CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Study every current SY0-701 exam domain with original, concise flashcards for security concepts, threats, architecture, operations, and governance.
Mayelana naleli qoqo
Build reliable recall across all five current Security+ SY0-701 domains with 744 original, open-response cards. The deck follows the newest official objectives for the current exam series: Version 6.0, accessed on August 25, 2026.
What this deck covers
- General security concepts: control functions, core principles, zero trust, change management, cryptography, certificates, and PKI.
- Threats, vulnerabilities, and mitigations: threat actors, attack vectors, social engineering, platform and application weaknesses, malicious activity, indicators, and defensive choices.
- Security architecture: cloud and virtualization models, secure infrastructure, data protection, availability, backups, and recovery design.
- Security operations: hardening, asset and vulnerability management, monitoring, security tooling, identity and access, automation, incident response, and evidence sources.
- Program management and oversight: governance, risk, third-party security, compliance, privacy, audits, and awareness.
Prompts include concept-to-purpose recall, scenario-to-control or threat identification, and operational comparisons. Reverse prompts appear only when choosing a control, evidence source, or response is useful in practice. Prerequisites come before dependent ideas, while related variants are spaced apart.
The deck excludes multiple-choice practice, copied exam material, dumps, raw objective wording, vague term-only prompts, vendor trivia, and mechanically reversed duplicates. Use it after a course or primary study guide, then add hands-on labs and legitimate practice questions to test application.
Scope was reconciled against CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0. Current certification requirements and exam-series status are on the official CompTIA Security+ page.
This is an unofficial educational deck by Flashcards Open Source App. It is not affiliated with, endorsed by, or produced by CompTIA. All card wording and cover artwork are original; no exam questions, answer dumps, objective prose, logos, or trade dress were copied.
Amakhadi akuleli qoqo
Ikhadi 1
Umbuzo
What does an information security policy establish?
Impendulo
Management's required direction, responsibilities, and high-level rules for protecting information and systems.
Ikhadi 2
Umbuzo
What is phishing?
Impendulo
A deceptive message intended to make a target reveal information, open malware, or take an unsafe action.
Ikhadi 3
Umbuzo
What does a public-key certificate bind to an identity?
Impendulo
A public key, together with identifying information and the issuer's signature.
Ikhadi 4
Umbuzo
What is data at rest?
Impendulo
Data stored on media such as disks, databases, backups, or mobile devices.
Ikhadi 5
Umbuzo
How does policy-driven access control decide a zero-trust access request?
Impendulo
Explicit policies or rules evaluate the access request and drive the allow-or-deny decision.
Ikhadi 6
Umbuzo
What does establishing a secure baseline produce?
Impendulo
An approved, documented configuration that defines the required secure state for a class of computing resource.
Ikhadi 7
Umbuzo
What is hashing used to verify?
Impendulo
Whether data has changed by comparing fixed-length digest values.
Ikhadi 8
Umbuzo
What is impersonation in social engineering?
Impendulo
Pretending to be a trusted person or organization to obtain access, data, or action.
Ikhadi 9
Umbuzo
What is virtualization?
Impendulo
Abstracting physical compute so multiple isolated guest systems can share a host.
Ikhadi 10
Umbuzo
What is chain of custody?
Impendulo
A documented history of who collected, handled, transferred, stored, and examined evidence.
Ikhadi 11
Umbuzo
What is quantitative risk analysis?
Impendulo
Estimating risk with numerical values such as money, frequency, or probability.
Ikhadi 12
Umbuzo
What is a phishing awareness campaign?
Impendulo
A planned series of guidance, exercises, and reminders that builds recognition and safe reporting behavior.
Ikhadi 13
Umbuzo
What is high availability?
Impendulo
Designing a service to remain accessible despite expected component failures.
Ikhadi 14
Umbuzo
What is a network security zone?
Impendulo
A group of systems with similar trust, function, or control requirements.
Ikhadi 15
Umbuzo
What is risk transfer?
Impendulo
Shifting some financial or operational consequence to another party, such as through insurance or contract.
Ikhadi 16
Umbuzo
What is media sanitization?
Impendulo
Making stored data infeasible to recover for the intended level of protection.
Ikhadi 17
Umbuzo
What does CVSS provide?
Impendulo
A standardized way to describe a vulnerability's technical severity characteristics.
Ikhadi 18
Umbuzo
What does security alerting do?
Impendulo
It turns matched events or behavior into a notification that the right responder can review.
Ikhadi 19
Umbuzo
What does a firewall rule enforce?
Impendulo
A permit, deny, or inspect decision for traffic that matches defined source, destination, service, protocol, direction, and state conditions.
Ikhadi 20
Umbuzo
What is deprovisioning?
Impendulo
Disabling or removing accounts, credentials, sessions, and access when they are no longer needed.
Ikhadi 21
Umbuzo
How does inline placement differ from a tap or monitor port?
Impendulo
Inline traffic passes through the control; a tap or monitor receives a copy for observation.
Ikhadi 22
Umbuzo
What is asymmetric encryption?
Impendulo
Encryption that uses a mathematically related public and private key pair.
Ikhadi 23
Umbuzo
What does SPF authorize?
Impendulo
Which mail servers may send mail for a domain in the SMTP envelope.
Ikhadi 24
Umbuzo
What is a possession factor?
Impendulo
Something the claimant has, such as a cryptographic authenticator.
Ikhadi 25
Umbuzo
What does ordinary TLS usually protect and authenticate?
Impendulo
It provides encryption and integrity protection, plus server authentication in the usual deployment. Client authentication is added when mutual TLS is configured.
Ikhadi 26
Umbuzo
What is single loss expectancy?
Impendulo
The estimated loss from one occurrence of a risk event.
Ikhadi 27
Umbuzo
What does a certificate authority do?
Impendulo
It validates certificate requests and signs certificates so relying parties can verify the binding between an identity and a public key.
Ikhadi 28
Umbuzo
What is a detective control meant to do?
Impendulo
Identify that an unwanted event has happened or is happening.
Ikhadi 29
Umbuzo
What is the security purpose of change-control approval?
Impendulo
Ensure authorized reviewers assess risk before the production change occurs.
Ikhadi 30
Umbuzo
What is shadow IT?
Impendulo
Technology used for organizational work without required approval or oversight.
Ikhadi 31
Umbuzo
What is a buffer overflow vulnerability?
Impendulo
A bounds-checking failure that lets input overwrite memory outside its intended buffer.
Ikhadi 32
Umbuzo
What is ransomware?
Impendulo
Malware or an intrusion outcome that denies access to data or systems to extort the victim.
Ikhadi 33
Umbuzo
How does network segmentation limit an incident?
Impendulo
It restricts communication paths and reduces lateral movement between zones.
Ikhadi 34
Umbuzo
How do load balancing and clustering support availability differently?
Impendulo
Load balancing distributes requests across healthy instances; clustering makes systems cooperate as one service and tolerate member failure.
Ikhadi 35
Umbuzo
What is vendor due diligence?
Impendulo
Evaluating a provider's security, capability, stability, and fit before commitment.
Ikhadi 36
Umbuzo
Who is a data subject?
Impendulo
The person whose personal data is collected or processed.
Ikhadi 37
Umbuzo
What is attestation?
Impendulo
A formal assertion or report about a subject matter, often supported by an independent examination.
Ikhadi 38
Umbuzo
What is a replay attack?
Impendulo
Valid captured data is retransmitted to repeat an authenticated or authorized action.
Ikhadi 39
Umbuzo
What does a wireless site survey establish?
Impendulo
Coverage, interference, channel use, access-point placement, and unauthorized radio sources in the real environment.
Ikhadi 40
Umbuzo
What is the time-of-check stage of a race-condition vulnerability?
Impendulo
The application verifies a condition or resource state before acting on it.
Ikhadi 41
Umbuzo
What is a penetration test?
Impendulo
An authorized attempt to exploit weaknesses and demonstrate practical impact.
Ikhadi 42
Umbuzo
What is a cold recovery site?
Impendulo
A facility with basic space and utilities but little preinstalled technology or current data.
Ikhadi 43
Umbuzo
What is data in transit?
Impendulo
Data moving between systems or across a network.
Ikhadi 44
Umbuzo
What is a vendor security questionnaire?
Impendulo
A structured request for information about a provider's controls and practices.
Ikhadi 45
Umbuzo
How does an internal actor's starting position differ from an external actor's?
Impendulo
An internal actor begins with some trusted access or proximity; an external actor must first cross the perimeter or obtain access.
Ikhadi 46
Umbuzo
What can unexpected account lockouts indicate?
Impendulo
Password guessing, credential stuffing, user error, or a broken client.
Ikhadi 47
Umbuzo
How do permissions enforce access control?
Impendulo
They specify which actions a subject may perform on a particular resource.
Ikhadi 48
Umbuzo
What is log aggregation?
Impendulo
Central collection of logs from multiple sources for search, correlation, and retention.
Ikhadi 49
Umbuzo
Why plan a service restart as part of a change?
Impendulo
The restart can interrupt dependent users or processes, so the plan needs timing, validation, and rollback steps.
Ikhadi 50
Umbuzo
What is infrastructure as code?
Impendulo
Managing infrastructure through versioned, machine-readable definitions rather than manual configuration.
Ikhadi 51
Umbuzo
What should security-awareness program development start with?
Impendulo
The audience's roles, risks, policies, incident lessons, desired behavior, and measurable outcomes.
Ikhadi 52
Umbuzo
What is a voice-based social-engineering attack called?
Impendulo
Vishing.
Ikhadi 53
Umbuzo
What happens during incident-response preparation?
Impendulo
Teams establish people, tools, access, communications, training, and procedures before an incident.
Ikhadi 54
Umbuzo
What does an offensive penetration-testing team do?
Impendulo
It emulates authorized attacker behavior to discover and demonstrate exploitable paths.
Ikhadi 55
Umbuzo
What is federation?
Impendulo
One security domain relies on identity assertions from another trusted domain.
Ikhadi 56
Umbuzo
What is asset classification?
Impendulo
Grouping an asset by sensitivity, criticality, or required handling.
Ikhadi 57
Umbuzo
What is cross-site scripting?
Impendulo
Injection of script-capable content that a browser executes in another site's security context.
Ikhadi 58
Umbuzo
What can IDS or IPS trends reveal?
Impendulo
Changes in the frequency, source, target, or type of detected activity that one isolated event may not show.
Ikhadi 59
Umbuzo
What can unexpected resource inaccessibility indicate?
Impendulo
Denial of service, destructive activity, ransomware, permission changes, or an ordinary outage.
Ikhadi 60
Umbuzo
What is a corrective control meant to do?
Impendulo
Limit damage and restore a secure state after an event.
Ikhadi 61
Umbuzo
How do containers differ from virtual machines?
Impendulo
Containers share the host kernel; virtual machines normally run separate guest operating systems.
Ikhadi 62
Umbuzo
How does an active security device differ from a passive one?
Impendulo
An active device can alter or block traffic; a passive device observes and reports without changing the flow.
Ikhadi 63
Umbuzo
Why is unsupported software a persistent attack surface?
Impendulo
Known weaknesses may remain reachable because supported fixes and vendor help are no longer available.
Ikhadi 64
Umbuzo
What is annualized rate of occurrence?
Impendulo
The estimated number of times a risk event occurs per year.
Ikhadi 65
Umbuzo
What is an inherence factor?
Impendulo
A biometric characteristic of the claimant.
Ikhadi 66
Umbuzo
What do a threat actor's sophistication and capability describe?
Impendulo
The technical skill, tools, knowledge, resources, and operational discipline the actor can apply.
Ikhadi 67
Umbuzo
What is a SIEM?
Impendulo
A platform that centralizes security data and supports search, correlation, alerting, and investigation.
Ikhadi 68
Umbuzo
What is sideloading?
Impendulo
Installing software from outside the platform's approved distribution path.
Ikhadi 69
Umbuzo
What does an IDS or IPS signature match?
Impendulo
A known pattern in traffic or behavior associated with a threat, exploit, or policy violation.
Ikhadi 70
Umbuzo
Why are embedded systems often difficult to patch?
Impendulo
They may have long lifecycles, specialized firmware, limited downtime, or weak vendor support.
Ikhadi 71
Umbuzo
What is a virtual private network?
Impendulo
An encrypted logical connection that carries private traffic across an untrusted or shared network.
Ikhadi 72
Umbuzo
What should an initial security-awareness report establish?
Impendulo
The starting participation, knowledge, behavior, incident, and reporting measures against which later results will be compared.
Ikhadi 73
Umbuzo
What is symmetric encryption?
Impendulo
Encryption that uses the same secret key to encrypt and decrypt data.
Ikhadi 74
Umbuzo
What happens during incident detection?
Impendulo
Monitoring or a report identifies activity that may meet the organization's incident criteria.
Ikhadi 75
Umbuzo
What is recovery time objective?
Impendulo
The target maximum time to restore a function after disruption.
Ikhadi 76
Umbuzo
Why prioritize password length?
Impendulo
Longer passwords expand the guessing space and support memorable passphrases without predictable substitutions.
Ikhadi 77
Umbuzo
What must sanitization accomplish before an asset leaves organizational control?
Impendulo
It must make the retained data infeasible to recover with the method appropriate to the media and risk.
Ikhadi 78
Umbuzo
What is a real-time operating system designed to provide?
Impendulo
Predictable response timing for tasks with strict deadlines.
Ikhadi 79
Umbuzo
What does fail-open behavior do when a control fails?
Impendulo
It permits traffic or access to preserve availability.
Ikhadi 80
Umbuzo
What is jailbreaking or rooting a mobile device?
Impendulo
Removing platform restrictions to gain privileged control over the operating system.
Ikhadi 81
Umbuzo
What does network access control enforce?
Impendulo
Identity, device posture, and access policy at network connection time and during a session.
Ikhadi 82
Umbuzo
What does data loss prevention do?
Impendulo
Detects and may block sensitive data use or transfer that violates policy.
Ikhadi 83
Umbuzo
What security property does a blockchain provide?
Impendulo
A chained, tamper-evident record in which changing an earlier entry invalidates later cryptographic links.
Ikhadi 84
Umbuzo
What is recovery point objective?
Impendulo
The target maximum acceptable data loss measured backward in time.
Ikhadi 85
Umbuzo
How do ICS and SCADA relate?
Impendulo
An industrial control system controls physical processes; SCADA provides supervisory monitoring and control across distributed industrial equipment.
Ikhadi 86
Umbuzo
What does fail-closed behavior do when a control fails?
Impendulo
It denies traffic or access to preserve security.
Ikhadi 87
Umbuzo
Which keys create and verify a typical digital signature?
Impendulo
The signer creates it with a private key, and others verify it with the corresponding public key.
Ikhadi 88
Umbuzo
What is SQL injection?
Impendulo
Input that alters the structure or meaning of a database query because code and data were not safely separated.
Ikhadi 89
Umbuzo
What does DKIM verify?
Impendulo
That selected message content was signed by a domain and was not altered after signing.
Ikhadi 90
Umbuzo
What is post-incident activity?
Impendulo
Learning from the event and improving controls, plans, and recovery based on evidence.
Ikhadi 91
Umbuzo
What characterizes an expansionary risk appetite?
Impendulo
A greater willingness to accept uncertainty and exposure in pursuit of growth, return, or strategic opportunity.
