Question: 在渗透测试中，利用栈溢出漏洞编写exploit时，以下哪个步骤是不正确的？

Answer: 找到程序中的栈溢出点并确定溢出长度

Answer: 计算返回地址相对于溢出点的偏移量

Answer: 在exploit中填充垃圾数据以迷惑分析者

Answer: 直接使用shellcode替换溢出区域，无需考虑地址空间布局随机化（ASLR）


Question: 以下哪种措施可以防止电子邮件中的钓鱼攻击？

Answer: 安装反病毒软件

Answer: 使用SSL\\/TLS加密

Answer: 对所有邮件进行病毒扫描

Answer: 训练员工识别网络钓鱼的迹象


Question: 以下哪种技术可以防止中间人攻击，确保Web通信的隐私和完整性？

Answer: SSL\\/TLS协议

Answer: 蜜罐技术

Answer: 安全策略审计

Answer: 端口扫描


Question: 社会工程学在钓鱼攻击中的应用通常涉及什么？

Answer: 利用技术漏洞获取信息

Answer: 通过物理访问窃取数据

Answer: 诱骗用户透露敏感信息

Answer: 直接修改目标系统的配置


Question: 在进行移动应用代码审计时，以下哪项操作是不推荐的？

Answer: 使用自动化工具进行初步扫描

Answer: 对关键函数进行手动审查

Answer: 忽略第三方库的安全性检查

Answer: 对应用的权限使用进行详细分析


Question: 钓鱼攻击中，攻击者如何利用社会认同心理诱骗受害者？

Answer: 模仿知名人士或权威机构的电子邮件签名

Answer: 利用受害者的恐惧感和紧迫感

Answer: 通过大量发送邮件来增加中奖的可信度

Answer: 提供看似合理的理由要求受害者提供信息


Question: 以下哪种防范措施可以有效防止员工通过电子邮件接收恶意软件？

Answer: 定期进行安全意识培训

Answer: 关闭电子邮件服务

Answer: 只允许接收加密的电子邮件

Answer: 禁止使用附件


Question: 钓鱼邮件是电子邮件的常见风险之一，针对钓鱼邮件，应采取下列哪种安全措施（）

Answer: 设置安全性高的密码

Answer: 使用邮件客户端接收邮件

Answer: 不轻易打开包含中奖等字眼的邮件

Answer: 使用自建的SMTP服务器


Question: 在渗透测试中，哪种技术用于测试Web应用程序的安全性？

Answer: 端口扫描

Answer: 模糊测试

Answer: 社会工程学

Answer: 蜜罐技术


Question: 在使用深度学习模型进行钓鱼攻击检测时，以下哪个步骤是特征工程的关键部分？

Answer: 收集大量正常邮件和钓鱼邮件的HTML源代码

Answer: 训练一个神经网络模型以自动分类邮件

Answer: 从邮件中提取如URL、关键词、邮件结构等特征

Answer: 使用模型进行实时预测并拦截可疑邮件


Question: 渗透测试中的漏洞识别阶段，以下哪种方法不是常用的？

Answer: 静态代码分析

Answer: 动态代码分析

Answer: 社会工程学

Answer: 网络嗅探


Question: 在移动端应用中，代码签名的主要作用是什么？

Answer: 确保代码的完整性和来源

Answer: 防止代码被反汇编

Answer: 检测并阻止恶意代码执行

Answer: 优化应用程序的运行速度


Question: 为了保护移动应用中的敏感数据，哪项安全措施是必要的？

Answer: 仅使用HTTPS进行通信

Answer: 数据加密和身份验证机制

Answer: 定期进行安全漏洞扫描

Answer: 避免存储任何用户数据


Question: What is the purpose of DMARC (Domain-based Message Authentication, Reporting, and Conformance) in email security?

Answer: A. To encrypt email messages to ensure confidentiality during transmission between the client and server.

Answer: B. To filter incoming emails based on predefined rules to block spam or malicious content.

Answer: C. To authenticate the sender's domain and provide instructions on how to handle emails that fail authentication checks.

Answer: D. To authenticate users before granting access to their email accounts.


Question: 以下哪种代码审查实践有助于发现潜在的XSS（跨站脚本）攻击漏洞？

Answer: 检查所有输入是否为预期格式

Answer: 验证所有输出是否已经过滤或转义

Answer: 确保所有函数都有适当的错误处理

Answer: 确保所有代码都遵循DRY（Don't Repeat Yourself）原则


Question: 在移动应用的认证机制中，以下哪种方法可以提供双因素认证？

Answer: 仅使用密码认证

Answer: 使用密码加上生物特征认证

Answer: 使用密码加上短信验证码

Answer: 仅使用短信验证码


Question: 在Web应用中，哪种技术主要用于保护用户隐私数据，如信用卡号或密码，使其在传输过程中不被窃取？

Answer: SSL\/TLS协议

Answer: 访问控制列表(ACL)

Answer: 数据生命周期管理(DLM)

Answer: 哈希函数


Question: 在发送敏感电子邮件时，以下哪种协议提供了端到端的加密，以确保邮件内容在传输过程中不被窃取？

Answer: SMTP

Answer: SSL\\/TLS

Answer: PGP

Answer: IMAP\\/POP3 over SSL


Question: 以下不属于进行安全输入验证和数据校验的方法的是？

Answer: 使用参数化查询

Answer: 对数据进行加密和哈希处理

Answer: 使用强密码和加密算法

Answer: 对用户输入进行长度、类型和范围的验证


Question: 渗透测试中，以下哪种行为属于合法的测试手段？

Answer: 未经授权访问内部网络

Answer: 利用公开漏洞进行测试

Answer: 破坏目标系统的数据

Answer: 伪装成目标公司的员工


Question: 以下哪种操作可以防止中间人攻击，确保电子邮件的机密性？

Answer: 仅使用HTTPS发送邮件

Answer: 使用SMTPS发送邮件

Answer: 使用PGP对邮件内容进行加密

Answer: 在邮件中添加数字签名


Question: 在移动应用程序安全中，以下哪项措施能够有效防止应用程序被逆向工程？

Answer: 代码混淆

Answer: 使用HTTPS

Answer: 定期备份数据

Answer: 限制应用程序权限


Question: 在移动应用程序的防御机制中，以下哪项措施可以有效防止中间人攻击？

Answer: 使用HTTP协议

Answer: 使用SSL\\/TLS加密通信

Answer: 禁用应用程序的网络访问

Answer: 限制应用程序的API调用


Question: 在进行移动应用程序的漏洞分析时，以下哪项不是常见的分析方法？

Answer: 静态代码分析

Answer: 动态运行时分析

Answer: 网络流量监控

Answer: 用户行为模拟


Question: 在检测零日攻击时，哪种技术最有可能成功阻止未知威胁？

Answer: 提交和回滚控制

Answer: 签名检测

Answer: 行为分析

Answer: 数据正规化控制


Question: 在渗透测试的哪个阶段，测试人员会尝试利用发现的漏洞来模拟攻击，以验证其可行性？

Answer: 侦查阶段

Answer: 漏洞分析阶段

Answer: 攻击模拟阶段

Answer: 报告编写阶段


Question: 在移动应用的认证机制中，以下哪种方法最不安全？

Answer: 双因素认证

Answer: 生物识别认证

Answer: 基于密码的认证

Answer: 基于令牌的认证


Question: 公钥基础设施（PKI）在邮件安全中扮演的角色是？

Answer: 提供邮件内容压缩服务

Answer: 管理邮件服务器

Answer: 提供密钥管理和证书颁发服务

Answer: 负责邮件的物理传输


Question: 在电子邮件安全中，沙箱技术主要用于：

Answer: 实时监控网络流量

Answer: 隔离和分析可疑附件

Answer: 防止内部数据泄露

Answer: 验证用户身份


Question: 在进行渗透测试时，以下哪项技术常用于模拟攻击以测试系统的安全性？

Answer: 防火墙配置

Answer: 加密通信

Answer: 社会工程学攻击

Answer: 代码审计


Question: 在渗透测试报告中，以下哪项内容通常不包括在漏洞评估部分？

Answer: 漏洞的详细描述

Answer: 漏洞的风险评分

Answer: 漏洞的补救建议

Answer: 漏洞的发现者个人信息


Question: 在邮件服务器的管理中，以下哪项技术用于保护邮件内容不被未授权访问？

Answer: 防病毒扫描

Answer: SSL\\/TLS加密传输

Answer: 反垃圾邮件过滤

Answer: 邮件服务器日志监控


Question: 以下哪种防御措施可以防止用户意外访问伪装网站？

Answer: 安装入侵检测系统

Answer: 使用安全浏览器扩展

Answer: 定期更新操作系统

Answer: 启用端点保护平台


Question: 以下哪种策略可以保护用户的浏览历史和个人数据，防止被ISP（互联网服务提供商）追踪？

Answer: 使用对称加密

Answer: 使用非对称加密

Answer: 使用虚拟私人网络（VPN）

Answer: 使用哈希函数


Question: 在电子邮件系统中，哪种安全功能可以防止恶意软件通过网络传播？

Answer: 内容过滤

Answer: IP黑名单

Answer: SSL\\/TLS加密

Answer: 强制使用两步验证


Question: 在进行移动应用渗透测试时，以下哪项不是常见的安全协议？

Answer: TLS

Answer: SSL

Answer: IPSec

Answer: FTP


Question: 在Web应用的身份验证机制中，以下哪种方法可以有效防止暴力破解攻击？

Answer: 使用简单的用户名和密码组合

Answer: 限制登录尝试次数并实施账户锁定策略

Answer: 不使用验证码

Answer: 存储明文密码


Question: What is the concept of isolating an application from the underlying operating system for testing purposes?

Answer: Abstracting

Answer: Application virtualization

Answer: Hosting

Answer: Sandboxing


Question: 以下哪种技术可以防止中间人攻击，确保用户与Web服务器之间的通信不被篡改或窃听？

Answer: 恶意代码分析

Answer: Web应用防火墙

Answer: HTTPS加密

Answer: 入侵预防系统


Question: 安全最佳实践中，以下哪项措施有助于防止跨站脚本（XSS）攻击？

Answer: 使用HTML实体编码输出

Answer: 禁用浏览器的JavaScript功能

Answer: 限制用户上传文件的类型

Answer: 定期更新服务器操作系统


Question: 移动应用中，为了保护用户登录凭据不被窃取，通常采用哪种技术进行数据传输？

Answer: 对称加密算法

Answer: 非对称加密算法

Answer: SSL\/TLS协议

Answer: OAuth认证


Question: （单选题）以下哪种方法在 PHP 开发语言中不能执行命令（）

Answer: system(whoami);

Answer: system('whoami');

Answer: system('eval(whoami);');

Answer: eval('system(whoami);');


Question: 在进行Web安全测试时，以下哪项测试通常用于评估系统的认证授权机制？

Answer: 渗透测试

Answer: 性能测试

Answer: 功能测试

Answer: 兼容性测试


Question: 以下哪项行为可能会增加Burp Suite在渗透测试中被识别的风险，从而影响测试的安全性？

Answer: 使用Cookie Jar

Answer: 频繁修改请求头

Answer: 使Burp证书公开

Answer: 隐藏防火墙


Question: 哪种技术可以帮助检测基于社交媒体的钓鱼攻击？

Answer: 深度学习的自然语言处理

Answer: 入侵检测系统（IDS）

Answer: 防火墙

Answer: 物理安全访问控制


Question: 以下哪种技术用于确保电子邮件内容在传输过程中的安全性？

Answer: SSL\\/TLS加密

Answer: POP3协议

Answer: SMTP认证

Answer: IMAP4协议


Question: 在检测钓鱼网站时，以下哪种技术可以识别模仿知名品牌的假冒网站？

Answer: URL的长度和复杂性分析

Answer: 图像识别和品牌logo的比对

Answer: 分析网站的HTML结构和内容

Answer: 检查网站的SSL证书签发者


Question: 当一个Web应用发现有SMTP注入漏洞时，以下哪种解决方法是最安全的？

Answer: 关闭SMTP服务直到找到可行的修复方案

Answer: 对所有的SMTP请求都进行详尽的记录

Answer: 对所有的用户输入进行适当的清理和过滤

Answer: 将SMTP服务转移到一个新的服务器


Question: SSL\\/TLS协议在电子邮件安全中扮演的角色是？

Answer: 用于加密邮件内容

Answer: 用于验证邮件发送者的身份

Answer: 用于保护邮件传输过程中的安全

Answer: 用于存储邮件的加密密钥


Question: 在渗透测试报告中，哪个部分通常用于详细描述发现的安全漏洞并提供漏洞分析？

Answer: 执行摘要

Answer: 方法与范围

Answer: 发现与结果

Answer: 建议与修复


Question: 在渗透测试报告中，哪项内容通常不包括在内？

Answer: 测试目标和范围

Answer: 详细的漏洞利用步骤

Answer: 客户敏感数据的明文

Answer: 建议的安全策略改进


Question: 在渗透测试中，以下哪种行为属于网络嗅探？

Answer: 利用exploit工具攻击已知漏洞

Answer: 设置中间人攻击以捕获网络流量

Answer: 分析系统日志以查找异常活动

Answer: 创建蜜罐系统来迷惑攻击者


Question: 网站克隆在钓鱼攻击中的目的是什么？

Answer: 创建一个与真实网站相似的虚假网站，以诱骗用户输入敏感信息

Answer: 分析用户在真实网站上的行为模式

Answer: 提供一个安全的替代访问途径

Answer: 增强网站的搜索引擎优化


Question: 以下哪种电子邮件安全协议可以防止中间人攻击，确保电子邮件的来源验证？

Answer: STARTTLS

Answer: PGP (Pretty Good Privacy)

Answer: DKIM (DomainKeys Identified Mail)

Answer: S/MIME (Secure/Multipurpose Internet Mail Extensions)


Question: 在进行移动应用安全测试时，以下哪项操作最能帮助发现应用中的权限滥用问题？

Answer: 模拟用户登录并进行正常操作

Answer: 分析应用的网络通信，检查加密是否正确

Answer: 检查应用请求的权限与实际功能是否匹配

Answer: 执行代码审计，查找可能的注入漏洞


Question: 以下哪种安全协议可以应用于电子邮件，以确保数据在传输过程中的加密？

Answer: TLS（传输层安全）

Answer: FTP（文件传输协议）

Answer: POP3（邮局协议第3版）

Answer: IMAP（因特网消息访问协议）


Question: 以下哪种方法不是防御CSRF攻击的有效手段？

Answer: 使用验证码

Answer: 使用随机生成的Token

Answer: 强制用户定期更改密码

Answer: 检查HTTP Referer头


Question: You are the IT security manager for a video game software development company. Inorder to test your products for security defects and performance issues, your firm decidesto use a small team of game testers recruited from a public pool of interested gamers whoapply for a chance to take part. This is an example of .

