Question: 在实施数据分级保护时，以下哪项措施最可能被用于保护高级别数据？

Answer: 简单的用户名和密码认证

Answer: 多因素认证

Answer: 不设任何访问限制

Answer: 仅允许内部网络访问


Question: 下面哪个程序负责 HDFS 数据存储。

Answer: NameNode

Answer: Jobtracker

Answer: Datanode

Answer: secondaryNameNode


Question: 以下哪种加密算法通常用于保护无线网络的安全？

Answer: RSA

Answer: AES

Answer: DES

Answer: SHA-256


Question: 在公钥加密系统中，用于解密邮件的密钥是？

Answer: 公钥

Answer: 私钥

Answer: 会话密钥

Answer: 哈希密钥


Question: 以下哪个过程是数字签名算法的主要功能？

Answer: 加密传输的数据

Answer: 隐藏发送者的信息

Answer: 确保数据的完整性和发送者的身份验证

Answer: 防止中间人攻击


Question: 某信息系统审计师在分析数据库管理系统（DBMS）的审计日志时发现，由于存在某个错误，有些交易仅被部分执行，并且没有进行回滚。这违反了下面哪项交易处理特性？

Answer: 一致性。

Answer: 隔离性。

Answer: 持久性。

Answer: 原子性。


Question: 以下关于代替密码的说法正确的是:

Answer: 明文根据密钥被不同的密文字母代替

Answer: 明文字母不变,仅仅是位置根据密钥发生改变

Answer: 明文和密钥的每个 bit 异或

Answer: 明文根据密钥作移位


Question: 以下哪项不是数据加密在保护个人数据隐私中的作用？

Answer: 防止未经授权的访问

Answer: 确保数据在传输过程中的完整性

Answer: 使数据在丢失或被盗后变得无用

Answer: 消除数据主体的隐私权


Question: 在密钥管理中，以下哪种做法最有可能导致密钥泄露？

Answer: 定期更换密钥

Answer: 使用强密码策略

Answer: 将密钥硬编码在应用程序中

Answer: 实施密钥分层管理


Question: 以下哪种加密技术最适合用于保护静态存储在云服务器上的企业数据？

Answer: AES-128

Answer: RSA-2048

Answer: SHA-256

Answer: Diffie-Hellman


Question: 以下哪种加密方法在处理大量数据时通常更有效率？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希函数

Answer: 数字签名


Question: The Secure Hash Algorithm (SHA-1) creates:

Answer: a xed length message digest from a xed length input message.

Answer: a variable length message digest from a variable length input message.

Answer: a xed length message digest from a variable length input message.

Answer: a variable length message digest from a xed length input message.


Question: What is the name for a substitution cipher that shifts the alphabet by 13 places?

Answer: Caesar cipher

Answer: Polyalphabetic cipher

Answer: ROT13 cipher

Answer: Transposition cipher


Question: 以下哪种加密算法最适合用于存储大量敏感数据，如用户密码？

Answer: AES-128

Answer: RSA-2048

Answer: SHA-256

Answer: bcrypt


Question: Which of the following is an important part of database design that ensures that attributes in a table depend only on the primary key?

Answer: Normalization

Answer: Assimilation

Answer: Reduction

Answer: Compaction


Question: 以下哪种数据备份策略可以确保在数据丢失后，可以恢复最近的交易记录？

Answer: 全量备份

Answer: 增量备份

Answer: 差异备份

Answer: 连续数据保护（CDP）


Question: PKI是一种标准的公钥密码的密钥管理平台，数字证书是PKI的基本组成部分。在PKI中，X.509数字证书的内容不包括（）。

Answer: 加密算法标识

Answer: 签名算法标识

Answer: 版本号

Answer: 主体的公开密钥信息


Question: 在数据备份策略中，以下哪种加密方式更适合保护大量数据的隐私？

Answer: 非对称加密

Answer: 对称加密

Answer: 哈希加密

Answer: 数字签名


Question: A DBS is a computer system that utilizes database technology. DBS is an aggregate that contains databases, computer hardware, software, and ( ).

Answer: systems analyst

Answer: programmer

Answer: Database Administrator

Answer: operator


Question: Which type of encryption is considered to be unbreakable if the stream is truly random and is as large as the plaintext and never reused in wholeor part?

Answer: One Time Pad (OTP)

Answer: One time Cryptopad (OTC)

Answer: Cryptanalysis

Answer: Pretty Good Privacy (PGP)


Question: 以下哪种数据分类与标签实践可以帮助企业确保合规性并降低数据泄露风险？

Answer: 将所有数据标记为敏感

Answer: 仅对客户数据进行分类

Answer: 根据敏感性和业务影响对数据进行分类

Answer: 不进行数据分类，依赖默认安全设置


Question: What is the goal of cryptanalysis?

Answer: To determine the strength of an algorithm

Answer: To increase the substitution functions in a cryptographic  algorithm

Answer: To decrease the transposition functions in a cryptographic  algorithm

Answer: To determine the permutations used


Question: Which of the following would best improve an organization' s system of limiting data use?

Answer: Implementing digital rights management technology.

Answer: Confirming implied consent for any secondary use of data.

Answer: Applying audit trails to resources to monitor company personnel.

Answer: Instituting a system of user authentication for company personnel.


Question: 在跨国数据传输中，使用哪种传输协议可以提供端到端的数据加密？

Answer: FTP

Answer: HTTP

Answer: HTTPS

Answer: SMTP


Question: The problem faced by DES encryption algorithms today is ( ).

Answer: The key is too short to be brute-force broken by modern computers.

Answer: Encryption algorithms are flawed and mathematically broken

Answer: Leaves a backdoor that may leak some information

Answer: Algorithms are too old and better alternatives are already available


Question: 在进行数据传输时，以下哪种加密技术应用最能确保数据的隐私权？

Answer: AES-128

Answer: DES

Answer: RSA（2048位）

Answer: MD5


Question: Which of the following is used to create and modify the structure of your tables and other objects in the database?

Answer: SQL Data Denition Language (DDL)

Answer: SQL Data Manipulation Language (DML)

Answer: SQL Data Relational Language (DRL)

Answer: SQL Data Identication Language (DIL)


Question: A process for can aid in protecting against data disclosure due tolost devices.

Answer: User punishment

Answer: Credential revocation

Answer: Law enforcement notification

Answer: Device tracking


Question: Which of the following was NOT designed to be a proprietary encryption algorithm?

Answer: RC2

Answer: RC4

Answer: Blowsh

Answer: Skipjack


Question: Which one of the following is a key agreement protocol used to enable two entities to agree and generate a session key (secret key used for onesession) over an insecure medium without any prior secrets or communications between the entities? The negotiated key will subsequently beused for message encryption usingSymmetric Cryptography.

Answer: RSA

Answer: PKI

Answer: Die_Hellmann

Answer: 3DES


Question: 以下哪种措施是有效的预防数据泄露的安全防护措施？

Answer: 定期进行数据备份，但不进行安全审计

Answer: 实施多因素认证，增强用户账户安全性

Answer: 允许所有员工访问所有敏感数据，以提高工作效率

Answer: 仅依赖防火墙，不部署其他安全软件


Question: How many bits make up the effective length of the DES key?

Answer: 56

Answer: 64

Answer: 32

Answer: 16


Question: 以下哪种数据加密技术最适合在移动设备上保护敏感用户信息？

Answer: AES-128

Answer: RSA-2048

Answer: SHA-256

Answer: DES


Question: 在加密通信中，以下哪种协议提供了端到端的加密保护？

Answer: SSL\\/TLS

Answer: IPsec

Answer: SSH

Answer: Signal Protocol


Question: Which of the following statements is used to view audit information when auditing is enabled in OraclE? ( )

Answer: select * from SYS.AUDIT$

Answer: select * from syslogins

Answer: select * from SYS.AUD$

Answer: AUDIT SESSION


Question: 在数据库安全事件响应中，以下哪项措施是首要执行的？

Answer: 分析事件原因

Answer: 立即通知所有用户

Answer: 隔离受影响的数据库

Answer: 启动备份恢复计划


Question: Which of the following attack vectors is new to the cloud environment and was nottypically found in on-premises, legacy environments?

Answer: Distributed denial of service (DDoS)

Answer: Guest escape

Answer: Internal threats

Answer: Inadvertent disclosure


Question: 以下哪种措施可以防止云环境中恶意用户的横向移动？

Answer: 数据加密

Answer: 访问控制策略

Answer: 安全审计日志

Answer: 灾难恢复计划


Question: 在云环境中，哪种安全机制主要用于防止未授权的网络访问并控制流量流？

Answer: 身份验证与授权

Answer: 安全组与防火墙

Answer: 数据加密

Answer: 入侵检测系统


Question: Security controls installed on a guest virtual machine operating system (VM OS) will notfunction when .

Answer: The user is accessing the VM remotely

Answer: The OS is not scanned for vulnerabilities

Answer: The OS is not subject to version control

Answer: The VM is not active while in storage


Question: 哪一层对于安全最重要并且被认为是云安全运行的基础

Answer: 元结构

Answer: 基础设施

Answer: 信息结构

Answer: 应用结构

Answer: 数据结构


Question: Which of the following is not one of the challenges created by hybrid cloud deployments?

Answer: increased routing complexity

Answer: additional costs for registering domain names

Answer: reduces the ability to run multiple cloud networks with overlapping IP ranges

Answer: complicates security because of the need to harmonize controls


Question: 以下哪种加密技术在云服务中用于保护数据的机密性？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希函数

Answer: 数字签名


Question: 以下哪种安全机制主要用于防止未经授权的云服务访问？

Answer: 数据加密技术

Answer: 访问控制机制

Answer: 安全隔离策略

Answer: 灾难恢复计划


Question: 在云环境中，以下哪种认证机制提供了最高级别的安全性？

Answer: 基于密码的认证

Answer: 基于令牌的认证

Answer: 基于生物特征的认证

Answer: 基于证书的认证


Question: Cryptographic keys for encrypted data stored in the cloud should be ________________ .

Answer: Not stored with the cloud provider.

Answer: Generated with redundancy

Answer: At least 128 bits long

Answer: Split into groups


Question: 在AWS中，哪种服务用于管理用户身份和访问权限？

Answer: Amazon S3

Answer: Amazon EC2

Answer: AWS Identity and Access Management (IAM)

Answer: Amazon VPC


Question: What are the two general delivery modes for the software as a service (SaaS) model?

