7 Security Tools and Operational Exercises Free Online FlashCards

What cycle makes security tools’ findings actionable?

Follow a repeatable cycle: identify assets and access, assess risk, apply controls, monitor for change, respond to incidents, and verify recovery.

What does least privilege mean?

Least privilege means granting only the permissions needed for a task, while preserving required workload access.

What access practices are recommended for human users?

Prefer temporary credentials and MFA for human access; reserve administrative access for approved tasks.

How should you test a new IAM policy?

In a simulator or sandbox, verify that the required action succeeds and an unrelated action is denied.

How should you select a host-hardening baseline?

Choose a baseline that matches the operating system and its intended role, and check operational impact before applying changes.

What does a passing baseline report establish?

A passing report covers the selected checks and profile; it does not prove that the host has no vulnerabilities.

What does OpenSCAP assess in a host-hardening exercise?

Use OpenSCAP with a compatible SCAP data stream and profile to assess system configuration against selected checks.

What factors should guide vulnerability prioritization?

Prioritize using severity together with exploitability, business importance, and available mitigations—not severity alone.

What should you verify before relying on a scanner’s suggested fix?

A scanner’s suggested fixed version is a remediation lead, not proof that upgrading is safe or fully resolves the issue. Re-scan the correct artifact or asset after changes.

What practices support useful security logging?

Enable relevant identity, system, application, and network logs; centralize them where feasible, restrict access, use consistent timestamps, and set policy-appropriate retention.

What can CloudTrail reveal about IAM and AWS STS activity?

CloudTrail records IAM and AWS STS API activity, helping investigators determine who made a change, when, and from where.

How should an analyst treat an alert?

Treat an alert as a lead. Confirm it against independent evidence and normal activity before declaring an incident.