Answer: Static testing

Answer: Dynamic testing

Answer: Code review

Answer: Open source review


Question: 以下哪种情况最可能导致SMTP服务器被用作中间人攻击的媒介？

Answer: 服务器未启用SSL\\/TLS加密

Answer: 服务器使用了弱加密算法

Answer: 服务器配置了过于严格的SPF策略

Answer: 服务器启用了IMAP\\/POP3而不是SMTP


Question: 在Web应用的授权管理中，RBAC（基于角色的访问控制）模型主要用于？

Answer: 加密敏感数据

Answer: 验证用户输入

Answer: 控制用户对资源的访问权限

Answer: 防止跨站脚本攻击


Question: 以下哪种安全防范措施可以有效防止电子邮件欺骗？

Answer: 安装反病毒软件并保持更新

Answer: 使用复杂的密码策略

Answer: 启用双因素认证

Answer: 实施电子邮件过滤和验证技术（如SPF, DKIM, DMARC）


Question: 移动应用的更新机制中，以下哪种做法可以确保用户安装的是经过验证的安全更新？

Answer: 通过应用内更新提示用户下载最新版本

Answer: 强制用户从官方应用商店下载更新

Answer: 允许用户从任何来源下载更新包

Answer: 定期推送更新通知，但不强制更新


Question: 在制定Web应用的安全策略时，以下哪项措施最有助于防止跨站脚本攻击（XSS）？

Answer: 使用HTTPS协议

Answer: 对所有用户输入进行HTML编码

Answer: 限制文件上传功能

Answer: 定期更新服务器软件


Question: 在Web应用中，以下哪种做法最不利于防止会话劫持？

Answer: 定期刷新会话ID

Answer: 使用SSL\\/TLS进行通信

Answer: 在URL中明文传递会话ID

Answer: 实现会话超时机制


Question: 在安全评估中，以下哪项技术用于确保在执行漏洞利用时不会被检测到？

Answer: 端口扫描技术

Answer: 漏洞分类技术

Answer: 安全信息和事件管理（SIEM）

Answer: 匿踪技术（Stealth techniques）


Question: 在邮件内容分析中，以下哪项不是文本分析的主要目标？

Answer: 识别关键词

Answer: 提取情感倾向

Answer: 检测语法错误

Answer: 分类邮件类型


Question: 在邮件通信中，以下哪种协议主要用于确保邮件的隐私和安全？

Answer: SMTP (Simple Mail Transfer Protocol)

Answer: POP3 (Post Office Protocol 3)

Answer: IMAP (Internet Message Access Protocol)

Answer: PGP (Pretty Good Privacy)


Question: 在识别钓鱼邮件时，以下哪项特征可能是恶意邮件的标志？

Answer: 发件人的电子邮件地址与公司官方地址完全一致

Answer: 邮件中包含紧急或威胁性的语言

Answer: 邮件内容与用户预期的业务通信相符

Answer: 邮件中的链接直接指向已知的、安全的网站


Question: 在权限模型中，以下哪种机制允许权限从父对象自动传递给子对象？

Answer: 权限继承

Answer: 访问控制列表

Answer: 角色定义

Answer: 审计日志


Question: Which of the following is used by RADIUS for communication between clients and servers?

Answer: TCP

Answer: SSL

Answer: UDP

Answer: SSH


Question: You are the IT security subject matter expert for a hobbyist collective that researches andarchives old music. If you create a federated identity management structure for all theparticipants in the collective using a third-party certification model, who would be thefederated service provider(s) in that structure?

Answer: The third party

Answer: A cloud access security broker (CASB)

Answer: The various members of the collective

Answer: The cloud provider


Question: 在访问控制策略中，最小权限原则指的是？

Answer: 所有用户都应拥有管理员权限

Answer: 用户应被授予完成工作所需的最小权限

Answer: 用户可以访问所有数据，但不能修改

Answer: 用户权限应根据其社会地位决定


Question: Which of the following is a proximity identication device that does not require action by the user and works by responding with an access code tosignals transmitted by a reader?

Answer: A passive system sensing device

Answer: A transponder

Answer: A card swipe

Answer: A magnetic card


Question: Which of the following is a client/server protocol designed to allow network access servers to authenticate remote users by sending access request messages to a central server?

Answer: RADIUS

Answer: OAuth

Answer: EAP

Answer: Kerberos


Question: CCM：在身份和访问管理（IAM）域中，IAM-04中的数字04，表示什么

Answer: 这个特定域中有4个控制子域

Answer: 控制ID是分配给控制项的随机数

Answer: 它是IAM域中的第4个控制子域

Answer: 以上都不是


Question: 以下哪种攻击方法能最有效地获得对一份复杂口令保护的资料的未授权访问？

Answer: 字典攻击

Answer: 旁路攻击

Answer: 彩虹表

Answer: 社会工程


Question: 以下哪种机制可以防止用户访问未经授权的系统资源？

Answer: 数字签名

Answer: 访问控制列表（ACLs）

Answer: RSA加密

Answer: 哈希函数


Question: 需要刷感应卡才能进入某个办公区域，这属于哪种控制？

Answer: 物理控制

Answer: 技术控制

Answer: 行政控制

Answer: 流程控制


Question: Single Sign-on (SSO) is characterized by which of the following advantages?

Answer: Convenience

Answer: Convenience and centralized administration

Answer: Convenience and centralized data administration

Answer: Convenience and centralized network administration


Question: Which concept might require users to use a second access token or to re-enter passwords to gain elevated access rights in the identity andaccess provisioning life cycle?

Answer: Time-based

Answer: Enrollment

Answer: Least privilege

Answer: Access review


Question: 在权限管理中，以下哪种用户账户权限设置最符合最小权限原则？

Answer: 所有用户都具有管理员权限

Answer: 每个用户只拥有完成其工作所需的最小权限

Answer: 所有用户都只能访问公共文件夹

Answer: 创建一个超级用户账户供所有员工共享


Question: 以下哪种访问控制模型允许用户基于角色的权限来控制资源访问？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于规则的访问控制（RBAC）

Answer: 基于属性的访问控制（ABAC）


Question: 下面哪一项能够最好地描述公钥基础设施中的目录服务器的作用？

Answer: 对通过网络传输的信息进行加密。

Answer: 向应用程序提供其他用户的证书。

Answer: 方便密码政策的实施。

Answer: 存储证书撤销清单。


Question: 以下哪种安全政策通常用于定义员工访问企业资源的权限？

Answer: 访问控制政策

Answer: 数据分类政策

Answer: 密码策略

Answer: 加密策略


Question: If a company has a high turnover rate, which access control structure is best?

Answer: Role-based

Answer: Decentralized

Answer: Rule-based

Answer: Discretionary


Question: 以下哪种访问控制机制最适合防止未经授权的内部员工访问敏感数据？

Answer: 多因素认证

Answer: 角色基础的访问控制（RBAC）

Answer: 强制访问控制（MAC）

Answer: 最小权限原则


Question: A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Answer: concern that the laser beam may cause eye damage

Answer: the iris pattern changes as a person grows older.

Answer: there is a relatively high rate of false accepts.

Answer: the optical unit must be positioned so that the sun does not shine into the aperture.


Question: Which of the following is implemented through scripts or smart agents that replay the users multiple log-ins against authentication servers toverify a user's identity which permit access to system services?

Answer: Single Sign-On

Answer: Dynamic Sign-On

Answer: Smart cards

Answer: Kerberos


Question: 在端点安全策略中，以下哪项措施最直接地防止身份冒用？

Answer: 安装防病毒软件

Answer: 实施多因素身份验证

Answer: 使用安全套接层(SSL)加密

Answer: 定期进行安全意识培训


Question: A user sends an e-mail request asking for read-only access to les that are not considered sensitive. A Discretionary Access Control (DAC)methodology is in place. Which is the MOST suitable approach that the administrator should take?

Answer: Administrator should request data owner approval to the user access

Answer: Administrator should request manager approval for the user access

Answer: Administrator should directly grant the access to the non-sensitive les

Answer: Administrator should assess the user access need and either grant or deny the access


Question: 以下哪种身份验证技术对防止钓鱼攻击最无效？

Answer: 一次性密码

Answer: 生物特征识别

Answer: 静态密码

Answer: 智能卡


Question: In non-discretionary access control using Role Based Access Control (RBAC), a central authority determines what subjects can have access tocertain objects based on the organizational security policy. The access controls may be based on:

Answer: The society‘s role in the organization

Answer: The individual's role in the organization

Answer: The group-dynamics as they relate to the individual's role in the organization

Answer: The group-dynamics as they relate to the master-slave role in the organization


Question: 基于角色的访问控制 (RBAC) 的重要特征是：

Answer: 依赖于岗位轮换

Answer: 简化了访问权限管理

Answer: 需要双因素验证

Answer: 支持强制访问控制 (MAC)


Question: 身份认证是证实客户的真实身份与其所声称的身份是否相符的验证过程。目前，计算机及网络系统中常用的身份认证技术主要有：用户名/密码方式、智能卡认证、动态口令、生物特征认证等。其中不属于生物特征的是（）。

Answer: 指纹

Answer: 手指静脉

Answer: 虹膜

Answer: 击键特征


Question: 在身份验证过程中，哪种方法可以防止钓鱼攻击通过获取用户的凭据？

Answer: 多因素认证

Answer: 使用复杂的静态密码

Answer: 定期更改密码

Answer: 仅在安全网络连接下登录


Question: 多因素认证（MFA）在电子邮件安全中的作用是什么？

Answer: 减少垃圾邮件的数量

Answer: 提高邮件发送速度

Answer: 增加账户被盗用的难度

Answer: 降低邮件存储成本


Question: Which of the following correctly describes a federated identity and its role within identity management processes?

Answer: A nonportable identity that can be used across business boundaries

Answer: A portable identity that can be used across business boundaries

Answer: An identity that can be used within intranet virtual directories and identity stores

Answer: An identity specified by domain names that can be used across business boundaries


Question: 在零信任环境中，以下哪项措施有助于实现持续监控？

Answer: 定期安全扫描

Answer: 实时日志分析

Answer: 静态代码分析

Answer: 定期渗透测试


Question: 以下哪种访问控制机制最适合用于限制员工只能访问与其工作职责相关的数据？

Answer: 强制访问控制（MAC）

Answer: 最小权限原则

Answer: 基于角色的访问控制（RBAC）

Answer: 自主访问控制（DAC）


Question:
With RBAC, each user can be  assigned:
根据RBAC，每个用户可以被分配：

Answer: One or more roles 一个或多个角色

Answer: Only one role 只有一个角色

Answer: A token role 一个令牌角色

Answer: A security token 一个安全令牌


Question: 以下哪种认证机制主要用于验证用户身份，而不是授权访问特定资源？

Answer: 访问控制列表

Answer: JSON Web Tokens (JWT)

Answer: Public Key Infrastructure (PKI)

Answer: Role-Based Access Control (RBAC)


Question: 在身份验证技术中，哪种方法最能防止钓鱼攻击导致的凭证盗窃？

Answer: 一次性密码（OTP）

Answer: 生物特征识别

Answer: 证书基础身份验证

Answer: 简单密码策略


Question: 在数字证书中，哪个实体负责验证并签发证书以确认服务器的身份？

Answer: 证书使用者

Answer: 证书撤销列表（CRL）

Answer: 证书颁发机构（CA）

Answer: 注册机构（RA）


Question: 以下哪种访问控制策略最适合防止内部员工滥用用户数据？

Answer: 强制访问控制（MAC）

Answer: 最小权限原则

Answer: 基于角色的访问控制（RBAC）

Answer: 自主访问控制（DAC）


Question: CAC 是什么形式的类型 2 认证因素？

Answer: 令牌

Answer: 生物识别标识符

Answer: 智能卡

Answer: PIV


Question: 在权限管理中，以下哪种策略有助于防止内部威胁？

Answer: 最小权限原则

Answer: 多因素认证

Answer: 网络隔离

Answer: 数据加密


Question: 以下哪种访问控制模型允许系统管理员根据用户的角色分配权限？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 基于策略的访问控制（PBAC）


Question: What is the main focus of the Bell-LaPadula security model?

Answer: Accountability

Answer: Integrity

Answer: Condentiality

Answer: Availability


Question: 在零信任模型中，以下哪项措施不是持续监控的关键组成部分？

Answer: 实时流量分析

Answer: 定期安全审计

Answer: 用户行为分析

Answer: 威胁情报集成


Question:
Why MUST the Kerberos server be well  protected from unauthorized access?
为什么Kerberos服务器必须得到很好的保护，防止非授权访问？

Answer:
It contains the keys of all clients.
因为它包含了所有客户的密钥

Answer:
It always operates at root privilege.
因为它总是在root权限下操作

Answer:
It contains all the tickets for services.
因为它包含了服务的所有票据

Answer:
It contains the Internet Protocol (IP) address of all network  entities.
因为它包含了所有网络设备的IP地址


Question: 多因素认证（MFA）在零信任实施中的作用是什么？

Answer: 仅用于外部用户访问控制

Answer: 用于增强单因素认证的安全性

Answer: 作为零信任架构的唯一认证手段

Answer: 用于确保用户身份的验证，增强访问控制的安全性


Question: 以下哪种情况不是令牌认证在多因素认证中的应用？

Answer: 用户接收到一次性密码（OTP）短信进行登录验证

Answer: 用户通过生物识别解锁设备

Answer: 用户使用硬件令牌生成动态验证码

Answer: 用户使用应用程序生成的动态二维码进行登录


Question: 把字典攻击和暴力破解结合起来的，针对口令的攻击是：

Answer: 社会工程

Answer: 混合攻击

Answer: 彩虹表攻击

Answer: 水坑攻击


Question: What determines the level of security of a combination lock?

Answer: Complexity of combination required to open the lock

Answer: Amount of time it takes to brute force the combination

Answer: The number of barrels associated with the internal mechanism

Answer: The hardness score of the metal lock material


Question: 在权限管理中，哪个原则有助于限制潜在的损害范围？

Answer: 最小权限原则

Answer: 多因素认证

Answer: 职责分离

Answer: 强制访问控制


Question: What provides the information to an application to make decisions about the authorization level appropriate when granting access?

Answer: User

Answer: Relying party

Answer: Federation

Answer: Identity Provider


Question: 下列哪个选项可以设置禁止某些用户和组作为远程桌面服务客户端登录（）

Answer: 管理共享

Answer: 系统服务

Answer: 本地组策略

Answer: 系统组件服务


Question: 以下哪种身份验证方法最不安全，因为它容易受到中间人攻击？

Answer: 单因素认证（仅密码）

Answer: 双因素认证（密码和短信验证码）

Answer: 多因素认证（密码、生物特征和硬件令牌）

Answer: 基于证书的身份验证


Question:
Tanya is working with the company’s internal software development team. Before a user of an application can access files located on the company’s centralized server, the user must present a valid one-time password, which is generated through a challenge/response mechanism. The company needs to tighten access control for these files and reduce the number of users who can access each and every file. The company is looking to Tanya and her team for solutions to better protect the data that has been classified and deemed critical to the company’s missions. Tanya has also been asked to implement a single sign-on technology for all internal users, but she does not have the budget to implement a public key infrastructure.
Which of the following is the best single sign-on technology for this situation?

Answer: PKI

Answer: Kerberos

Answer: RADIUS

Answer: TACACS+


Question: Which of the following can be dened as a framework that supports multiple, optional authentication mechanisms for PPP, including cleartextpasswords, challenge-response, and arbitrary dialog sequences?

Answer: Extensible Authentication Protocol

Answer: Challenge Handshake Authentication Protocol

Answer: Remote Authentication Dial-In User Service

Answer: Multilevel Authentication Protocol.


Question: 一个业务应用系统的业务用户可以执行业务功能，但不能执行管理功能，应用的维护管理员可以执行管理功能但不能执行业务功能，这属于：

Answer: 职责分离

Answer: 最小授权

Answer: 基于规则的访问控制

Answer: 自主访问控制


Question: 在零信任环境中，以下哪种访问控制模型最常用于管理资源访问？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于属性的访问控制（ABAC）

Answer: 基于策略的访问控制（PBAC）


Question: Which of the following is a remote access protocol that uses a static authentication?