Answer: Ranked and free

Answer: Hosted application management and software on demand

Answer: Intrinsic motivation complex and undulating perspective details

Answer: Framed and modular


Question: 在云存储环境中，以下哪种数据冗余策略可以确保数据的高可用性和容错性？

Answer: 单副本存储

Answer: 镜像冗余

Answer: 无冗余存储

Answer: 定期备份


Question: 在云平台审计日志中，以下哪项信息通常不包括在内？

Answer: 用户登录和登出时间

Answer: 数据修改的详细记录

Answer: 系统错误和警告信息

Answer: 用户个人隐私信息


Question: 在云环境中，以下哪种做法有助于确保数据在传输过程中的安全性？

Answer: 实施网络访问控制列表（ACLs）

Answer: 使用SSL\\/TLS协议

Answer: 定期进行安全审计

Answer: 使用数据恢复策略


Question: 在云环境中，响应安全事件的流程通常不包括以下哪一步？

Answer: 事件检测与分类

Answer: 事件调查与分析

Answer: 系统升级与维护

Answer: 恢复与事后分析


Question: 服务协议中通常包含哪些与用户数据相关的条款？

Answer: 数据所有权归属

Answer: 数据处理方式

Answer: 数据存储位置

Answer: 以上都是


Question: Designers making applications for the cloud have to take into consideration risks andoperational constraints that did not exist or were not as pronounced in the traditionalenvironment. Which of the following is an element cloud app designers may not be able touse as readily in the cloud environment as it was deployed in the traditional environment?

Answer: Cryptography

Answer: STRIDE testing

Answer: Field validation

Answer: Logging


Question: A Virtual Machine (VM) environment has ve guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review toaudit a user's access to data les?

Answer: Host VM monitor audit logs

Answer: Guest OS access controls

Answer: Host VM access controls

Answer: Guest OS audit logs


Question: Which of the following roles is responsible for overseeing customer relationships and the processing of financial transactions?

Answer: Cloud service manager

Answer: Cloud service deployment

Answer: Cloud service business manager

Answer: Cloud service operations manager


Question: 在云服务中，数字签名主要用于以下哪个目的？

Answer: 数据加密

Answer: 数据压缩

Answer: 身份验证和数据完整性验证

Answer: 数据备份


Question: 在云环境中，以下哪项是实施云安全监控的关键工具？

Answer: 虚拟专用网络（VPN）

Answer: 入侵检测系统（IDS）

Answer: 负载均衡器

Answer: 内容分发网络（CDN）


Question: 以下哪种技术可以防止云环境中数据的未授权访问？

Answer: 入侵检测系统（IDS）

Answer: 数据加密

Answer: 安全信息和事件管理（SIEM）

Answer: 网络访问控制（NAC）


Question: 在容器化技术中，以下哪种方法可以有效实现容器间的隔离？

Answer: 共享内核

Answer: 命名空间隔离

Answer: 文件系统挂载

Answer: 网络端口映射


Question: 在云环境中，哪种安全措施有助于确保即使数据丢失或被破坏，也能恢复关键信息？

Answer: 身份验证

Answer: 数据加密

Answer: 访问控制

Answer: 数据备份


Question: Managed cloud services exist because the service is less expensive for each customer thancreating the same services for themselves in a traditional environment. Using a managedservice allows the customer to realize significant cost savings through the reduction of.

Answer: Risk

Answer: Security controls

Answer: Personnel

Answer: Data


Question: 以下哪种策略是云服务提供商用来确保在灾难发生时能够恢复服务？

Answer: 数据加密

Answer: 多因素认证

Answer: 安全审计日志

Answer: 灾难恢复计划


Question: 以下哪种技术最常用于保护在云存储中传输的敏感数据？

Answer: 哈希函数

Answer: 访问控制列表（ACLs）

Answer: 端到端加密

Answer: 数据分类


Question: 以下哪种技术用于隔离云中的不同租户，防止他们之间的数据泄露？

Answer: 身份验证与授权

Answer: 数据加密机制

Answer: 安全网络隔离

Answer: 安全存储策略


Question: 在云安全事件响应中，以下哪种恢复策略最适用于数据丢失事件？

Answer: 从最近的备份中恢复数据

Answer: 重新部署应用程序

Answer: 更新安全策略

Answer: 增加网络带宽


Question: 云服务提供商的隐私政策中，通常会包含以下哪项内容？

Answer: 服务价格调整机制

Answer: 用户数据加密方法

Answer: 服务器的物理位置

Answer: 用户数据备份频率


Question: 在云安全事件监测中，以下哪项技术主要用于实时监控和分析云环境中的安全事件？

Answer: 数据加密

Answer: 入侵检测系统（IDS）

Answer: 数据备份

Answer: 访问控制列表（ACL）


Question: Countermeasures for protecting cloud operations against internal threats include all of the following except:

Answer: Extensive and comprehensive training programs, including initial, recurring, and refresher sessions

Answer: Skills and knowledge testing

Answer: Hardened perimeter devices

Answer: Aggressive background checks


Question: 以下哪种技术可以帮助云服务提供商及时获取并应对最新的威胁情报？

Answer: 安全组配置

Answer: 威胁情报平台

Answer: 数据加密

Answer: 应用防火墙


Question:
Which of the following roles is responsible for preparing  systems for the cloud, administering and monitoring services, and managing  inventory
and assets?

Answer: Cloud service business manager

Answer: Cloud service deployment manager

Answer: Cloud service operations manager

Answer: Cloud service manager


Question: Which of the following cloud deployment model is provisioned for open use by the general public?

Answer: Private Cloud

Answer: Community Cloud

Answer: Public Cloud

Answer: Hybrid Cloud


Question: 以下哪种安全机制主要用于确保云服务中的资源访问仅限于授权用户？

Answer: 加密技术

Answer: 访问控制机制

Answer: 安全审计

Answer: 灾难恢复与备份


Question: 以下哪种技术用于跟踪和记录云环境中的用户活动以进行审计？

Answer: 数据加密

Answer: 日志管理

Answer: 访问控制列表

Answer: 深度包检测


Question: 在容器运行时安全中，以下哪种技术用于防止容器逃逸？

Answer: SELinux

Answer: Dockerfile

Answer: Kubernetes YAML

Answer: Docker Compose


Question: 以下哪种措施是针对云服务提供商的基础设施，以确保在灾难发生时能够快速恢复服务？

Answer: 身份验证与授权

Answer: 数据加密

Answer: 安全隔离

Answer: 灾难恢复计划


Question: Which of the following is a risk associated with automated patching, especially in thecloud?

Answer: Patches may interfere with some tenants‘ production environments.

Answer: Patches don‘t work with software as a service (SaaS) service models.

Answer: Patches don‘t work with private cloud builds.

Answer: Vendors don‘t issue patches to cloud providers.


Question: Which of the following roles is responsible for creating cloud  components and the testing and validation of services?

Answer: Cloud auditor

Answer: Inter-cloud provider

Answer: Cloud service broker

Answer: Cloud service developer


Question: 在云环境中，以下哪种响应策略最适用于处理数据泄露事件？

Answer: 立即关闭受影响的云服务

Answer: 启动备份恢复计划

Answer: 隔离受影响的系统并进行详细调查

Answer: 增加防火墙规则限制外部访问


Question: What is the most important asset to protect in cloud BC/DR activities?

Answer: Intellectual property

Answer: Hardware at the cloud data center

Answer: Personnel

Answer: Data on portable media


Question: 在云环境中，为了防止虚拟机逃逸攻击，应该采取以下哪种措施？

Answer: 定期更新虚拟机镜像

Answer: 使用强密码策略

Answer: 实施硬件辅助虚拟化

Answer: 限制虚拟机之间的网络通信


Question: 在分布式系统中，哪种安全策略主要用于确保只有授权的用户或服务可以访问特定的资源或数据？

Answer: 身份验证

Answer: 访问控制

Answer: 数据加密

Answer: 故障检测与恢复


Question: 在容器化技术中，以下哪种方法可以有效防止容器逃逸攻击？

Answer: 使用强密码

Answer: 限制容器权限

Answer: 定期更新容器镜像

Answer: 实施网络隔离


Question: Bit-by-bit imaging of cloud data for forensic purposes is generally __________.

Answer: required by law

Answer: up to the cloud customer

Answer: extremely expensive

Answer: difficult or impossible


Question: 在云服务中，以下哪种安全协议用于保护电子邮件通信的安全性？

Answer: SSL\\/TLS

Answer: IPsec

Answer: S\\/MIME

Answer: SSH


Question: 以下哪种方法不是针对云应用的威胁指标（IoC）的典型应用？

Answer: 检测恶意IP地址

Answer: 监控异常API调用

Answer: 防止数据规范化

Answer: 识别恶意文件哈希


Question: When reviewing the BIA after a cloud migration, the organization should take into account new factors related to data breach impacts. One ofthese new factors is:

Answer: Many states have data breach notification laws.

Answer: Breaches can cause the loss of proprietary data.

Answer: Breaches can cause the loss of intellectual property.

Answer: Legal liability can't be transferred to the cloud provider.


Question: 在云原生环境中，以下哪种技术用于确保数据在传输过程中的安全性？

Answer: 服务发现

Answer: API网关

Answer: 加密技术

Answer: 负载均衡


Question: 在云环境中，哪种安全策略最直接地保护数据隐私，确保数据在传输过程中不被未经授权的第三方访问？

Answer: 数据加密

Answer: 多因素认证

Answer: 安全信息事件管理（SIEM）

Answer: 访问控制列表（ACL）


Question: 以下哪项是云服务提供商应提供的，以帮助客户应对安全事件？

Answer: 恶意软件分析工具

Answer: 全面的网络监控

Answer: 入侵检测系统（IDS）

Answer: 应急响应计划


Question: 在云环境中，以下哪种加密方法最适合保护数据在传输过程中的安全？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希加密

Answer: SSL\\/TLS加密


Question: 在云环境中，以下哪种加密技术最适合保护静态数据？

Answer: 传输层安全（TLS）

Answer: 数据加密标准（DES）

Answer: 高级加密标准（AES）

Answer: 安全散列算法（SHA）


Question: 在云服务模型中，以下哪一项提供了最高级别的控制和安全性？

Answer: 基础设施即服务（IaaS）

Answer: 平台即服务（PaaS）

Answer: 软件即服务（SaaS）

Answer: 容器即服务（CaaS）


Question: The different cloud service models have varying levels of responsibilities for functions and operations depending with the model's level of service.In which of the following models would the responsibility for patching lie predominantly with the cloud customer?

Answer: DaaS

Answer: SaaS

Answer: PaaS

Answer: IaaS


Question: 在云计算环境中，OAuth2.0协议主要用于实现哪个安全功能？

Answer: 加密算法的选择

Answer: 用户身份的验证

Answer: 访问控制决策

Answer: 第三方应用的授权访问


Question: 威胁情报在云安全监控中的主要作用是什么？

Answer: 提供实时数据备份

Answer: 增强用户身份验证

Answer: 预测和识别潜在的安全威胁

Answer: 自动化系统维护


Question: 在云安全风险评估中，以下哪项因素通常不被考虑？

Answer: 数据敏感性

Answer: 服务提供商的信誉

Answer: 用户的地理位置

Answer: 硬件故障率


Question: A company wants to absolutely minimize their involvement in administration of IT; whichcombination of cloud service model and deployment should it consider?

Answer: IaaS, private

Answer: PaaS, private

Answer: SaaS, private

Answer: SaaS, public


Question: In what cloud computing service model is the customer responsible for installing andmaintaining the operating system?

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: QaaS


Question: According to the Cloud Security Alliance, most modern APIs (application programming interfaces) use __________.

Answer: electricity

Answer: native architecture

Answer: REST (representational state transfer)

Answer: FTP (file transfer protocol)


Question: Which of the following is not a typical cloud deployment model, as defined by NIST and ISO?