Ikhadi 92
Umbuzo
How do centralized and decentralized architectures differ?
Impendulo
Centralized architecture concentrates key services or decisions; decentralized architecture distributes them across independent components or locations.
Ikhadi 93
Umbuzo
What does a certificate revocation list publish?
Impendulo
Certificate serial numbers that the issuer has invalidated before their scheduled expiration.
Ikhadi 94
Umbuzo
What is a legal hold?
Impendulo
A directive to preserve potentially relevant information by suspending normal deletion or disposal.
Ikhadi 95
Umbuzo
What is exposure factor in quantitative risk analysis?
Impendulo
The estimated percentage of an asset's value lost in one event.
Ikhadi 96
Umbuzo
What is decentralized architecture?
Impendulo
Control or service responsibility is distributed across multiple independent components or locations.
Ikhadi 97
Umbuzo
What is tokenization?
Impendulo
Replacing sensitive data with a non-sensitive token whose mapping is held separately.
Ikhadi 98
Umbuzo
How can automation act as a workforce multiplier?
Impendulo
It handles repeatable work consistently so people can focus on judgment, exceptions, investigation, and improvement.
Ikhadi 99
Umbuzo
What can endpoint process logs reveal?
Impendulo
Which programs ran, their parent-child relationships, users, timing, and command details when captured.
Ikhadi 100
Umbuzo
What does the CIA triad protect?
Impendulo
Confidentiality protects against unauthorized disclosure, integrity protects accuracy and completeness, and availability protects reliable, timely access.
Ikhadi 101
Umbuzo
How does data masking protect information?
Impendulo
It hides selected values or characters while preserving a usable representation.
Ikhadi 102
Umbuzo
How can a national requirement affect security governance?
Impendulo
It can impose country-level duties that policies, controls, records, and oversight must satisfy.
Ikhadi 103
Umbuzo
What do integrations and APIs provide to security orchestration?
Impendulo
Defined interfaces for exchanging data and triggering actions across tools without manual handoffs.
Ikhadi 104
Umbuzo
What makes a compliance report external?
Impendulo
It is prepared for a regulator, customer, auditor, partner, or other party outside the organization.
Ikhadi 105
Umbuzo
What does a cryptographic algorithm define?
Impendulo
The mathematical procedure used to encrypt, decrypt, hash, sign, or otherwise transform protected data.
Ikhadi 106
Umbuzo
Why compare systems with a secure baseline regularly?
Impendulo
To detect drift, unauthorized changes, and missing hardening.
Ikhadi 107
Umbuzo
What does integrity protect?
Impendulo
The accuracy and completeness of data and systems against unauthorized change.
Ikhadi 108
Umbuzo
What does vulnerability classification organize?
Impendulo
Findings into meaningful types or categories so teams can route, compare, and remediate them consistently.
Ikhadi 109
Umbuzo
What does a password standard define?
Impendulo
Mandatory, measurable requirements for creating, storing, using, and changing passwords.
Ikhadi 110
Umbuzo
What technology capacity must a recovery design plan for?
Impendulo
The compute, storage, software, licenses, and supporting services needed to meet recovery demand.
Ikhadi 111
Umbuzo
What does a confidential data classification indicate?
Impendulo
Disclosure is limited to authorized people because exposure could harm the organization or affected parties.
Ikhadi 112
Umbuzo
What makes a vendor assessment independent?
Impendulo
The assessor is free from responsibility for the vendor activity being evaluated and reports evidence against defined criteria.
Ikhadi 113
Umbuzo
What lets a worm spread without attaching itself to another file?
Impendulo
It is a standalone program that replicates across reachable systems or services.
Ikhadi 114
Umbuzo
What is microsegmentation?
Impendulo
Fine-grained isolation of individual workloads or small groups with explicit communication policy.
Ikhadi 115
Umbuzo
What can application logs reveal?
Impendulo
Transactions, errors, user actions, and application-specific security events.
Ikhadi 116
Umbuzo
What does deploying a secure baseline require?
Impendulo
Applying the approved settings consistently to the intended resources and verifying the realized configuration.
Ikhadi 117
Umbuzo
How can resource-provisioning automation improve security?
Impendulo
It creates infrastructure from approved templates with consistent ownership, logging, and baseline controls.
Ikhadi 118
Umbuzo
What does availability protect?
Impendulo
Reliable, timely access to systems and data when authorized users need them.
Ikhadi 119
Umbuzo
Why must a change request describe business impact?
Impendulo
So approvers can weigh the benefit, risk, outage, and affected users before authorizing it.
Ikhadi 120
Umbuzo
What does an authenticated vulnerability scan add?
Impendulo
Credentialed inspection of local versions, settings, and missing patches that a remote scan may miss.
Ikhadi 121
Umbuzo
What does a change-management procedure specify?
Impendulo
The required steps, roles, evidence, approvals, testing, implementation, validation, and rollback for a change.
Ikhadi 122
Umbuzo
What is a sanction for noncompliance?
Impendulo
A formal penalty or restriction imposed by an authority for failing to meet a requirement.
Ikhadi 123
Umbuzo
How can email deliver a security attack?
Impendulo
It can carry a malicious link, attachment, request, or embedded content designed to exploit software or manipulate a recipient.
Ikhadi 124
Umbuzo
What is an internal compliance audit?
Impendulo
An organization-led examination of whether selected operations and controls meet defined requirements.
Ikhadi 125
Umbuzo
What is a Trojan?
Impendulo
Malware disguised as legitimate or desirable software.
Ikhadi 126
Umbuzo
What is clustering?
Impendulo
Multiple systems work together to provide a service and tolerate member failure.
Ikhadi 127
Umbuzo
What makes data regulated?
Impendulo
A law or regulation imposes specific collection, handling, retention, protection, or disclosure duties.
Ikhadi 128
Umbuzo
What does a wireless heat map show?
Impendulo
Measured or modeled signal strength and coverage across a physical area.
Ikhadi 129
Umbuzo
How should vendor criticality affect due diligence?
Impendulo
Higher access, concentration, data sensitivity, or operational dependence warrants deeper evidence and stronger approval.
Ikhadi 130
Umbuzo
How can a digital signature support non-repudiation?
Impendulo
It provides evidence that the holder of a private key signed specific data.
Ikhadi 131
Umbuzo
What should vulnerability prioritization consider beyond severity?
Impendulo
Exploitability, exposure, asset importance, environmental context, business impact, and available mitigations.
Ikhadi 132
Umbuzo
What is a security guideline?
Impendulo
Recommended practice that allows judgment unless adopted as a requirement.
Ikhadi 133
Umbuzo
What usually distinguishes a nation-state threat actor?
Impendulo
Strategic objectives, substantial resources, patience, and advanced operational capability.
Ikhadi 134
Umbuzo
What is spyware?
Impendulo
Software that secretly collects information about a user or system.
Ikhadi 135
Umbuzo
Why maintain an allow list for applications?
Impendulo
Only explicitly approved software is permitted to execute.
Ikhadi 136
Umbuzo
How can an image become an attack vector?
Impendulo
It may exploit a decoder flaw, hide malicious data, or direct a user through an embedded code.
Ikhadi 137
Umbuzo
What makes a security control technical?
Impendulo
It is enforced mainly by technology, such as a firewall rule or endpoint policy.
Ikhadi 138
Umbuzo
What is identity proofing?
Impendulo
Establishing that a person is who they claim to be before issuing an account or credential.
Ikhadi 139
Umbuzo
What is an automated security guardrail?
Impendulo
A policy control that prevents, flags, or corrects unsafe configuration, such as an overexposed security group.
Ikhadi 140
Umbuzo
Why assign an owner to a planned change?
Impendulo
To make one party accountable for coordination, execution, and follow-through.
Ikhadi 141
Umbuzo
How can national privacy law affect data handling?
Impendulo
It can set country-level duties for collection, use, access, retention, transfer, security, and individual rights.
Ikhadi 142
Umbuzo
What is continuity of operations?
Impendulo
Maintaining essential functions during disruption and restoring supporting capabilities in a planned order.
Ikhadi 143
Umbuzo
What security tradeoff comes with BYOD?
Impendulo
The organization gains flexibility but has less control over personally owned device configuration, privacy, and lifecycle.
Ikhadi 144
Umbuzo
How should policies and handbooks support security training?
Impendulo
They provide accessible, current rules and reporting steps that training can apply to real situations.
Ikhadi 145
Umbuzo
What is a keylogger?
Impendulo
A tool that records keystrokes to capture data such as credentials.
Ikhadi 146
Umbuzo
What makes information a trade secret?
Impendulo
It provides business value because it is not generally known and is protected through reasonable secrecy measures.
Ikhadi 147
Umbuzo
What does authentication establish?
Impendulo
It verifies a presented authenticator or credential bound to the claimed identity. Identity proofing establishes the real-world identity behind the claim.
Ikhadi 148
Umbuzo
What risk comes from an untrusted file attachment?
Impendulo
Opening or parsing it can execute malicious code or expose data.
Ikhadi 149
Umbuzo
How does risk tolerance affect vulnerability remediation?
Impendulo
It sets how much residual exposure the organization will accept and how quickly a finding must be treated.
Ikhadi 150
Umbuzo
How can a global requirement affect security governance?
Impendulo
It can require a common control and oversight approach across multiple countries while local obligations still apply.
Ikhadi 151
Umbuzo
Why should questionnaire answers be supported by evidence?
Impendulo
Self-assertions alone may not prove that controls are designed or operating effectively.
Ikhadi 152
Umbuzo
What is an independent third-party audit?
Impendulo
An external party with suitable independence examines evidence against defined criteria.
Ikhadi 153
Umbuzo
What do account provisioning and deprovisioning do?
Impendulo
Provisioning creates an identity and approved access; deprovisioning disables or removes accounts, credentials, sessions, and access when no longer needed.
Ikhadi 154
Umbuzo
What is an unskilled attacker commonly called?
Impendulo
A script kiddie: someone who relies on tools or instructions created by others.
Ikhadi 155
Umbuzo
What is a rootkit?
Impendulo
Software designed to maintain privileged, concealed access by altering or subverting the system.
Ikhadi 156
Umbuzo
What does an access control list enforce?
Impendulo
Explicit permit or deny rules for subjects, traffic, or actions on a protected resource.
Ikhadi 157
Umbuzo
What should system security monitoring observe?
Impendulo
Host state and behavior such as processes, authentication, configuration, resource use, and security events.
Ikhadi 158
Umbuzo
What can operating-system security logs reveal?
Impendulo
Authentication, privilege use, policy changes, services, and other host security events.
Ikhadi 159
Umbuzo
Why isolate operational technology from general business networks?
Impendulo
To limit attack paths into safety- and availability-critical processes.
Ikhadi 160
Umbuzo
What is the COPE mobile deployment model?
Impendulo
The organization owns the device but permits defined personal use while retaining management control.
Ikhadi 161
Umbuzo
What security work belongs in asset acquisition and procurement?
Impendulo
Define security requirements before purchase, evaluate the product and vendor against them, and obtain approval before acquisition or deployment.
Ikhadi 162
Umbuzo
How can user-provisioning automation improve security?
Impendulo
It creates, changes, and removes access from authoritative identity events with consistent approvals and logging.
Ikhadi 163
Umbuzo
What people capacity must a continuity plan account for?
Impendulo
Enough trained staff, coverage, authority, and specialist knowledge to operate and recover essential services.
Ikhadi 164
Umbuzo
What do authorization models define?
Impendulo
How permissions are assigned to authenticated subjects and evaluated for requested actions.
Ikhadi 165
Umbuzo
Why are removable devices an attack vector?
Impendulo
They can introduce malware or remove data while bypassing network controls.
Ikhadi 166
Umbuzo
What should predeployment change-test results show?
Impendulo
Whether the change meets its acceptance criteria without unacceptable functional, security, or operational effects.
Ikhadi 167
Umbuzo
What is the time-of-use stage of a race-condition vulnerability?
Impendulo
The application acts on a resource after the check, creating a gap in which another process may change the resource.
Ikhadi 168
Umbuzo
What is data in use?
Impendulo
Data actively processed in memory or by an application.
Ikhadi 169
Umbuzo
What does open-source vulnerability intelligence contribute?
Impendulo
Public advisories, exploit reporting, research, and observable activity that help identify and prioritize exposure.
Ikhadi 170
Umbuzo
What can file-integrity monitoring detect?
Impendulo
Unexpected changes to protected files, directories, or configuration.
Ikhadi 171
Umbuzo
Why should deprovisioning be prompt?
Impendulo
Former users or roles should not retain usable access.
Ikhadi 172
Umbuzo
What is an acceptable use policy?
Impendulo
Rules for permitted and prohibited use of organizational systems, accounts, and data.
Ikhadi 173
Umbuzo
What makes a compliance report internal?
Impendulo
It is prepared for the organization's owners, operators, management, or governance bodies to track compliance and action.
Ikhadi 174
Umbuzo
What is a logic bomb?
Impendulo
Malicious code that activates when a specified condition or time is reached.
Ikhadi 175
Umbuzo
What does a right-to-audit clause provide?
Impendulo
Contractual authority to inspect or obtain evidence about agreed controls.
Ikhadi 176
Umbuzo
Where should a forward proxy sit in an enterprise traffic path?
Impendulo
Between clients and external services so outbound requests pass through policy and logging before reaching destinations.
Ikhadi 177
Umbuzo
Which cues should make a message look suspicious?
Impendulo
Unexpected context, mismatched identity or links, unusual attachments, urgency, secrecy, and requests for credentials or payment.
Ikhadi 178
Umbuzo
What makes a security control managerial?
Impendulo
It directs risk and governance through decisions such as policies, assessments, and oversight.
Ikhadi 179
Umbuzo
What is the CYOD mobile deployment model?
Impendulo
The user selects from organization-approved device options that remain subject to corporate security requirements.
Ikhadi 180
Umbuzo
How does client-based vulnerable software differ from an agentless exposure?
Impendulo
Client-based exposure depends on installed endpoint software, while an agentless service can be reached and assessed without a local agent.
Ikhadi 181
Umbuzo
What makes a risk assessment recurring?
Impendulo
It is repeated on a defined schedule so changes in threats, assets, controls, and impact are reevaluated.
Ikhadi 182
Umbuzo
What does a defensive penetration-testing team practice?
Impendulo
Detection, investigation, containment, and improvement while authorized offensive activity tests the environment.
Ikhadi 183
Umbuzo
In a zero-trust data plane, what can the subject or system represent?
Impendulo
The user, device, workload, or service requesting access to a protected resource.
Ikhadi 184
Umbuzo
What primarily motivates a hacktivist?
Impendulo
A political, social, or ideological cause.
Ikhadi 185
Umbuzo
What is bloatware?
Impendulo
Unnecessary preinstalled software that consumes resources and can expand the attack surface.
Ikhadi 186
Umbuzo
Why keep endpoint-protection signatures and engines current?
Impendulo
They need current detection logic to recognize newly identified malware and exploit behavior.
Ikhadi 187
Umbuzo
What should application security monitoring observe?
Impendulo
Application errors, authentication, requests, transactions, dependencies, and behavior that may indicate misuse or compromise.
Ikhadi 188
Umbuzo
What is role-based access control?
Impendulo
Permissions are assigned to roles, and identities receive access through their roles.
Ikhadi 189
Umbuzo
What is geographic dispersal?