Answer: Point-to-Point Tunneling Protocol (PPTP)

Answer: Routing Information Protocol (RIP)

Answer: Password Authentication Protocol (PAP)

Answer: Challenge Handshake Authentication Protocol (CHAP)


Question: 下面哪个是检查时间/使用时间（TOC/TOU）问题的实例？

Answer: A user whose profile has been revoked logs on using the password of a  valid user of the system.

Answer: A user session is terminated immediately after the user profile is  revoked.

Answer: A user logs on with a valid profile which is revoked without termination  of the session.

Answer: A user session is not validated until after the log on.


Question: Which of the following access control models requires security clearance for subjects?

Answer: Identity-based access control

Answer: Role-based access control

Answer: Discretionary access control

Answer: Mandatory access control


Question: 以下哪项不是IAM系统中的身份管理功能？

Answer: 用户账户创建

Answer: 密码重置

Answer: 数据备份与恢复

Answer: 用户权限分配


Question: 在身份验证机制中，哪种方法最能防止钓鱼攻击获取用户的凭据？

Answer: 使用简单的密码

Answer: 多因素身份验证

Answer: 保存用户名和密码在浏览器中

Answer: 只在家中使用公共Wi-Fi进行登录


Question: 两步验证中，哪一项不适合作为第二步验证？

Answer: 短信验证码

Answer: 指纹识别

Answer: 面部识别

Answer: 公开的社交媒体帐号


Question: 关于两步验证，以下哪个描述是正确的？

Answer: 两步验证仅通过电子邮件发送验证码，确保账户安全

Answer: 两步验证要求用户提供密码和一个随机生成的代码，增加安全性

Answer: 两步验证使得账户无法被黑客攻击

Answer: 两步验证总是需要物理设备，如智能卡


Question: 以下属于哪一种认证实现方式:用户登录时,认证服务器(Authentication Server, AS)产生一个随机数发送给用户,用户用某种单向算法将自己的口令、种子密钥和随机数混合计算后作为一次性口令,并发送给 AS,AS 用同样的方法计算后,验证比较两个口令即可验证用户身份

Answer: 口令序列

Answer: 时间同步

Answer: 挑战/应答

Answer: 静态口令


Question: 在防止钓鱼攻击中，哪种身份验证方法最能保护用户免受冒充合法服务的欺诈？

Answer: 基于知识的身份验证（如密码）

Answer: 基于拥有的身份验证（如一次性短信验证码）

Answer: 基于生物特征的身份验证（如指纹）

Answer: 基于设备的身份验证（如设备ID）


Question: 在零信任环境中，权限分配的最佳实践是什么？

Answer: 一次性分配所有权限

Answer: 按需分配权限，并定期审查

Answer: 仅在用户请求时分配权限

Answer: 基于用户的工作职责分配权限


Question: 身份管理中，随着信任度增加：

Answer: 风险减少

Answer: 风险增加

Answer: 权限增加

Answer: 权限减少


Question: __________ is one of the single most effective security controls to defend against a wide variety of attacks.

Answer: A firewall

Answer: Infrared camera surveillance

Answer: Egress monitoring

Answer: Multifactor authentication


Question: 在零信任架构中，身份验证通常涉及以下哪项？

Answer: 仅用户名和密码

Answer: 多因素认证

Answer: 单一的生物识别认证

Answer: 基于IP地址的认证


Question: 以下哪种访问控制模型基于用户的安全级别和信息的敏感性级别？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 多层访问控制（MLAC）


Question: 在零信任网络模型中，多因素认证（MFA）通常不包括以下哪种验证方法？

Answer: 知识因素，如密码

Answer: 拥有因素，如智能卡

Answer: 生物识别，如指纹

Answer: 位置因素，如IP地址


Question: 在防止钓鱼攻击中，哪种身份验证方法对防止欺诈性登录最不相关？

Answer: 基于知识的身份验证（如密码）

Answer: 基于拥有的身份验证（如一次性短信验证码）

Answer: 基于生物特征的身份验证（如指纹）

Answer: 基于设备的身份验证（如设备ID）


Question: Which of the following is addressed by Kerberos?

Answer: Condentiality and Integrity

Answer: Authentication and Availability

Answer: Validation and Integrity

Answer: Auditability and Integrity


Question: Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers toverify a user's identity which permit access to system services?

Answer: Single Sign-On

Answer: Dynamic Sign-On

Answer: Smart cards

Answer: Kerberos


Question: Kerberos 是一种常用的身份认证协议,它采用的加密算法是（ ）。

Answer: Elgamal

Answer: DES

Answer: MD5

Answer: RSA


Question: Identity Management solutions include such technologies as Directories services, Single Sign-On and Web Access management. There are manyreasons for management to choose an identity management solution.Which of the following is a key management challenge regarding identity management solutions?

Answer: Increasing the number of points of failures.

Answer: Users will no longer be able to "recycle" their password for different applications.

Answer: Costs increase as identity management technologies require signicant resources.

Answer: It must be able to scale to support high volumes of data and peak transaction rates.


Question: 在实现访问控制时，以下哪种方法最能确保只有授权用户可以访问特定资源？

Answer: 使用复杂的密码策略

Answer: 实施多因素身份验证

Answer: 应用IP地址白名单

Answer: 启用加密技术


Question: 以下哪种访问控制策略有助于防止未经授权的员工访问敏感的个人信息？

Answer: 强制实施最小权限原则

Answer: 使用多因素认证

Answer: 实施隐私保护法规

Answer: 定期进行安全培训


Question: Which of the following remote access authentication systems is the most robust?

Answer: TACACS+

Answer: RADIUS

Answer: PAP

Answer: TACACS


Question: 以下哪种技术能够提供基于用户身份和上下文的访问控制，以限制对特定网络资源的访问？

Answer: 网络层过滤

Answer: 应用网关

Answer: 状态检测

Answer: 访问控制列表


Question: 以下哪项是两步验证的主要目的？

Answer: 简化登录过程

Answer: 增加额外的安全层，防止未经授权的访问

Answer: 减少用户记忆多个密码的负担

Answer: 允许用户在任何设备上快速登录


Question: Which of the following does not typically represent a means for enhanced authentication?

Answer: Challenge questions

Answer: Variable keystrokes

Answer: Out-of-band identity confirmation

Answer: Dynamic end-user knowledge


Question: Given: AAA is an architectural framework used to provide three separate security components in a network. Listed below are three phrases thateach describe one aspect of the AAA framework.Option-1 This AAA function is performed first and validates user identify prior to determining the network resources to which they will be grantedaccess.Option-2 This function is used for monitoring and auditing purposes and includes the collection of data that identifies what a user has done whileconnected.Option-3 This function is used to designate permissions to a particular user.What answer correctly pairs the AAA component with the descriptions provided above?

Answer: Option-1 - Access Control Option-2 - Authorization Option-3 - Accounting

Answer: Option-1 - Authentication Option-2 - Accounting Option-3 - Association

Answer: Option-1 - Authorization Option-2 - Access Control Option-3 - Association

Answer: Option-1 - Authentication Option-2 - Accounting


Question: 多因子认证（MFA）在防御钓鱼攻击中的作用是什么？

Answer: 完全消除钓鱼攻击的风险

Answer: 提供额外的安全层，即使攻击者获得了用户密码，也无法轻易访问账户

Answer: 自动检测并阻止所有钓鱼尝试

Answer: 减少用户对密码的依赖


Question: Which of the following is true about two-person integrity?

Answer: It forces all employees to distrust one another.

Answer: It requires two different identity and access management matrices (IAM).

Answer: It forces collusion for unauthorized access.

Answer: It enables more thieves to gain access to the facility.


Question: 在多层权限体系中，以下哪个概念用于确定用户是否可以执行特定操作？

Answer: 身份验证

Answer: 授权

Answer: 权限模型

Answer: 访问控制列表


Question:
Question: Which of the following provides a mechanism that  allows an end-user to use a single sign-on (SSO) for multiple services?
=======

Answer: The Open ID Federation.

Answer: PCI Data Security Standards Council

Answer: International Organization for Standardization.

Answer: Personal Information Protection and Electronic Documents Act.


Question:
Which of the following is implemented through scripts or smart  agents that replays the users multiple log-ins against authentication servers  to
verify a user's identity which permit access to system services?

Answer: Single Sign-On

Answer: Dynamic Sign-On

Answer: Smart cards

Answer: Kerberos


Question: In identity management, as trust increases:

Answer: Risk increases

Answer: Risk decreases

Answer: Permissions decrease

Answer: Permissions increase


Question:
Which of the following has the correct term-to-definition mapping?
i. Brute-force attacks: Performed with tools that cycle through many possible character, number, and symbol combinations to uncover a password.
ii. Dictionary attacks: Files of thousands of words are compared to the user’s password until a match is found.
iii. Social engineering: An attacker falsely convinces an individual that she has the necessary authorization to access specific resources.
iv. Rainbow table: An attacker uses a table that contains all possible passwords already in a hash format.

Answer: i, ii

Answer: i, ii, iv

Answer: i, ii, iii, iv

Answer: i, ii, iii


Question: 在客户机／服务器架构中的“相互验证”指的是？

Answer: 服务器和服务器之间的交叉验证

Answer: 客户端和服务器端建立连接时的三次握手

Answer: 客户端一旦被服务器端验证，则客户端可以访问系统内其他的资源

Answer: 服务器端验证客户端，客户端验证服务器端


Question: 在访问控制模型中，以下哪个选项最能描述RBAC（Role-Based Access Control）？

Answer: 用户直接授予对资源的访问权限

Answer: 用户通过其所属的组来获得访问权限

Answer: 用户必须通过身份验证和授权才能访问资源

Answer: 用户权限基于其在系统中的角色和职责


Question: 以下哪种身份认证方法在安全性与便捷性之间提供了较好的平衡，常用于移动设备或云服务的访问控制？

Answer: 静态密码

Answer: 双因素认证（2FA）

Answer: 生物特征识别（如指纹）

Answer: 物理安全令牌


Question: 关于多因素认证（MFA），以下哪项陈述是不正确的？

Answer: MFA增加了攻击者获取账户访问的难度

Answer: MFA通常需要用户提供两种或更多验证因素

Answer: 短信验证码是一种常见的MFA方法，但并非最安全

Answer: 使用MFA后，用户可以完全避免任何安全威胁


Question:
Question: A user who owns a resource wants to give other  individuals access to the resource.
What control would apply?
=======

Answer: Mandatory access control.

Answer: Role-based access controls.

Answer: Discretionary access control.

Answer: Context of authority controls.


Question: IDaaS的关键特征是：

Answer: IGA 身份治理和管理

Answer: 虚拟化

Answer: 容器化

Answer: OpenID


Question: What role does biometrics play in access control?

Answer: Authorization

Answer: Authenticity

Answer: Authentication

Answer: Accountability


Question: 以下哪种权限管理策略有助于防止内部用户滥用系统资源？

Answer: 所有用户都分配管理员权限

Answer: 根据角色和职责分配权限

Answer: 允许用户自由共享账户和密码

Answer: 尽量减少权限审核和更新


Question: 安全审计在单点登录（SSO）系统中的作用是什么？

Answer: 用于监控用户行为

Answer: 用于增加用户登录速度

Answer: 用于减少系统资源消耗

Answer: 用于提高用户认证的复杂性


Question: In a given network, client C needs to access the services of server S. Client C must be authenticated by server S. Client C also needs to authenticate server B. Which type of authentication does this authentication belong to ()

Answer: single-item identification

Answer: bidirectional identification

Answer: Third party identification

Answer: None of the above.


Question: What are the physical characteristics of a retinal scan  biometric device?

Answer: The size, curvature, and shape of the retina

Answer: The amount of light reflected by the retina

Answer: The amount of light reaching the retina

Answer: The pattern of blood vessels at the back of the eye


Question: Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplementalhardware/ software units. Such controls, also known as logical controls, represent which pairing?

Answer: Preventive/Administrative Pairing

Answer: Preventive/Technical Pairing

Answer: Preventive/Physical Pairing

Answer: Detective/Technical Pairing


Question: Which of the following occurs in a PKI environment?

Answer: The RA creates the certificate, and the CA signs it.

Answer: The CA signs the certificate.

Answer: The RA signs the certificate.

Answer: The user signs the certificate.


Question: Which of the following is not normally an element of user accounts management audits?

Answer: Password hashing

Answer: Signed AUPs

Answer: Privileged accounts

Answer: Suspended accounts


Question: 假如有证书发放机构 i1，i2 用户 a 在 i1 获取证书，用户 b 在 i2 获取证书，i1 和 i2 已安全交换了各自的公钥，如果用 i1《a》表示由 i1 颁发给 a 的证书，a 可通过（ ）证书链获取 b 的公开密钥。

Answer: i1《i2》i2《b》

Answer: i2《b》i1《i2》

Answer: i1《b》i2《i2》

Answer: i2《i1》i2《b》


Question: 以下哪种技术用于确保只有经过身份验证的用户才能访问网络资源？

Answer: 权限等级

Answer: 访问控制列表

Answer: 角色基础访问控制

Answer: 用户身份验证


Question: The type of discretionary access control (DAC) that is based on an individual's identity is also calle

Answer: Identity-based Access control

Answer: Rule-based Access control

Answer: Non-Discretionary Access Control

Answer: Lattice-based Access control


Question: Which of the following binds a subject name to a public key value?

Answer: A public-key certicate

Answer: A public key infrastructure

Answer: A secret key infrastructure

Answer: A private key certicate


Question: Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplishe

Answer: through access control mechanisms that require identification and authentication and through the audit function.

Answer: through logical or technical controls involving the restriction of access to systems and the protection of information.

Answer: through logical or technical controls but not involving the restriction of access to systems and the protection of information.

Answer: through access control mechanisms that do not require identification and authentication and do not operate through the audit function.


Question: 实施访问控制时首先需要：

Answer: 分类信息系统资源。

Answer: 标记信息系统资源。

Answer: 创建访问控制列表。

Answer: 创建信息系统资源清单。


Question: IIS是Microsoft 公司提供的Web服务器软件，主要提供Web服务。IIS的访问控制包括：请求过滤、URL 授权控制、IP地址限制、文件授权等安全措施，其中对文件夹的NTFS 许可权限管理属于（    ）。

Answer: 请求过滤

Answer: URL授权控制

Answer: IP地址限制

Answer: 文件授权


Question: 以下哪种访问控制策略最适合用于限制内部网络中特定资源的访问？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 多层访问控制（MLAC）


Question: SiKey口令是一种一次性口令生成方案，它可以对抗（）。

Answer: 恶意代码木马攻击

Answer: 拒绝服务攻击

Answer: 协议分析攻击

Answer: 重放攻击


Question: 在实施访问控制时，以下哪项是身份验证的主要目标？

Answer: 确保用户可以访问所有资源

Answer: 验证用户的身份以确定其是否有权访问特定资源

Answer: 限制用户只能访问特定资源

Answer: 提高系统的可用性


Question: 在移动端身份验证中，以下哪种方法通常用于增强安全性？

Answer: 单一密码验证

Answer: 双因素认证

Answer: 基于位置的身份验证

Answer: 基于时间的身份验证


Question: 在网络安全中，哪种技术用于确认用户身份，防止冒充？

Answer: 加密算法

Answer: 防火墙技术

Answer: 身份验证

Answer: 网络入侵检测


Question: 关于访问控制，以下哪一项描述是不正确的？

Answer: 访问控制是确保数据安全的重要手段

Answer: 访问控制可以防止未授权的数据访问

Answer: 访问控制策略可以完全防止数据泄露

Answer: 访问控制需要根据数据分类进行差异化设置


Question: What type of access control model is Biba?

Answer: Role BAC

Answer: MAC

Answer: ABAC

Answer: DAC


Question: A tool used to map out access rights and permissions against authenticated identity assertions and characteristics.