Answer: hybrid

Answer: community

Answer: private

Answer: isolated


Question: 以下哪种技术可以确保云环境中数据在传输过程中的安全性？

Answer: 访问控制列表

Answer: 数字签名

Answer: SSL\\/TLS

Answer: 入侵检测系统


Question: 在云原生应用中，以下哪种威胁检测技术最适合实时监控和响应安全事件？

Answer: 基于签名的入侵检测系统（IDS）

Answer: 基于异常的入侵检测系统（IDS）

Answer: 基于日志分析的威胁检测

Answer: 基于网络流量的威胁检测


Question: 云服务提供商应遵循的安全标准中，以下哪项是确保数据传输安全的关键措施？

Answer: 数据备份与恢复

Answer: 访问控制与身份验证

Answer: 数据加密与解密

Answer: 安全审计与监控


Question: 在云服务架构中，以下哪种技术可以实现资源的隔离和高效利用？

Answer: 虚拟化技术

Answer: 分布式文件系统

Answer: 负载均衡器

Answer: 网络地址转换（NAT）


Question: 在云安全恢复计划中，以下哪项不是必须考虑的因素？

Answer: 数据的备份与恢复

Answer: 系统的快速重建

Answer: 用户的满意度

Answer: 合规性要求


Question: 在微服务架构中，以下哪种加密方法最适合保护数据在传输过程中的安全？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希加密

Answer: TLS\/SSL协议


Question: 在进行安全评估时，以下哪项不是漏洞扫描的主要目的？

Answer: 识别已知的安全漏洞

Answer: 评估系统的安全配置

Answer: 检测系统的性能瓶颈

Answer: 验证系统的合规性


Question: CCM：一家为“IT4Sure”的公司提供了一个基于云的IT管理解决方案。他们发展迅速，并采取了一些安全措施，但员工仍在使用个人移动设备存储和传输公司机密信息。因此，他们决定为员工提供公司的移动设备，并实施移动设备管理政策。两个月后，客户想审查公司的移动设备安全实践，在公司的移动设备管理政策中，客户应该寻找以下哪种基本的保护措施

Answer: 移动设备登记

Answer: 物理保护的要求

Answer: 移动设备软件版本和应用补丁的要求

Answer: 恶意软件防护

Answer: 以上都是


Question: 以下哪种加密技术适用于大量数据的加密，且在云存储中广泛使用？

Answer: RSA

Answer: AES

Answer: ECDSA

Answer: Diffie-Hellman


Question: Which of the following is an assurance program for cloud customers to review assessments of various cloud providers?

Answer: the CSA Cloud Controls Matrix (CCM)

Answer: the CSA Security, Trust, and Risk (STAR) Registry

Answer: the CSA Consensus Assessments Initiative Questionnaire (CAIQ)

Answer: the CSA Oblique Inference Program (OIP)


Question: 以下哪种加密技术通常用于保护在云中存储的敏感数据？

Answer: 哈希函数

Answer: 对称密钥加密

Answer: 公钥基础设施（PKI）

Answer: 消息认证码（MAC）


Question: Virtualizing resources into pools typically creates an environment where resiliency is decreased for __________.

Answer: any single virtual asset/machine

Answer: international customers

Answer: fiber networks

Answer: ISO-certified systems


Question: 业务影响分析（BIA）在云服务灾难恢复计划中的主要作用是什么？

Answer: 确定数据备份的频率

Answer: 评估灾难发生时的财务损失

Answer: 识别关键业务流程和恢复时间目标（RTO）

Answer: 选择合适的云服务提供商


Question: 在云环境中，以下哪项技术用于实时监控和分析网络流量，以便及时发现潜在的安全威胁？

Answer: 安全信息与事件管理（SIEM）

Answer: 入侵检测系统（IDS）

Answer: 数据丢失防护（DLP）

Answer: 虚拟私人网络（VPN）


Question: 安全审计在云安全模型中的作用是什么？

Answer: 提供数据加密服务

Answer: 验证用户身份

Answer: 记录和分析安全相关事件

Answer: 执行访问控制策略


Question: Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?

Answer: Create

Answer: Use

Answer: Share

Answer: Store


Question: 在云服务中，为了保护数据不被未授权访问，以下哪项措施是必不可少的？

Answer: 数据备份

Answer: 数据加密

Answer: 数据压缩

Answer: 数据去重


Question: 在云原生环境中，以下哪种认证机制最适合用于服务间的身份验证？

Answer: 基于IP地址的认证

Answer: 基于用户名和密码的认证

Answer: 基于OAuth 2.0的认证

Answer: 基于共享密钥的认证


Question: In which service model is the customer more likely to have the ability to architect the cloud environment for resiliency?

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: public


Question: 以下哪种技术用于确保只有授权的用户可以访问特定的云资源？

Answer: 加密技术

Answer: 权限管理

Answer: 身份验证机制

Answer: 数据备份


Question: Marthem 的公司正在考虑从供应商处购买基于网页的电子邮件服务，这是什么类型的云计算模型？

Answer: SaaS

Answer: IaaS

Answer: CaaS

Answer: PaaS


Question: 以下哪种安全措施可以防止云环境中未经授权的访问？

Answer: 密码学基础

Answer: 多因素认证

Answer: SSL\\/TLS 协议

Answer: 日志的读写访问权限控制


Question: 以下哪种做法可以防止云存储中的数据被未经授权的访问？

Answer: 定期进行数据备份

Answer: 实施访问控制列表（ACLs）

Answer: 使用简单的密码

Answer: 仅使用对称加密


Question: 在云环境中，以下哪种技术可以防止中间人攻击，确保数据在传输过程中的安全？

Answer: 对称加密

Answer: 非对称加密

Answer: 数字签名

Answer: SSL\\/TLS协议


Question: Using cloud storage is considered under most privacy frameworksand laws.

Answer: Illegal

Answer: Data collection

Answer: Opt-in

Answer: Processing


Question: 以下哪种技术可以防止云服务提供商内部的恶意员工访问敏感客户数据？

Answer: 最小权限原则

Answer: 数据脱敏

Answer: 安全信息和事件管理（SIEM）

Answer: 分布式拒绝服务（DDoS）防护


Question: What sort of interface does the cloud customer typically have with the management plane in an SaaS cloud model?

Answer: root-level access of the underlying hardware

Answer: an “admin” tab on the user panel

Answer: administrative access to the operating system the app runs on

Answer: physical access to the data center itself


Question: Which of the following tasks within a SaaS environment would NOT be something the cloud customer would be responsible for?

Answer: Authentication mechanism

Answer: Branding

Answer: Training

Answer: User access


Question: 安全协议（如SSL\\/TLS）在云服务中的主要作用是？

Answer: 实现用户身份认证

Answer: 加密数据存储

Answer: 确保数据传输的机密性和完整性

Answer: 管理访问控制列表


Question: 在选择异地容灾架构时，以下哪个因素最不重要？

Answer: 地理位置的距离

Answer: 网络连接的稳定性

Answer: 数据中心的硬件配置

Answer: 数据中心的运营成本


Question: 以下哪种安全协议最常用于确保云存储数据在传输过程中的安全性？

Answer: SSL\\/TLS

Answer: SSH

Answer: SFTP

Answer: AES


Question: Modern managed cloud service providers will often use secure keyboard/video/mouse(KVM) devices within their data centers. These devices are extremely expensive comparedto their non-secured counterparts. Which of the following is one of the reasons cloudservice providers do this?

Answer: They have plenty of revenue and can afford it.

Answer: They have invested heavily in the secure KVM market.

Answer: Cloud data centers need very few of these devices.

Answer: Managed cloud providers often manufacture their own devices as well.


Question: 在云安全监控中，以下哪项工具用于实时检测和响应安全事件？

Answer: 数据加密软件

Answer: 安全信息和事件管理（SIEM）系统

Answer: 虚拟化管理平台

Answer: 网络流量分析工具


Question: You are the privacy data officer for a large hospital and trauma center. You are called onto give your opinion of the hospital‘s plans to migrate all IT functions to a cloud service.Which of the following Uptime Institute tier-level ratings would you insist be included forany data center offered by potential providers?

Answer: 1

Answer: 2

Answer: 3

Answer: 4


Question: 在云服务提供商的合规框架中，以下哪项不是必须包含的要素？

Answer: 数据加密

Answer: 用户隐私保护

Answer: 无限制的数据备份

Answer: 定期的合规审计


Question: 在云服务中，哪种安全措施允许用户仅访问他们被授权的数据和资源？

Answer: 加密机制

Answer: 访问控制列表

Answer: 安全令牌

Answer: 数据冗余


Question: Which concept BEST describes the capability for a cloud environment to automatically scale a system or application, based on its currentresource demands?

Answer: On-demand self-service

Answer: Resource pooling

Answer: Measured service

Answer: Rapid elasticity


Question: 在遭受DDoS攻击后，以下哪种恢复策略是立即执行的？

Answer: 更新防火墙规则

Answer: 备份数据到离线存储

Answer: 启用备用服务器

Answer: 分析攻击源并追踪


Question: A security challenge that may make the cloud computing environment risky compared to the traditional IT environment.

Answer: the use of software

Answer: limited detailed visibility

Answer: users

Answer: physical security


Question: 在云环境中，以下哪种安全措施主要用于检测和防止潜在的入侵或恶意活动？

Answer: 数据加密

Answer: 访问控制列表

Answer: 安全审计日志分析

Answer: 灾备与恢复策略


Question: 在云原生环境中，以下哪项是进行合规性检查的关键步骤？

Answer: 定期进行安全审计

Answer: 持续监控容器日志

Answer: 频繁更新容器镜像

Answer: 限制容器的资源使用


Question: 以下哪种方法可以防止云中的数据在传输过程中被窃取？

Answer: SSL\\/TLS 加密

Answer: 数据加密

Answer: IPsec 隧道

Answer: 入侵防御系统（IPS）


Question: Which of the following would make a good provision to include in the service-levelagreement (SLA) between cloud customer and provider?

Answer: Location of the data center

Answer: Amount of data uploaded/downloaded during a pay period

Answer: Type of personnel security controls for network administrators

Answer: Physical security barriers on the perimeter of the data center campus


Question: 在云服务安全架构设计中，以下哪项活动有助于发现和记录安全事件？

Answer: 访问控制

Answer: 数据加密

Answer: 虚拟化安全

Answer: 安全审计


Question: 在微服务架构中，以下哪种身份认证机制最适合确保服务间通信的安全性？

Answer: 基于IP地址的访问控制

Answer: 基于角色的访问控制（RBAC）

Answer: 服务网格中的双向TLS（mTLS）

Answer: 单点登录（SSO）


Question: Which of the following is not a category of data security controls discussed in the CSA Cloud Security Guidance v4, Domain 11?

Answer: controlling which data goes into the cloud

Answer: protecting and managing data in the cloud

Answer: enforcing information lifecycle management

Answer: training users who access the cloud environment


Question: 在分布式系统的安全架构设计中，以下哪种机制主要用于确保不同组件之间的通信是安全的？

Answer: 身份验证机制

Answer: 数据加密技术

Answer: 分布式权限管理

Answer: 故障检测与恢复策略


Question: Cloud customers in a public cloud managed services environment can install all thefollowing types of firewalls except .