Impendulo
Placing redundant resources in separate locations so one regional event does not affect all copies.
Ikhadi 190
Umbuzo
What is a malicious update?
Impendulo
An update that has been intentionally altered or distributed to install harmful code through a trusted update path.
Ikhadi 191
Umbuzo
What does static application analysis inspect?
Impendulo
Source code, bytecode, or compiled code without executing the application.
Ikhadi 192
Umbuzo
What does a firewall access list define?
Impendulo
An ordered set of traffic-matching conditions and the action applied when a condition matches.
Ikhadi 193
Umbuzo
What does a disaster recovery policy establish?
Impendulo
Management expectations for restoring technology and data after a disruptive event.
Ikhadi 194
Umbuzo
How does logical segmentation separate workloads that share physical infrastructure?
Impendulo
It uses enforced network, identity, or virtualization boundaries to restrict communication without requiring separate hardware.
Ikhadi 195
Umbuzo
How should IDS and IPS placement differ?
Impendulo
An IDS can monitor copied traffic out of band; an IPS must sit inline to block traffic.
Ikhadi 196
Umbuzo
What should automated ticket creation capture?
Impendulo
The triggering evidence, affected resource, severity, owner, required action, and a traceable link to the source event.
Ikhadi 197
Umbuzo
What makes information intellectual property?
Impendulo
It is a protected creation or intangible asset, such as copyrighted work, a patentable invention, a trademark, or a trade secret.
Ikhadi 198
Umbuzo
What is a backout plan?
Impendulo
Predefined steps for safely reversing a failed or harmful change.
Ikhadi 199
Umbuzo
Why is an unsecure wireless network an attack vector?
Impendulo
Nearby attackers may intercept traffic, impersonate access points, or reach exposed services when encryption and authentication are weak.
Ikhadi 200
Umbuzo
What is physical brute force?
Impendulo
Using force to defeat a lock, barrier, enclosure, or other physical control.
Ikhadi 201
Umbuzo
What is application sandboxing?
Impendulo
Running code in a constrained environment with limited access to the host and data.
Ikhadi 202
Umbuzo
Why assign an asset owner?
Impendulo
One accountable party must decide its use, protection, and lifecycle.
Ikhadi 203
Umbuzo
What happens during risk identification?
Impendulo
Teams identify assets, objectives, threats, vulnerabilities, events, and dependencies that could create uncertainty or harm.
Ikhadi 204
Umbuzo
What should an SLA state about breach notification?
Impendulo
The triggering conditions, notification deadline, required content, contacts, update cadence, and cooperation duties.
Ikhadi 205
Umbuzo
How do due diligence and due care differ in compliance?
Impendulo
Due diligence investigates and monitors obligations or risk; due care takes the reasonable actions those findings require.
Ikhadi 206
Umbuzo
What is attribute-based access control?
Impendulo
Policy evaluates attributes of the subject, resource, action, and environment.
Ikhadi 207
Umbuzo
What does a zero-trust policy engine do?
Impendulo
It evaluates policy and signals to decide whether access should be allowed.
Ikhadi 208
Umbuzo
How does a cloud responsibility matrix allocate security duties?
Impendulo
It maps each security task to the provider, the customer, or both, according to the service model and agreement.
Ikhadi 209
Umbuzo
Where should a load balancer sit in a service path?
Impendulo
In front of service instances so it can route requests to healthy backends.
Ikhadi 210
Umbuzo
What should the security team do with a reported suspicious message?
Impendulo
Triage it, protect other recipients, preserve useful evidence, and tell the reporter what action to take.
Ikhadi 211
Umbuzo
What makes an operating-system vulnerability high impact?
Impendulo
It can affect every application and security control that relies on the compromised OS.
Ikhadi 212
Umbuzo
What does dynamic application analysis inspect?
Impendulo
The behavior and externally visible weaknesses of a running application.
Ikhadi 213
Umbuzo
How can false-positive trends affect IDS or IPS tuning?
Impendulo
Repeated false positives reveal signatures, thresholds, or contexts that need adjustment; IPS errors also risk blocking legitimate traffic.
Ikhadi 214
Umbuzo
What does a business continuity policy establish?
Impendulo
Management expectations for sustaining and restoring critical business functions.
Ikhadi 215
Umbuzo
What is a hot recovery site?
Impendulo
A ready, synchronized environment intended to take over quickly.
Ikhadi 216
Umbuzo
What makes an insider threat distinct?
Impendulo
The actor has legitimate access or organizational knowledge that can be misused.
Ikhadi 217
Umbuzo
What is RFID cloning?
Impendulo
Copying an RFID credential's data so another token can impersonate it when the system lacks stronger protections.
Ikhadi 218
Umbuzo
Why apply vendor security updates promptly?
Impendulo
They remove known weaknesses before attackers can exploit the unpatched exposure.
Ikhadi 219
Umbuzo
What should infrastructure security monitoring observe?
Impendulo
Network, cloud, identity, facility, and platform signals that reveal availability, configuration, or attack activity.
Ikhadi 220
Umbuzo
What can firewall logs reveal?
Impendulo
Allowed or denied network connections across controlled boundaries.
Ikhadi 221
Umbuzo
Why minimize open service ports?
Impendulo
Each reachable service adds code, configuration, and authentication paths an attacker can probe.
Ikhadi 222
Umbuzo
What is threat hunting?
Impendulo
A proactive search for evidence of malicious activity that existing detections have not confirmed.
Ikhadi 223
Umbuzo
What triggers an ad hoc risk assessment?
Impendulo
A specific change, incident, finding, or decision that requires evaluation outside the regular schedule.
Ikhadi 224
Umbuzo
What makes an assessment external?
Impendulo
A party outside the organization evaluates a defined scope against stated criteria and reports its conclusions.
Ikhadi 225
Umbuzo
What is data sovereignty?
Impendulo
The principle that data is subject to laws and governance of the jurisdiction where it is located or controlled.
Ikhadi 226
Umbuzo
What security boundary does a cellular connection create for a mobile device?
Impendulo
It uses the carrier network instead of local Wi-Fi, but still requires trusted applications, encrypted traffic, and managed device policy.
Ikhadi 227
Umbuzo
What makes a security control operational?
Impendulo
It is carried out mainly by people and processes, such as security-awareness training or incident-response procedures.
Ikhadi 228
Umbuzo
What is discretionary access control?
Impendulo
A resource owner can decide who receives access, within system policy.
Ikhadi 229
Umbuzo
How can careful automation support employee retention?
Impendulo
It reduces repetitive toil and alert handling while leaving meaningful judgment and improvement work with people.
Ikhadi 230
Umbuzo
Why does ease of deployment matter in an architecture decision?
Impendulo
A design that can be deployed consistently and safely reduces configuration error, rollout time, and operational burden.
Ikhadi 231
Umbuzo
What tradeoff comes with placing an NGFW inline?
Impendulo
It can block application-aware threats, but failure or overload can interrupt traffic unless availability and fail-mode behavior are designed.
Ikhadi 232
Umbuzo
What does a zero-trust policy administrator do?
Impendulo
It carries out the policy engine's decision, such as creating or ending a session.
Ikhadi 233
Umbuzo
What should a master service agreement define for data return and deletion?
Impendulo
The format, timing, verification, retained copies, exceptions, and responsibilities when the service or contract ends.
Ikhadi 234
Umbuzo
What is an environmental physical attack?
Impendulo
Causing harmful conditions such as heat, water, fire, or power loss to disrupt equipment or facilities.
Ikhadi 235
Umbuzo
When should a maintenance window be chosen?
Impendulo
When disruption and rollback can be managed with the least business impact.
Ikhadi 236
Umbuzo
What is memory injection?
Impendulo
Placing malicious code or data into another process's memory so it executes in that process's context.
Ikhadi 237
Umbuzo
What does software composition analysis find?
Impendulo
Known risks and license information in third-party dependencies.
Ikhadi 238
Umbuzo
What is DNS filtering?
Impendulo
Blocking or redirecting DNS lookups for domains that policy considers malicious or inappropriate.
Ikhadi 239
Umbuzo
What should an incident response policy establish?
Impendulo
Authority, scope, reporting duties, and organizational commitment for incident handling.
Ikhadi 240
Umbuzo
How can noncompliance cause reputational damage?
Impendulo
Customers, partners, employees, or the public may lose trust when the organization fails a stated or required duty.
Ikhadi 241
Umbuzo
What does full-disk encryption protect?
Impendulo
All data stored on the disk while the device is powered off or the disk is removed, subject to proper key protection.
Ikhadi 242
Umbuzo
Why are default credentials dangerous?
Impendulo
They are widely known or easily discovered and often remain unchanged.
Ikhadi 243
Umbuzo
What makes a risk assessment one-time?
Impendulo
It evaluates a defined decision or scope once without an established repeating cadence.
Ikhadi 244
Umbuzo
What is a warm recovery site?
Impendulo
A partially equipped environment that needs some data restoration or configuration before use.
Ikhadi 245
Umbuzo
What does application input validation do?
Impendulo
It checks that input matches the expected type, length, range, and format before use.
Ikhadi 246
Umbuzo
What should an asset inventory record besides a device name?
Impendulo
Identifiers, owner, location, status, classification, dependencies, and supported version as applicable.
Ikhadi 247
Umbuzo
What is mandatory access control?
Impendulo
A central authority enforces access through labels and rules that ordinary owners cannot override.
Ikhadi 248
Umbuzo
What security benefit does infrastructure as code provide?
Impendulo
Repeatable, reviewable deployments that reduce undocumented configuration drift.
Ikhadi 249
Umbuzo
When should a public service control fail closed?
Impendulo
When allowing unchecked traffic would create greater harm than an outage, the failed control should block the path.
Ikhadi 250
Umbuzo
What should users do with a suspicious message?
Impendulo
Report it through the approved channel without interacting with its links or attachments.
Ikhadi 251
Umbuzo
What usually motivates organized cybercrime?
Impendulo
Financial gain through scalable or repeatable criminal activity.
Ikhadi 252
Umbuzo
How can malicious code support a network attack?
Impendulo
It can establish control, scan reachable systems, move laterally, or disrupt networked services after execution.
Ikhadi 253
Umbuzo
When is virtual patching useful?
Impendulo
When a network or application control can block exploit traffic before the underlying system can be patched.
Ikhadi 254
Umbuzo
What does security-monitoring reporting provide?
Impendulo
A summarized, audience-appropriate view of findings, trends, risk, and response status.
Ikhadi 255
Umbuzo
What does data geolocation identify?
Impendulo
The physical or legal location where data is stored, processed, or transmitted.
Ikhadi 256
Umbuzo
What does a zero-trust policy enforcement point do?
Impendulo
It enables, monitors, and terminates the connection between a subject and a resource.
Ikhadi 257
Umbuzo
What is cryptographic key exchange?
Impendulo
A method for parties to establish shared key material over an untrusted channel.
Ikhadi 258
Umbuzo
How can a vendor become a supply-chain attack vector?
Impendulo
An attacker can compromise the vendor's product, update, credentials, or support channel to reach the vendor's customers.
Ikhadi 259
Umbuzo
Why can legacy hardware remain vulnerable?
Impendulo
It may lack current security features, supported firmware, replacement parts, or compatibility with modern controls.
Ikhadi 260
Umbuzo
What can proprietary vulnerability intelligence add beyond open sources?
Impendulo
Curated analysis, customer-specific context, private telemetry, or earlier reporting available under a commercial or trusted relationship.
Ikhadi 261
Umbuzo
How does a centralized proxy apply web filtering?
Impendulo
It receives client web requests at a shared enforcement point and applies policy before forwarding allowed traffic.
Ikhadi 262
Umbuzo
How can continuous integration and testing improve security automation?
Impendulo
Changes receive repeatable checks before deployment instead of reaching production unvalidated.
Ikhadi 263
Umbuzo
What is containment?
Impendulo
Limiting an incident's spread or damage while preserving necessary operations and evidence.
Ikhadi 264
Umbuzo
What is a software development lifecycle policy meant to ensure?
Impendulo
Security requirements and checks are integrated throughout design, development, release, and maintenance.
Ikhadi 265
Umbuzo
What makes risk assessment continuous?
Impendulo
Relevant signals and changes update the risk view as they occur instead of waiting for a scheduled review.
Ikhadi 266
Umbuzo
What is a memorandum of agreement?
Impendulo
A document that records agreed responsibilities and commitments between parties; its legal effect depends on its terms and jurisdiction.
Ikhadi 267
Umbuzo
What makes a penetration test integrated?
Impendulo
Offensive and defensive teams coordinate the exercise to test both attack paths and detection or response.
Ikhadi 268
Umbuzo
How does a DNS amplification attack magnify traffic?
Impendulo
It sends small spoofed queries that trigger larger replies toward the victim.
Ikhadi 269
Umbuzo
Why does ease of recovery matter in an architecture decision?
Impendulo
The design should let operators restore service and trusted state without fragile, slow, or undocumented steps.
Ikhadi 270
Umbuzo
What does 802.1X control before a device receives normal network access?
Impendulo
Port-based admission; the device or user must authenticate through the access device before ordinary traffic is allowed.
Ikhadi 271
Umbuzo
What is rule-based access control?
Impendulo
System-wide rules grant or deny access based on conditions such as network, time, or action.
Ikhadi 272
Umbuzo
What is mobile device management?
Impendulo
Central enrollment, configuration, monitoring, and enforcement for managed mobile devices.
Ikhadi 273
Umbuzo
What tradeoff comes with a cold recovery site?
Impendulo
It costs less to maintain, but recovery takes longer because systems, data, and connectivity must be prepared after activation.
Ikhadi 274
Umbuzo
Why identify stakeholders before approving a security-sensitive change?
Impendulo
They can identify operational impact, dependencies, and acceptance criteria that the implementer may otherwise miss.
Ikhadi 275
Umbuzo
How do attestation and acknowledgement differ?
Impendulo
Attestation asserts that a condition or control is true; acknowledgement confirms receipt or understanding of a requirement.
Ikhadi 276
Umbuzo
What does zero-trust adaptive identity mean?
Impendulo
Access decisions adjust to current risk signals rather than relying only on a static login.
Ikhadi 277
Umbuzo
What makes a security control physical?
Impendulo
It protects facilities or equipment through a tangible barrier or mechanism.
Ikhadi 278
Umbuzo
What is geo-fencing for data?
Impendulo
Enforcing location-based boundaries on where data or services may be accessed or operated.
Ikhadi 279
Umbuzo
What does a Trusted Platform Module protect?
Impendulo
Hardware-backed keys and measurements used for device identity, disk protection, and boot-state attestation.
Ikhadi 280
Umbuzo
Why can a managed service provider amplify risk?
Impendulo
Its privileged access and shared tooling can provide a path into many customers.
Ikhadi 281
Umbuzo
What does probability express in risk analysis?
Impendulo
A quantified chance that a defined event will occur within stated conditions or time.
Ikhadi 282
Umbuzo
Why can shadow IT create a threat?
Impendulo
It bypasses security review, inventory, monitoring, and supported configuration.
Ikhadi 283
Umbuzo
What is on-path interception?
Impendulo
An attacker positions between communicating parties to observe or alter traffic.
Ikhadi 284
Umbuzo
Why include encryption in a system-hardening baseline?