Answer: attribute portal

Answer: entitlement matrix

Answer: facet corollary

Answer: digital rights management (DRM)


Question: 以下选项中,不属于生物识别方法的是（ ）。

Answer: 掌纹识别

Answer: 个人标记号识别

Answer: 人脸识别

Answer: 指纹识别


Question: What are the key stages of account management?

Answer: Provisioning or adding accounts, modifying accounts, and suspending accounts

Answer: Adding accounts, deleting accounts, and deleting users’ data

Answer: Verifying account passwords, validating account usage, and deleting accounts

Answer: Provisioning accounts, modifying accounts, auditing the use of accounts, and suspending accounts


Question: 在应对钓鱼邮件时，哪种身份验证机制最能防止恶意登录尝试？

Answer: 基于知识的身份验证（如密码）

Answer: 基于拥有的身份验证（如一次性短信验证码）

Answer: 基于设备的身份验证（如设备指纹）

Answer: 基于生物特征的身份验证（如指纹识别）


Question: Which of the following is addressed by Kerberos?

Answer: Confidentiality and Integrity

Answer: Authentication and Availability

Answer: Validation and Integrity

Answer: Auditability and Integrity


Question: 在零信任网络中，以下哪项措施不是用于增强身份验证的？

Answer: 多因素认证

Answer: 生物识别技术

Answer: 定期更改密码

Answer: 网络流量分析


Question: 身份认证的主要目的是什么？

Answer: 防止数据泄露

Answer: 确保用户身份的真实性

Answer: 提高系统性能

Answer: 减少系统维护成本


Question: 以下哪种控制措施主要用于验证用户的身份，以确保只有授权的用户可以访问系统资源？

Answer: 权限模型

Answer: 身份验证

Answer: 授权策略

Answer: 访问矩阵


Question: 在生成系统帐号时，系统管理员应该分配给合法用户一个____，用户在第一次登录时应更改口令。

Answer: 唯一的口令

Answer: 登录的位置

Answer: 使用的说明

Answer: 系统的规则


Question: Access Control techniques do not include which of the  following choices?

Answer: Relevant Access Controls

Answer: Discretionary Access Control

Answer: Mandatory Access Control

Answer: Lattice Based Access Control


Question: Which of the following is NOT an administrative control?

Answer: Logical access control mechanisms

Answer: Screening of personnel

Answer: Development of policies, standards, procedures and guidelines

Answer: Change control procedures


Question: 在SAML协议中，哪个实体是服务提供者，它需要验证用户的身份以提供服务？

Answer: 身份提供者

Answer: 认证权威机构

Answer: 服务提供者

Answer: 用户


Question: 以下哪种权限管理策略允许管理员根据用户角色分配权限？

Answer: 强制访问控制

Answer: 自主访问控制

Answer: 基于角色的访问控制

Answer: 基于策略的访问控制


Question: 以下哪种技术主要用于确保用户身份的真实性，防止冒充？

Answer: 加密

Answer: 访问控制

Answer: 身份验证

Answer: 数据隐私法规


Question: 在操作系统中，角色-based访问控制（RBAC）的主要目的是什么？

Answer: 限制用户只能访问与其角色相关的工作所需资源

Answer: 通过加密确保数据在传输过程中的安全性

Answer: 验证用户身份以确保只有授权用户可以登录

Answer: 创建访问控制列表（ACL）以定义网络流量


Question: The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which ofthe following concept:

Answer: The reference monitor.

Answer: Discretionary Access Control.

Answer: The Security Kernel.

Answer: Mandatory Access Control.


Question: Which access control model provides upper and lower bounds of access capabilities for a subject?

Answer: Role-based access control

Answer: Lattice-based access control

Answer: Biba access control

Answer: Content-dependent access control


Question: What is called the percentage at which the False Rejection  Rate equals the False Acceptance Rate?

Answer: False Rejection Rate (FRR) or Type I Error

Answer: False Acceptance Rate (FAR) or Type II Error

Answer: Crossover Error Rate (CER)

Answer: Failure to enroll rate (FTE or FER)


Question: 在访问控制模型中，以下哪种模型提供了最细粒度的权限控制？

Answer: 自主访问控制（DAC）

Answer: 强制访问控制（MAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 基于属性的访问控制（ABAC）


Question: Which of the following is an entity-owned identification method ().

Answer: Users log in to the system with their own passwords to complete the identification process.

Answer: Users use their personal fingerprints for identification through the fingerprint recognition system

Answer: The user utilizes a secret function negotiated with the system to correctly respond to challenges sent by the system, through identity authentication

Answer: Users use smart cards to complete authentication


Question: 在身份验证和授权过程中，以下哪种做法是不安全的？

Answer: 使用复杂的密码策略，要求定期更改密码

Answer: 依赖单一的身份验证因素，如仅使用密码

Answer: 实施多因素认证（MFA）

Answer: 在传输敏感信息时使用HTTPS协议


Question: 以下哪种安全措施可以增加对两步验证应用的保护，以防止钓鱼攻击？

Answer: 仅使用短信接收验证码。

Answer: 启用基于时间的一次性密码（TOTP）。

Answer: 依赖于电子邮件接收验证码。

Answer: 在所有设备上启用自动登录功能。


Question: 以下哪种方法不是有效的两步验证设置？

Answer: 短信验证码

Answer: 生物识别（如指纹或面部识别）

Answer: 使用一次性密码应用生成的代码

Answer: 仅使用复杂的密码


Question: 多因素认证（MFA）在防范钓鱼攻击中的作用是什么？

Answer: 完全消除钓鱼攻击的风险

Answer: 提供额外的安全层，即使密码被窃取，攻击者也需要第二个因素才能访问账户

Answer: 减少用户对密码的依赖

Answer: 增加用户登录的便捷性


Question: 在零信任模型中，内部防御的主要目标是什么？

Answer: 防止外部攻击

Answer: 监控内部用户行为

Answer: 提高网络带宽

Answer: 减少硬件成本


Question: Which of the following techniques can be used to implement  role-based access control to protect the confidentiality of data in a  database?

Answer: Encryption

Answer: View

Answer: Hash

Answer: Masking


Question: 以下哪种身份验证机制依赖于用户知道的信息，如密码或PIN码？

Answer: 双因素认证

Answer: 生物识别认证

Answer: 基于知识的认证

Answer: 基于令牌的认证


Question: Which of the following is not a crucial component of the identity and access management relationship between customer and provider?

Answer: trust relationships

Answer: legal framework

Answer: designation of responsibilities

Answer: technical mechanics of implementation


Question: Mathew is a security administrator for a consulting company. He must use access control to limit user access based on previous user activity. Which security model is most suitable for Mathew's needs?

Answer: Brewer-Nash

Answer: Biba

Answer: Bell-LaPadula

Answer: Clark-Wilson


Question: 在零信任架构中，审计跟踪的主要作用是什么？

Answer: 提高系统性能

Answer: 记录和分析所有用户活动以检测异常行为

Answer: 仅记录系统错误

Answer: 用于用户认证


Question: 在权限控制中，以下哪种原则允许用户只能访问其工作所需的数据？

Answer: 最小权限原则

Answer: 职责分离原则

Answer: 权限继承原则

Answer: 审计跟踪原则


Question: 在RBAC系统中，审计与合规的主要目的是什么？

Answer: 为用户分配角色

Answer: 监控和记录用户活动

Answer: 创建新的角色

Answer: 更新角色的权限


Question: Which of the following is NOT a two-factor authentication mechanism?

Answer: Something you have and something you know.

Answer: Something you do and a password.

Answer: A smartcard and something you are.

Answer: Something you know and a password.


Question: 在信息系统中，访问控制是重要的安全功能之一。以下不属于访问控制模型的特点的是（）

Answer: 只涉及安全性质，不过多牵扯系统的功能或其实现细节

Answer: 复杂的，不易理解

Answer: 精确的、无歧义的

Answer: 简单的、抽象的，容易理解


Question: 实体身份鉴别一般依据以下三种基本情况或这三种情况的组合：实体所知的鉴别方法、实体所有的鉴别方法和基于实体特征的鉴别方法。下面选项中属于使用基于实体特征的鉴别方法是（  ）。[1分]

Answer: 将登录口令设置为出生日期

Answer: 通过询问和核对用户的个人隐私信息来鉴别

Answer: 使用系统定制的、在本系统专用的IC卡进行鉴别

Answer: 通过扫描和识别用户的脸部信息来鉴别


Question: Privileged user (administrators, managers, and so forth) accounts need to be reviewedmore closely than basic user accounts. Why is this?

Answer: Privileged users have more encryption keys.

Answer: Regular users are more trustworthy.

Answer: There are extra controls on privileged user accounts.

Answer: Privileged users can cause more damage to the organization.


Question: 以下哪种情况最有可能是二步验证在防止钓鱼攻击中的作用？

Answer: 阻止攻击者通过猜测密码登录

Answer: 检测并阻止恶意软件的传播

Answer: 验证用户设备的合法性

Answer: 在用户尝试登录时提供额外的身份验证步骤


Question: 以下哪种访问控制策略允许系统记录用户的活动，以便在发生安全事件时进行追踪？

Answer: 非对称加密

Answer: 审计与追踪

Answer: 密钥管理

Answer: 零信任网络


Question: 在基于令牌的身份验证中，以下哪个描述了令牌的角色？

Answer: 存储用户密码的加密数据

Answer: 用户身份的长期证明

Answer: 临时的、可验证的访问凭据

Answer: 用于加密通信的共享密钥


Question: Which access control model enables the OWNER of the resource to specify what subjects can access specific resources based on their identity?

Answer: Discretionary Access Control

Answer: Mandatory Access Control

Answer: Sensitive Access Control

Answer: Role-based Access Control


Question: 在权限控制中，最小权限原则指的是：

Answer: 每个用户都应拥有执行所有操作的权限

Answer: 每个用户只能访问他们需要完成工作所必需的资源

Answer: 系统管理员应拥有所有权限以便快速解决问题

Answer: 所有用户权限应相同，以确保公平


Question:
Which access control type has a central authority that  determine to what objects the subjects have access to and it is based on role  or on the
organizational security policy?

Answer: Mandatory Access Control

Answer: Discretionary Access Control

Answer: Non-Discretionary Access Control

Answer: Rule-based Access control


Question: What security model implies a central authority that denes rules and sometimes global rules, dictating what subjects can have access to whatobjects?

Answer: Flow Model

Answer: Discretionary access control

Answer: Mandatory access control

Answer: Non-discretionary access control


Question: As with logical access controls, audit logs should be produced  and monitored for physical access controls. Which of the following statements  is correct about auditing physical access?

Answer: Unsuccessful access attempts should be logged but only need to be  reviewed by a security guard.

Answer: Only successful access attempts should be logged and reviewed.

Answer: Only unsuccessful access attempts during unauthorized hours should be  logged and reviewed.

Answer: All unsuccessful access attempts should be logged and reviewed.


Question: 以下哪种身份验证流程主要用于允许用户使用单一登录凭据访问多个独立的应用系统？

Answer: 基本身份验证

Answer: 多因素身份验证

Answer: 访问控制列表

Answer: 身份联合与单点登录


Question: What enables users to validate each other's certicate when they are certied under different certication hierarchies?

Answer: Cross-certication

Answer: Multiple certicates

Answer: Redundant certication authorities

Answer: Root certication authorities


Question: 以下哪种技术用于验证用户身份，例如在登录网上银行时输入的用户名和密码？

Answer: 加密技术

Answer: 入侵检测系统

Answer: 身份验证

Answer: 网络层次模型


Question: 在 windows 用户管理中，使用组策略 a-g-dl-p,其中 p 表示（）。

Answer: 用户账号

Answer: 资源访问权限

Answer: 域本地组

Answer: 通用组


Question: Which type of password provides maximum security because a new  password is required for each new log-on?

Answer: One-time or dynamic password

Answer: Congnitive password

Answer: Static password

Answer: Passphrase


Question: A passphrase is the most commonly used means of authenticating a user's identity. Which of the following passphrases has the greatest range of potential risk implications? ( )

Answer: Passwords that have not been changed for a long time

Answer: Excessively short muzzles

Answer: A password shared by two people.

Answer: The default passphrase provided by the equipment vendor


Question: 以下哪种访问控制模型允许管理员根据用户角色分配权限？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于规则的访问控制

Answer: 角色基础访问控制（RBAC）


Question: Which of the following biometric devices offers the LOWEST CER?

Answer: Keystroke dynamics

Answer: Voice verication

Answer: Iris scan

Answer: Fingerprint


Question: 零信任模型中的最小权限原则是指什么？

Answer: 用户只能访问他们需要的资源

Answer: 用户必须通过多因素认证

Answer: 网络被划分为多个隔离区域

Answer: 所有通信都必须加密


Question: When submitting a passphrase for authentication, the passphrase is converted into:

Answer: a virtual password by the system.

Answer: a new passphrase by the system.

Answer: a new passphrase by the encryption technology

Answer: a real password by the system which can be used forever.


Question: 在身份验证与授权中，多因素认证（MFA）至少需要多少种验证因素？

Answer: 1

Answer: 2

Answer: 3

Answer: 4


Question: 在认证与授权中，以下哪种方法可以确保用户访问权限的最小化，从而降低内部威胁的风险？

Answer: 多因素认证

Answer: 最小权限原则

Answer: 零信任网络

Answer: 角色基础的访问控制


Question: 以下哪种方法最直接地防止钓鱼攻击中的身份盗用？

Answer: 安装端点安全软件

Answer: 使用安全套接层（SSL）

Answer: 定期更新操作系统和应用程序

Answer: 实施双因素身份验证


Question: Pin, Password, Passphrases, Tokens, smart cards, and biometric devices are all items that can be used for Authentication. When one of theseitem listed above in conjunction with a second factor to validate authentication, it provides robust authentication of the individual by practicingwhich of the following?

Answer: Multi-party authentication

Answer: Two-factor authentication

Answer: Mandatory authentication

Answer: Discretionary authentication


Question:
Which of the following implements the  authorized access relationship between subjects and objects of a  system?
下面哪项实现了系统的主体和客体之间的授权访问关系？

Answer: Security model 安全模型

Answer: Reference kernel 参考内核

Answer: Security kernel 安全内核

Answer: Information flow model 信息流模型


Question: 在访问控制策略中，以下哪项最能防止内部员工非法访问敏感的财务数据？

Answer: 应用数据备份策略以防止数据丢失

Answer: 实施基于角色的访问控制(RBAC)

Answer: 执行隐私合规培训，提高员工意识

Answer: 采用加密技术隐藏数据内容


Question: Which format is the most commonly used standard for exchanging information within a federated identity system?

Answer: XML

Answer: HTML

Answer: SAML

Answer: JSON


Question: 以下哪种协议主要用于企业级环境，允许用户在多个不同的服务提供者之间进行身份验证，而只需要登录一次？

Answer: OAuth2.0

Answer: OpenID Connect

Answer: SAML协议

Answer: HTTP Digest Authentication


Question:
This is a common security issue that is  extremely hard to control in large environments. It occurs when a user has  more computer rights, permissions, and privileges that what is required for  the tasks the user needs to fulfill. What best describes this scenario?
这是一个在大型环境中常见的非常难以控制的安全问题。它发生在当用户拥有超出完成任务需要的更多的计算机权利、许可和特权。这说的是？

Answer: Excessive Rights 过多的权利

Answer: Excessive Access 过多的访问

Answer: Excessive Permissions 过多的许可

Answer: Excessive Privileges 过多的特权


Question: The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which of thefollowing concept:

Answer: The reference monitor.

Answer: Discretionary Access Control.