Answer: Provider operated

Answer: Host-based

Answer: Third party

Answer: Hardware


Question: 在云环境中，以下哪项不是恢复重建阶段的关键活动？

Answer: 数据恢复

Answer: 系统重建

Answer: 用户培训

Answer: 安全审计


Question: 在云环境中，以下哪项技术主要用于保护数据在传输过程中的安全？

Answer: 数据加密

Answer: 访问控制列表

Answer: 入侵检测系统

Answer: 数据备份策略


Question: 在云服务中，哪项法规主要关注个人数据的保护和隐私权？

Answer: 通用数据保护条例（GDPR）

Answer: 健康保险流通与责任法案（HIPAA）

Answer: 联邦信息安全管理法案（FISMA）

Answer: 萨班斯-奥克斯利法案（SOX）


Question: How is an object stored within an object storage system?

Answer: Key value

Answer: Database

Answer: LDAP

Answer: Tree structure


Question: 在云环境中，为了保护数据不被未授权访问，以下哪种身份认证机制最为关键？

Answer: 单因素认证

Answer: 双因素认证

Answer: 生物识别认证

Answer: 证书认证


Question: 在云原生环境中，以下哪种加密方式最适合保护数据在传输过程中的安全？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希加密

Answer: 传输层安全协议（TLS）


Question: 在进行云应用风险评估时，以下哪个步骤是首要的？

Answer: 实施安全策略

Answer: 识别潜在威胁

Answer: 部署安全监控工具

Answer: 执行合规性审计


Question: 在云服务中，数据分类的目的是什么？

Answer: 提高数据处理速度

Answer: 减少数据存储成本

Answer: 确保数据隐私和合规性

Answer: 增加数据的可访问性


Question: A cloud data encryption situation where the cloud customer retains control of theencryption keys and the cloud provider only processes and stores the data could beconsidered a .

Answer: Threat

Answer: Risk

Answer: Hybrid cloud deployment model

Answer: Case of infringing on the rights of the provider


Question:
Which of the following approaches would NOT be considered  sucient to meet the requirements of secure data destruction within a  cloud
environment?

Answer: Cryptographic erasure

Answer: Zeroing

Answer: Overwriting

Answer: Deletion


Question: Which of the following characteristics of cloud computing makes it unlikely that customers will be allowed to perform physical audits of cloud data centers?

Answer: virtualization

Answer: multitenancy

Answer: rapid elasticity

Answer: metered service


Question: Which of the following represents a minimum guaranteed  resource within a cloud environment for the cloud customer?

Answer: Reservation

Answer: Share

Answer: Limit

Answer: Provision


Question: 云服务提供商通常如何确保客户密钥的安全存储，以防止未经授权的访问？

Answer: 对称加密

Answer: 非对称加密

Answer: 密钥存储服务

Answer: 哈希函数


Question: 在制定云安全恢复计划时，以下哪项不是优先考虑的因素？

Answer: 数据的备份和恢复策略

Answer: 合规性要求

Answer: 云服务提供商的响应时间

Answer: 用户界面的友好性


Question: 在云服务中，数据分类的主要目的是什么？

Answer: 隐藏数据内容

Answer: 确定数据的敏感性和保护级别

Answer: 提高数据传输速度

Answer: 简化数据备份策略


Question: Migrating to a cloud environment will reduce an organization‘s dependence on.

Answer: Capital expenditures for IT

Answer: Operational expenditures for IT

Answer: Data-driven workflows

Answer: Customer satisfaction


Question: 下列哪项技术通常用于云存储服务中，以保护数据不被未授权访问？

Answer: 访问控制列表（ACL）

Answer: 数据备份

Answer: 数据压缩

Answer: 数据去重


Question: 在云环境中，以下哪种认证标准最适用于确保云服务的身份验证安全？

Answer: OAuth

Answer: SAML

Answer: Kerberos

Answer: X.509


Question: What is a form of cloud storage where data is stored in a logical storage area assigned tothe user but not necessarily physically attached or even geographically proximate to thecompute node the user is utilizing?

Answer: Volume storage

Answer: Databases

Answer: Content delivery network (CDN)

Answer: Object storage


Question: 在云环境中，以下哪种安全措施可以防止中间人攻击？

Answer: SSL\\/TLS证书验证

Answer: IP地址白名单

Answer: 加密技术

Answer: 安全组配置


Question: 在云安全服务中，以下哪项是威胁检测的关键组成部分？

Answer: 数据加密

Answer: 网络隔离

Answer: 日志分析

Answer: 用户认证


Question: 威胁情报在云安全事件响应流程中的作用是什么？

Answer: 用于云资源的动态分配

Answer: 提供关于已知威胁的信息以指导响应策略

Answer: 仅用于云服务的计费

Answer: 用于云环境的物理安全


Question: 以下哪种技术可以防止用户隐私数据在云存储中被未授权访问？

Answer: 数据混淆

Answer: 零知识证明

Answer: 数据分割

Answer: 端到端加密


Question: Being in a cloud environment, cloud customers lose a lot of insight and knowledge as to how their data is stored and their systems are deployed.Which concept from the ISO/IEC cloud standards relates to the necessity of the cloud provider to inform the cloud customer on these issues?

Answer: Disclosure

Answer: Transparency

Answer: Openness

Answer: Documentation


Question: 在云环境中，以下哪种机制用于验证用户身份并授权访问云资源？

Answer: 访问控制列表(ACL)

Answer: 安全组

Answer: 身份验证和授权服务

Answer: 端口扫描


Question: You are the security manager for a company that is considering cloud migration to aninfrastructure as a service (IaaS) environment. You are assisting your company‘s IT architectsin constructing the environment. Which of the following options do you recommend?

Answer: Unrestricted public access

Answer: Use of a Type I hypervisor

Answer: Use of a Type II hypervisor

Answer: Enhanced productivity without encryption


Question: 在云环境中，以下哪种策略最直接地关联于预防潜在的安全威胁？

Answer: 备份与恢复策略

Answer: 安全监控与预警

Answer: 故障切换与冗余

Answer: 合规性审计


Question: What is the business advantage of shifting from capital expenditure in an on-premisesenvironment to the operating expenditures of a cloud environment?

Answer: Reduces the overall cost

Answer: Reduces tax exposure

Answer: Reduces cash flow risks

Answer: Increases profit


Question: An organization must terminate their cloud vendor agreement immediately What is the most secure way to delete the encrypted data stored in thecloud?

Answer: Transfer the data to another location

Answer: Invoke the appropriate deletion clause in the cloud terms and conditions.

Answer: Obtain a destruction certificate from the cloud vendor

Answer: Destroy all encryption keys associated with the data


Question: Which of the following is not considered a major virtualization category, according to the Cloud Security Alliance?

Answer: compute

Answer: networking

Answer: user

Answer: storage


Question: 在云服务中，为了确保只有数据所有者能够解密其数据，以下哪种加密策略最有效？

Answer: 服务提供商持有密钥的对称加密

Answer: 用户持有公钥的非对称加密

Answer: 用户持有私钥的非对称加密

Answer: 使用零知识证明的加密


Question: 在云安全模型中，以下哪项技术用于实时监控和检测潜在的安全威胁？

Answer: 数据加密

Answer: 入侵检测系统（IDS）

Answer: 虚拟专用网络（VPN）

Answer: 多因素认证（MFA）


Question: __________ is essential to proper management of an immutable environment.

Answer: consistency in the image creation process

Answer: highly-paid engineers

Answer: the proper geophysical location

Answer: auditor approval


Question: 在云服务环境中，以下哪种身份认证方式被认为是最安全的？

Answer: 单一密码认证

Answer: 双因素认证

Answer: 生物识别认证

Answer: 基于角色的访问控制


Question: When the cloud provider manages cryptographic keys, the key storage and production environments are generally separate, reducing the possibility keys are exposed. However, keys might still be exposed by __________.

Answer: user error

Answer: misconfiguration

Answer: governmental request

Answer: failure of the physical infrastructure


Question: 以下哪项不是云计算安全中的主要威胁？

Answer: 数据泄露

Answer: 服务中断

Answer: 物理安全

Answer: 软件更新


Question: 以下哪项是中国的云计算安全评估标准？

Answer: ISO 27001

Answer: NIST CSF

Answer: GDPR 合规

Answer: CCSA 指南


Question: 在容器安全中，以下哪项措施不是为了防止容器逃逸攻击？

Answer: 使用只读文件系统

Answer: 限制容器的资源配额

Answer: 实施严格的网络策略

Answer: 定期进行容器镜像的漏洞扫描


Question: A company is considering a cloud migration to a platform as a service (PaaS) environment.Which of the following factors might make the company less likely to choose the cloudenvironment?

Answer: The company wants to reduce overhead costs.

Answer: The company operates proprietary software.

Answer: The company hopes to reduce energy costs related to operation of a data center.

Answer: The company is seeking to enhance its business continuity and disaster recovery


Question: Which of the following is not an example of an economic denial of service attack against a cloud environment, according to ENISA?

Answer: identity theft

Answer: cache poisoning

Answer: unexpected resource consumption

Answer: attacker consuming the customer’s metered service


Question: 根据《网络安全法》，云服务提供商在发生数据泄露时应当采取哪些措施？

Answer: 立即删除所有相关数据

Answer: 通知受影响的用户并报告给监管机构

Answer: 仅通知监管机构

Answer: 等待用户自行发现问题


Question: When using an IaaS solution, what is the capability provided to the customer?

Answer: To provision processing, storage, networks, and other fundamental computing resources when the consumer is able to deploy and runarbitrary software, which can include OSs and applications.

Answer: To provision processing, storage, networks, and other fundamental computing resources when the auditor is able to deploy and run arbitrarysoftware, which can include OSs and applications.

Answer: To provision processing, storage, networks, and other fundamental computing resources when the provider is able to deploy and runarbitrary software, which can include OSs and applications.

Answer: To provision processing, storage, networks, and other fundamental computing resources when the consumer is not able to deploy and runarbitrary software, which can include OSs and applications.


Question: 在云环境中，哪种行为分析方法可以识别出不寻常的登录模式，例如来自不同地理位置的频繁登录尝试？

Answer: 基于统计的异常检测

Answer: 基于签名的检测

Answer: 基于用户和实体行为分析（UEBA）

Answer: 基于蜜罐技术的欺骗防御


Question: 在云服务中，哪种策略用于确保只有授权用户可以访问特定的敏感数据？

Answer: 加密技术

Answer: 匿名化处理

Answer: 数据最小化

Answer: 权限控制


Question: If the organization operates in a cloud environment, security operations proceduresshould include guidance for all of the following audit or logging processes except.

