡片 635 **问题** Why must governance track local or regional requirements? **答案** They may impose location-specific duties that differ from national, global, industry, or contractual rules. ### 卡片 636 **问题** How can a dependency become a useful key risk indicator? **答案** A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing. ### 卡片 637 **问题** What is a business partners agreement? **答案** An agreement defining how business partners will work together, including responsibilities and security or data-handling terms. ### 卡片 638 **问题** What makes an audit regulatory? **答案** It evaluates compliance with requirements established or enforced by a government or delegated authority. ### 卡片 639 **问题** What is a honeyfile? **答案** A decoy file whose access can reveal unauthorized activity. ### 卡片 640 **问题** Why does legal information require explicit protection? **答案** It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk. ### 卡片 641 **问题** Which indicator can mass file renaming and encryption produce? **答案** Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them. ### 卡片 642 **问题** What remains with an organization after transferring architecture risk? **答案** Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences. ### 卡片 643 **问题** When does local console placement provide useful administrative access? **答案** When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path. ### 卡片 644 **问题** What makes a harmful user action unintentional? **答案** The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse. ### 卡片 645 **问题** How should an organization harden workstations? **答案** Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall. ### 卡片 646 **问题** What is journaling in recovery? **答案** Recording ordered changes so data can be replayed or restored to a consistent point. ### 卡片 647 **问题** What downtime must a change plan account for? **答案** The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems. ### 卡片 648 **问题** Why must a privacy program map local or regional law to data flows? **答案** The applicable duties can change with the location of the person, organization, processing, or stored data. ### 卡片 649 **问题** Why combine independent preventive controls at different layers? **答案** A failure at one layer does not automatically let the same attack succeed at the next layer. ### 卡片 650 **问题** What is passwordless authentication? **答案** A flow that does not require the user to enter a memorized password, often using public-key credentials. ### 卡片 651 **问题** How can automation improve security reaction time? **答案** It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs. ### 卡片 652 **问题** What does record-level encryption protect? **答案** Individual records or fields, allowing finer protection than encrypting the entire database. ### 卡片 653 **问题** How can business email compromise misuse urgency? **答案** It pressures an employee to bypass normal verification for a payment, credential, or data request. ### 卡片 654 **问题** What does impact measure in risk analysis? **答案** The consequence to objectives, such as financial, operational, safety, legal, or reputational harm. ### 卡片 655 **问题** What makes cyber activity part of warfare? **答案** It supports military or state conflict objectives such as disruption, intelligence, or influence. ### 卡片 656 **问题** Which indicator can a newly created privileged account produce outside the normal change window? **答案** Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled. ### 卡片 657 **问题** How can configuration enforcement validate a deployed mitigation? **答案** It compares the realized settings with the approved state and corrects or reports drift. ### 卡片 658 **问题** How does validating an alert improve alert tuning? **答案** The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence. ### 卡片 659 **问题** What data-layer impact can a SQL injection vulnerability create? **答案** It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations. ### 卡片 660 **问题** What environmental variables can change vulnerability priority? **答案** Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment. ### 卡片 661 **问题** What security role does SELinux provide? **答案** Mandatory access controls that confine processes according to centrally defined policy. ### 卡片 662 **问题** Why review governance documents periodically? **答案** Business, technology, threats, and external obligations change. ### 卡片 663 **问题** Why evaluate power requirements for a system design? **答案** Power capacity and redundancy constrain availability and recovery. ### 卡片 664 **问题** When is IPsec a better tunnel choice than TLS? **答案** Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection. ### 卡片 665 **问题** What is a honeytoken? **答案** A fake credential or data element that generates a high-confidence alert when used. ### 卡片 666 **问题** What should embedded-system hardening prioritize? **答案** Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path. ### 卡片 667 **问题** Why must sanitization address data remanence? **答案** Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk. ### 卡片 668 **问题** Why require rules of engagement for vendor testing? **答案** Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity. ### 卡片 669 **问题** What does a private data classification indicate? **答案** The information concerns an individual or limited internal audience and should not be exposed publicly. ### 卡片 670 **问题** What does a tabletop recovery exercise test? **答案** Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps. ### 卡片 671 **问题** Why prevent password reuse? **答案** One compromised password should not unlock other accounts or services. ### 卡片 