Answer: The Security Kernel.

Answer: Mandatory Access Control.


Question: In the context of Biometric authentication, there is a quick way to compare the accuracy of devices. In general, the devices that have the lowestvalue would be the most accurate. Which of the following would be used to compare accuracy of devices?

Answer: the CER is used.

Answer: the FRR is used

Answer: the FAR is used

Answer: the FER is used


Question: As with logical access controls, audit logs should be produced and monitored for physical access controls. Which of the following statements is correct about auditing physical access?

Answer: Unsuccessful access attempts should be logged but only need to be reviewed by a security guard.

Answer: Only successful access attempts should be logged and reviewed.

Answer: Only unsuccessful access attempts during unauthorized hours should be logged and reviewed.

Answer: All unsuccessful access attempts should be logged and reviewed.


Question: What kind of certificate is used to validate a user identity?

Answer: Public key certificate

Answer: Attribute certificate

Answer: Root certificate

Answer: Code signing certificate


Question: 在OAuth 2.0中，授权码流程的主要目的是什么？

Answer: 直接向资源服务器请求资源

Answer: 通过授权服务器安全地获取访问令牌

Answer: 向用户展示广告

Answer: 收集用户数据


Question: 在多因素认证中，以下哪种方法不被视为第二因素？

Answer: 短信验证码

Answer: 记住我（Remember Me）功能

Answer: 生物特征（如指纹）

Answer: 硬件安全令牌


Question: Which of the following benets does Role Based Access Control (RBAC) provide for the access review process?

Answer: Lowers the amount of access requests after review

Answer: Gives more control into the revocation phase

Answer: Gives more ne-grained access analysis to accesses

Answer: Lowers the number of items to be reviewed


Question: 在访问控制模型中，以下哪项原则是指用户只能访问他们被授权访问的信息和资源？

Answer: 最小权限原则

Answer: 职责分离原则

Answer: 需要知道原则

Answer: 审计日志原则


Question:
What is the MOST effective method to  enhance security of a Single Sign-On (SSO) solution that interfaces with  critical systems?
下面哪个是最有效的方法，来增强关键系统的单点登录解决方案的安全性？

Answer:
High performance encryption algorithms
高性能加密算法

Answer:
Reusable tokens for application-level authentication
应用级认证的可重用令牌

Answer:
Transport Layer Security (TLS) for all communications
所有通信采用TLS加密

Answer:
Two-factor authentication
双因素验证


Question: 以下哪个协议允许不同认证系统的互操作性？

Answer: SAML (Security Assertion Markup Language)

Answer: OAuth 2.0

Answer: FIDO (Fast IDentity Online)

Answer: Kerberos


Question: 以下哪种技术可以防止未经授权的用户访问特定资源？

Answer: SSL\\/TLS证书

Answer: 数据备份与恢复策略

Answer: 访问控制列表（ACL）

Answer: 哈希函数


Question: Which security model uses division of operations into different parts and requires different users to perform each part?

Answer: Bell-LaPadula model

Answer: Biba model

Answer: Clark-Wilson model

Answer: Non-interference model


Question: 在多因素认证中，哪种因素最难被攻击者伪造？

Answer: 基于知识的密码

Answer: 基于拥有的硬件令牌

Answer: 基于生物识别的指纹

Answer: 基于位置的GPS坐标


Question: Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution ofsecret keys and provides additional access control support?

Answer: SESAME

Answer: RADIUS

Answer: KryptoKnight

Answer: TACACS+


Question: Which of the following access control models introduces user security clearance and data classification?

Answer: Role-based access control

Answer: Discretionary access control

Answer: Non-discretionary access control

Answer: Mandatory access control


Question: 双因素认证与多因素认证的主要区别是什么？

Answer: 双因素认证不需要密码

Answer: 多因素认证只使用生物识别

Answer: 双因素认证使用两种认证因素，而多因素认证使用两种以上

Answer: 多因素认证不包括令牌认证


Question: Alice and Bob want to use the Internet to communicate privately. They each have theirown asymmetric key pairs and want to use them to create temporary symmetric keys foreach connection or session. Which of the following will enable them to do this?

Answer: Remote Authentication Dial-In User Service (RADIUS)

Answer: Rivest-Shamir-Adelman (RSA) encryption

Answer: Diffie-Hellman exchange

Answer: Terminal Access Controller Access-Control System (TACACS)


Question: 在用户权限管理中，以下哪种做法最不利于防止内部威胁？

Answer: 根据员工角色和职责分配最小权限

Answer: 定期审查和更新用户权限

Answer: 为所有员工设置统一的高权限账户

Answer: 实施多因素认证（MFA）


Question: To control access by a subject (an active entity such as  individual or process) to an object (a passive entity such as a file)  involves setting up:

Answer: Access Rules

Answer: Access Matrix

Answer: Identification controls

Answer: Access terminal


Question:
Tanya is working with the company’s internal software development team. Before a user of an application can access files located on the company’s centralized server, the user must present a valid one-time password, which is generated through a challenge/response mechanism. The company needs to tighten access control for these files and reduce the number of users who can access each and every file. The company is looking to Tanya and her team for solutions to better protect the data that has been classified and deemed critical to the company’s missions. Tanya has also been asked to implement a single sign-on technology for all internal users, but she does not have the budget to implement a public key infrastructure.
Which of the following best describes what is currently in place?

Answer: Capability-based access system

Answer: Synchronous tokens that generate one-time passwords

Answer: RADIUS

Answer: Kerberos


Question: What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Answer: Authentication

Answer: Identification

Answer: Authorization

Answer: Confidentiality


Question: A periodic review of user account management should NOT determine:

Answer: conformity with the concept of least privilege.

Answer: whether active accounts are still being used.

Answer: strength of user-chosen passwords.

Answer: whether management authorizations are up-to-date.


Question: 在多因素认证中，以下哪一项通常不被视为一个独立的认证因素？

Answer: 生物识别信息（如指纹）

Answer: 用户知道的信息（如密码）

Answer: 用户拥有的物品（如智能包）

Answer: 用户的地理位置


Question: 在零信任安全模型中，以下哪项原则强调了用户只能访问完成其工作所需的最小权限资源？

Answer: 微分段

Answer: 最小权限

Answer: 持续验证

Answer: 多因素认证


Question: 零信任原则的核心理念是什么？

Answer: 信任所有内部网络流量

Answer: 默认情况下不信任任何内部或外部网络流量，直到经过验证

Answer: 仅信任内部网络流量

Answer: 信任所有外部网络流量


Question: 在多因素认证中，以下哪种安全协议通常用于确保设备与服务器之间的通信安全？

Answer: TLS（传输层安全）

Answer: FTP（文件传输协议）

Answer: HTTP（超文本传输协议）

Answer: IMAP（Internet消息访问协议）


Question: 在多级安全模型中，以下哪种访问控制机制允许用户访问与其安全级别相匹配或更低级别的信息？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 访问控制列表（ACL）


Question: Which authentication technique BEST protects against hijacking?

Answer: Static authentication

Answer: Continuous authentication

Answer: Robust authentication

Answer: Strong authentication


Question: 在零信任安全模型中，以下哪项不是持续验证的关键组成部分？

Answer: 实时监控用户行为

Answer: 定期进行风险评估

Answer: 基于角色的访问控制

Answer: 动态调整访问策略


Question: 在网络安全中，哪种技术用于确保用户身份的真实性？

Answer: 安全协议

Answer: 防火墙技术

Answer: 身份验证

Answer: 入侵检测


Question: 在移动设备的身份认证机制中，以下哪项不是常见的认证因素？

Answer: 知识因素（如密码）

Answer: 拥有因素（如智能卡）

Answer: 生物特征因素（如指纹）

Answer: 地理位置因素


Question: 以下哪种身份验证模型允许用户通过提供与他们身份相关联的物理设备来验证自己的身份？

Answer: 基于知识的身份验证

Answer: 基于拥有的身份验证

Answer: 基于行为的身份验证

Answer: 基于身份的加密


Question: 在基于角色的访问控制(RBAC)模型中，以下哪项不是RBAC的核心组成部分？

Answer: 角色定义

Answer: 权限分配

Answer: 用户组管理

Answer: 会话管理


Question: 以下哪一项能有效验证交易的发起人？

Answer: 在发起人和接收者之间使用加密密码。

Answer: 使用接收者的公钥加密交易。

Answer: 使用可移植文档格式封装交易内容。

Answer: 使用来源者的私钥对交易执行数字签名。


Question: Which of the following is an example of discretionary access control?

Answer: Identity-based access control

Answer: Task-based access control

Answer: Role-based access control

Answer: Rule-based access control


Question: 安全认证机制的主要目的是什么？

Answer: 提高邮件发送速度

Answer: 防止未经授权的访问

Answer: 增加邮件附件的大小限制

Answer: 减少邮件服务器的负载


Question: 下面哪个是检查时间/使用时间（TOC/TOU）问题的实例？

Answer: A user whose profile has been revoked logs on using the password of a  valid user of the system.

Answer: A user logs on with a valid profile which is revoked without termination  of the session.

Answer: A user session is terminated immediately after the user profile is  revoked.

Answer: A user session is not validated until after the log on.


Question: 以下哪种权限管理策略有助于防止内部威胁并确保最小权限原则？

Answer: 所有用户都拥有系统管理员权限

Answer: 根据角色分配权限

Answer: 用户可以自由共享他们的账户和密码

Answer: 每个用户对所有资源都有完全访问权限


Question: 以下哪种访问控制模型允许管理员根据用户角色分配权限，以管理大量用户的访问权限？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于属性的访问控制（ABAC）

Answer: 角色基础访问控制（RBAC）


Question: 在零信任环境中，以下哪项措施不是用来增强身份验证和访问控制的？

Answer: 使用生物识别技术

Answer: 实施网络微隔离

Answer: 采用单点登录系统

Answer: 应用基于角色的访问控制


Question: 以下哪种访问控制策略是零信任网络架构的关键组成部分？

Answer: 最小权限原则

Answer: 基于角色的访问控制（RBAC）

Answer: 强制访问控制（MAC）

Answer: 所有用户都具有管理员权限


Question: Which access control model provides upper and lower bounds of access capabilities for a subject?

Answer: Role-based access control

Answer: Lattice-based access control

Answer: Biba access control

Answer: Content-dependent access control


Question: Which of the following can best dene the "revocation request grace period"?

Answer: The period of time allotted within which the user must make a revocation request upon a revocation reason

Answer: Minimum response time for performing a revocation by the CA

Answer: Maximum response time for performing a revocation by the CA

Answer: Time period between the arrival of a revocation request and the publication of the revocation information


Question: Terminal Access Controller Access-Control System (TERMINALAccessControllerAccess-ControlSystem, TACACS), during the authentication process, the client sends a START packet to the server, which includes information about the type of authentication being performed, the user name, etc. The START packet is only used at the beginning of an authentication session The START packet is used only at the beginning of an authentication session, and the sequence number is always (). After the server receives the START packet, it sends back a REPLY packet indicating whether the authentication continues or ends.

Answer: 0

Answer: 1

Answer: 2

Answer: 4


Question: Which item is not part of a Kerberos authentication implementation?

Answer: Message authentication code

Answer: Ticket granting service

Answer: Authentication service

Answer: Users, programs, and services


Question: RADIUS incorporates which of the following services?

Answer: Authentication server and PIN codes.

Answer: Authentication of clients and static passwords generation.

Answer: Authentication of clients and dynamic passwords generation.

Answer: Authentication server as well as support for Static and Dynamic passwords.


Question: 在SSO系统中，令牌机制的主要作用是什么？

Answer: 用于存储用户的登录信息

Answer: 用于加密和解密用户数据

Answer: 用于在不同服务间传递认证和授权信息

Answer: 用于监控用户行为


Question: 访问控制列表（ACL）的主要作用是什么？

Answer: 记录用户登录历史

Answer: 定义用户身份认证方式

Answer: 指定哪些用户或系统可以访问特定资源

Answer: 监控系统性能


Question: 在权限模型中，以下哪项不是访问控制列表（ACL）的主要功能？

Answer: 定义用户对特定资源的访问权限

Answer: 实现基于角色的访问控制（RBAC）

Answer: 记录用户对资源的访问历史

Answer: 控制用户对资源的读写操作


Question: Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplishe

Answer: through access control mechanisms that require identication and authentication and through the audit function.

Answer: through logical or technical controls involving the restriction of access to systems and the protection of information.

Answer: through logical or technical controls but not involving the restriction of access to systems and the protection of information.

Answer: through access control mechanisms that do not require identication and authentication and do not operate through the audit function.


Question: 以下哪种身份验证机制对防止网络欺诈最有效？

Answer: 单一因素身份验证（如密码）

Answer: 双因素身份验证（如密码+短信验证码）

Answer: 基于IP地址的身份验证

Answer: 基于用户行为的身份验证


Question: A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Answer: Concern that the laser beam may cause eye damage.

Answer: The iris pattern changes as a person grows older.

Answer: There is a relatively high rate of false accepts.

Answer: The optical unit must be positioned so that the sun does not shine into the aperture.


Question: 公司的呼叫中心 IT 政策要求为所有用户指定独一无二的用户账户。如果发现并非所有当前用户均符合此要求，最适当的建议是什么？

Answer: 让营运管理人员审批当前配置。

Answer: 确保现有的所有账户都有审计轨迹。

Answer: 为所有员工实施独立的用户账户。

Answer: 修改IT政策以允许使用共享账户。


Question: Which of the following accurately describes Identity as a  Service (IDaaS)?

Answer: A form of single sign-on (SSO) that spans multiple entities in an  enterprise

Answer: A form of SSO that spans multiple independent enterprises

Answer: A way to provide SSO without multiple forms of authentication

Answer: A way to demonstrate identity without having to sign on


Question: 在零信任安全模型中，以下哪项措施最直接地对应于威胁情报的利用？

Answer: 定期进行内部网络扫描以发现异常活动

Answer: 实施多因素认证以增强用户身份验证

Answer: 基于风险的访问控制，利用威胁情报对用户和设备进行动态评估

Answer: 建立入侵检测系统（IDS）以监控网络流量


Question: Which of the following controls related to physical security is NOT an administrative control?

Answer: Personnel controls

Answer: Alarms

Answer: Training

Answer: Emergency response and procedures


Question: 在文件系统中，以下哪种权限模型允许管理员为每个用户分配特定的文件访问权限？

Answer: 基于角色的访问控制（RBAC）

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于策略的访问控制（PBAC）


Question: Revocation and reissuing of compromised credentials is impossible for which of the following authentication techniques?

Answer: Biometric data.

Answer: Picture passwords.

Answer: Personal identification number.

Answer: Radio frequency identification.


Question: 以下哪种访问控制策略允许管理员定义一组规则，根据用户属性、时间、网络位置等来控制访问？

Answer: 自主访问控制

Answer: 强制访问控制

Answer: 基于策略的访问控制

Answer: 基于角色的访问控制


Question: 生物识别技术中，以下哪项不属于常见的生物特征？

Answer: 指纹识别

Answer: 虹膜扫描

Answer: 声音识别

Answer: 密码输入


Question: A password is a technique used to obfuscate, where the user wants normal (recognizable) information to be transformed into unrecognizable information. However, this unrecognizable information can be partially reprocessed and recovered and cracked. Xiaogang is a new employee of a company, and the company requires him to register an account for the company's website. Xiaogang uses a safer password, so which one of the following options is the most secure ()

Answer: Use the same password as the username

Answer: Select a passphrase that can be found in any dictionary or language

Answer: Select any passphrase related to personal information

Answer: Takes a mix of numbers, letters and special symbols and is easy to memorize.