Answer: Definition of security events and incidents

Answer: The brand or vendor of the cloud provider‘s audit or logging tool

Answer: Process for adding new audit or logging rules

Answer: Process for filtering out false positives by amending the rule set


Question: 在云环境中，哪种策略通常用于检测和阻止恶意软件？

Answer: DDoS攻击防护

Answer: 防火墙策略更新

Answer: 恶意软件行为分析

Answer: 数据加密


Question: 以下哪种技术用于确保云环境中数据在传输过程中的安全？

Answer: 身份验证

Answer: IPsec（Internet协议安全）

Answer: API密钥

Answer: 访问控制列表（ACL）


Question: 在云服务环境中，以下哪项技术主要用于确保用户身份的真实性？

Answer: 访问控制列表（ACL）

Answer: 多因素认证（MFA）

Answer: 数据加密技术

Answer: 安全协议（如SSL\\/TLS）


Question: 在云原生应用中，为了确保只有授权用户才能访问敏感数据，应该采用以下哪种安全机制？

Answer: 数据加密

Answer: 微服务隔离

Answer: 网络策略

Answer: 身份认证


Question: 在云服务中，以下哪种访问控制模型最适用于多租户环境？

Answer: 强制访问控制（MAC）

Answer: 自主访问控制（DAC）

Answer: 基于角色的访问控制（RBAC）

Answer: 基于属性的访问控制（ABAC）


Question: 在云服务中，哪种做法有助于防止数据泄露并符合隐私影响评估的要求？

Answer: 定期进行安全审计和风险评估

Answer: 仅依赖服务提供商的安全策略

Answer: 不进行任何额外的安全措施，信任云服务的安全性

Answer: 在所有数据上应用相同的加密策略，无论其敏感程度如何


Question: 以下哪种措施有助于防止云服务提供商内部的恶意活动？

Answer: 多因素认证

Answer: 数据加密

Answer: 系统审计日志

Answer: 防火墙配置


Question: 云安全检测技术中，以下哪项技术主要用于实时监控和分析网络流量以识别潜在的安全威胁？

Answer: 入侵检测系统（IDS）

Answer: 数据加密技术

Answer: 访问控制列表（ACL）

Answer: 虚拟专用网络（VPN）


Question: SaaS消费者可以使用哪些加密选项

Answer: 提供者管理和（有时）代理加密

Answer: 可用于卷存储、对象存储或PaaS的任何加密选项

Answer: 客户端/应用程序和文件/文件夹加密

Answer: 对象加密

Answer: 卷存储加密


Question: 在云环境中，哪种安全技术主要用于检测潜在的入侵和异常行为？

Answer: 入侵检测系统（IDS）

Answer: 数据加密

Answer: 访问控制列表（ACLs）

Answer: 负载均衡器


Question: 在云环境中，哪种安全控制能够整合来自多个来源的威胁情报，以提高对潜在攻击的可见性？

Answer: 自动化工具链

Answer: 威胁情报整合

Answer: 工作流定制

Answer: 安全策略执行


Question: 在云环境中，以下哪项是确保数据保护的关键措施？

Answer: 定期进行物理安全检查

Answer: 实施强有力的访问控制策略

Answer: 仅依赖云服务提供商的安全措施

Answer: 不定期更改数据存储位置


Question: Which aspect of cloud computing would make the use of a cloud the most attractive as a BCDR solution?

Answer: Interoperability

Answer: Resource pooling

Answer: Portability

Answer: Measured service


Question: 合规性审计在云应用安全中的作用是什么？

Answer: 确保云服务提供商遵守行业标准

Answer: 提高云服务的性能

Answer: 减少云服务的成本

Answer: 增加云服务的用户数量


Question: Users in your organization have been leveraging application programming interfaces(APIs) for enhancing their productivity in the cloud environment. To ensure thatyou are securing API access to the production environment, you should deploy and .

Answer: Secure Sockets Layer (SSL) and message-level cryptography

Answer: Transport Layer Security (TLS) and message-level cryptography

Answer: SSL and whole drive encryption

Answer: TLS and whole drive encryption


Question: 以下哪种安全机制可以追踪和检测云环境中异常的活动或访问模式？

Answer: 访问控制机制

Answer: 入侵检测系统（IDS）

Answer: 数据混淆技术

Answer: 资源调度算法


Question: 以下哪种安全措施可以防止攻击者通过未授权的API调用来获取云服务中的敏感数据？

Answer: 数据加密

Answer: 攻击模型识别

Answer: API访问权限控制

Answer: 内存安全扫描


Question: 在云服务安全架构中，以下哪项措施最有助于防止未授权的数据访问？

Answer: 使用静态数据加密

Answer: 定期进行安全审计

Answer: 实施严格的物理访问控制

Answer: 采用多因素认证


Question: The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threatsto organizations participating in cloud computing. According to the CSA, what aspect ofmanaged cloud services makes the threat of malicious insiders so alarming?

Answer: Scalability

Answer: Multitenancy

Answer: Metered service

Answer: Flexibility


Question: 在云环境中，哪种做法有助于在安全事件发生时快速恢复业务？

Answer: 定期备份数据

Answer: 实施细粒度的权限控制

Answer: 执行常规的漏洞扫描

Answer: 建立安全意识培训计划


Question: 以下哪项是微服务架构中实现身份验证的最佳实践？

Answer: 使用共享数据库进行用户认证

Answer: 在每个微服务中独立实现身份验证逻辑

Answer: 通过API网关集中处理身份验证

Answer: 依赖第三方服务进行身份验证


Question: 在云环境中，以下哪项措施最有助于防止未授权访问？

Answer: 数据加密

Answer: 身份认证

Answer: 访问控制

Answer: 威胁检测


Question: 在云服务模型中，以下哪项服务模型提供了最高级别的资源控制和管理？

Answer: 基础设施即服务（IaaS）

Answer: 平台即服务（PaaS）

Answer: 软件即服务（SaaS）

Answer: 容器即服务（CaaS）


Question: The cloud computing characteristic of elasticity promotes which aspect of the CIA triad?

Answer: Confidentiality

Answer: Integrity

Answer: Availability

Answer: None


Question: 在虚拟化环境中，哪种安全机制可以防止虚拟机之间的非法访问？

Answer: 虚拟机加密

Answer: 虚拟局域网隔离

Answer: 虚拟机监控器（VMM）的访问控制

Answer: 虚拟机备份


Question: 在云基础设施中，以下哪种加密方法主要用于保护存储在云中的数据？

Answer: 传输层安全（TLS）

Answer: 静态数据加密

Answer: 动态数据加密

Answer: 应用层加密


Question: 在云服务安全合规性管理中，以下哪项措施有助于应对数据泄露的风险？

Answer: 不进行数据分类和标记

Answer: 不实施数据访问审计

Answer: 实施数据丢失预防(DLP)策略

Answer: 不限制数据传输的加密


Question: 在云环境中，以下哪项技术主要用于检测和防御恶意软件的入侵？

Answer: 数据加密

Answer: 入侵检测系统（IDS）

Answer: 负载均衡

Answer: 虚拟专用网络（VPN）


Question: 在云计算基础架构安全体系中，以下哪种技术用于防止数据在存储时被未授权访问？

Answer: 数据备份

Answer: 数据加密技术

Answer: 数据压缩

Answer: 数据迁移


Question: 77. Mark is considering replacing his organization's customer  relationship management (CRM) solution with a new product that is available  in the cloud. This new solution is completely managed by the vendor, and  Mark's company will not have to write any code or manage any physical  resources. What type of cloud solution is Mark considering?

Answer: IaaS

Answer: CaaS

Answer: PaaS

Answer: SaaS


Question: 在云架构设计中，以下哪项原则有助于提高系统的容错性和可用性？

Answer: 数据备份

Answer: 负载均衡

Answer: 数据加密

Answer: 访问审计


Question: 在云应用中，哪种隐私保护机制允许数据在不被明文访问的情况下进行计算？

Answer: 数据加密

Answer: 同态加密

Answer: 访问控制列表

Answer: 零知识证明


Question: 在云环境中，多因素认证通常不包括以下哪一项？

Answer: 密码

Answer: 指纹识别

Answer: 短信验证码

Answer: 地理位置信息


Question: 在微服务架构中，以下哪种安全措施主要用于确保服务间通信的机密性和完整性？

Answer: 基于角色的访问控制（RBAC）

Answer: 服务网格（Service Mesh）

Answer: 数据加密

Answer: 网络隔离


Question: 以下哪种做法可以有效防止云环境中数据的未授权访问？

Answer: 仅依赖云服务提供商的默认安全设置

Answer: 实施细粒度的访问控制策略

Answer: 在所有数据上使用相同的加密密钥

Answer: 关闭所有安全更新以避免潜在的漏洞


Question: Which of the following poses a new risk in the cloud, not affecting the traditional,on-premise environment?

Answer: Fire

Answer: Legal seizure of another firm‘s assets

Answer: Mandatory privacy data breach notifications

Answer: Flooding


Question: 在云架构安全中，以下哪项措施是确保数据传输安全的关键？

Answer: 使用静态加密

Answer: 实施严格的访问控制

Answer: 采用SSL\/TLS加密协议

Answer: 定期进行安全审计


Question: 在云安全中，合规性框架的作用是什么？

Answer: 提供云计算服务的定价模型

Answer: 定义云服务的性能标准

Answer: 确保云服务提供商和用户遵守相关的法律、法规和标准

Answer: 限制云服务的创新和发展


Question: Which of the following terms is not used to describe cloud computing, in either the ISO or NIST definitions?

Answer: elastic

Answer: shared resources

Answer: frangible

Answer: self-service


Question: 在云服务协议中，以下哪项条款通常用于确保用户数据隐私和安全合规性？

Answer: 数据备份和恢复条款

Answer: 数据加密和传输安全条款

Answer: 服务水平协议（SLA）条款

Answer: 用户界面设计条款


Question: What type of data storage is often used in platform as a service (PaaS) arrangements?

Answer: Ephemeral

Answer: Database

Answer: Long-term

Answer: Nefarious


Question: 在处理云中的安全事件时，以下哪项是首要任务？

Answer: 隔离受影响的系统

Answer: 收集日志以进行事后分析

Answer: 通知所有受影响的用户

Answer: 修复漏洞并恢复服务


Question: 微服务架构中，哪种安全策略能够有效防止服务间的不安全通信？

Answer: 使用HTTP Basic认证

Answer: 服务间通信加密

Answer: 使用API网关进行访问控制

Answer: 定期进行安全审计


Question: Which of the following are risks associated with virtualization?

Answer: Loss of governance, snapshot and image security, and sprawl

Answer: Public awareness, snapshot and image availability, and sprawl

Answer: Increased cost, snapshot and image security, and sprawl

Answer: Loss of data


Question: 云服务提供商在制定合规与策略时，以下哪项不是必须考虑的因素？

Answer: 数据隐私法规

Answer: 服务级别协议（SLA）

Answer: 用户个人偏好

Answer: 行业标准和最佳实践


Question: You are the security manager for a small application development company. Yourcompany is considering the use of the cloud for software testing purposes. Which cloudservice model is most likely to suit your needs?

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: LaaS


Question: 在云应用中，以下哪种防御策略最适合防止跨站请求伪造（CSRF）攻击？

Answer: 使用双因素认证

Answer: 实施严格的输入验证

Answer: 使用随机生成的令牌进行会话管理

Answer: 定期更新软件和系统


Question: You are the IT director for an automotive parts supply distribution service; yourcompany wants to operate a production environment in the cloud. In reviewing provideroptions, management considers an offer from Cloud Services Corp., who has contractswith several cloud providers and data centers and has offered to tailor a package ofservices for your company‘s needs. In this case, Cloud Services Corp. is considered a.