Impendulo
It limits data exposure if storage, traffic, or a protected secret is accessed outside the intended trust boundary.
Ikhadi 285
Umbuzo
Why tune security alerts?
Impendulo
To keep useful detections while reducing noise that wastes analyst attention.
Ikhadi 286
Umbuzo
What can IPS or IDS logs contribute to an investigation?
Impendulo
The matched rule or signature, source and destination, timestamp, action, and traffic context around detected activity.
Ikhadi 287
Umbuzo
What is VM escape?
Impendulo
A vulnerability that lets code break out of a virtual machine and affect the host or another guest.
Ikhadi 288
Umbuzo
How can segmentation reduce vulnerability exposure before a patch is available?
Impendulo
It limits which systems and users can reach the vulnerable service and restricts paths for lateral movement.
Ikhadi 289
Umbuzo
Why should firewall policy name the required ports and protocols explicitly?
Impendulo
Explicit scope permits only the intended service traffic and avoids exposing unnecessary network paths.
Ikhadi 290
Umbuzo
What is a change management policy meant to control?
Impendulo
How changes are requested, assessed, approved, tested, implemented, and reviewed.
Ikhadi 291
Umbuzo
What is a hybrid-cloud architecture?
Impendulo
An environment that integrates private or on-premises resources with public cloud services.
Ikhadi 292
Umbuzo
How do AH and ESP differ in the security services they can provide?
Impendulo
AH provides integrity and data-origin authentication without confidentiality. ESP can provide confidentiality and may also provide integrity and data-origin authentication. Actual services depend on AH or ESP, mode, algorithms, and policy/configuration.
Ikhadi 293
Umbuzo
What makes user behavior risky?
Impendulo
It creates avoidable exposure, such as bypassing controls, mishandling data, or using unapproved access paths.
Ikhadi 294
Umbuzo
What is least privilege?
Impendulo
Granting only the access needed for the required task and no more.
Ikhadi 295
Umbuzo
What do Secure, HttpOnly, and SameSite cookie attributes restrict?
Impendulo
Transmission to HTTPS, script access, and cross-site sending, respectively.
Ikhadi 296
Umbuzo
Why discover unmanaged assets?
Impendulo
Unknown systems cannot be patched, monitored, or governed reliably.
Ikhadi 297
Umbuzo
What is a service-level agreement?
Impendulo
Measurable service commitments and remedies, such as availability or response targets.
Ikhadi 298
Umbuzo
What should govern automated security escalation?
Impendulo
Clear severity criteria, ownership, evidence, rate limits, and a fallback path when the automation cannot decide safely.
Ikhadi 299
Umbuzo
What is platform diversity as a resilience strategy?
Impendulo
Using different implementations so one common flaw or failure is less likely to affect every copy.
Ikhadi 300
Umbuzo
How can replayed session material affect an application?
Impendulo
It can let an attacker reuse a captured token or request to impersonate a valid session or repeat an authorized action.
Ikhadi 301
Umbuzo
What is an implicit trust zone in zero trust?
Impendulo
A boundary where access was previously trusted by location alone and must instead receive explicit policy enforcement.
Ikhadi 302
Umbuzo
What does salting a password hash accomplish?
Impendulo
It makes identical passwords hash differently and defeats precomputed hash tables.
Ikhadi 303
Umbuzo
What is spear phishing?
Impendulo
Phishing tailored to a specific person, role, or organization.
Ikhadi 304
Umbuzo
What is eradication?
Impendulo
Removing the attacker's access, malicious artifacts, and exploited conditions.
Ikhadi 305
Umbuzo
Who is a risk owner?
Impendulo
The person accountable for deciding and monitoring how a specific risk is handled.
Ikhadi 306
Umbuzo
What does a partially known penetration-test environment provide?
Impendulo
The tester receives limited information or access, modeling an attacker with some insider knowledge or initial foothold.
Ikhadi 307
Umbuzo
What is a microservices architecture?
Impendulo
An application is split into small independently deployable services with explicit interfaces and distributed trust boundaries.
Ikhadi 308
Umbuzo
What is a jump server?
Impendulo
A hardened intermediary used to reach systems in a restricted management network.
Ikhadi 309
Umbuzo
What can happen when a configuration change is made without dependency analysis?
Impendulo
A downstream service can fail even when the changed component works.
Ikhadi 310
Umbuzo
What is resource reuse exposure?
Impendulo
Sensitive data from a previous use remains accessible when storage or memory is reassigned.
Ikhadi 311
Umbuzo
Why does financial information require explicit protection?
Impendulo
It can expose accounts, transactions, forecasts, or reporting and may create fraud, legal, or business risk if altered or disclosed.
Ikhadi 312
Umbuzo
What does CVE provide?
Impendulo
A common identifier for a publicly disclosed vulnerability.
Ikhadi 313
Umbuzo
Where can DLP controls operate?
Impendulo
On endpoints, networks, email, and cloud services, depending on the product and visibility.
Ikhadi 314
Umbuzo
What does privileged password vaulting protect?
Impendulo
It stores and controls use of privileged secrets so users or automation do not need to know or retain the underlying password.
Ikhadi 315
Umbuzo
What does an access-control standard define?
Impendulo
Mandatory, measurable requirements for identity, authentication, authorization, review, and removal of access.
Ikhadi 316
Umbuzo
How can automation support compliance monitoring?
Impendulo
It can collect evidence, test controls, flag exceptions, and produce repeatable reports, with human review of context.
Ikhadi 317
Umbuzo
What does static code analysis examine?
Impendulo
Source or compiled code for weakness patterns without executing the application.
Ikhadi 318
Umbuzo
What actor attribute describes funding, time, and personnel?
Impendulo
Resources.
Ikhadi 319
Umbuzo
What is DNS poisoning?
Impendulo
Introducing false DNS data so names resolve to attacker-chosen destinations.
Ikhadi 320
Umbuzo
Why change default credentials during hardening?
Impendulo
Default secrets are predictable and commonly targeted.
Ikhadi 321
Umbuzo
What does quarantine do after a security alert?
Impendulo
It restricts a suspected asset or object while analysts validate and remediate the risk.
Ikhadi 322
Umbuzo
What does key stretching do for stored passwords?
Impendulo
It deliberately makes each password guess more computationally expensive.
Ikhadi 323
Umbuzo
What is smishing?
Impendulo
Phishing delivered through SMS or another text-messaging service.
Ikhadi 324
Umbuzo
What is qualitative risk analysis?
Impendulo
Using descriptive scales such as low, medium, and high to compare likelihood and impact.
Ikhadi 325
Umbuzo
What is a master service agreement?
Impendulo
An umbrella contract establishing general legal and commercial terms for ongoing work.
Ikhadi 326
Umbuzo
What is threat scope reduction?
Impendulo
Narrowing the systems, privileges, or paths an attacker can reach.
Ikhadi 327
Umbuzo
Why use a third-party cloud service instead of building locally?
Impendulo
It can provide faster deployment, elasticity, and managed capabilities, with added dependency and governance risk.
Ikhadi 328
Umbuzo
What should determine security-device placement?
Impendulo
The traffic or resource to observe or enforce, the trust boundary, failure behavior, reachability, and resilience needs.
Ikhadi 329
Umbuzo
What does situational awareness mean for a user?
Impendulo
Notice the people, devices, requests, location, and context around a task before acting.
Ikhadi 330
Umbuzo
What does a failover test validate?
Impendulo
That the service can transfer to the alternate component or site within the required recovery targets under the tested conditions.
Ikhadi 331
Umbuzo
What is a preventive control meant to do?
Impendulo
Stop an unwanted event before it succeeds.
Ikhadi 332
Umbuzo
What is just-in-time privileged access?
Impendulo
Elevated access is granted only when needed and expires after a short approved period.
Ikhadi 333
Umbuzo
What safeguard should security-group automation enforce?
Impendulo
Least-privileged rules tied to an approved resource, owner, purpose, and review or expiration point.
Ikhadi 334
Umbuzo
How does a reflected DDoS attack hide and multiply sources?
Impendulo
The attacker spoofs the victim's address so many third-party services send their replies to the victim.
Ikhadi 335
Umbuzo
What is a security misconfiguration?
Impendulo
An unsafe setting, such as public storage, default access, or excessive permissions, that exposes a resource.
Ikhadi 336
Umbuzo
Why can the same vulnerability have different organizational impact?
Impendulo
Industry obligations, business processes, safety needs, data sensitivity, and asset criticality change the consequence of exploitation.
Ikhadi 337
Umbuzo
What does URL scanning evaluate before a user opens a web destination?
Impendulo
The address, redirect chain, reputation, category, and known threat indicators associated with the destination.
Ikhadi 338
Umbuzo
What is the board's security governance role?
Impendulo
Provide oversight, set risk direction, and hold executives accountable.
Ikhadi 339
Umbuzo
What does code signing establish?
Impendulo
That code came from the holder of the signing key and has not changed since signing.
Ikhadi 340
Umbuzo
How should an asset's classification affect security operations?
Impendulo
It should drive handling, access, monitoring, recovery, and disposal controls that match the asset's sensitivity and impact.
Ikhadi 341
Umbuzo
How does encryption protect data?
Impendulo
It uses a cryptographic key to transform plaintext into ciphertext, which authorized parties can decrypt with the required key while unauthorized readers cannot feasibly recover the original data.
Ikhadi 342
Umbuzo
What is a secure enclave?
Impendulo
A hardware-isolated execution area intended to protect selected code and data from the rest of the system.
Ikhadi 343
Umbuzo
What is business email compromise?
Impendulo
Impersonation or takeover of a business identity to induce a fraudulent action, often a payment or data release.
Ikhadi 344
Umbuzo
What is recovery in incident response?
Impendulo
Restoring services safely, monitoring them, and returning to normal operations.
Ikhadi 345
Umbuzo
How is single loss expectancy commonly estimated?
Impendulo
Asset value multiplied by the exposure factor.
Ikhadi 346
Umbuzo
What does an unknown penetration-test environment provide?
Impendulo
The tester begins with little or no internal information, modeling an external attacker's discovery process.
Ikhadi 347
Umbuzo
What security boundary does a hypervisor provide?
Impendulo
It isolates virtual machines while controlling their access to shared hardware.
Ikhadi 348
Umbuzo
Why does a TLS tunnel not protect a compromised endpoint?
Impendulo
TLS protects data between endpoints; malware or misuse at either endpoint can access the data before encryption or after decryption.
Ikhadi 349
Umbuzo
Why update diagrams after an infrastructure change?
Impendulo
Operations and incident responders need the documentation to match the deployed environment.
Ikhadi 350
Umbuzo
What does privacy ownership assign?
Impendulo
An accountable role for privacy decisions, obligations, data inventory, and corrective action.
Ikhadi 351
Umbuzo
What does a security control gap analysis compare?
Impendulo
The controls required for the target state with the controls currently in place.
Ikhadi 352
Umbuzo
Someone outside the organization steals an employee's VPN credentials and logs in. Is the actor internal or external?
Impendulo
External. Stolen internal credentials provide access but do not change the outsider's relationship to the organization.
Ikhadi 353
Umbuzo
What is application privilege escalation?
Impendulo
Exploiting a flaw or misconfiguration to gain permissions beyond those originally granted.
Ikhadi 354
Umbuzo
What risk remains when unnecessary software is left installed?
Impendulo
Its code, services, dependencies, and privileges add attack surface even when users do not need it.
Ikhadi 355
Umbuzo
What does SCAP standardize?
Impendulo
Formats and identifiers for expressing, checking, and scoring security configuration and vulnerability information.
Ikhadi 356
Umbuzo
What can packet capture reveal?
Impendulo
Protocol-level conversation details and payloads when traffic is not encrypted and collection is authorized.
Ikhadi 357
Umbuzo
What makes a privileged credential ephemeral?
Impendulo
It is created for a limited task or session and expires or is destroyed automatically after that use.
Ikhadi 358
Umbuzo
How do a statement of work and a work order differ?
Impendulo
A statement of work defines scope, deliverables, schedule, and responsibilities; a work order authorizes a defined unit of work under an agreement.
Ikhadi 359
Umbuzo
Why might multi-cloud improve resilience?
Impendulo
A provider-wide failure need not stop workloads that can run independently elsewhere.
Ikhadi 360
Umbuzo
How can a service provider introduce a supply-chain vulnerability?
Impendulo
Its privileged access, hosted service, or compromised integration can expose customers that depend on it.
Ikhadi 361
Umbuzo
What is a false positive in vulnerability scanning?
Impendulo
A reported weakness that is not actually present or exploitable in the assessed context.
Ikhadi 362
Umbuzo
How do EDR and XDR differ?
Impendulo
EDR focuses on endpoint telemetry and response; XDR correlates detection and response across endpoints and other security domains.
Ikhadi 363
Umbuzo
What should onboarding and offboarding procedures coordinate?
Impendulo
Identity, access, equipment, data, training, approvals, and ownership changes at the start or end of a relationship.
Ikhadi 364
Umbuzo
How should an organization harden managed mobile devices?
Impendulo
Enforce an MDM baseline with timely updates, screen lock and encryption, least privilege, approved apps, and remote lock or wipe.
Ikhadi 365
Umbuzo
What is a certificate signing request?
Impendulo
A request containing a public key and subject information for a certificate authority to sign.
Ikhadi 366
Umbuzo
What is pretexting?
Impendulo
Using a fabricated role or situation to make a request seem legitimate.
Ikhadi 367
Umbuzo
How is annualized loss expectancy commonly estimated?
Impendulo
Single loss expectancy multiplied by annualized rate of occurrence.
Ikhadi 368
Umbuzo
What security consequence follows from containers sharing a kernel?
Impendulo
A host-kernel compromise can affect multiple containers, so kernel and runtime hardening matter.
Ikhadi 369
Umbuzo
Where does 802.1X enforce a network admission decision?
Impendulo
At the controlled switch port or wireless access point before normal network access is granted.
Ikhadi 370
Umbuzo
What should insider-threat awareness teach?
Impendulo
Recognize misuse or concerning behavior without profiling people, and report evidence through approved channels.
Ikhadi 371
Umbuzo
What access action is suitable for careful automation?
Impendulo
Enabling or disabling a defined service or account from an approved lifecycle or incident event.
Ikhadi 372
Umbuzo
What is an evil twin?
Impendulo
A rogue wireless network made to resemble a legitimate one so users connect to it.
amakhadi angu-744
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
Funda leli qoqo mahhalaI-Nibomo iyavuleka ukuze uqale ukufunda.
Ikhadi 373
Umbuzo
Does non-human-readable data need less protection?
Impendulo
No. Encoded or machine-readable data can carry the same sensitive meaning and impact.
Ikhadi 374
Umbuzo
What does authenticating a system establish?
Impendulo
It verifies a presented authenticator or credential bound to the claimed device, workload, or service identity. Identity proofing or enrollment establishes what real-world entity that identity represents.
Ikhadi 375
Umbuzo
What does LDAP provide in identity systems?
Impendulo
A standard protocol for querying and modifying directory entries such as users, groups, and attributes.
Ikhadi 376
Umbuzo
What is a deterrent control meant to do?
Impendulo
Discourage an attacker from attempting an unwanted action.
Ikhadi 377
Umbuzo
Why update procedures after changing a security control?
Impendulo
Staff need accurate steps for operating, monitoring, and recovering the new control.