Question: 在认证协议中，以下哪种协议提供了前向保密性？

Answer: SSL\/TLS

Answer: Kerberos

Answer: RADIUS

Answer: LDAP


Question: 某windows系统用户名为Admin，该系统开启了账户策略中的口令符合复杂性的策略，并限制密码长度最小值为6个字符，以下哪个口令是符合策略要求会被系统接受的（）

Answer: Admin246!

Answer: a135!

Answer: AdILN153!

Answer: 2w3e4dfg


Question: 多因素认证通常包含以下哪三种类型的因素？

Answer: 知识因素、所有权因素、生物特征因素

Answer: 知识因素、行为因素、环境因素

Answer: 知识因素、所有权因素、位置因素

Answer: 知识因素、行为因素、生物特征因素


Question: Of the following, what is the primary item that a capability table is based upon?

Answer: A subject

Answer: An object

Answer: A product

Answer: An application


Question:
The three classic ways of authenticating yourself to the  computer security software are by something you know, by something you have,  and by
something:

Answer: you need.

Answer: non-trivial

Answer: you are.

Answer: you can get.


Question: 以下哪种情况体现了权限继承的概念？

Answer: 在Windows域环境中，用户账户被添加到一个具有特定权限的组

Answer: 在Linux系统中，使用chown命令更改文件的所有者

Answer: 在数据库中，创建一个新的表并设置其默认权限

Answer: 在Web服务器上，为特定目录设置访问控制列表


Question: 在防止钓鱼攻击中，哪种身份验证方法可以提供额外的安全层，使得即使用户密码被窃取，攻击者也无法轻易访问系统？

Answer: 一次性密码

Answer: 静态密码

Answer: 基于知识的身份验证

Answer: 基于拥有的身份验证


Question: 分析表明，攻击者通过TLS  VPN网关获得了访问网络的权限后侵入了网络。攻击者是在猜出了用户名并使用了暴力破解得到了密码后获得访问权限的。以下哪一项最有助于降低这一风险？

Answer: 在VPN上实施强密码验证

Answer: 将VPN和集中身份存储集成

Answer: 改用IPsec VPN

Answer: 使用双因素验证


Question: Kerberos can prevent which one of the following attacks?

Answer: Tunneling attack.

Answer: Playback (replay) attack.

Answer: Destructive attack.

Answer: Process attack.


Question: 88. What technique do API developers most commonly use to limit  access to an API to autho-rized individuals and applications?

Answer: Encryption

Answer: Input validation

Answer: API keys

Answer: IP filters


Question: 以下哪种身份验证模型允许用户使用单一的凭据登录，然后可以访问多个相互信任的网络服务？

Answer: 单点登录（SSO）模型

Answer: 基于生物特征的身份验证模型

Answer: 基于令牌的身份验证模型

Answer: 基于挑战-响应的身份验证模型


Question: Which of the following elements is NOT included in a Public Key Infrastructure (PKI)?

Answer: Timestamping

Answer: Repository

Answer: Certificate revocation

Answer: Internet Key Exchange (IKE)


Question: 在基于角色的访问控制（RBAC）模型中，以下哪项不是角色定义的关键组成部分？

Answer: 角色名称

Answer: 角色权限

Answer: 角色成员

Answer: 角色审计


Question: 在RBAC中，角色层次结构的作用是什么？

Answer: 限制用户只能访问特定资源

Answer: 定义角色之间的继承关系

Answer: 管理用户的登录时间

Answer: 控制系统的审计日志


Question: 以下哪种方法属于实体所有的鉴别方法（）。

Answer: 用户通过自己设置的口令登录系统，完成身份鉴别

Answer: 用户使用个人指纹，通过指纹识别系统的身份鉴别

Answer: 用户利用和系统协商的秘密函数，对系统发送挑战进行正确应答，通过身份鉴别

Answer: 用户使用智能卡完成身份鉴别


Question: What is the usual order of an access management process?

Answer: Access-authorization-authentication

Answer: Authentication-authorization-access

Answer: Authorization-authentication-access

Answer: Authentication-access-authorization


Question: Access control provides users with maximum sharing of system resources based on the management of user access rights to prevent unauthorized tampering with and misuse of information, the following does not belong to the role of access control ()

Answer: Ensure that users work properly under the system's security policy

Answer: Deny unauthorized access to illegal users

Answer: Denial of unauthorized access to legitimate users

Answer: Denial of normal access to legitimate users


Question: 权限管理中，以下哪种策略可以有效防止权限提升攻击？

Answer: 最小权限原则

Answer: 权限继承

Answer: 权限合并

Answer: 权限轮换


Question: Which of the following remote access authentication systems is the MOST robust?

Answer: TACACS+

Answer: RADIUS

Answer: PAP

Answer: TACACS


Question: 零信任网络架构中，以下哪项措施不是用于增强身份验证的安全性？

Answer: 单点登录（SSO）

Answer: 生物识别技术

Answer: 细粒度访问控制

Answer: 智能卡认证


Question: 访问控制列表（ACL）是实现访问控制的一种机制，以下哪项不是ACL的主要功能？

Answer: 定义用户对资源的访问权限

Answer: 记录用户的访问历史

Answer: 控制用户对资源的访问方式

Answer: 限制用户对资源的访问时间


Question: The Terminal Access Controller Access Control System (TACACS) employs which of the following?

Answer: a user ID and static password for network access

Answer: a user ID and dynamic password for network access

Answer: a user ID and symmetric password for network access

Answer: a user ID and asymmetric password for network access


Question: Zhao, a graduate of a university majoring in computer science and technology, is applying for a job in a large enterprise and is asked by the interview manager to give his design ideas for an access control model for the enterprise's information system. If he wants to implement an autonomous access control function for an information system with a large number of users, among the following options, the most appropriate model or approach he should take among the following options from the point of view of time and resource consumption is ().

Answer: BLP model

Answer: Biba model

Answer: Competency List (CL)

Answer: Access Control Lists (ACLs)


Question: 关于权限与认证，以下哪种说法是错误的？

Answer: 多因素认证提高了账户安全性

Answer: 基于角色的访问控制（RBAC）允许根据用户角色分配权限

Answer: 明文存储密码可以简化用户找回密码的过程

Answer: 限制默认账户的权限可以减少攻击面


Question: 在权限模拟攻击中，攻击者通常试图做什么？

Answer: 获取对受害者计算机的物理访问

Answer: 欺骗用户下载恶意软件

Answer: 模仿合法用户的身份以获取敏感信息

Answer: 利用软件漏洞执行远程代码


Question: 以下哪种访问控制策略可以防止未经授权的员工访问高级管理人员的电子邮件？

Answer: 基于角色的访问控制（RBAC）

Answer: 强制访问控制（MAC）

Answer: 自由访问控制（DAC）

Answer: 多级安全（MLS）


Question: 为确保输入的密码符合由字母和数字组成这一安全政策要求，信息系统审计师应建议：

Answer: 更改公司政策。

Answer: 定期更改密码。

Answer: 使用自动化密码管理工具。

Answer: 进行安全意识培训。


Question: 在身份验证机制中，以下哪种方法主要用于确保用户身份的真实性？

Answer: 基于角色的访问控制（RBAC）

Answer: 单点登录（SSO）

Answer: 多因素认证（MFA）

Answer: 访问控制列表（ACL）


Question: 以下哪项是防止身份盗用的最有效策略之一？

Answer: 定期更改所有账户的密码，并使用复杂的密码

Answer: 仅在公共Wi-Fi网络上进行敏感的在线交易

Answer: 忽略来自未知来源的电子邮件和消息

Answer: 在所有设备上禁用多因素认证


Question: 在权限与认证机制中，以下哪种方法可以防止会话劫持攻击？

Answer: 使用复杂的密码策略

Answer: 实施多因素认证

Answer: 定期更新服务器软件

Answer: 使用会话ID的随机性和短生命周期


Question: 在零信任安全模型中，下列哪项措施不属于持续监控的范畴？

Answer: 实时日志分析

Answer: 定期安全审计

Answer: 用户行为分析

Answer: 网络流量监控


Question: Which of the following statements pertaining to biometrics is FALSE?

Answer: User can be authenticated based on behavior.

Answer: User can be authenticated based on unique physical attributes.

Answer: User can be authenticated by what he knows.

Answer: A biometric system's accuracy is determined by its crossover error rate (CER).


Question: 在身份验证的多因素认证中，以下哪项不属于常见的认证因素？

Answer: 知识因素（如密码）

Answer: 所有权因素（如手机接收的短信验证码）

Answer: 生物特征因素（如指纹）

Answer: 物理位置因素（如用户所在城市）


Question: 拥有高度机密信息访问权限的某个员工已辞职。离职时，应首先进行以下哪一项？

Answer: 与员工进行离职面谈。

Answer: 确保已制定接任计划。

Answer: 撤销该员工对所有系统的访问权限。

Answer: 审查该员工的工作历史记录。


Question: 在检测到端点上的可疑登录活动时，哪种身份验证技术最有助于确认用户身份的合法性？

Answer: 静态密码

Answer: 多因素认证

Answer: IP地址白名单

Answer: 会话固定


Question: Director Zhang's computer using Windows 7 operating system, he often logged on the user name zhang, director Zhang to his personal folder set the permissions for only zhang this user has access to this directory, the administrator in a maintenance inadvertently zhang this user deleted, and then re-established a user named zhang, director Zhang zhang this user logged on to the system and found that he could not access his original personal folder because () After logging on to the system with the user name zhang, Director Zhang finds that he cannot access his original personal folder because ()

Answer: Any new user needs to be authorized to access files on the system

Answer: Windows does not consider the newly created user zhang to be the same user as the original user zhang, and therefore does not have access to the

Answer: When a user is deleted, the folder created by that user is also automatically deleted, and the new user cannot find the original user's folder and therefore cannot access it.

Answer: The newly created user zhang will inherit the permissions of the original user, and will not be able to access the folder because it is encrypted.


Question: Which of the following is most relevant to determining the  maximum effective cost of access control?

Answer: the value of information that is protected

Answer: management's perceptions regarding data importance

Answer: budget planning related to base versus incremental spending.

Answer: the cost to replace lost data


Question: Which of the following techniques can be used to implement role-based access control to protect the confidentiality of data in a database?

Answer: Encryption

Answer: View

Answer: Hash

Answer: Masking


Question: Which of the following Condentiality, Integrity, Availability (CIA) attribute supports the principle of least privilege by providing access toinformation only to authorized and intended users?

Answer: Condentiality

Answer: Integrity

Answer: Availability

Answer: Accuracy


Question: 在操作系统中，访问控制列表（ACL）主要用于实现哪种类型的权限管理？

Answer: 限制特定用户对网络资源的访问

Answer: 防止恶意软件通过网络传播

Answer: 加密存储在硬盘上的数据

Answer: 监控和记录用户活动


Question: 信息系统审计师最有可能以什么身份查看应用哈希函数？

Answer: 身份认证。

Answer: 识别。

Answer: 授权。

Answer: 加密。


Question: 在零信任安全模型中，以下哪项措施有助于限制用户对资源的访问权限？

Answer: 完全开放权限

Answer: 最小权限原则

Answer: 无限制的网络访问

Answer: 定期共享密码


Question: 为了防止未授权访问，以下哪种策略通常被用于限制对敏感数据的访问？

Answer: 防火墙策略

Answer: 数据加密

Answer: 入侵检测系统（IDS）

Answer: 访问控制


Question: Which of the following MUST be scalable to address security concerns raised by the integration of third-party identity services?

Answer: Mandatory Access Controls (MAC)

Answer: Enterprise security architecture

Answer: Enterprise security procedures

Answer: Role Based Access Controls (RBAC)


Question: 以下哪种方法可以防止权限模拟攻击，确保用户只能访问他们被授权的资源？

Answer: 实施多因素认证

Answer: 使用SSL\\/TLS加密所有通信

Answer: 实现基于角色的访问控制（RBAC）

Answer: 定期进行密码破解尝试


Question: Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution ofsecret keys and provides additional access control support?

Answer: SESAME

Answer: RADIUS

Answer: KryptoKnight

Answer: TACACS+


Question: 以下哪种身份验证模型允许用户通过提供两种或更多种类型的凭据来验证自己的身份，提高了安全性？

Answer: 单因素认证

Answer: 多因素认证

Answer: 基于知识的身份验证

Answer: 基于拥有的身份验证


Question: 在保护网络安全时，哪种措施主要用于确保用户身份的真实性？

Answer: 防火墙技术

Answer: 加密通信

Answer: 身份验证

Answer: 安全更新与补丁


Question: What are the two general types of proximity identification devices?

Answer: Biometric devices and access control devices

Answer: Swipe card devices and passive devices

Answer: Preset code devices and wireless devices

Answer: User-activated devices and system sensing devices


Question: 在使用复杂度不高的口令时，容易产生弱口令的安全脆弱性，被攻击者利用从而破解用户账户，下列设置的口令中，（）具有最好的口令复杂度。

Answer: morrison

Answer: Wm.S*F2m5@

Answer: 27776394

Answer: wangjing1977


Question: Lenny is a new security manager for a retail company that is  expanding its functionality to its partners and customers. The company’s CEO  wants to allow its partners’ customers to be able to purchase items through  the company’s web stores as easily as possible. The CEO also wants the  company’s partners to be able to manage inventory across companies more  easily. The CEO wants to be able to understand the network traffic and  activities in a holistic manner, and he wants to know from Lenny what typeof technology should be put into place to allow for a more proactive  approach to stopping malicious traffic if it enters the network. The company  is a high-profile entity constantly dealing with zero-day attacks.Lenny has a meeting with the internal software developers who are  responsible for implementing the necessary functionality within the web-based  system. Which of the following best describes the two items that Lenny needs  to be prepared to discuss with this team?

Answer: Service Provisioning Markup Language and the Extensible Access Control  Markup Language

Answer: Standard Generalized Markup Language and the Generalized Markup  Language

Answer: Extensible Markup Language and the Hypertext Markup Language

Answer: Service Provisioning Markup Language and the Generalized Markup  Language


Question: 在权限模型中，以下哪个概念用于确保进程或服务不能滥用其权限？

Answer: 权限降级

Answer: 特权隔离

Answer: 最小权限原则

Answer: 访问控制列表


Question: Who or what determines if an organization is going to operate under a discretionary, mandatory, or nondiscretionary access control model?

Answer: Administrator

Answer: Security policy

Answer: Culture

Answer: Security levels


Question: OAuth身份验证协议主要用于实现什么功能？

Answer: 在用户设备上加密本地数据

Answer: 验证用户身份并授权第三方应用访问资源

Answer: 创建数字签名以验证消息来源

Answer: 生成哈希函数以验证数据完整性


Question: 在某大型且复杂的组织中设计了一个新业务应用程序，并且业务主管要求基于“按需知密”原则查看各种报告。在以下访问控制方法中，哪项是实现该要求的最佳方法？

Answer: 强制访问控制。

Answer: 基于角色的访问控制。

Answer: 自主访问控制。

Answer: 单点登录。


Question: 在身份验证过程中，以下哪种方法可以提供最高等级的安全性？

Answer: 单因素身份验证（如密码）

Answer: 双因素身份验证（如密码+短信验证码）

Answer: 多因素身份验证（如密码+生物特征+硬件令牌）

Answer: 基于知识的身份验证（如安全问题）


Question: 以下哪种访问控制策略允许系统跟踪并记录用户对资源的访问行为？

Answer: 强制访问控制

Answer: 自主访问控制

Answer: 权限分配

Answer: 审计与追踪


Question:
Which of the following offers advantages such as the ability  to use stronger passwords, easier password administration, one set of  credential, and
faster resource access?