Answer: Cloud provider

Answer: Cloud customer

Answer: Cloud reseller

Answer: Cloud database


Question: 在云原生环境中，容器安全主要关注哪些方面？

Answer: 容器镜像的来源和内容

Answer: 容器运行时的隔离和资源限制

Answer: 容器网络的安全配置

Answer: 以上都是


Question: To deploy a set of microservices to clients instead of building one monolithic application,it is best to use a(n) to coordinate client requests.

Answer: Extensible Markup Language (XML) gateway

Answer: Application programming interface (API) gateway

Answer: Web application firewall (WAF)

Answer: Database activity monitor (DAM)


Question: 一位信息系统审计师正在评估一个基于虚拟机 （VM） 的架构，该架构用于所有编程和测试环境。生产架构是一个三层物理架构。以下哪项测试是为确保生产中 Web 应用程序的可用性和机密性而进行的最重要的IT控制？

Answer: 服务器配置已适当增强。

Answer: 分配的物理资源可用。

Answer: 系统管理员接受培训以使用VM架构。

Answer: VM服务器包含在灾难恢复计划中。


Question: The Cloud Security Alliance (CSA) Security, Trust, and Assurance Registry (STAR)program has tiers.

Answer: Two

Answer: Three

Answer: Four

Answer: Eight


Question: You are the security manager for a software development firm. Your company isinterested in using a managed cloud service provider for hosting its testing environment.Management has decided that the company will deploy encryption, data loss preventionor data leak protection (DLP), and digital rights management (DRM) in the cloudenvironment for additional protection. When consulting with management, you explainthat these tools will most likely reduce .

Answer: External threats

Answer: Internal threats

Answer: Software vulnerabilities

Answer: Quality of service


Question: 在云原生环境中，持续监控的目的是什么？

Answer: 减少网络流量

Answer: 提高系统性能

Answer: 实时检测和响应安全威胁

Answer: 增加存储需求


Question: 在云服务提供商的合规审计中，以下哪项是评估云服务安全性的关键指标？

Answer: 云服务器的物理位置

Answer: 云服务的用户满意度

Answer: 云服务的数据加密强度

Answer: 云服务的用户数量


Question: Which of the following is a risk in the cloud environment that does not exist or is not asprevalent in the traditional environment?

Answer: Legal liability in multiple jurisdictions

Answer: Loss of productivity due to DDoS

Answer: Ability of users to gain access to their physical workplace

Answer: Fire


Question: 以下哪种措施是针对云服务中断或数据丢失的预防策略？

Answer: 数据加密

Answer: 安全组与防火墙

Answer: 定期备份与恢复策略

Answer: 网络访问控制列表


Question: 在云原生应用中，以下哪项是秘钥管理的关键作用？

Answer: 实现服务间的负载均衡

Answer: 确保数据的加密和解密

Answer: 提供服务发现功能

Answer: 管理容器的生命周期


Question: Which of the following entities publishes a cloud-centric set of risk-benefit recommendationsthat includes a “Top 8” list of security risks an organization might face during a cloudmigration, based on likelihood and impact?

Answer: National Institute of Standards and Technology (NIST)

Answer: International Organization for Standardization (ISO)

Answer: European Union Agency for Network and Information Security (ENISA)

Answer: Payment Card Industry (PCI)


Question: 以下哪种安全协议用于确保在云服务之间传输的数据的机密性和完整性？

Answer: SSH

Answer: TLS

Answer: FTP

Answer: SNMP


Question: All of the following are reasons overwriting is not a viable secure sanitization method fordata stored in the cloud except .

Answer: Overwriting an entire storage resource would affect other tenants‘ data

Answer: Regulators usually frown on the practice

Answer: Locating the specific storage locations of cloud data is almost impossible

Answer: Data is being backed constantly in the cloud; before you finished overwriting an


Question: How is an object stored within an object storage system?

Answer: Key value

Answer: Database

Answer: LDAP

Answer: Tree structure


Question: With the rapid emergence of cloud computing, very few regulations were in place that pertained to it specifically, and organizations often had toresort to using a collection of regulations that were not specific to cloud in order to drive audits and policies.Which standard from the ISO/IEC was designed specifically for cloud computing?

Answer: ISO/IEC 27001

Answer: ISO/IEC 19889

Answer: ISO/IEC 27001:2015

Answer: ISO/IEC 27018


Question: 在进行云原生应用的漏洞分析时，以下哪项技术通常被用于发现潜在的安全漏洞？

Answer: 静态应用安全测试（SAST）

Answer: 动态应用安全测试（DAST）

Answer: 交互式应用安全测试（IAST）

Answer: 以上都是


Question: 在云安全风险评估中，以下哪项不是评估的关键要素？

Answer: 资产价值评估

Answer: 威胁识别

Answer: 用户满意度调查

Answer: 脆弱性分析


Question: Cloud computing affects __________ phase(s) of the secure software development lifecycle (SSDLC).

Answer: many

Answer: one

Answer: the secure operations

Answer: all


Question: Using one cloud provider for your operational environment and another for your BC/DRbackup will also give you the additional benefit of .

Answer: Allowing any custom VM builds you use to be instantly ported to another environment

Answer: Avoiding vendor lock-in/lock-out

Answer: Increased performance

Answer: Lower cost


Question: 以下哪种技术可以帮助云服务提供商实时检测并响应潜在的入侵行为？

Answer: 威胁情报分析

Answer: 日志备份

Answer: 数据加密

Answer: 服务器硬件升级


Question: 在云环境中，哪种技术有助于快速响应安全事件并恢复服务？

Answer: 威胁模型

Answer: 日志分析

Answer: 自动化的应急响应

Answer: 安全信息和事件管理（SIEM）


Question: 下列哪一项是与云环境相关的主要合规性问题

Answer: 云服务成本降低可能违反计算机服务禁令

Answer: 应用程序即服务的出现可能违反软件许可协议

Answer: 云存储的分布式特性可能导致跨地理边界发送受监管的信息

Answer: 多租户模型允许云客户不公平地共享原本单独购买的硬件

Answer: 通过统一和集中管理平台提高透明度


Question: 在云原生环境中，以下哪种措施可以增强网络安全？

Answer: 完全开放所有端口

Answer: 使用默认的网络策略

Answer: 实施网络微分段

Answer: 依赖于主机的防火墙


Question: 在云环境中，哪种安全措施主要用于保护静态数据，即使云服务提供商的系统被攻破，数据仍然保持安全？

Answer: 身份验证与授权

Answer: 安全隔离

Answer: 数据加密

Answer: 合规性与审计


Question: 在云部署模型中，哪种模型最适合需要严格控制数据和基础设施的企业？

Answer: 公有云

Answer: 私有云

Answer: 混合云

Answer: 社区云


Question: 在云基础设施安全保护策略中，以下哪项措施主要用于防止未授权访问和数据泄露？

Answer: 网络流量分析

Answer: 数据备份与恢复

Answer: 访问控制列表（ACL）

Answer: 负载均衡


Question: 在微服务架构中，以下哪种技术用于实现服务之间的通信和安全控制？

Answer: 容器化技术

Answer: 服务网格

Answer: 持续集成\\/持续部署

Answer: 数据加密


Question: You are the IT security manager for a video game software development company. Inorder to test the functionality of online multiplayer game content, your testing teamwants to use a cloud service independent from the internal production environment. Youremind them that it is absolutely crucial that they perform beforeincluding any sample player or billing data.

Answer: Vulnerability scans

Answer: Intrusion detection

Answer: Masking

Answer: Malware scans


Question: 在云备份策略中，以下哪种方法能够确保数据在传输过程中的安全性？

Answer: 使用明文传输数据

Answer: 使用SSL\\/TLS加密传输数据

Answer: 仅在非高峰时段进行数据备份

Answer: 使用私有网络进行数据备份


Question: 以下哪种云安全措施主要用于防止未授权的内部人员访问敏感数据？

Answer: 防火墙

Answer: 数据加密

Answer: 权限管理

Answer: 入侵检测系统（IDS）


Question: 威胁建模在云安全中的主要作用是什么？

Answer: 提供云服务的负载均衡

Answer: 增强云存储的数据加密

Answer: 识别和评估潜在的安全威胁

Answer: 优化云资源的分配


Question: Which of the following actions will NOT make data part of the  "create" phase of the cloud data lifecycle?

Answer: Modifying metadata

Answer: Importing data

Answer: Modifying data

Answer: Constructing new data


Question: 在云灾难恢复策略中，以下哪种数据备份方法最适用于确保数据的快速恢复？

Answer: 仅使用本地备份

Answer: 使用云端快照备份

Answer: 仅依赖于磁带备份

Answer: 使用定期手动备份


Question: 在制定云灾难恢复计划时，以下哪项措施最有助于确保业务的连续性？

Answer: 定期进行数据备份

Answer: 实施严格的访问控制

Answer: 建立跨区域的数据复制

Answer: 频繁进行系统升级


Question: 在处理云安全事件时，哪个步骤是确保安全工具协同工作并执行适当响应的关键？

Answer: 威胁情报共享

Answer: 安全工具集成

Answer: 事件调查

Answer: 权限管理


Question: The primary tool used to provision identities across multiple cloud platforms/services/systems.

Answer: digital rights management (DRM)

Answer: data loss prevention (DLP)

Answer: federation

Answer: virtualization


Question: 在云环境中，访问控制的实现通常不包括哪个阶段？

Answer: 身份验证

Answer: 授权

Answer: 会话管理

Answer: 数据加密


Question: Why is the term (ISC) 2 Cloud Secure Data Lifecycle actually somewhat inaccurate?

Answer: The term is not used only by (ISC)2.

Answer: Not all phases are secure.

Answer: Not all phases take place in the cloud.

Answer: It‘s not actually a cycle.


Question: 在云环境中，以下哪种认证方式结合了密码和物理令牌的使用？

Answer: 单一密码认证

Answer: 双因素认证

Answer: 三因素认证

Answer: 生物识别认证


Question: If the cloud is used for BC/DR purposes, the loss of could gravelyaffect your organization‘s RT

Answer: Any cloud administrator

Answer: A specific VM

Answer: Your policy and contract documentation

Answer: ISP connectivity


Question: The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threatsto organizations participating in cloud computing. According to the CSA, in the event of adata breach, a cloud customer will likely need to comply with all the following data breachnotification requirements except .

Answer: Multiple state laws

Answer: Contractual notification requirements

Answer: All standards-based notification schemes

Answer: Any applicable federal regulations


Question: 以下哪种做法是遵循云安全最佳实践，以确保数据在传输过程中的加密？

Answer: 使用SSL\/TLS进行通信

Answer: 定期进行安全审计和日志审查

Answer: 遵守ISO 27001合规性框架

Answer: 实施多因素身份验证和授权机制


Question: 在云安全事件监控中，以下哪种技术常用于实时检测异常行为？

Answer: 机器学习

Answer: 数据压缩

Answer: 负载均衡

Answer: 数据迁移


Question: You are the data manager for a retail company; you anticipate a much higher volumeof sales activity in the final quarter of each calendar year than the other quarters. Inorder to handle these increased transactions, and to accommodate the temporary salespersonnel you will hire for only that time period, you consider augmenting your internal,on-premises production environment with a cloud capability for a specific duration, andwill return to operating fully on-premises after the period of increased activity. Whichdeployment model best describes this type of arrangement?