Ikhadi 378
Umbuzo
How does OCSP differ from a certificate revocation list?
Impendulo
OCSP returns status for a specific certificate, while a revocation list distributes a signed set of revoked certificate serial numbers.
Ikhadi 379
Umbuzo
What is the goal of data exfiltration?
Impendulo
Remove data from its authorized environment without permission.
Ikhadi 380
Umbuzo
What is a watering-hole attack?
Impendulo
Compromising a site frequented by the intended targets so their visits expose them.
Ikhadi 381
Umbuzo
How can a hardware provider introduce a supply-chain vulnerability?
Impendulo
A compromised component, firmware image, manufacturing step, or delivery path can weaken the device before deployment.
Ikhadi 382
Umbuzo
What is application forgery?
Impendulo
Creating or altering a request, token, or object so the application treats it as authentic.
Ikhadi 383
Umbuzo
How does least privilege mitigate compromise?
Impendulo
It limits the actions and resources available to a compromised account or process.
Ikhadi 384
Umbuzo
What is serverless computing?
Impendulo
A model where the provider manages servers and the customer deploys event-driven code or functions.
Ikhadi 385
Umbuzo
What makes an infrastructure control effective for a specific risk?
Impendulo
Its placement, failure behavior, visibility, enforcement scope, and operating cost match the protected path and threat.
Ikhadi 386
Umbuzo
What does parallel recovery processing test?
Impendulo
Whether primary and alternate environments can run together consistently before a controlled cutover.
Ikhadi 387
Umbuzo
Which password-authentication method does WPA3-Personal use?
Impendulo
Simultaneous Authentication of Equals, which replaces WPA2-Personal's PSK authentication and resists offline password guessing.
Ikhadi 388
Umbuzo
How does data retention affect asset disposal?
Impendulo
Required data must be preserved for its retention period, while expired data should be sanitized before reuse or destruction.
Ikhadi 389
Umbuzo
What is a false negative in vulnerability scanning?
Impendulo
A real weakness that the assessment fails to report.
Ikhadi 390
Umbuzo
What does recurring security scanning add to monitoring?
Impendulo
Periodic discovery of exposed services, missing fixes, weak configurations, or other detectable changes.
Ikhadi 391
Umbuzo
What should guide port selection for a secure protocol?
Impendulo
Use the documented service port or an explicitly managed alternative, and expose it only on the required interfaces and paths.
Ikhadi 392
Umbuzo
What does forensic acquisition create?
Impendulo
A controlled, documented copy or collection of relevant evidence while preserving its integrity and context.
Ikhadi 393
Umbuzo
How do system owners and data owners divide security accountability?
Impendulo
A system owner is accountable for the system's risk, access, operation, and lifecycle; a data owner sets the data's classification, access, handling, and retention requirements.
Ikhadi 394
Umbuzo
What does likelihood express in risk analysis?
Impendulo
A reasoned estimate of how plausible or frequent an event is, often stated qualitatively when precise probability is unavailable.
Ikhadi 395
Umbuzo
What is a memorandum of understanding?
Impendulo
A documented understanding of intentions and responsibilities, whose legal effect depends on its terms and jurisdiction.
Ikhadi 396
Umbuzo
What does the right to be forgotten generally require?
Impendulo
Deletion of qualifying personal data when the applicable law grants the right and no overriding retention duty applies.
Ikhadi 397
Umbuzo
What does an audit committee oversee?
Impendulo
Audit independence, plans, significant findings, management responses, and corrective-action follow-through.
Ikhadi 398
Umbuzo
What does identity interoperability require?
Impendulo
Compatible protocols, attribute meanings, trust, and lifecycle behavior across connected systems.
Ikhadi 399
Umbuzo
How does a bollard protect a facility?
Impendulo
It blocks or redirects vehicles before they can reach a protected area.
Ikhadi 400
Umbuzo
How can hashing protect a downloaded file?
Impendulo
A trusted digest lets the recipient detect whether the file changed.
Ikhadi 401
Umbuzo
What is a credential replay attack?
Impendulo
Using captured valid credentials or tokens again without needing to discover the secret.
Ikhadi 402
Umbuzo
How can automation complexity create security risk?
Impendulo
Hidden dependencies and branching behavior can make failures difficult to predict, diagnose, contain, or reverse.
Ikhadi 403
Umbuzo
What must an architecture provide when a component cannot be patched?
Impendulo
Compensating isolation, restricted access, monitoring, and a replacement plan that reduce exposure until the component can be retired.
Ikhadi 404
Umbuzo
What makes remote access secure?
Impendulo
Controlled, authenticated, encrypted access to a private resource from outside its local trusted network.
Ikhadi 405
Umbuzo
What should users verify before connecting removable media or a cable?
Impendulo
That the device and connection are approved, expected, and handled under organizational policy.
Ikhadi 406
Umbuzo
What is a self-signed certificate?
Impendulo
A certificate signed by its own private key rather than by a separate trusted issuer.
Ikhadi 407
Umbuzo
What is brand impersonation?
Impendulo
Using a trusted organization's identity or look to deceive people.
Ikhadi 408
Umbuzo
What characterizes a conservative risk appetite?
Impendulo
A preference for lower uncertainty and exposure, even when that limits speed, return, or opportunity.
Ikhadi 409
Umbuzo
What should a managed mobile device verify before using Wi-Fi?
Impendulo
The expected network identity, strong encryption, trusted authentication, and policy compliance before sending sensitive traffic.
Ikhadi 410
Umbuzo
What is a zero-day vulnerability?
Impendulo
A flaw previously unknown to the vendor or defenders, or one without an available fix when discovered. A zero-day exploit is code or a technique that attacks such a flaw.
Ikhadi 411
Umbuzo
What does verification confirm after vulnerability remediation?
Impendulo
Retesting confirms that the remediation removed or reduced the finding as intended within the tested scope.
Ikhadi 412
Umbuzo
What is user and entity behavior analytics?
Impendulo
Analysis that identifies deviations from expected behavior for users, accounts, hosts, or services.
Ikhadi 413
Umbuzo
What does a physical security policy establish?
Impendulo
Required protection for facilities, people, equipment, entry, monitoring, and response to physical events.
Ikhadi 414
Umbuzo
What does a UPS provide?
Impendulo
Immediate short-term power and power conditioning while systems shut down or alternate power starts.
Ikhadi 415
Umbuzo
What is a nondisclosure agreement?
Impendulo
A contract restricting use and disclosure of defined confidential information.
Ikhadi 416
Umbuzo
What should be checked before assigning a user permission?
Impendulo
The user's approved duties, the resource and action allowed, separation-of-duties conflicts, and the impact if the permission is misused.
Ikhadi 417
Umbuzo
How does espionage differ from ordinary theft?
Impendulo
It seeks confidential intelligence for strategic advantage, often while remaining hidden.
Ikhadi 418
Umbuzo
What is password spraying?
Impendulo
Trying a small set of common passwords across many accounts to avoid lockouts.
Ikhadi 419
Umbuzo
What is the purpose of system isolation during an incident?
Impendulo
Stop harmful communication while preserving the system for response and investigation.
Ikhadi 420
Umbuzo
What is a security benchmark?
Impendulo
A documented set of recommended configuration checks for a platform or product.
Ikhadi 421
Umbuzo
Which metadata fields give a log record investigative context?
Impendulo
Fields such as timestamp and time zone, source system, user or process identity, event ID or type, severity, and correlation ID.
Ikhadi 422
Umbuzo
What does an access-control vestibule prevent?
Impendulo
It limits tailgating by allowing controlled passage through one door at a time.
Ikhadi 423
Umbuzo
What is version control's security value for configuration?
Impendulo
It preserves attributable history and enables review or rollback of changes.
Ikhadi 424
Umbuzo
Why use both internal and external compliance monitoring?
Impendulo
Internal monitoring supports continuous correction; external review adds independent or regulatory scrutiny.
Ikhadi 425
Umbuzo
What distinguishes on-premises architecture?
Impendulo
The organization operates the infrastructure in facilities it controls and retains the associated physical and platform duties.
Ikhadi 426
Umbuzo
What risk can split tunneling add to a VPN?
Impendulo
The endpoint can reach the protected network and an untrusted network at the same time, creating a path around centralized inspection.
Ikhadi 427
Umbuzo
What is a certificate root of trust?
Impendulo
A trusted root certificate or key from which a client validates a certificate chain.
Ikhadi 428
Umbuzo
What is typosquatting?
Impendulo
Registering a look-alike domain based on common typing errors or visual similarity.
Ikhadi 429
Umbuzo
What is root-cause analysis?
Impendulo
Identifying the underlying conditions that allowed an incident, not just its visible symptoms.
Ikhadi 430
Umbuzo
What is risk tolerance?
Impendulo
The acceptable variation or boundary around a specific objective or risk area.
Ikhadi 431
Umbuzo
What is a security self-assessment?
Impendulo
A structured internal evaluation in which the organization measures its own controls against selected criteria.
Ikhadi 432
Umbuzo
What does data masking change?
Impendulo
It replaces sensitive values with altered but usable representations, often preserving format for testing or display.
Ikhadi 433
Umbuzo
How do wireless authentication protocols let clients prove identity securely?
Impendulo
They define how a client proves control of a credential, such as a password-derived secret or a certificate's private key; stronger choices also validate the server and protect the exchange.
Ikhadi 434
Umbuzo
Why reconcile inventory with network discovery?
Impendulo
Differences expose missing records, retired systems, or unauthorized devices.
Ikhadi 435
Umbuzo
Why does sideloading raise mobile risk?
Impendulo
It can bypass store review, signing policy, and managed application controls.
Ikhadi 436
Umbuzo
What does an information-sharing organization add to vulnerability management?
Impendulo
Sector or community intelligence about relevant threats, incidents, and defensive action.
Ikhadi 437
Umbuzo
What does a web-filter block rule specify?
Impendulo
The URL, domain, category, reputation, content, user, or context that should prevent a web request.
Ikhadi 438
Umbuzo
How do data custodians and data stewards differ?
Impendulo
Custodians implement and operate technical safeguards for data; stewards guide its definitions, quality, handling, and proper use under the owner’s direction.
Ikhadi 439
Umbuzo
What is a brute-force password attack?
Impendulo
Systematically trying many candidate secrets against an account or protected value.
Ikhadi 440
Umbuzo
What is a compensating control?
Impendulo
An alternative safeguard used when the preferred control is impractical or unavailable.
Ikhadi 441
Umbuzo
How can location act as an authentication factor?
Impendulo
A system can evaluate where the claimant is, but location signals are usually contextual and spoofable rather than sufficient alone.
Ikhadi 442
Umbuzo
Why must security automation remain supportable?
Impendulo
Owners must be able to update dependencies, understand failures, rotate credentials, and adapt the workflow as systems change.
Ikhadi 443
Umbuzo
What does a standby generator provide?
Impendulo
Longer-duration power during a utility outage, after a startup delay.
Ikhadi 444
Umbuzo
What makes an architecture air-gapped?
Impendulo
It has no direct network path to less-trusted networks, although removable media and maintenance workflows can still cross the boundary.
Ikhadi 445
Umbuzo
What is a software-defined WAN?
Impendulo
A centrally managed overlay that selects wide-area paths by policy across underlying network links.
Ikhadi 446
Umbuzo
What password-management behavior should awareness training reinforce?
Impendulo
Use unique long passwords through an approved manager and report suspected compromise promptly.
Ikhadi 447
Umbuzo
What security value does fencing provide?
Impendulo
It defines and delays entry across a physical perimeter.
Ikhadi 448
Umbuzo
What is a wildcard certificate?
Impendulo
A certificate that can match multiple hosts at one domain level, such as subdomains of an example domain.
Ikhadi 449
Umbuzo
How does misinformation differ from disinformation?
Impendulo
Misinformation is false regardless of intent; disinformation is deliberately false or misleading.
Ikhadi 450
Umbuzo
What is a risk threshold?
Impendulo
A defined level that triggers escalation, treatment, or another required response.
Ikhadi 451
Umbuzo
What does a vendor penetration test contribute to assessment?
Impendulo
Authorized evidence of exploitable paths in the vendor's relevant environment under agreed scope.
Ikhadi 452
Umbuzo
What is the objective of a service-disruption attack?
Impendulo
Make a system or business function unavailable or unreliable.
Ikhadi 453
Umbuzo
What is directory traversal?
Impendulo
Manipulating a file path to reach files outside the directory the application intended to expose.
Ikhadi 454
Umbuzo
Why decommission an unsupported system?
Impendulo
Removing it eliminates an exposure that can no longer be patched or securely maintained.
Ikhadi 455
Umbuzo
Why archive security-monitoring data?
Impendulo
To preserve evidence for investigations, trend analysis, compliance, and retention requirements beyond the live system.
Ikhadi 456
Umbuzo
What role does RADIUS commonly play in enterprise Wi-Fi?
Impendulo
It centralizes authentication, authorization information, and accounting for network access.
Ikhadi 457
Umbuzo
Why separate the requester and approver of a high-risk change?
Impendulo
To reduce error, fraud, and unilateral unauthorized modification.
Ikhadi 458
Umbuzo
Why can a jailbroken device violate a security baseline?
Impendulo
It weakens platform isolation and allows unapproved privileged changes.
Ikhadi 459
Umbuzo
When is tokenization especially useful?
Impendulo
When a system needs a surrogate value without retaining the original sensitive value in that workflow.
Ikhadi 460
Umbuzo
Why can dark-web intelligence affect vulnerability priority?
Impendulo
Discussion, exploit sales, or leaked access can signal attacker interest, but the evidence must be validated.
Ikhadi 461
Umbuzo
What firewall policy should govern traffic from a screened subnet to internal systems?
Impendulo
Deny it by default and allow only explicitly required flows.
Ikhadi 462
Umbuzo
What does SAML commonly carry?
Impendulo
XML assertions about authentication and attributes between an identity provider and service provider; signatures commonly protect their authenticity and integrity.
Ikhadi 463
Umbuzo
What does a security governance committee do?
Impendulo
It coordinates stakeholders, reviews risk and performance, and makes or recommends decisions within its charter.
Ikhadi 464
Umbuzo
How can global privacy requirements affect one data process?
Impendulo
A shared process may need to satisfy overlapping duties across jurisdictions where people, systems, or data are located.
Ikhadi 465
Umbuzo
What characterizes an IoT device?
Impendulo
It combines sensing or actuation with network connectivity, often under tight resource and update constraints.
Ikhadi 466
Umbuzo
What is a unified threat management appliance?
Impendulo
One device combines several controls, such as firewalling, intrusion prevention, filtering, and malware inspection.
Ikhadi 467
Umbuzo
What does a hardware security module provide?
Impendulo
A dedicated, tamper-resistant environment for generating, storing, and using cryptographic keys.
Ikhadi 468
Umbuzo
A remotely reachable API is fixed, but its desktop client stays vulnerable. What exposure remains?
Impendulo
Client-based exposure remains because the installed endpoint software is still vulnerable; fixing the remote API does not remediate the client.
Ikhadi 469
Umbuzo
What is a tabletop exercise?
Impendulo
A discussion-based walkthrough of a scenario to test decisions, roles, and procedures.
Ikhadi 470
Umbuzo
What does a risk exemption authorize?
Impendulo
A documented release from a requirement for a defined scope, owner, rationale, controls, review, and expiration.