Answer: Smart cards

Answer: Single Sign-On (SSO)

Answer: Symmetric Ciphers

Answer: Public Key Infrastructure (PKI)


Question: Which of the following choices describe a Challenge-response tokens generation?

Answer: A workstation or system that generates a random challenge string that the user enters into the token when prompted along with the properPI

Answer: A workstation or system that generates a random login id that the user enters when prompted along with the proper PI

Answer: A special hardware device that is used to generate ramdom text in a cryptography system.

Answer: The authentication mechanism in the workstation or system does not determine if the owner should be authenticated.


Question: 以下哪种授权策略可以防止未授权用户访问特定的系统资源？

Answer: 多因素认证

Answer: 最小权限原则

Answer: 零信任网络

Answer: 访问控制列表(ACL)


Question: 以下哪一项是最小授权原则的运用？

Answer: 建立岗位轮换机制

Answer: 监控和评审特权会话

Answer: 建立VPN隧道连接

Answer: 建立沙箱环境


Question: 以下哪种情况体现了身份认证中的“知道”因素？

Answer: 使用指纹解锁手机

Answer: 接收并输入短信验证码

Answer: 插入智能卡进行身份验证

Answer: 通过面部识别进入安全区域


Question: When is a security guard the best choice for a physical access control mechanism?

Answer: When discriminating judgment is required

Answer: When intrusion detection is required

Answer: When the security budget is low

Answer: When access controls are in place


Question: 以下关于 cpu 的叙述中，错误的是 （ ） 。

Answer: cpu 产生每条指令的操作信号并将操作信号送往相应的部件进行控制

Answer: 程序控制器 pc 除了存放指令地址，也可以临时存储算术/逻辑运算结果

Answer: cpu 中的控制器决定计算机运行过程的自动化

Answer: 指令译码器是 cpu 控制器中的部件


Question: 3GPP标准中，哪种加密算法被广泛用于保护移动通信的安全？

Answer: AES（Advanced Encryption Standard）

Answer: DES（Data Encryption Standard）

Answer: RSA（Rivest-Shamir-Adleman）

Answer: SHA-256（Secure Hash Algorithm 256）


Question: The Diffie-Hellman algorithm is primarily used to provide which of the following?

Answer: Confidentiality

Answer: Key Agreement

Answer: Integrity

Answer: Non-repudiation


Question: What can be dened as a momentary low voltage?

Answer: spike

Answer: blackout

Answer: sag

Answer: fault


Question: 5G 采用的正交振幅调制（Quadrature Amplitude Modulation,QAM）技术中，2560QAM 的一个载波上可以调制（）比特信息。

Answer: 2

Answer: 4

Answer: 6

Answer: 8


Question: 下面关于 rs-232-c 标准的描述中，正确的是（ ）。

Answer: 可以实现长距离远程通信

Answer: 可以使用 9 针或 25 针 d 型连接器

Answer: 必须采用 24 根线韵电缆进行连接

Answer: 诵常用于连接并行打印机


Question: a=17,b=2,则满足 a 与 b 取模同余的是（ ）。

Answer: 4

Answer: 5

Answer: 6

Answer: 7


Question: What would you get from running the command dig ns domain.com?

Answer: Mail exchanger records for domain.com

Answer: Name server records for domain.com

Answer: Caching name server for domain.com

Answer: IP address for the hostname ns


Question: 计算机运行过程中，CPU 需要与外设进行数据交换。采用（）控制技术时，CPU 与外设可并行工作。

Answer: 程序查询方式和中断方式

Answer: 中断方式和 DMA 方式

Answer: 程序查询方式和 DMA 方式

Answer: 程序查询方式、中断方式和 DMA 方式


Question: Which software development model is actually a meta-model that incorporates a number of the software development models?

Answer: The Waterfall model

Answer: The modied Waterfall model

Answer: The Spiral model

Answer: The Critical Path Model (CPM)


Question: 在 OraclE中，将 scott 的资源文件改为 otherprofilE，下列哪个是正确的？(    )

Answer: ALTER PROFILEUSER scott otherprofilE

Answer: ALTER otherprofilEUSER scottPROFILE

Answer: ALTER USER scott PROFILEotherprofilE

Answer: ALTER scott USER PROFILEotherprofilE


Question: 在硬盘结构中，哪个部分存储了文件系统的元数据，如文件分配表（FAT）或inode？

Answer: 引导扇区

Answer: 数据扇区

Answer: 主引导记录（MBR）

Answer: 超级块（Superblock）


Question: Which of the following does NOT concern itself with key management?

Answer: Internet Security Association Key Management Protocol (ISAKMP)

Answer: Diffie-Hellman (DH)

Answer: Cryptology (CRYPTO)

Answer: Key Exchange Algorithm (KEA)


Question: What does "System Integrity" mean?

Answer: The software of the system has been implemented as designed.

Answer: Users can't tamper with processes they do not own.

Answer: Hardware and firmware have undergone periodic testing to verify that they are functioning properly.

Answer: Design specifications have been verified against the formal top-level specification.


Question: Which of the following management shares does not exist ()

Answer: C$

Answer: D$

Answer: ADMIN$

Answer: 1$


Question: 在 linux 中，更改用户口令的命令是（ ）

Answer: pwd

Answer: passwd

Answer: kouling

Answer: password


Question: The main current algorithms based on symmetric key systems are. ( )

Answer: RSA

Answer: DES

Answer: AES

Answer: DSA


Question: In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?

Answer: Subordinate CA

Answer: Top Level CA

Answer: Big CA

Answer: Master CA


Question:
Windows 中，在命令行输入（ ）命令可以得到如下的回显。Server: UnKnown
Adress: 159.47.11.80
xxx.edu.cn
primary name server = nsl.xxx.edu.cn responsible mail addr = mailxxx.edu.cn serial = 2020061746
refresh= 1200(20 mins)
retry= 7200(2 hours)
expire = 3600(1 hour)
default TTL = 3600(1 hour)

Answer: nslookup -type=A xxx.edu.cn

Answer: nslookup -type=CNAME xxx.edu.cn

Answer: nslookup -type=NS xxx.edu.cn

Answer: nlookup type=PTR xxx.edu.cn


Question: What does DEA stand for?

Answer: Data Encoding Algorithm

Answer: Data Encoding Application

Answer: Data Encryption Algorithm

Answer: Digital Encryption Algorithm


Question: 下列哪个命令可以显示出当前目录

Answer: echo $(pwd)

Answer: echo pwd

Answer: $pwd

Answer: pwd | echo


Question: The basic features of standardization are correctly understood ()

Answer: Standardization as an activity

Answer: The object of standardization is people, things and objects

Answer: The benefits of standardization can only be realized after application

Answer: All of the above is correct.


Question: 衡量系统可靠性的指标是（）。

Answer: 周转时间和故障率λ

Answer: 周转时间和吞吐量

Answer: 平均无故障时间 MTBF 和故障率λ

Answer: 平均无故障时间 MTBE 和吞吐量


Question: What is the PRIMARY purpose of using redundant array of inexpensive disks (RAID) level zero?

Answer: To improve system performance.

Answer: To maximize usage of hard disk space.

Answer: To provide fault tolerance and protection against le server hard disk crashes.

Answer: To implement integrity.


Question: 在 windows 中，ping 命令的-n 选项表示 （ ） 。

Answer: ping 的次数

Answer: ping 的网络号

Answer: 用数字形式显示结果

Answer: 不要重复，只 ping 一次


Question: Most APIs will support a variety of different data formats or structures.However, the SOAP API will only support which one of the following data formats?

Answer: XML

Answer: XSLT

Answer: JSON

Answer: SAML


Question: 在操作系统中，以下哪种加密技术最适合用于保护用户数据的机密性？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希加密

Answer: 数字签名


Question: 正交幅度调制 16-qam 的数据速率是码元速率的（）倍。

Answer: 2

Answer: 4

Answer: 8

Answer: 16


Question: What is the process that RAID Level 0 uses as it creates one large disk by using several disks?

Answer: striping

Answer: mirroring

Answer: integrating

Answer: clustering


Question: The message sender digitally signs the message using __________.

Answer: Your own private key

Answer: Your own public key

Answer: Counterparty's private key

Answer: Counterparty's public key


Question: 下列选项中， （ ） 不属于 windows 的网络应用程序接口（api）。

Answer: winsock

Answer: nfs

Answer: rpc

Answer: netbios


Question: What language is used in the Simple Object Access Protocol (SOAP) application designprotocol?

Answer: Hypertext Markup Language (HTML)

Answer: 509

Answer: Extensible Markup Language (XML)

Answer: Hypertext Transfer Protocol (HTTP)


Question: 在PKI中，不属于CA的任务是（）。

Answer: 证书的颁发

Answer: 证书的审批

Answer: 证书的备份

Answer: 证书的加密


Question: (    )是指电子系统或设备在自己正常工作产生的电磁环境下，电子系统或设备之间的相互之间的相互不影响的电磁特性。

Answer: 电磁兼容性

Answer: 传导干扰

Answer: 电磁干扰

Answer: 辐射干扰


Question: 基于组件的开发方法的主要优点是：

Answer: 可以管理各种数据类型。

Answer: 实现对复杂关系进行建模。

Answer: 能够满足不断变化的环境需求。

Answer: 支持多种开发环境。


Question: Which of the following statements about Type 1 hypervisors is true?

Answer: The hardware vendor and software vendor are different.

Answer: The hardware vendor and software vendor are the same

Answer: The hardware vendor provides an open platform for software vendors.

Answer: The hardware vendor and software vendor should always be different for the sake of security.


Question: 在 xdsl 技术中，能提供上下行信道非对称传输的技术是（ ）。

Answer: hdsl

Answer: adsl

Answer: sdsl

Answer: isdn dsl


Question: What information does a buffer overflow intend to control?

Answer: Stack pointer

Answer: Frame pointer

Answer: Instruction pointer

Answer: Buffer pointer


Question: 在操作系统中，以下哪种安全模型主要用于实现访问控制，确保只有授权用户才能访问系统资源？

Answer: Bell-LaPadula模型

Answer: Biba完整性模型

Answer: Clark-Wilson完整性模型

Answer: Chinese Wall模型


Question: 在安全套接层（SSL）协议中，下列哪项不是其主要功能？

Answer: 数据加密

Answer: 身份验证

Answer: 数据压缩

Answer: 数据完整性保护


Question: In which state must a computer system be operated to handle  input or output instructions?

Answer: Inter-process communication

Answer: State detection

Answer: User mode

Answer: Management mode


Question: 恶意代码是指为达到恶意目的而专门设计的程序或代码。以下恶意代码中，属于脚本病毒的是 （  ）。

Answer: Worm. Sasser, f

Answer: Trojan. Huigezi. a

Answer: Harm. formatC. f

Answer: Script. Redlof


Question: 如果主存容量为 16m 字节，且按字节编址，表示该主存地址至少应需要 （ ） 位。

Answer: 16

Answer: 20

Answer: 24

Answer: 32


Question: Which of the following choices describe a condition when RAM and Secondary storage are used together?

Answer: Primary storage

Answer: Secondary storage

Answer: Virtual storage

Answer: Real storage


Question: The following are not Unix operating system log files ()

Answer: wtmp\/wtmpx

Answer: SecEvent.

Answer: utmp\/utmpx

Answer: Lastlog


Question: Because ordinary cable introduces a toxic hazard in the event of re, special cabling is required in a separate area provided for air circulation forheating, ventilation, and air-conditioning (sometimes referred to as HVAC) and typically provided in the space between the structural ceiling and adrop-down ceiling. This area is referred to as the:

Answer: smoke boundary area.

Answer: re detection area.

Answer: plenum area.

Answer: intergen area.


Question: Which of the following is NOT an application or utility to apply and enforce baselines on a system?

Answer: Chef

Answer: GitHub

Answer: Puppet

Answer: Active Directory


Question: 下列叙述中，与提高软件可移植性相关的是 （ ） 。

Answer: 选择时间效率高的算法

Answer: 尽可能减少注释

Answer: 选择空间效率高的算法

Answer: 尽量用高级语言编写系统中对效率要求不高的部分


Question: 计算机在一个指令周期的过程中，为从内存读取指令操作码，首先要将（ ）的内容送到地址总线上。

Answer: 指令寄存器（ir）

Answer: 通用寄存器（gr）

Answer: 程序计数器（pc）

Answer: 状态寄存器（psw）


Question: 算术表达式 a+(b-c)*d 的后缀式是 （ ） （+、-、*表示算术的加、减、乘运算，运算符的优先级和结合性遵循惯例）。

Answer: b c – d * a +

Answer: a b c – d * +

Answer: a b + c – d *

Answer: a b c d – * +


Question: Who was involved in developing the first public key algorithm?

Answer: Adi Shamir

Answer: Ross Anderson

Answer: Bruce Schneier

Answer: Martin Hellman


Question: 如何创建软链接

Answer: ln

Answer: ln -s <文件名>

Answer: ln -h <文件名>

Answer: ln -s <source> <destination>


Question: 97. What software development concept was pioneered by the  Defense Department in the1990s as an effort to bring together diverse product development  teams?

Answer: Integrated product team

Answer: Agile methodology

Answer: Scrum approach

Answer: User stories


Question: Which of the following is based on the fact that it is hard to  factor large numbers into two original prime numbers?

Answer: ECC

Answer: RSA

Answer: DES

Answer: Diffie-Hellman


Question: 在程序执行过程中，cache 与主存的地址映像由 （ ） 。

Answer: 硬件自动完成

Answer: 程序员调度

Answer: 操作系统管理

Answer: 程序员与操作系统协同完成


Question: Which of the following RAID levels is not used in practice and was quickly superseded by the more exible levels?

Answer: RAID Level 0

Answer: RAID Level 1

Answer: RAID Level 2

Answer: RAID Level 7


Question: What is the main function of the Amnesic Incognito Live System or TAILS device?

Answer: It allows the user to run a self-contained computer from a USB device.

Answer: It accesses systems with a credential that leaves no discernable tracks.

Answer: It encrypts data stored on any computer on a network.

Answer: It causes a system to suspend its security protocols.


Question: 在计算机系统中，构成虚拟存储器 （ ） 。

Answer: 只需要一定的硬件资源便可实现

Answer: 只需要一定的软件即可实现

Answer: 既需要软件也需要硬件方可实现

Answer: 既不需要软件也不需要硬件


Question: 某机器字长为 n，最高位是符号位，其定点整数的最大值为（ ）。

Answer: 2n-1

Answer: 2n-1-1

Answer: 2n

Answer: 2n-1


Question: Typically, when raised flooring is used as an air plenum, air isdirected through it.

Answer: Warm

Answer: Cold

Answer: Bleed

Answer: Exhaust


Question: 关于COTS(Commercial-Off-The-Shelf)商用现成品或技术，以下哪一项是正确的描述：

Answer: 可以采购到的具有开放式标准定义的接口的软件或硬件产品，可以节省成本和时间。

Answer: 供应商提供的现成的商业软件，用于可用性较高的工业控制环境

Answer: 供应商根据企业的具体情况，具体要求而定制开发的软件。

Answer: 美国国防采办项目要求必须使用国防部颁布的军用标准与军用规范。


Question: 设指令由取指、分析、执行 3 个子部件完成，每个子部件的工作周期均为△t ，采用常规标量单流水线处理机。若连续执行 10 条指令，则共需时间 （ ） △t 。

Answer: 8

Answer: 10

Answer: 12

Answer: 14


Question: Which of the following statements does not correctly describe  SOAP and Remote Procedure Calls?