Answer: Private cloud

Answer: Community cloud

Answer: Public cloud

Answer: Hybrid cloud


Question: The Cloud Security Alliance Cloud Controls Matrix (CSA CCM) lists security controlsfrom all the following laws except .

Answer: Health Information Portability and Accountability Act (HIPAA)

Answer: Family Education Rights and Privacy Act (FERPA)

Answer: Personal Information Protection and Electronic Documents Act (PIPEDA)

Answer: Digital Millennium Copyright Act (DMCA)


Question: 根据法规要求，以下哪种情况下的网络渗透测试需要遵守额外的合规条件？

Answer: 针对公共云服务的渗透测试

Answer: 针对内部私有网络的渗透测试

Answer: 针对已知漏洞的模拟攻击测试

Answer: 针对自家产品的安全测试


Question: 云服务协议中，以下哪项不是用户通常需要遵守的条款？

Answer: 数据备份与恢复

Answer: 服务水平协议（SLA）

Answer: 数据加密要求

Answer: 数据所有权转移


Question: 云服务提供商在进行风险评估时，以下哪项不是评估的关键因素？

Answer: 服务提供商的财务稳定性

Answer: 物理安全措施

Answer: 客户的数据分类

Answer: 服务水平协议（SLA）的合规性


Question: 在云环境中，审计日志的主要作用是什么？

Answer: 提高云服务的运行速度

Answer: 记录和分析用户行为，以确保安全性和合规性

Answer: 增加云服务的存储成本

Answer: 作为云服务营销的工具


Question: Alice runs a small software development company, and wants to use a cloud environment to install, test, and modify applications across a number of operating systems (OSs). Which cloud service model is probably best for her purposes?

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: Grimbo


Question: What type of segregation and separation of resources is needed within a cloud environment for multitenancy purposes versus a traditional datacenter model?

Answer: Virtual

Answer: Security

Answer: Physical

Answer: Logical


Question: From a legal perspective, what is the most important rst step  after an eDiscovery order has been received by the cloud provider?

Answer: Notication

Answer: Key identication

Answer: Data collection

Answer: Virtual image snapshots


Question: 在云环境中，哪种技术可以帮助分析网络流量模式，以识别潜在的恶意活动？

Answer: 恶意软件防护

Answer: 网络流量分析

Answer: 日志管理

Answer: 安全事件响应


Question: 在云安全模型中，以下哪项技术主要用于保护数据的机密性和完整性？

Answer: 虚拟专用网络（VPN）

Answer: 数据备份和恢复

Answer: 加密技术

Answer: 入侵检测系统（IDS）


Question: The physical layout of a cloud data center campus should include redundancies of all thefollowing except .

Answer: Physical perimeter security controls (fences, lights, walls, etc.)

Answer: The administration/support staff building

Answer: Electrical utility lines

Answer: Communications connectivity lines


Question: 在微服务架构中，如何确保不同服务之间的通信安全，防止数据在传输过程中被窃取或篡改？

Answer: 服务身份验证

Answer: API网关安全

Answer: 微服务间的通信安全

Answer: 容器安全


Question: 云安全策略中，以下哪项措施不是为了防止数据泄露？

Answer: 实施严格的访问控制

Answer: 定期进行安全审计

Answer: 使用防火墙限制网络流量

Answer: 定期进行数据备份


Question: You are the security manager for a small application development company. Yourcompany is considering the use of the cloud for software testing purposes.Which of the following traits of cloud functionality is probably the most crucial in termsof deciding which cloud provider you will choose?

Answer: Portability

Answer: Interoperability

Answer: Resiliency

Answer: Governance


Question: When targeting a cloud customer, a court grants an order allowing a law enforcemententity to seize .

Answer: Electronic data

Answer: Hardware

Answer: Electronic data and the hardware on which it resides

Answer: Only data extracted from hardware


Question: What is the biggest benefit to leasing space in a data center versus building or maintain your own?

Answer: Certification

Answer: Costs

Answer: Regulation

Answer: Control


Question: In which cloud service model is the customer required to maintain the OS?

Answer: Iaas

Answer: CaaS

Answer: PaaS

Answer: SaaS


Question:
Joe works as an IT administrator in an organization and has  recently set up a cloud computing service for the organization. To implement  this
service, he reached out to a telecom company for providing Internet  connectivity and transport services between the organization and the  cloud
service provider.
In the NIST cloud deployment reference architecture, under which category  does the telecom company fall in the above scenario?

Answer: Cloud consumer

Answer: Cloud broker

Answer: Cloud auditor

Answer: Cloud carrier


Question: 在云环境中，以下哪种防火墙配置策略能够提供最高级别的网络隔离？

Answer: 基于子网的访问控制

Answer: 基于虚拟局域网（VLAN）的隔离

Answer: 基于安全组的访问控制

Answer: 基于网络虚拟化的隔离


Question: 在云环境中，以下哪种风险管理策略专注于识别和减轻潜在威胁？

Answer: 灾难恢复计划

Answer: 威胁建模和漏洞评估

Answer: 多因素认证

Answer: 资源池化


Question: 在云服务中，使用加密技术的主要目的是什么？

Answer: 提高数据传输速度

Answer: 减少数据存储空间

Answer: 保护数据隐私和完整性

Answer: 增加数据备份频率


Question: 在云安全服务架构中，访问控制通常不包括以下哪项功能？

Answer: 基于角色的访问控制

Answer: 强制访问控制

Answer: 自主访问控制

Answer: 数据备份与恢复


Question: 以下哪项不是云安全防御策略的一部分？

Answer: 使用虚拟专用网络（VPN）进行安全通信

Answer: 定期进行安全审计和风险评估

Answer: 完全依赖于云服务提供商的安全措施

Answer: 实施多因素认证（MFA）以增强访问控制


Question: 在云存储服务中，以下哪种隐私保护技术用于防止数据被未授权访问？

Answer: 数据加密

Answer: 数据压缩

Answer: 数据去重

Answer: 数据迁移


Question: A main objective for an organization when utilizing cloud services is to avoid vendor lock-in so as to ensure flexibility and maintain independence.Which core concept of cloud computing is most related to vendor lock-in?

Answer: Scalability

Answer: Interoperability

Answer: Portability

Answer: Reversibility


Question: 在云环境中，哪种操作对于确保数据安全和业务连续性不是必需的？

Answer: 定期更新和修补云服务

Answer: 配置自动备份计划

Answer: 建立详细的恢复时间目标（RTO）和恢复点目标（RPO）

Answer: 仅在本地存储敏感数据


Question: 在云备份中，哪种技术可以防止因单点故障导致的数据丢失？

Answer: 数据冗余

Answer: 分片存储

Answer: 哈希校验

Answer: 网络拓扑优化


Question:
Question: SCENARIO

WebTracker Limited is a cloud-based online marketing service located in  London. Last year, WebTracker migrated its IT infrastructure to the cloud  provider AmaZure, which provides SQL Databases and Artificial Intelligence  services to WebTracker. The roles and responsibilities between the two  companies have been formalized in a standard contract, which includes  allocating the role of data controller to WebTracker.

The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of  AmaZure''s privacy controls, and he recently decided to hire you as an  independent auditor. The scope of the engagement is limited only to the  marketing services provided by WebTracker, you will not be evaluating any  internal data processing activity, such as HR or Payroll.

This ad-hoc audit was triggered due to a future partnership between  WebTracker and SmartHome -- a partnership that will not require any data  sharing. SmartHome is based in the USA, and most recently has dedicated  substantial resources to developing smart refrigerators that can suggest the  recommended daily calorie intake based on DNA information. This and other  personal data is collected by WebTracker.

To get an idea of the scope of work involved, you have decided to start  reviewing the company''s documentation and interviewing key staff to  understand potential privacy risks.

The results of this initial work include the following notes:

There are several typos in the current privacy notice of WebTracker, and  you were not able to find the privacy notice for SmartHome.
You were unable to identify all the sub-processors working for SmartHome.  No subcontractor is indicated in the cloud agreement with AmaZure, which is  responsible for the support and maintenance of the cloud  infrastructure.
There are data flows representing personal data being collected from the  internal employees of WebTracker, including an interface from the HR system.  Part of the DNA data collected by WebTracker was from employees, as this was  a prototype approved by the CEO of WebTracker.
All the WebTracker and SmartHome customers are based in USA and  Canada.

Which of the following issues is most likely to require an investigation by  the Chief Privacy Officer (CPO) of WebTracker?
=======

Answer: Data flows use encryption for data at rest, as defined by the IT  manager.

Answer: AmaZure sends newsletter to WebTracker customers, as approved by the  Marketing Manager.

Answer: Employees'' personal data are being stored in a cloud HR system, as  approved by the HR Manager.

Answer: File Integrity Monitoring is being deployed in SQL servers, as indicated  by the IT Architect Manager.


Question: 以下哪种技术可以用于保护用户身份信息，同时在云服务中实现匿名交易或通信？

Answer: 对称加密

Answer: 零知识证明

Answer: SSL\\/TLS协议

Answer: 数字证书


Question: 在云数据备份策略中，以下哪项措施对于防止数据丢失最为关键？

Answer: 定期进行数据压缩

Answer: 使用RAID技术

Answer: 实施异地备份

Answer: 限制备份数据的访问权限


Question: 在设计云服务的安全架构时，以下哪种加密方法最适合保护数据在传输过程中的安全？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希加密

Answer: 端到端加密


Question: 在容器隔离中，哪个功能主要负责确保一个容器的资源使用不会影响到其他容器？

Answer: 命名空间隔离

Answer: Cgroups（控制组）

Answer: 安全上下文

Answer: 网络策略


Question: 在云环境中，访问控制列表(ACL)通常用于实现什么功能？

Answer: 加密存储在云中的敏感数据

Answer: 验证用户身份以允许访问

Answer: 定义网络流量的允许和拒绝规则

Answer: 根据用户角色分配服务使用权限


Question: 在云服务安全审计中，以下哪项不是审计日志的主要用途？

Answer: 检测异常行为

Answer: 记录用户活动

Answer: 优化系统性能

Answer: 支持合规性检查


Question: 在云存储中，哪种加密技术允许数据所有者保留对加密密钥的控制，从而增强数据隐私？

Answer: 对称加密

Answer: 非对称加密

Answer: 客户持有密钥（CHKM）

Answer: 哈希函数


Question:
According to the Cloud Security Alliance (CSA) Security Guidance v4, what’s the most

important security consideration for any cloud project?

Answer: knowing who is responsible for what

Answer: personal privacy

Answer: physical protection of the underlying architecture

Answer: preventing electronic surveillance


Question: According to the NIST Cloud Computing Reference Architecture, which of the followingis most likely a cloud carrier?