Ikhadi 471
Umbuzo
What is a regulatory examination?
Impendulo
An authorized regulator reviews records, controls, and practices to determine whether the organization meets applicable requirements.
Ikhadi 472
Umbuzo
What does physical video surveillance primarily provide?
Impendulo
Detection and evidence of activity in monitored areas.
Ikhadi 473
Umbuzo
What is a birthday attack against a hash?
Impendulo
Using collision probability to find any two matching digests much faster than targeting one exact preimage.
Ikhadi 474
Umbuzo
Why keep backups both onsite and offsite?
Impendulo
Onsite copies support fast recovery, while offsite copies survive a site-wide loss.
Ikhadi 475
Umbuzo
How does technical debt affect security automation?
Impendulo
Outdated assumptions, dependencies, and workarounds make the workflow harder to change and more likely to fail unsafely.
Ikhadi 476
Umbuzo
What should switch hardening restrict first?
Impendulo
Administrative access, unused ports, insecure management protocols, and unauthorized changes to switching configuration.
Ikhadi 477
Umbuzo
What should happen when an asset changes owners?
Impendulo
Inventory, access, support responsibility, and data handling should be updated.
Ikhadi 478
Umbuzo
What does evidence of a vendor's internal audits contribute?
Impendulo
It shows how the vendor tests its own controls, records findings, assigns remediation, and follows issues to closure.
Ikhadi 479
Umbuzo
What is identity attestation?
Impendulo
Evidence that an identity, device, authenticator, or claim has been verified by a trusted process.
Ikhadi 480
Umbuzo
Why can standard enterprise patching be unsafe for an RTOS device?
Impendulo
A change can disrupt timing guarantees or certified operational behavior.
Ikhadi 481
Umbuzo
What is secure access service edge?
Impendulo
A cloud-delivered architecture that combines wide-area connectivity with policy-driven security services near users and resources.
Ikhadi 482
Umbuzo
What social-engineering habit should awareness training reinforce?
Impendulo
Pause and independently verify unusual requests instead of trusting urgency, authority, or familiarity.
Ikhadi 483
Umbuzo
How can a software provider introduce a supply-chain vulnerability?
Impendulo
A compromised package, build system, dependency, or update channel can deliver vulnerable or malicious code to customers.
Ikhadi 484
Umbuzo
Why include internet exposure in remediation priority?
Impendulo
A reachable vulnerable service usually has more attack opportunity than an isolated one.
Ikhadi 485
Umbuzo
What does a mail gateway inspect?
Impendulo
Inbound and outbound email for threats, policy violations, spoofing, and sensitive data.
Ikhadi 486
Umbuzo
What is a data controller?
Impendulo
The entity that determines why and how personal data is processed.
Ikhadi 487
Umbuzo
How does blackmail motivate a cyberattack?
Impendulo
The attacker threatens disclosure or harm unless the victim complies.
Ikhadi 488
Umbuzo
What is a downgrade attack?
Impendulo
Forcing parties to use an older or weaker protocol or security mode.
Ikhadi 489
Umbuzo
How does encryption mitigate data exposure?
Impendulo
It makes captured data unreadable without the required key.
Ikhadi 490
Umbuzo
How do network and web vulnerability scanners differ?
Impendulo
Network scanners assess reachable hosts, services, versions, and configurations; web scanners exercise running web behavior for application weaknesses.
Ikhadi 491
Umbuzo
How can vulnerability-scan data support an investigation?
Impendulo
It shows which weaknesses, versions, services, and exposures were known on the affected systems near the incident timeline.
Ikhadi 492
Umbuzo
What is key escrow?
Impendulo
Controlled storage of a recoverable copy of a cryptographic key by an authorized party.
Ikhadi 493
Umbuzo
Which human vector commonly uses a fake sign-in page to harvest credentials?
Impendulo
Phishing; the message sends the target to an imitation service that captures the submitted credentials.
Ikhadi 494
Umbuzo
What is risk avoidance?
Impendulo
Stopping or not starting the activity that creates the risk.
Ikhadi 495
Umbuzo
What is data obfuscation?
Impendulo
Making data harder to understand while preserving some utility, without necessarily providing cryptographic secrecy.
Ikhadi 496
Umbuzo
What is a directive control?
Impendulo
A safeguard that tells people what behavior or action is required.
Ikhadi 497
Umbuzo
What does a security guard add that a camera cannot?
Impendulo
Human judgment and an immediate physical response.
Ikhadi 498
Umbuzo
Why define restricted activities in change management?
Impendulo
High-risk actions can then require extra authorization, separation of duties, or a prohibited window.
Ikhadi 499
Umbuzo
What contractual impact can noncompliance create?
Impendulo
It can trigger remediation duties, service credits, indemnity, audit rights, suspension, termination, or claims for breach.
Ikhadi 500
Umbuzo
What should determine backup frequency?
Impendulo
The recovery point objective, data-change rate, business impact, and available replication or storage capacity.
Ikhadi 501
Umbuzo
What should router hardening protect?
Impendulo
Administrative access, routing configuration, exposed services, and the integrity of traffic-control policy.
Ikhadi 502
Umbuzo
What problem does OAuth 2.0 address?
Impendulo
Delegated authorization: a client obtains limited access to a resource without receiving the user's password.
Ikhadi 503
Umbuzo
What does SCADA do?
Impendulo
It provides supervisory monitoring and control across distributed industrial equipment.
Ikhadi 504
Umbuzo
How does a Layer 3/4 firewall rule differ from a Layer 7 rule?
Impendulo
Layer 3/4 evaluates IP addresses plus transport protocols and ports; Layer 7 evaluates application content or actions.
Ikhadi 505
Umbuzo
What distinguishes a computer virus?
Impendulo
It attaches to a host file or program and spreads when that infected host executes or is shared.
Ikhadi 506
Umbuzo
What does a key management system coordinate?
Impendulo
Secure key creation, storage, access, rotation, revocation, recovery, and destruction.
Ikhadi 507
Umbuzo
How can an unsecure wired network expose traffic?
Impendulo
An unauthorized device on the network may observe, redirect, or inject traffic when access control and link protections are weak.
Ikhadi 508
Umbuzo
Why is vulnerable device firmware hard to remediate?
Impendulo
Firmware updates may be rare, vendor-dependent, or impossible after support ends.
Ikhadi 509
Umbuzo
What does patching change in vulnerability remediation?
Impendulo
It installs the vendor's corrected code or configuration to remove the underlying software weakness.
Ikhadi 510
Umbuzo
What does DMARC add to SPF and DKIM?
Impendulo
Domain alignment, receiver policy, and reporting for messages claiming the visible From domain.
Ikhadi 511
Umbuzo
How does automation improve security efficiency?
Impendulo
It performs repeatable actions quickly and consistently while reducing manual handoffs and rework.
Ikhadi 512
Umbuzo
What is a simulation exercise?
Impendulo
A more realistic practice in which participants respond to injected events using operational processes.
Ikhadi 513
Umbuzo
What is a data processor?
Impendulo
An entity that processes personal data on behalf of a controller.
Ikhadi 514
Umbuzo
What is risk mitigation?
Impendulo
Reducing likelihood, impact, or both through controls or process changes.
Ikhadi 515
Umbuzo
Why monitor a vendor after onboarding?
Impendulo
Security posture, ownership, services, incidents, and dependencies can change.
Ikhadi 516
Umbuzo
What does a physical penetration test assess?
Impendulo
Whether authorized testers can bypass facility, personnel, and physical access controls under agreed rules.
Ikhadi 517
Umbuzo
Why use access badges at a facility?
Impendulo
To associate entry attempts with authorized identities and enforce access rules.
Ikhadi 518
Umbuzo
How does permission restriction protect data?
Impendulo
Only authorized identities receive the actions and scope their roles require.
Ikhadi 519
Umbuzo
What is the usual objective of ransomware extortion?
Impendulo
Force payment by denying access, threatening disclosure, or both.
Ikhadi 520
Umbuzo
What does impossible travel indicate?
Impendulo
One identity appears to authenticate from distant locations too quickly for legitimate travel.
Ikhadi 521
Umbuzo
What is configuration enforcement?
Impendulo
Continuously applying or restoring approved settings so systems do not remain in an insecure state.
Ikhadi 522
Umbuzo
What does a web vulnerability scanner inspect?
Impendulo
Running web behavior for issues such as unsafe input handling and insecure configuration.
Ikhadi 523
Umbuzo
How does cost affect an architecture choice?
Impendulo
It constrains acquisition, operation, staffing, resilience, and recovery options across the system's life.
Ikhadi 524
Umbuzo
What does EAP provide with 802.1X?
Impendulo
A framework for carrying an authentication method between the supplicant and authentication infrastructure.
Ikhadi 525
Umbuzo
What should operational-security training help users protect?
Impendulo
Sensitive routines, capabilities, locations, relationships, and small details that an observer could combine into useful intelligence.
Ikhadi 526
Umbuzo
What does a time-of-day access rule do?
Impendulo
Allows or denies a requested action according to an approved schedule.
Ikhadi 527
Umbuzo
What should cloud infrastructure hardening establish?
Impendulo
Secure identities, network boundaries, logging, encryption, approved configurations, and continuous checks for drift.
Ikhadi 528
Umbuzo
What should an asset owner ensure during offboarding?
Impendulo
Assigned assets, access, data, and custody records are returned, transferred, or disposed of under the approved process.
Ikhadi 529
Umbuzo
Why encrypt backups?
Impendulo
Backup media and transfers can expose the same sensitive data as production systems.
Ikhadi 530
Umbuzo
What is steganography?
Impendulo
Hiding the existence of data inside another medium rather than merely encrypting its contents.
Ikhadi 531
Umbuzo
Which human vector uses a fabricated authority role to justify a sensitive request?
Impendulo
Pretexting; the attacker invents a credible role and situation to make the request seem legitimate.
Ikhadi 532
Umbuzo
Why does risk transfer not remove accountability?
Impendulo
The organization can retain legal, reputational, operational, and oversight consequences.
Ikhadi 533
Umbuzo
Why validate a change after deployment?
Impendulo
To confirm the intended result occurred without introducing unacceptable side effects.
Ikhadi 534
Umbuzo
What makes end-of-life hardware a security vulnerability?
Impendulo
The vendor no longer supplies fixes or support, so known weaknesses can persist without a reliable remediation path.
Ikhadi 535
Umbuzo
What does an audit add to remediation validation?
Impendulo
Independent evidence that the approved fix, process, and documentation were completed and remain effective.
Ikhadi 536
Umbuzo
Why can SPF pass while a message still impersonates a brand?
Impendulo
SPF checks the envelope domain, which may differ from the visible From domain.
Ikhadi 537
Umbuzo
What role can a government entity have in security governance?
Impendulo
It can establish, enforce, or oversee legal and regulatory requirements within its authority.
Ikhadi 538
Umbuzo
How do data inventory and retention support privacy governance?
Impendulo
The inventory records what data is processed and where; retention rules define how long it is kept and when it is deleted or anonymized.
Ikhadi 539
Umbuzo
What can concurrent sessions from distant regions indicate?
Impendulo
A stolen account or shared credential, subject to VPN and proxy context.
Ikhadi 540
Umbuzo
What does supply-chain analysis examine?
Impendulo
Upstream providers, components, dependencies, concentration, and compromise paths that can affect the purchased service.
Ikhadi 541
Umbuzo
What is the purpose of facility lighting as a control?
Impendulo
Deter covert activity and improve observation of people and areas.
Ikhadi 542
Umbuzo
What architecture quality keeps a service usable during component failure?
Impendulo
Availability.
Ikhadi 543
Umbuzo
When is fail-open behavior preferable to fail-closed behavior?
Impendulo
When preserving availability during control failure is more important than blocking uninspected traffic, based on the system's risk decision.
Ikhadi 544
Umbuzo
Which control function does a login-failure alert provide?
Impendulo
Detection; it reveals suspicious authentication activity.
Ikhadi 545
Umbuzo
What does a biometric MFA implementation verify?
Impendulo
A measured physical or behavioral characteristic presented by the user, matched against an enrolled template.
Ikhadi 546
Umbuzo
How can automation enforce a security baseline?
Impendulo
It compares realized settings with the approved state and reports or corrects unauthorized drift.
Ikhadi 547
Umbuzo
How do wireless cryptographic protocols protect network traffic?
Impendulo
They encrypt frames over the air and add integrity protection, reducing eavesdropping and tampering when a secure protocol and configuration are used.
Ikhadi 548
Umbuzo
Why segment sensitive data stores?
Impendulo
It limits reachable paths and separates them from lower-trust workloads.
Ikhadi 549
Umbuzo
What must remain secret in an asymmetric key pair?
Impendulo
The private key; disclosure lets another party impersonate the owner or decrypt data intended for that key, depending on its use.
Ikhadi 550
Umbuzo
How can a supplier become a supply-chain attack vector?
Impendulo
A compromised material, component, credential, or delivery process can weaken products before they reach the organization.
Ikhadi 551
Umbuzo
What is e-discovery?
Impendulo
Identifying, preserving, collecting, reviewing, and producing electronically stored information for a legal matter.
Ikhadi 552
Umbuzo
What characterizes a neutral risk appetite?
Impendulo
A balanced willingness to accept uncertainty when expected value and controls justify the exposure.
Ikhadi 553
Umbuzo
What is passive reconnaissance?
Impendulo
Gathering information without directly interacting with the target's systems.
Ikhadi 554
Umbuzo
What does a philosophical motive mean for a threat actor?
Impendulo
The actor acts to advance a belief or moral position rather than primarily for money.
Ikhadi 555
Umbuzo
What does unexpected resource consumption indicate?
Impendulo
Possible malware, denial of service, cryptomining, or a malfunction that needs investigation.
Ikhadi 556
Umbuzo
What does a host-based intrusion prevention system do?
Impendulo
It monitors activity on one host and can block behavior that matches exploit or attack rules.
Ikhadi 557
Umbuzo
How does agent-based monitoring differ from agentless monitoring?
Impendulo
An agent collects local detail on the host; agentless monitoring uses remote interfaces and may have less visibility.
Ikhadi 558
Umbuzo
What can network logs contribute to an investigation?
Impendulo
Connection timing, endpoints, protocols, routing, name resolution, and other evidence of communication across the environment.
Ikhadi 559
Umbuzo
What is the purpose of a backup restore test?
Impendulo
Demonstrate under tested conditions that required data and systems can be recovered within expectations.
Ikhadi 560
Umbuzo
Why can obsolete hardware become a security risk?
Impendulo
It may lack supported firmware, modern protections, or replacement parts.
Ikhadi 561
Umbuzo
What does rescanning confirm after remediation?
Impendulo
Whether the scanner can still detect the original finding on the affected asset.
Ikhadi 562
Umbuzo
What should a secure transport method provide?
Impendulo
Authenticated endpoints where required, confidentiality, integrity, replay resistance, and supported cryptography for the traffic.
Ikhadi 563
Umbuzo
How can law affect security governance?
Impendulo
It can impose mandatory duties based on jurisdiction, data, industry, or activity.
Ikhadi 564
Umbuzo
What does resilience mean for a security architecture?
Impendulo
The ability to withstand disruption, adapt, and recover while preserving essential functions.
Ikhadi 565
Umbuzo
Why minimize an infrastructure's attack surface?