Answer: SOAP was designed to overcome the compatibility and security issues  associated with Remote Procedure Calls.

Answer: Both SOAP and Remote Procedure Calls were created to enable  application-layer communication.

Answer: SOAP enables the use of Remote Procedure Calls for information exchange  between applications over the Internet.

Answer: HTTP was not designed to work with Remote Procedure Calls, but  SOAP


Question: 在程序的执行过程中，cache 与主存的地址映像由()

Answer: 专门的硬件自动完成

Answer: 程序员进行调度

Answer: 操作系统进行管理

Answer: 程序员和操作系统共同协调完成


Question: 若文件系统容许不同用户的文件可以具有相同的文件名，则操作系统应采用 （ ）来实现。

Answer: 索引表

Answer: 索引文件

Answer: 指针

Answer: 多级目录


Question: 关于证书权威机构（CA），以下哪个描述是错误的？

Answer: CA是负责签发和管理数字证书的可信第三方

Answer: 用户可以直接信任由顶级CA签发的证书

Answer: 所有浏览器都内置了信任的CA列表

Answer: CA只能签发服务器证书，不能签发客户端证书


Question: RAID 技术中，磁盘容量利用率最低的是（）。

Answer: RAID0

Answer: RAID1

Answer: RAID5

Answer: RAID6


Question: (    )是指一切与有用信号无关的、不希望有的或对电器及电子设备产生不良影响的电磁发射。

Answer: 电磁兼容性

Answer: 传导干扰

Answer: 电磁干扰

Answer: 辐射干扰


Question: 哪个组件是软件容器系统的关键部分

Answer: 客户端

Answer: 执行环境

Answer: 自动化控制器

Answer: 操作系统

Answer: 工作负载工具


Question: 设 16 位浮点数，其中阶符 1 位、阶码值 6 位、数符 1 位，尾数 8 位。若阶码用移码表示，尾数用补码表示，则该浮点数所能表示的数值范围是（ ） 。

Answer: -2^64 ~（1-2^{-8})2^64

Answer: -2^63~（1-2^{-8}）2^63

Answer: -(1-2^{-8})2^64 ~ (1-2^{-8})2^64

Answer: -(1-2^{-8})2^63 ~（1-2^{-8})2^63


Question: Which of the following is the default share that windows opens up ()

Answer: 1$

Answer: IPC$

Answer: CD$

Answer: 6!$


Question: What common element of a general‐purpose computing platform does an IoT not typically have?

Answer: Memory

Answer: Processor

Answer: External keyboards

Answer: Programs


Question: As cryptography continues to evolve, it gradually moves from an art to a science. Which of the following is not a stage in the development of cryptography ().

Answer: Classical code stage

Answer: Modern Cipher Stage

Answer: modern cryptographic stage

Answer: Contemporary Code Stages


Question: Which hardware vendor uses the term SPAN on switches?

Answer: HP

Answer: 3COM

Answer: Cisco

Answer: Juniper


Question: Which of the following is NOT a property of a one-way hash function?

Answer: It converts a message of a fixed length into a message digest of arbitrary length.

Answer: It is computationally infeasible to construct two different messages with the same digest.

Answer: It converts a message of arbitrary length into a message digest of a fixed length.

Answer: Given a digest value, it is computationally infeasible to find the corresponding message.


Question: Compared to RSA, which of the following is true of Elliptic Curve Cryptography (ECC)?

Answer: It has been mathematically proved to be more secure.

Answer: It has been mathematically proved to be less secure.

Answer: It is believed to require longer key for equivalent security.

Answer: It is believed to require shorter keys for equivalent security.


Question: What is the maximum key size for the RC5 algorithm?

Answer: 128 bits

Answer: 256 bits

Answer: 1024 bits

Answer: 2040 bits


Question: (2) A basic principle of modern cryptography is that all codes reside in ().

Answer: coded text

Answer: secret key

Answer: encryption algorithm

Answer: decryption algorithm


Question: 在 PCM 中，若对模拟信号的采样值使用 64 级量化，则至少需使用（ ）位二进制。

Answer: 4

Answer: 5

Answer: 6

Answer: 7


Question: Compared with hardware cryptography, software cryptography is generally

Answer: less expensive and slower.

Answer: more expensive and faster.

Answer: more expensive and slower.

Answer: less expensive and faster.


Question: Along with humidity, temperature is crucial to a data center for optimal operations and protection of equipment.Which of the following is the optimal temperature range as set by ASHRAE?

Answer: 69.8 to 86.0 degrees Fahrenheit (21 to 30 degrees Celsius)

Answer: 51.8 to 66.2 degrees Fahrenheit (11 to 19 degrees Celsius)

Answer: 64.4 to 80.6 degrees Fahrenheit (18 to 27 degrees Celsius)

Answer: 44.6 to 60.8 degrees Fahrenheit (7 to 16 degrees Celsius)


Question: 正在发展的第四代无线通信技术推出了多个标准，下面的选项中不属于 4g 标准的是（ ）。

Answer: lte

Answer: wimaxii

Answer: wcdma

Answer: umb


Question: Setting thermostat controls by measuring the temperature willresult in the highest energy costs.

Answer: Server inlet

Answer: Return air

Answer: Under-floor

Answer: External ambient


Question: 在指令系统的各种寻址方式中，获取操作数最快的方式是()

Answer: 直接寻址

Answer: 间接寻址

Answer: 立即寻址

Answer: 寄存器寻址


Question: （ ）存储方式常使用 NFS 协议为 Linux 操作系统提供文件共享服务。

Answer: DAS

Answer: NAS

Answer: IP-SAN

Answer: FC-SAN


Question: A prolonged high voltage is

Answer: spike

Answer: blackout

Answer: surge

Answer: fault


Question: 在 Linux 系统中，为某一个文件在另外一个位置建立文件连接的命令为（ ）。

Answer: ln

Answer: vi

Answer: locatek

Answer: cat


Question: MySQL 安装程序会给出三种选择， 用户可以根据自身的需要选择一种适合的安装方式，以下哪些是正确的？(    )

Answer: Typical（典型安装）

Answer: Compact(最小安装 )

Answer: Full( 全部安装 )

Answer: Custom(选择安装 )


Question: 2017年11月，在德国柏林召开的第55次ISO\\/IEC信息安全分技术委员会（SC27）会议上，我国专家组提出的（）算法一致通过成为国际标准。

Answer: SM2与SM3

Answer: SM3与SM4

Answer: SM4与SM9

Answer: SM9与SM2


Question: 安全内核的实质：

Answer: 用户

Answer: 进程

Answer: 完整性

Answer: 访问权限


Question: 若内存按字节编址，用存储容量为 32k x 8 比特的存储器芯片构成地址编号 a0000h 至 dffffh 的内存空间，则至少需要 （ ） 片。

Answer: 4

Answer: 6

Answer: 8

Answer: 10


Question: Which of the following is a widely used tool for code development, branching, and collaboration?

Answer: GitHub

Answer: Maestro

Answer: Orchestrator

Answer: Conductor


Question: 在审计数据中心的安全性时，信息系统审计师应查明是否存在电压调节器，以确保：

Answer: 防止硬件遭遇电涌。

Answer: 在主电源中断时保持数据完整性。

Answer: 在主电源中断时立即供电。

Answer: 防止硬件遭遇长期电源波动。


Question: 在windows系统的命令提示符界面下用来删除文件的命令是（）

Answer: replace

Answer: del

Answer: dir

Answer: cd


Question: 要使 Samba 服务器在网上邻居中出现的主机为 smbserver，其配置文件 smb.conf 中应包含（ ） 。

Answer: workgroup=smbserver

Answer: netbios name=smbserver

Answer: server string=smbserver

Answer: guest account=smbserver


Question: Tim’s development team is designing a new operating system. One  of the requirements of the new product is that critical memory segments need  to be categorized as nonexecutable, with the goal of reducing malicious code  from being able to execute instructions in privileged mode. The team also  wants to make sure that attackers will have a difficult time predicting  execution target addresses.Which of the following best describes the type of technology the team  should implement to increase the work effort of buffer overflow  attacks?

Answer: Address space layout randomization

Answer: Memory induction application

Answer: Input memory isolation

Answer: Read-only memory integrity checks


Question: Which RAID Level often implements a one-for-one disk to disk ratio?

Answer: RAID Level 1

Answer: RAID Level 0

Answer: RAID Level 2

Answer: RAID Level 5


Question: What is the maximum key size for the RC5 algorithm?

Answer: 128 bits

Answer: 256 bits

Answer: 1024 bits

Answer: 2040 bits


Question: What is an advantage of RSA over DSA?

Answer: It can provide digital signature and encryption functionality.

Answer: It uses fewer resources and encrypts faster because it uses symmetric  keys.

Answer: It is a block cipher rather than a stream cipher.

Answer: It employs a one-time encryption pad.


Question: Which of the following is the core of fiber optic cables made of?

Answer: PVC

Answer: Glass fibers

Answer: Kevlar

Answer: Teflon


Question: 以下关于类继承的说法中，错误的是（ ）。

Answer: 通过类继承，在程序中可以复用基类的代码

Answer: 在继承类中可以增加新代码

Answer: 在继承类中不能定义与被继承类（基类）中的方法同名的方法

Answer: 在继承类中可以覆盖被继承类（基类）中的方法


Question: 延长的高电压是？

Answer: 猛增

Answer: 停电

Answer: 浪涌

Answer: 故障


Question: Win+R打开运行后输入下列哪个选项可以打开注册表编辑器（）

Answer: mstsc

Answer: nslookup

Answer: regedit

Answer: regedit.msc


Question: What is the best description of a security kernel from a  security point of view?

Answer: Reference monitor

Answer: Resource manager

Answer: Memory mapper

Answer: Security perimeter


Question: A momentary high voltage is

Answer: spike

Answer: blackout

Answer: surge

Answer: fault


Question: What key size is used by the Clipper Chip?

Answer: 40 bits

Answer: 56 bits

Answer: 64 bits

Answer: 80 bits


Question: 用 linux ls –al 命令列出下面的文件列表，（ ）是块设备文件。

Answer: drwx------ 1 hel users 1024 sep 10 08:10 aaa

Answer: -rw------- 2 hel –s users 56 sep 09 11:05 bbb

Answer: brw------- 2 hel s users 56 sep 09 11:05 ccc

Answer: lrwx------ 1 hel users 2024 sep 12 08:12 ddd


Question:
有脚本 functest.sh 内容如下：
#!/bin/bash
func1() { echo -n 0; return 0; }
func2() { echo -n 1; return 1; }
func3() { echo -n 2; return 2; }
需补充一行以执行脚本中定义的function，使得执行该脚本的标准输出为 012

Answer: func1 && func2 || func3

Answer: if func1; then func2; else func3; fi

Answer: func1 || func2 && func3

Answer: func1 || func2 || func3


Question: SOA（面向服务的架构）是一种（）服务架构。

Answer: 细粒度、紧耦合

Answer: 粗粒度、松耦合

Answer: 粗粒度、紧耦合

Answer: 细粒度、松耦合


Question: The following is not a method of static analysis of code ().

Answer: memory scan

Answer: pattern matching

Answer: theorem proving

Answer: Model Detection


Question: The American Society of Heating, Refrigeration, and Air Conditioning Engineers(ASHRAE) guidelines for internal environmental conditions within a data center suggestthat a temperature setting of degrees (F) would be too low.

Answer: 93

Answer: 80

Answer: 72

Answer: 32


Question: The equation used to calculate the total number of symmetric keys (K) needed for a group of users (N) to communicate securely with each otheris given by which of the following?

Answer: K(N - 1)/ 2

Answer: N(K - 1)/ 2

Answer: K(N + 1)/ 2

Answer: N(N - 1)/ 2


Question: What is the bit length of the IDEA key?( ).

Answer: 56

Answer: 64

Answer: 96

Answer: 128


Question: 下面那个命令不可以用来查看文件内容

Answer: cat

Answer: ls

Answer: less

Answer: more


Question: 从技术角度，以下不是漏洞来源的是(    )

Answer: 软件或协议设计时候的瑕疵

Answer: 软件或协议实现中的弱点

Answer: 软件本身的瑕疵

Answer: 显示卡内存容量过低


Question: Docker通过Linux内核提供的namespace实现了资源隔离，以下哪一项namespace是实现主机名与域名的隔离

Answer: IPC

Answer: User

Answer: UTS

Answer: PID


Question: Compared to hardware encryption, software encryption is generally:

Answer: Less expensive and faster.

Answer: More expensive and faster.

Answer: Less expensive and slower.

Answer: More expensive and slower.


Question: The only difference between RAID 3 and RAID 4 is that level 3 is implemented at the byte level while level 4 is usually implemented at which of thefollowing?

Answer: Block level.

Answer: Bridge level.

Answer: Channel level.

Answer: Buffer level.


Question: 以下哪个不包含在证书中？(    )

Answer: 密钥采取的算法

Answer: 公钥及其参数

Answer: 私钥及其参数

Answer: 签发证书的CA名称


Question: 在mysql console下查看mysql版本的正确命令是

Answer: select version();

Answer: show version();

Answer: version();

Answer: get version();


Question: 下列哪一项准确地描述了可信计算基（TCB）

Answer: TCB只作用于固件（Firmware

Answer: TCB描述了一个系统提供的安全级别

Answer: TCB描述了一个系统内部的保护机制

Answer: TCB通过安全标签来表示数据的敏感性


Question: An Architecture where there are more than two execution domains or privilege levels is calle

Answer: Ring Architecture.

Answer: Ring Layering

Answer: Network Environment.

Answer: Security Models


Question: Filesystems form the basis of Linux. What are the common filesystems used in Linux?

Answer: ext3

Answer: ext2

Answer: hfs

Answer: reiserfs


Question: 在程序运行过程中，cpu 需要将指令从内存中取出并加以分析和执行。cpu 依据（ ）来区分在内存中以二进制编码形式存放的指令和数据。

Answer: 指令周期的不同阶段

Answer: 指令和数据的寻址方式

Answer: 指令操作码的译码结果

Answer: 指令和数据所在的存储单元


Question: ieee 802.16 工作组提出的无线接入系统空中接口标准是（ ）。

Answer: gprs

Answer: umb

Answer: lte

Answer: wimax


Question: 67 mod 119 的逆元是（）

Answer: 52

Answer: 67

Answer: 16

Answer: 19


Question: The following are not components of PKI ().

Answer: Body of the certificate

Answer: Applications and systems using certificates

Answer: Certificate Authority

Answer: AS


Question: Which of the following encryption methods is more suitable for hardware implementation?

Answer: Cipher block chaining

Answer: Stream encryption;

Answer: Electronic codebook

Answer: Block encryption


Question: 下列（）接口不适用于 SSD 磁盘。

Answer: SATA

Answer: IDE

Answer: PCle

Answer: M.2


Question: The computations involved in selecting keys and in enciphering data are complex, and are not practical for manual use. However, usingmathematical properties of modular arithmetic and a method known as "_________________," RSA is quite feasible for computer use.

Answer: computing in Galois fields

Answer: computing in Gladden fields

Answer: computing in Gallipoli fields

Answer: computing in Galbraith fields


Question: Which type of re extinguisher is MOST appropriate for a digital information processing facility?

Answer: Type A

Answer: Type B

Answer: Type C

Answer: Type D


Question: In November 2017, at the 55th ISO\\/IEC Information Security Sub-Technical Committee (SC27) meeting held in Berlin, Germany, the ( ) algorithm proposed by our expert group was unanimously adopted as an international standard.

Answer: SM2 and SM3

Answer: SM3 and SM4

Answer: SM4 vs. SM9

Answer: SM9 vs. SM2