672 **问题** Which malicious-activity indicator is unexplained sustained CPU or memory use? **答案** Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use. ### 卡片 673 **问题** What does transport encryption protect? **答案** It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints. ### 卡片 674 **问题** How can a voice call become an attack vector? **答案** An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions. ### 卡片 675 **问题** What should a digital-forensics report document? **答案** The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion. ### 卡片 676 **问题** What tradeoff comes with an expansionary risk appetite? **答案** It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit. ### 卡片 677 **问题** What does a known penetration-test environment provide? **答案** The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing. ### 卡片 678 **问题** Why evaluate compute requirements before deployment? **答案** Insufficient resources can cause failure, while excessive resources increase cost and attack surface. ### 卡片 679 **问题** Why place sensors at network choke points? **答案** They can observe traffic crossing important trust boundaries. ### 卡片 680 **问题** What should hybrid or remote-work security training emphasize? **答案** Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments. ### 卡片 681 **问题** Why plan an application restart separately from a service restart? **答案** The application may need its own state handling, user coordination, health checks, and rollback point. ### 卡片 682 **问题** What is a cryptographic vulnerability? **答案** A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection. ### 卡片 683 **问题** Why report findings by asset owner? **答案** Owners need clear accountability and a prioritized remediation queue. ### 卡片 684 **问题** What should guide selection of a secure protocol? **答案** The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints. ### 卡片 685 **问题** How do centralized and decentralized governance structures differ? **答案** Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency. ### 卡片 686 **问题** How does privacy-aware design limit data retention? **答案** It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle. ### 卡片 687 **问题** What does a pressure security sensor detect? **答案** Force or weight applied to a protected surface, such as a floor mat or fence line. ### 卡片 688 **问题** What automation costs should a security team plan for? **答案** Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow. ### 卡片 689 **问题** What should RTOS hardening preserve while reducing attack surface? **答案** Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled. ### 卡片 690 **问题** What is the goal of disruption-for-chaos activity? **答案** Create instability or damage itself rather than pursue a clear financial or intelligence return. ### 卡片 691 **问题** Which indicator can repeated password guessing produce? **答案** Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy. ### 卡片 692 **问题** How does removing unnecessary software harden a system? **答案** It eliminates code, services, dependencies, and privileges that an attacker could otherwise target. ### 卡片 693 **问题** What does NetFlow provide? **答案** Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts. ### 卡片 694 **问题** How can a dashboard support an investigation? **答案** It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope. ### 卡片 695 **问题** When should a password be expired? **答案** When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard. ### 卡片 696 **问题** Why does cryptographic key length matter? **答案** It affects the work required to search the key space, although security also depends on the algorithm and implementation. ### 卡片 697 **问题** How can an unsecure Bluetooth connection become an attack vector? **答案** Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands. ### 卡片 698 **问题** What is a key risk indicator? **答案** A metric that signals changing exposure or increasing likelihood of an adverse outcome. ### 卡片 699 **问题** What should vendor monitoring verify when a contract ends? **答案** Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved. ### 卡片 700 **问题** What does a sensitive data classification indicate? **答案** The information needs safeguards because unauthorized access, change, or loss could cause harm. ### 卡片 701 **问题** What does software-defined networking separate? **答案** The control plane that decides traffic behavior from the data plane that forwards traffic. ### 卡片 702 **问题** Where should a web application firewall be placed? **答案** In the path of web requests before they reach the protected application. ### 卡片 703 **问题** What does a simulated recovery exercise test? **答案** Participants perform realistic response actions in a controlled environment without disrupting production. ### 卡片 704 **问题** How can a team verify that a detective control is effective? **答案** Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence. ### 卡片 705 **问题** How should defenders apply a published or documented indicator to telemetry and validate it before escalating? **答案** Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating. ### 卡片 706 **问题** What makes a vulnerability cloud-specific? **答案** It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior. ### 卡片 707 **问题** How can insurance respond to vulnerability risk? **答案** It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties. ### 卡片 708 **问题** How does reputation improve web filtering? **答案** It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk. ### 卡片 709 **问题** What does an encryption policy establish? **答案** Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties. ### 卡片 710 **问题** How does a microwave security sensor detect movement? **答案** It emits microwave energy and detects changes in the reflected signal caused by motion. ### 卡片 711 **问题** What should IoT-device hardening change before deployment? **答案** Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access. ### 卡片 712 **问题** Why track software licenses as assets? **答案** License ownership, permitted use, updates, and end-of-support status affect compliance and risk. ### 卡片 713 **问题** What does a password manager improve? **答案** It can generate and store unique long passwords so users do not memorize or reuse them. ### 卡片 714 **问题** What makes a ledger open and public? **答案** Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries. ### 卡片 715 **问题** What should a payment-change request trigger? **答案** Independent verification through a known channel before any account or payment detail is changed. ### 卡片 716 **问题** What does preserving digital evidence require? **答案** Protecting its integrity, context, access history, and availability from collection through final disposition. ### 卡片 717 **问题** What should a risk report tell decision-makers? **答案** The risk, uncertainty, business impact, owner, treatment, trend, and decision required. ### 卡片 718 **问题** What should an external assessment report provide? **答案** Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions. ### 卡片 719 **问题** What is a centralized design's main resilience risk? **答案** A central dependency can become a bottleneck or single point of failure. ### 卡片 720 **问题** What does mutual TLS add to a TLS-protected service connection? **答案** It adds client authentication, commonly with a client certificate, so the client and server authenticate each other. ### 卡片 721 **问题** What should recurring security-awareness reporting show? **答案** Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions. ### 卡片 722 **问题** Why do legacy applications require extra change planning? **答案** They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely. ### 卡片 723 **问题** How do a data controller and a data processor differ? **答案** A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf. ### 卡片 724 **问题** How can orchestration become a single point of failure? **答案** Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them. ### 卡片 725 **问题** Why should defenses account for a threat actor's sophistication and capability? **答案** Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them. ### 卡片 726 **问题** How does an injection attack make an application execute unintended instructions? **答案** It sends crafted input that an interpreter treats as code or commands instead of data. ### 卡片 727 **问题** What does a host-based firewall control? **答案** Inbound and outbound network traffic for one endpoint according to local rules. ### 卡片 728 **问题** Why revise alerting after an incident? **答案** The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert. ### 卡片 729 **问题** Why include security duties in procurement criteria? **答案** Security is easier to require before selection than to retrofit after dependency and data transfer begin. ### 卡片 730 **问题** What does a critical data classification indicate? **答案** The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls. ### 卡片 731 **问题** What infrastructure capacity must support failover? **答案** The alternate site, network, power, cooling, and facility resources needed to carry the transferred load. ### 卡片 732 **问题** Why does shared cloud context matter when evaluating a cloud-specific vulnerability? **答案** The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness. ### 卡片 733 **问题** How does a remediation exemption differ from an exception? **答案** Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation. ### 卡片 734 **问题** Why should automated EDR or XDR blocking have an exception and rollback path? **答案** A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly. ### 卡片 735 **问题** What does a security playbook provide? **答案** A repeatable set of roles, decisions, and actions for handling a defined operational scenario. ### 卡片 736 **问题** How does an ultrasonic security sensor detect movement? **答案** It emits high-frequency sound and detects changes in the returning sound pattern caused by motion. ### 卡片 737 **问题** What should a managed mobile device require for Bluetooth connections? **答案** Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles. ### 卡片 738 **问题** How do password complexity rules differ from password length? **答案** Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone. ### 卡片 739 **问题** What makes a certificate third-party trusted? **答案** A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems. ### 卡片 740 **问题** Why is an out-of-band check effective against impersonation? **答案** It verifies the request through a separate, previously trusted communication path. ### 卡片 741 **问题** What does a risk exception authorize? **答案** A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration. ### 卡片 742 **问题** What security challenge grows in a decentralized design? **答案** Consistent policy, inventory, monitoring, and patching become harder. ### 卡片 743 **问题** How should controls be selected for an unused network path? **答案** Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable. ### 卡片 744 **问题** How can a buffer-overflow attack affect an application? **答案** It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution. --- *[查看此页面的带样式 HTML 版本]()* *AI agent 可以从 `GET https://api.nibomo.com/v1/` 开始，为用户在该服务中创建账号。完成设置后，也可以通过 MCP 连接 `https://mcp.nibomo.com/mcp`。* *提示：在 https://nibomo.com 上任意 URL 后追加 `.md`，即可获得该页面的纯 Markdown 版本。*