Impendulo
Fewer exposed services and paths leave fewer opportunities for exploitation.
Ikhadi 566
Umbuzo
What does executing a security-awareness program require?
Impendulo
Delivering the approved content to the intended audiences, tracking participation, handling exceptions, and measuring outcomes.
Ikhadi 567
Umbuzo
What does an infrared security sensor detect?
Impendulo
A change in infrared energy, often the heat pattern created by a person moving through its field of view.
Ikhadi 568
Umbuzo
What is a knowledge factor?
Impendulo
Something the claimant knows, such as a password.
Ikhadi 569
Umbuzo
Why review allow-list and deny-list impact before a change?
Impendulo
Adding or removing an entry can unexpectedly grant access, block users, or interrupt dependencies.
Ikhadi 570
Umbuzo
What does partition-level encryption protect?
Impendulo
One selected disk partition, leaving other partitions outside that encryption boundary.
Ikhadi 571
Umbuzo
How can instant messaging deliver a security attack?
Impendulo
It can deliver a malicious link, file, request, or impersonated conversation through a fast, trusted-looking channel.
Ikhadi 572
Umbuzo
What can repeated blocked-content events indicate?
Impendulo
Malware, policy bypass, a misconfigured application, or a user repeatedly reaching prohibited resources.
Ikhadi 573
Umbuzo
What should a server-hardening baseline reduce?
Impendulo
Unnecessary services, exposed administration, weak identity controls, insecure defaults, and unmonitored configuration change.
Ikhadi 574
Umbuzo
When is physical media destruction appropriate?
Impendulo
When reuse is unnecessary or sanitization cannot provide adequate assurance.
Ikhadi 575
Umbuzo
What is mean time to repair?
Impendulo
The average time required to restore a failed component or service.
Ikhadi 576
Umbuzo
Why disclose conflicts of interest during vendor selection?
Impendulo
A personal or financial relationship can bias evaluation away from the organization's requirements.
Ikhadi 577
Umbuzo
What is a fine for noncompliance?
Impendulo
A monetary penalty imposed for failing to meet a legal, regulatory, or contractual requirement.
Ikhadi 578
Umbuzo
What does a public data classification authorize?
Impendulo
Approved disclosure without confidentiality restrictions, while integrity and availability requirements may still apply.
Ikhadi 579
Umbuzo
What security benefit comes from standard infrastructure configurations?
Impendulo
They reduce variation, make review repeatable, and let the same approved controls be applied across resources.
Ikhadi 580
Umbuzo
How does horizontal scaling increase capacity?
Impendulo
It adds more service instances and distributes work among them.
Ikhadi 581
Umbuzo
Why can added connectivity weaken segmentation?
Impendulo
Each allowed path can become a route for lateral movement or data escape.
Ikhadi 582
Umbuzo
What coding practice is central to preventing SQL injection?
Impendulo
Use parameterized queries so untrusted values remain data rather than executable query syntax.
Ikhadi 583
Umbuzo
When is a compensating control appropriate for a vulnerability?
Impendulo
When timely removal or patching is infeasible and another control can reduce the risk.
Ikhadi 584
Umbuzo
How does agent-based web filtering enforce policy?
Impendulo
Software on the endpoint evaluates or redirects web traffic, including traffic that does not pass through a central network proxy.
Ikhadi 585
Umbuzo
How can regulation differ from an internal policy?
Impendulo
Regulation is externally enforceable; internal policy is an organizational rule that may implement external duties.
Ikhadi 586
Umbuzo
What is a storage snapshot?
Impendulo
A point-in-time representation of data or system state, whose independence depends on how it is stored.
Ikhadi 587
Umbuzo
What does password age measure?
Impendulo
How long the current password has existed, which policy may use to prevent immediate reuse or trigger a risk-based change.
Ikhadi 588
Umbuzo
What does an ethical motive mean in vulnerability research?
Impendulo
The researcher intends to improve security, typically through authorized testing and responsible disclosure.
Ikhadi 589
Umbuzo
What can missing security logs indicate?
Impendulo
Logging failure, tampering, retention misconfiguration, or an inactive source.
Ikhadi 590
Umbuzo
Why disable unused ports and protocols?
Impendulo
They expose unnecessary communication paths and code that attackers can reach.
Ikhadi 591
Umbuzo
What does antivirus contribute to monitoring?
Impendulo
It scans files, memory, or behavior and reports suspected malicious code.
Ikhadi 592
Umbuzo
What is a honeypot?
Impendulo
A decoy system or service designed to attract and observe malicious activity.
Ikhadi 593
Umbuzo
What does file-level encryption protect?
Impendulo
Selected files independently of whether the rest of the disk or volume is encrypted.
Ikhadi 594
Umbuzo
How can SMS deliver a security attack?
Impendulo
A text message can carry a malicious link or urgent request that exploits the recipient's trust in the phone channel.
Ikhadi 595
Umbuzo
What happens during incident analysis?
Impendulo
Responders validate the event, determine scope and impact, build a timeline, and identify the systems, accounts, and data involved.
Ikhadi 596
Umbuzo
What is mean time between failures?
Impendulo
The average operating time between repairable failures.
Ikhadi 597
Umbuzo
What is active reconnaissance?
Impendulo
Probing or interacting with target systems to discover services and behavior.
Ikhadi 598
Umbuzo
What constraint should guide ICS or SCADA hardening?
Impendulo
Safety and process availability must be preserved while access, services, network paths, and changes are tightly controlled.
Ikhadi 599
Umbuzo
Which control function does restoring a clean system image provide?
Impendulo
Correction; it returns the system to a known-good state.
Ikhadi 600
Umbuzo
What does responsiveness mean in an architecture decision?
Impendulo
How quickly the system and its operators can adapt to demand, failure, or attack.
Ikhadi 601
Umbuzo
How does out-of-band access strengthen remote administration?
Impendulo
It uses a management path separate from production traffic, preserving controlled access during an outage or compromise.
Ikhadi 602
Umbuzo
What makes user behavior unexpected?
Impendulo
It differs materially from the person's normal role, timing, location, resource use, or established work pattern.
Ikhadi 603
Umbuzo
What is a work order?
Impendulo
A document authorizing a defined unit of work under an existing agreement.
Ikhadi 604
Umbuzo
What can out-of-cycle logging indicate?
Impendulo
Unexpected activity outside a system's normal schedule, including misuse, compromise, or an unplanned job.
Ikhadi 605
Umbuzo
Why update a standard operating procedure after a change?
Impendulo
It keeps routine work aligned with the new approved state and reduces inconsistent or unsafe execution.
Ikhadi 606
Umbuzo
What coding practice limits cross-site scripting?
Impendulo
Context-appropriate output encoding, supported by safe templating and input handling.
Ikhadi 607
Umbuzo
What does a restricted data classification indicate?
Impendulo
Access is tightly limited because unauthorized disclosure, alteration, or loss would create serious harm.
Ikhadi 608
Umbuzo
How does a bug bounty support responsible disclosure?
Impendulo
It defines eligible systems, rules, reporting, and possible rewards for external researchers.
Ikhadi 609
Umbuzo
What does web-filter content categorization provide?
Impendulo
A policy label for a site or page based on its subject, function, or risk so access rules can treat categories consistently.
Ikhadi 610
Umbuzo
How do hard and soft authentication tokens differ?
Impendulo
A hard token is a separate physical device; a soft token is implemented in software on a general-purpose device.
Ikhadi 611
Umbuzo
How can industry requirements affect security governance?
Impendulo
Industry standards, shared practices, assurance expectations, and sector-specific risks can shape required policies and controls.
Ikhadi 612
Umbuzo
How can noncompliance cause loss of a license?
Impendulo
An authority may suspend or revoke the permission needed to operate, sell, or perform regulated work.
Ikhadi 613
Umbuzo
What does volume-level encryption protect?
Impendulo
All data within a selected logical storage volume.
Ikhadi 614
Umbuzo
How can impersonation exploit familiarity?
Impendulo
The attacker imitates a known person or routine communication style so the request receives less scrutiny.
Ikhadi 615
Umbuzo
How does RTO guide recovery design?
Impendulo
It sets the target maximum time to restore the function, driving recovery automation, staffing, capacity, and site choices.
Ikhadi 616
Umbuzo
What is a honeynet?
Impendulo
A network of decoy systems used to study or divert attackers.
Ikhadi 617
Umbuzo
What does backup replication provide?
Impendulo
Additional synchronized or copied recovery data in another system or location.
Ikhadi 618
Umbuzo
What lets automation scale securely?
Impendulo
Bounded permissions, validated inputs, rate controls, audit records, and consistent policy at every new resource.
Ikhadi 619
Umbuzo
Why monitor a hardened computing resource continuously?
Impendulo
New drift, failures, attacks, and unsupported changes can appear after a secure baseline is deployed.
Ikhadi 620
Umbuzo
Why keep a certificate of destruction?
Impendulo
It documents that a disposal provider handled specified media under the agreed process.
Ikhadi 621
Umbuzo
Why consider patch availability before selecting a platform?
Impendulo
Unsupported or difficult-to-update components accumulate known exposure.
Ikhadi 622
Umbuzo
Why should remote administration use an encrypted, authenticated protocol?
Impendulo
It keeps credentials and commands confidential in transit. When correctly configured with integrity protection, the protocol also detects tampering and authenticates the intended endpoint.
Ikhadi 623
Umbuzo
How can revenge motivate an insider incident?
Impendulo
A disgruntled person may damage systems or disclose data to punish the organization.
Ikhadi 624
Umbuzo
What is a published or documented indicator of malicious activity?
Impendulo
A malicious observable or behavior—such as a hash, domain, IP address, or TTP—shared through threat intelligence, an advisory, or an incident report to help identify related malicious activity.
Ikhadi 625
Umbuzo
Why monitor a system more closely when a mitigation exception is accepted?
Impendulo
Monitoring can reveal exploitation or control failure while the documented exception remains open.
Ikhadi 626
Umbuzo
What is an SNMP trap?
Impendulo
An unsolicited device notification sent to a management system when a configured event occurs.
Ikhadi 627
Umbuzo
How can an automated report support an investigation?
Impendulo
It assembles repeatable findings, trends, or control results that investigators can correlate with the incident timeline.
Ikhadi 628
Umbuzo
What is a security key?
Impendulo
A hardware authenticator that uses cryptographic proof, often bound to the legitimate service origin.
Ikhadi 629
Umbuzo
What does database-level encryption protect?
Impendulo
A database or selected database structures through controls managed at the database layer.
Ikhadi 630
Umbuzo
How does brand impersonation exploit trust?
Impendulo
It copies a familiar organization's identity so a fraudulent message, site, or account appears legitimate.
Ikhadi 631
Umbuzo
What browser-side impact can a cross-site scripting vulnerability create?
Impendulo
It can run attacker-controlled script in a trusted site's origin and access data or actions available to the victim's session.
Ikhadi 632
Umbuzo
How can a system or process audit identify vulnerabilities?
Impendulo
It compares evidence with required configuration and procedure to reveal control gaps.
Ikhadi 633
Umbuzo
What security role can Group Policy provide?
Impendulo
Centralized Windows configuration of account, application, audit, and system security settings.
Ikhadi 634
Umbuzo
What should incident-response training prepare people to do?
Impendulo
Recognize their role, use the communication and escalation paths, preserve evidence, and perform approved response actions.
Ikhadi 635
Umbuzo
Why must governance track local or regional requirements?
Impendulo
They may impose location-specific duties that differ from national, global, industry, or contractual rules.
Ikhadi 636
Umbuzo
How can a dependency become a useful key risk indicator?
Impendulo
A measurable change in its availability, capacity, control state, or concentration can warn that exposure is increasing.
Ikhadi 637
Umbuzo
What is a business partners agreement?
Impendulo
An agreement defining how business partners will work together, including responsibilities and security or data-handling terms.
Ikhadi 638
Umbuzo
What makes an audit regulatory?
Impendulo
It evaluates compliance with requirements established or enforced by a government or delegated authority.
Ikhadi 639
Umbuzo
What is a honeyfile?
Impendulo
A decoy file whose access can reveal unauthorized activity.
Ikhadi 640
Umbuzo
Why does legal information require explicit protection?
Impendulo
It may contain privileged advice, case strategy, evidence, or regulated records whose disclosure or alteration creates legal risk.
Ikhadi 641
Umbuzo
Which indicator can mass file renaming and encryption produce?
Impendulo
Resource inaccessibility; users may be unable to open files after an attacker encrypts or renames them.
Ikhadi 642
Umbuzo
What remains with an organization after transferring architecture risk?
Impendulo
Oversight and residual risk remain, even when a provider or insurer accepts defined responsibility or financial consequences.
Ikhadi 643
Umbuzo
When does local console placement provide useful administrative access?
Impendulo
When network management is unavailable or unsafe, a physically controlled console offers a direct recovery path.
Ikhadi 644
Umbuzo
What makes a harmful user action unintentional?
Impendulo
The user causes exposure or policy violation through error or misunderstanding rather than deliberate misuse.
Ikhadi 645
Umbuzo
How should an organization harden workstations?
Impendulo
Apply a managed secure baseline: patch the OS and applications, remove unnecessary software and services, enforce least privilege, and enable endpoint protection and a host firewall.
Ikhadi 646
Umbuzo
What is journaling in recovery?
Impendulo
Recording ordered changes so data can be replayed or restored to a consistent point.
Ikhadi 647
Umbuzo
What downtime must a change plan account for?
Impendulo
The period when the affected service will be unavailable or degraded, including the impact on users and dependent systems.
Ikhadi 648
Umbuzo
Why must a privacy program map local or regional law to data flows?
Impendulo
The applicable duties can change with the location of the person, organization, processing, or stored data.
Ikhadi 649
Umbuzo
Why combine independent preventive controls at different layers?
Impendulo
A failure at one layer does not automatically let the same attack succeed at the next layer.
Ikhadi 650
Umbuzo
What is passwordless authentication?
Impendulo
A flow that does not require the user to enter a memorized password, often using public-key credentials.
Ikhadi 651
Umbuzo
How can automation improve security reaction time?
Impendulo
It can collect context and perform preapproved containment or routing as soon as a reliable trigger occurs.
Ikhadi 652
Umbuzo
What does record-level encryption protect?
Impendulo
Individual records or fields, allowing finer protection than encrypting the entire database.
Ikhadi 653
Umbuzo
How can business email compromise misuse urgency?
Impendulo
It pressures an employee to bypass normal verification for a payment, credential, or data request.
Ikhadi 654
Umbuzo
What does impact measure in risk analysis?
Impendulo
The consequence to objectives, such as financial, operational, safety, legal, or reputational harm.
Ikhadi 655
Umbuzo
What makes cyber activity part of warfare?
Impendulo
It supports military or state conflict objectives such as disruption, intelligence, or influence.
Ikhadi 656
Umbuzo
Which indicator can a newly created privileged account produce outside the normal change window?
Impendulo
Out-of-cycle logging; the account event appears at a time when no authorized administrative change was scheduled.
Ikhadi 657
Umbuzo
How can configuration enforcement validate a deployed mitigation?
Impendulo
It compares the realized settings with the approved state and corrects or reports drift.
Ikhadi 658
Umbuzo
How does validating an alert improve alert tuning?
Impendulo
The analyst can identify which conditions, thresholds, or context caused noise or missed important evidence.
Ikhadi 659
Umbuzo
What data-layer impact can a SQL injection vulnerability create?
Impendulo
It can let untrusted input alter a database query, exposing or changing data and sometimes executing administrative operations.
Ikhadi 660
Umbuzo
What environmental variables can change vulnerability priority?
Impendulo
Local exposure, configuration, existing controls, asset importance, and the effect on the organization's actual environment.
Ikhadi 661
Umbuzo
What security role does SELinux provide?
Impendulo
Mandatory access controls that confine processes according to centrally defined policy.
Ikhadi 662
Umbuzo
Why review governance documents periodically?
Impendulo
Business, technology, threats, and external obligations change.
Ikhadi 663
Umbuzo
Why evaluate power requirements for a system design?
Impendulo
Power capacity and redundancy constrain availability and recovery.
Ikhadi 664
Umbuzo
When is IPsec a better tunnel choice than TLS?
Impendulo
Choose IPsec when policy must protect IP traffic broadly below individual applications—for example, across a site-to-site gateway tunnel. Choose TLS for a specific service connection.
Ikhadi 665
Umbuzo
What is a honeytoken?
Impendulo
A fake credential or data element that generates a high-confidence alert when used.
Ikhadi 666
Umbuzo
What should embedded-system hardening prioritize?
Impendulo
Trusted firmware, restricted interfaces, secure defaults, minimal services, and a supported update path.
Ikhadi 667
Umbuzo
Why must sanitization address data remanence?
Impendulo
Residual data may remain recoverable after ordinary deletion, so the sanitization method must make recovery infeasible for the media and risk.
Ikhadi 668
Umbuzo
Why require rules of engagement for vendor testing?
Impendulo
Authorized scope, timing, methods, contacts, and stop conditions prevent unsafe or mistaken activity.
Ikhadi 669
Umbuzo
What does a private data classification indicate?
Impendulo
The information concerns an individual or limited internal audience and should not be exposed publicly.
Ikhadi 670
Umbuzo
What does a tabletop recovery exercise test?
Impendulo
Participants walk through a scenario and decisions without switching production systems, exposing plan and coordination gaps.
Ikhadi 671
Umbuzo
Why prevent password reuse?
Impendulo
One compromised password should not unlock other accounts or services.
Ikhadi 672
Umbuzo
Which malicious-activity indicator is unexplained sustained CPU or memory use?
Impendulo
Abnormal resource consumption, such as unusual CPU, memory, power, storage, or network-bandwidth use.
Ikhadi 673
Umbuzo
What does transport encryption protect?
Impendulo
It protects data-in-transit confidentiality: captured or intercepted traffic is unreadable without the key. Encryption does not prevent interception or, by itself, provide integrity or authenticate endpoints.
Ikhadi 674
Umbuzo
How can a voice call become an attack vector?
Impendulo
An attacker can use a live or synthetic voice to impersonate a trusted party and request secrets, money, or unsafe actions.
Ikhadi 675
Umbuzo
What should a digital-forensics report document?
Impendulo
The question examined, methods, evidence sources, timeline, findings, limitations, and the basis for each conclusion.
Ikhadi 676
Umbuzo
What tradeoff comes with an expansionary risk appetite?
Impendulo
It accepts more uncertainty and exposure to pursue growth or return, so limits and monitoring must remain explicit.
Ikhadi 677
Umbuzo
What does a known penetration-test environment provide?
Impendulo
The tester receives substantial internal knowledge or access so the exercise can focus on deeper control and attack-path testing.
Ikhadi 678
Umbuzo
Why evaluate compute requirements before deployment?
Impendulo
Insufficient resources can cause failure, while excessive resources increase cost and attack surface.
Ikhadi 679
Umbuzo
Why place sensors at network choke points?
Impendulo
They can observe traffic crossing important trust boundaries.
Ikhadi 680
Umbuzo
What should hybrid or remote-work security training emphasize?
Impendulo
Trusted networks and devices, physical privacy, secure communication, reporting, data handling, and separation of work from shared environments.
Ikhadi 681
Umbuzo
Why plan an application restart separately from a service restart?
Impendulo
The application may need its own state handling, user coordination, health checks, and rollback point.
Ikhadi 682
Umbuzo
What is a cryptographic vulnerability?
Impendulo
A weakness in algorithm choice, key handling, implementation, or protocol use that defeats the intended protection.
Ikhadi 683
Umbuzo
Why report findings by asset owner?
Impendulo
Owners need clear accountability and a prioritized remediation queue.
Ikhadi 684
Umbuzo
What should guide selection of a secure protocol?
Impendulo
The protocol must protect the required data flow, authenticate the right endpoints, use supported cryptography, and fit operational constraints.
Ikhadi 685
Umbuzo
How do centralized and decentralized governance structures differ?
Impendulo
Centralized governance sets decisions from one authority; decentralized governance delegates them and needs strong coordination for consistency.
Ikhadi 686
Umbuzo
How does privacy-aware design limit data retention?
Impendulo
It records a justified retention period and makes deletion or anonymization part of the normal data lifecycle.
Ikhadi 687
Umbuzo
What does a pressure security sensor detect?
Impendulo
Force or weight applied to a protected surface, such as a floor mat or fence line.
Ikhadi 688
Umbuzo
What automation costs should a security team plan for?
Impendulo
Development, licensing, infrastructure, monitoring, maintenance, failure recovery, and the staff needed to own the workflow.
Ikhadi 689
Umbuzo
What should RTOS hardening preserve while reducing attack surface?
Impendulo
Deterministic timing and safety requirements, with only necessary services, privileges, interfaces, and validated updates enabled.
Ikhadi 690
Umbuzo
What is the goal of disruption-for-chaos activity?
Impendulo
Create instability or damage itself rather than pursue a clear financial or intelligence return.
Ikhadi 691
Umbuzo
Which indicator can repeated password guessing produce?
Impendulo
Unexpected account lockout; repeated failed attempts can trigger the account's lockout policy.
Ikhadi 692
Umbuzo
How does removing unnecessary software harden a system?
Impendulo
It eliminates code, services, dependencies, and privileges that an attacker could otherwise target.
Ikhadi 693
Umbuzo
What does NetFlow provide?
Impendulo
Metadata summarizing network conversations, such as endpoints, ports, timing, protocol, and byte counts.
Ikhadi 694
Umbuzo
How can a dashboard support an investigation?
Impendulo
It brings selected current and historical signals together so investigators can spot changes, patterns, and affected scope.
Ikhadi 695
Umbuzo
When should a password be expired?
Impendulo
When compromise is suspected, policy or risk requires a change, or the credential no longer meets the approved authentication standard.
Ikhadi 696
Umbuzo
Why does cryptographic key length matter?
Impendulo
It affects the work required to search the key space, although security also depends on the algorithm and implementation.
Ikhadi 697
Umbuzo
How can an unsecure Bluetooth connection become an attack vector?
Impendulo
Weak pairing, discoverability, or vulnerable services can let a nearby attacker connect, intercept data, or issue commands.
Ikhadi 698
Umbuzo
What is a key risk indicator?
Impendulo
A metric that signals changing exposure or increasing likelihood of an adverse outcome.
Ikhadi 699
Umbuzo
What should vendor monitoring verify when a contract ends?
Impendulo
Vendor accounts, credentials, connections, data access, and retained assets are removed or transferred as approved.
Ikhadi 700
Umbuzo
What does a sensitive data classification indicate?
Impendulo
The information needs safeguards because unauthorized access, change, or loss could cause harm.
Ikhadi 701
Umbuzo
What does software-defined networking separate?
Impendulo
The control plane that decides traffic behavior from the data plane that forwards traffic.
Ikhadi 702
Umbuzo
Where should a web application firewall be placed?
Impendulo
In the path of web requests before they reach the protected application.
Ikhadi 703
Umbuzo
What does a simulated recovery exercise test?
Impendulo
Participants perform realistic response actions in a controlled environment without disrupting production.
Ikhadi 704
Umbuzo
How can a team verify that a detective control is effective?
Impendulo
Trigger a known test event and confirm that the control records it, alerts the right responder, and supplies useful evidence.
Ikhadi 705
Umbuzo
How should defenders apply a published or documented indicator to telemetry and validate it before escalating?
Impendulo
Search relevant telemetry for matches, then confirm the indicator's relevance, context, and freshness before escalating.
Ikhadi 706
Umbuzo
What makes a vulnerability cloud-specific?
Impendulo
It arises from cloud service configuration, shared responsibility, control-plane exposure, tenancy, or provider-specific behavior.
Ikhadi 707
Umbuzo
How can insurance respond to vulnerability risk?
Impendulo
It may transfer defined financial consequences, but it does not remove the weakness or the organization's duties.
Ikhadi 708
Umbuzo
How does reputation improve web filtering?
Impendulo
It uses prior observations about a domain, address, certificate, or hosting pattern to identify destinations with elevated risk.
Ikhadi 709
Umbuzo
What does an encryption policy establish?
Impendulo
Which data and communications require encryption, approved methods, key responsibilities, exceptions, and review duties.
Ikhadi 710
Umbuzo
How does a microwave security sensor detect movement?
Impendulo
It emits microwave energy and detects changes in the reflected signal caused by motion.
Ikhadi 711
Umbuzo
What should IoT-device hardening change before deployment?
Impendulo
Default credentials, unnecessary services, insecure communication, unmanaged updates, and unrestricted network access.
Ikhadi 712
Umbuzo
Why track software licenses as assets?
Impendulo
License ownership, permitted use, updates, and end-of-support status affect compliance and risk.
Ikhadi 713
Umbuzo
What does a password manager improve?
Impendulo
It can generate and store unique long passwords so users do not memorize or reuse them.
Ikhadi 714
Umbuzo
What makes a ledger open and public?
Impendulo
Anyone can inspect its recorded entries, while its consensus and integrity controls determine who can add valid entries.
Ikhadi 715
Umbuzo
What should a payment-change request trigger?
Impendulo
Independent verification through a known channel before any account or payment detail is changed.
Ikhadi 716
Umbuzo
What does preserving digital evidence require?
Impendulo
Protecting its integrity, context, access history, and availability from collection through final disposition.
Ikhadi 717
Umbuzo
What should a risk report tell decision-makers?
Impendulo
The risk, uncertainty, business impact, owner, treatment, trend, and decision required.
Ikhadi 718
Umbuzo
What should an external assessment report provide?
Impendulo
Its scope, criteria, evidence, findings, limitations, conclusions, and responsible follow-up actions.
Ikhadi 719
Umbuzo
What is a centralized design's main resilience risk?
Impendulo
A central dependency can become a bottleneck or single point of failure.
Ikhadi 720
Umbuzo
What does mutual TLS add to a TLS-protected service connection?
Impendulo
It adds client authentication, commonly with a client certificate, so the client and server authenticate each other.
Ikhadi 721
Umbuzo
What should recurring security-awareness reporting show?
Impendulo
Changes in participation, knowledge, behavior, reporting, and incidents, with gaps assigned to owners and follow-up actions.
Ikhadi 722
Umbuzo
Why do legacy applications require extra change planning?
Impendulo
They may depend on undocumented behavior, unsupported components, or fragile integrations that make failure and rollback more likely.
Ikhadi 723
Umbuzo
How do a data controller and a data processor differ?
Impendulo
A controller decides why and how personal data is processed. A processor handles that data on the controller’s behalf.
Ikhadi 724
Umbuzo
How can orchestration become a single point of failure?
Impendulo
Many security workflows may depend on one engine, credential path, or integration hub whose outage stops all of them.
Ikhadi 725
Umbuzo
Why should defenses account for a threat actor's sophistication and capability?
Impendulo
Those attributes indicate which techniques the actor can sustain and which controls are likely to slow or expose them.
Ikhadi 726
Umbuzo
How does an injection attack make an application execute unintended instructions?
Impendulo
It sends crafted input that an interpreter treats as code or commands instead of data.
Ikhadi 727
Umbuzo
What does a host-based firewall control?
Impendulo
Inbound and outbound network traffic for one endpoint according to local rules.
Ikhadi 728
Umbuzo
Why revise alerting after an incident?
Impendulo
The incident can reveal missing telemetry, logic, thresholds, or response paths that should produce a better future alert.
Ikhadi 729
Umbuzo
Why include security duties in procurement criteria?
Impendulo
Security is easier to require before selection than to retrofit after dependency and data transfer begin.
Ikhadi 730
Umbuzo
What does a critical data classification indicate?
Impendulo
The information is essential to vital operations, safety, or mission outcomes and needs the strongest availability and recovery controls.
Ikhadi 731
Umbuzo
What infrastructure capacity must support failover?
Impendulo
The alternate site, network, power, cooling, and facility resources needed to carry the transferred load.
Ikhadi 732
Umbuzo
Why does shared cloud context matter when evaluating a cloud-specific vulnerability?
Impendulo
The affected service model and responsibility boundary determine who can observe, patch, configure, or compensate for the weakness.
Ikhadi 733
Umbuzo
How does a remediation exemption differ from an exception?
Impendulo
Terminology follows the governing policy. A common convention is that an exemption removes a requirement for an approved scope, while an exception permits a time-bounded deviation.
Ikhadi 734
Umbuzo
Why should automated EDR or XDR blocking have an exception and rollback path?
Impendulo
A false positive can isolate a critical endpoint or stop a legitimate process, so operators need controlled recovery without disabling protection broadly.
Ikhadi 735
Umbuzo
What does a security playbook provide?
Impendulo
A repeatable set of roles, decisions, and actions for handling a defined operational scenario.
Ikhadi 736
Umbuzo
How does an ultrasonic security sensor detect movement?
Impendulo
It emits high-frequency sound and detects changes in the returning sound pattern caused by motion.
Ikhadi 737
Umbuzo
What should a managed mobile device require for Bluetooth connections?
Impendulo
Intentional pairing, non-discoverable operation when unused, trusted peers, current software, and only necessary Bluetooth profiles.
Ikhadi 738
Umbuzo
How do password complexity rules differ from password length?
Impendulo
Complexity rules require selected character types; length measures total characters. Current policy should prioritize sufficient length and block weak or compromised choices instead of relying on composition alone.
Ikhadi 739
Umbuzo
What makes a certificate third-party trusted?
Impendulo
A certificate authority outside the subject organization signs it and chains it to a root trusted by relying systems.
Ikhadi 740
Umbuzo
Why is an out-of-band check effective against impersonation?
Impendulo
It verifies the request through a separate, previously trusted communication path.
Ikhadi 741
Umbuzo
What does a risk exception authorize?
Impendulo
A documented deviation from a requirement for a defined scope, rationale, controls, owner, review, and expiration.
Ikhadi 742
Umbuzo
What security challenge grows in a decentralized design?
Impendulo
Consistent policy, inventory, monitoring, and patching become harder.
Ikhadi 743
Umbuzo
How should controls be selected for an unused network path?
Impendulo
Choose controls that block it by default, expose only approved connectivity, and make exceptions explicit and reviewable.
Ikhadi 744
Umbuzo
How can a buffer-overflow attack affect an application?
Impendulo
It writes past a buffer boundary to corrupt memory, which can crash the application or redirect execution.
amakhadi angu-744
CompTIA Security+ SY0-701 Flashcards: Complete Objective Review
I-Nibomo iyavuleka ukuze uqale ukufunda.