Answer: Amazon Web Services

Answer: Netflix

Answer: Verizon

Answer: Nessus


Question: 出现以下哪种情况时，信息系统审计师最需要对第三方托管的云计算环境进行审查？

Answer: 组织无权评估供应商站点中的控制。

Answer: 服务水平协议未规定出现安全漏洞时供应商应承担的责任。

Answer: 组织和供应商所在国家/地区的法律和法规不同。

Answer: 组织使用的旧版浏览器存在某些类型的安全风险。


Question: 以下哪项措施最有助于保护云中的数据免受未授权访问？

Answer: 使用强密码策略

Answer: 实施数据加密

Answer: 定期更新软件

Answer: 限制物理访问


Question: You are the IT director for a small contracting firm. Your company is consideringmigrating to a cloud production environment. Which service model would best fit yourneeds if you wanted an option that reduced the chance of vendor lock-in but also did notrequire the highest degree of administration by your own personnel?

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: TanstaafL


Question: Which of the following aspects of cloud computing can enhance the customer‘s businesscontinuity and disaster recovery (BC/DR) efforts?

Answer: Geographical separation of data centers

Answer: Hypervisor security

Answer: Pooled resources

Answer: Multitenancy


Question: 在云原生应用中，以下哪种安全协议最适合用于保护服务间的通信？

Answer: SSH（Secure Shell）

Answer: IPsec（Internet Protocol Security）

Answer: TLS（Transport Layer Security）

Answer: Kerberos


Question: 在云架构中，以下哪项防火墙技术最适合用于保护虚拟机间的通信安全？

Answer: 网络地址转换（NAT）防火墙

Answer: 下一代防火墙（NGFW）

Answer: 虚拟私有网络（VPN）

Answer: 虚拟防火墙（VFW）


Question: 在制定云应用安全策略时，以下哪项不是必须考虑的因素？

Answer: 数据分类和敏感性

Answer: 用户身份验证和授权

Answer: 云服务提供商的地理位置

Answer: 数据备份和恢复计划


Question: A cloud provider offering database services is most likely utilizing the __________ service model.

Answer: IaaS

Answer: PaaS

Answer: SaaS

Answer: Las


Question: Having a reservation in a cloud environment can ensure operations continue in the event of high utilization across the cloud.Which of the following would NOT be a capability covered by reservations?

Answer: Performing business operations

Answer: Starting virtual machines

Answer: Running applications

Answer: Auto-scaling


Question: 在云原生安全中，哪种策略用于收集和分析应用程序及基础设施的日志，以进行合规性和安全审计？

Answer: 网络流量分析

Answer: 日志管理与审计

Answer: 威胁情报

Answer: 应用防火墙


Question: 云服务提供商在实施合规性实践时，以下哪项措施是不必要的？

Answer: 定期进行安全审计

Answer: 实施数据加密

Answer: 提供用户培训

Answer: 限制物理访问


Question: 以下哪种技术用于确保云存储中敏感数据的隐私，即使数据在传输过程中被截获？

Answer: 身份验证与授权

Answer: 数据加密技术

Answer: 安全隔离与多租户

Answer: 合规性与审计


Question: 以下哪种操作是隔离与恢复过程中的关键步骤？

Answer: 立即关闭所有系统以防止进一步损害

Answer: 确定受影响的资源并隔离它们

Answer: 更新所有安全补丁以防止未来攻击

Answer: 公开事件以警告其他用户


Question: Of the following options, which is a reason cloud data center audits are often less easy toverify than traditional audits?

Answer: Cryptography is present.

Answer: Auditors don‘t like the cloud.

Answer: Cloud equipment is resistant to audit.

Answer: They often rely on data the provider chooses to disclose.


Question: 以下哪种技术可以帮助安全团队实时监控云环境中的潜在威胁？

Answer: 安全工具集成

Answer: 事件响应

Answer: 工作流自动化

Answer: 实时监控


Question: __________ is a cloud business continuity/disaster recovery (BCDR) feature that is not easily accomplished in a traditional (on-prem) IT environment.

Answer: regular backups

Answer: deploying virtual machines across multiple, distinct geographic availability zones

Answer: versioning of baseline operating system (OS) builds

Answer: personnel training


Question: 以下哪种防火墙配置有助于防止钓鱼攻击？

Answer: 阻止所有外部电子邮件进入公司网络

Answer: 设置规则阻止访问已知恶意网站的IP地址

Answer: 仅允许内部网络的特定端口通信

Answer: 关闭所有网络服务，只允许HTTP和HTTPS


Question: 以下哪种防御策略最适合对抗APT攻击的持续性存在？

Answer: 定期更新操作系统和软件

Answer: 实施深度防御策略

Answer: 强化端点检测和响应

Answer: 仅使用一次性密码进行身份验证


Question: DNS投毒攻击中，攻击者的主要目标是什么？

Answer: 获取用户敏感信息

Answer: 增加网站流量

Answer: 篡改域名解析结果

Answer: 破坏DNS服务器


Question: What type of cable is used with 100Base-TX Fast Ethernet?

Answer: Fiber-optic cable

Answer: Category 3 or 4 unshielded twisted-pair (UTP).

Answer: Category 5 unshielded twisted-pair (UTP).

Answer: RG-58 cable.


Question: 下列端口号中，（）是电子邮件发送协议默认的服务端口号。

Answer: 23

Answer: 25

Answer: 110

Answer: 143


Question: 三层网络设计方案中，（）是汇聚层的功能。

Answer: 不同区域的高速数据转发

Answer: 用户认证、计费管理

Answer: 终端用户接入网络

Answer: 实现网络的访问策略控制


Question: 在HTTPS协议中，哪种技术用于确保数据在传输过程中的安全性？

Answer: MD5加密算法

Answer: SSL\/TLS协议

Answer: ARP嗅探工具

Answer: 简单的HTTP协议


Question: 在应对网络入侵时，哪种技术能够监控网络流量，识别异常行为并发出警报？

Answer: 身份认证控制

Answer: 入侵检测系统

Answer: 数据加密

Answer: 日志管理


Question: 以下哪种加密算法在TLS协议中通常用于密钥交换？

Answer: AES

Answer: RSA

Answer: SHA-256

Answer: DES


Question: 在HTTPS协议中，哪种加密算法主要用于加密通信内容以保护数据的隐私？

Answer: RSA (公钥加密算法)

Answer: AES (高级加密标准)

Answer: SHA-256 (安全哈希算法)

Answer: MD5 (消息摘要算法)


Question: SSL\\/TLS协议中的密钥交换算法通常用于做什么？

Answer: 加密数据

Answer: 验证客户端身份

Answer: 生成会话密钥

Answer: 压缩数据


Question: 以下哪种安全技术主要用于检测和防止内部网络中的恶意活动或异常行为？

Answer: 防火墙技术

Answer: 加密通信

Answer: 身份验证

Answer: 入侵检测系统


Question: Kerberos 是一种网络认证协议。它采用的加密算法是(    )。

Answer: RSA

Answer: PGP

Answer: DES

Answer: MD5


Question: 相比于 TCP，UDP 的优势为（）。

Answer: 可靠传输

Answer: 开销较小

Answer: 拥塞控制

Answer: 流量控制


Question: 以下哪种技术可以实时监测网络流量，以识别潜在的攻击行为？

Answer: 防火墙技术

Answer: 加密与认证

Answer: 漏洞管理

Answer: 入侵检测系统


Question: 在网络安全中，以下哪种技术主要用于检测和防止未经授权的网络访问？

Answer: 漏洞扫描

Answer: 密码学基础

Answer: 网络嗅探

Answer: 防火墙策略


Question: 在钓鱼攻击中，攻击者通常会利用哪种技术来伪造合法网站？

Answer: 端口扫描

Answer: 中间人攻击

Answer: 域名系统欺骗

Answer: 拒绝服务攻击


Question: 以下哪种防火墙技术允许基于应用的数据流通过，并且可以执行协议分析和内容检查？

Answer: 包过滤

Answer: 应用网关

Answer: 状态检测

Answer: 代理防火墙


Question: 在威胁情报收集过程中，以下哪项活动通常不涉及？

Answer: 分析公开来源的信息

Answer: 监控暗网活动

Answer: 进行社会工程学测试

Answer: 实施网络钓鱼攻击


Question: 以下哪种防火墙技术主要用于检查网络数据包的传输并阻止潜在的恶意流量？

Answer: 应用级网关（应用代理防火墙）

Answer: 状态检查防火墙

Answer: 电路级网关

Answer: 包过滤防火墙


Question: 以下哪种技术可以帮助识别网络中的异常流量模式，可能指示潜在的攻击？

Answer: 恶意软件分析

Answer: 入侵检测系统（IDS）

Answer: 安全协议应用

Answer: 应急响应策略


Question: 以下哪种技术用于确保HTTPS协议中的数据在传输过程中的完整性和机密性？

Answer: 公钥加密

Answer: 数字签名

Answer: 哈希函数

Answer: SSL\/TLS协议


Question: 以下哪种网络追踪技术对于追查钓鱼攻击者最不相关？

Answer: IP地址追踪

Answer: DNS记录分析

Answer: 社交媒体情报

Answer: 蓝牙信号追踪


Question: 关于点到点微波传输的正确的说法是？

Answer: 因为采用了多路复用技术，所以不容易被拦截侦听

Answer: 因为有加密，所以不容易被拦截侦听

Answer: 容易被拦截侦听

Answer: 是否被拦截侦听取决于信号强度


Question: 在SSL\/TLS协议中，哪个阶段主要负责握手协议，确认加密算法和交换会话密钥？

Answer: 证书认证阶段

Answer: 握手协议阶段

Answer: 应用数据传输阶段

Answer: 安全套接字层建立阶段


Question: 在SSL\/TLS协议中，以下哪个组件负责在客户端和服务器之间建立安全连接？

Answer: 数字证书

Answer: VPN隧道

Answer: 对称密钥

Answer: 非对称密钥交换算法


Question: 在威胁检测和防御中，以下哪项活动最直接地与漏洞评估相关？

Answer: 定期更新防火墙规则

Answer: 监控网络流量以识别异常模式

Answer: 定期扫描系统和应用程序以查找已知安全漏洞

Answer: 制定应急响应计划以应对安全事件


Question: 88. Alaina wants to ensure that systems are compliant with her  network security settings before they are allowed on the network and wants to  ensure that she can test and validate system settings as possible. What type  of NAC system should she deploy?

Answer: A pre-admit, clientless NAC system

Answer: A postadmission, client-based NAC system

Answer: A pre-admit, client-based NAC system

Answer: A postadmission, clientless NAC system


Question: 在应对DDoS（分布式拒绝服务）攻击时，以下哪一步骤通常是在安全事件响应流程中首先执行的？

Answer: 立即隔离受影响的系统以防止进一步损害

Answer: 识别攻击的来源和类型

Answer: 启动备份系统并切换到灾难恢复计划

Answer: 监控网络流量以检测异常模式


Question: 在入侵检测系统（IDS）中，哪种类型的检测方法侧重于识别已知的攻击模式，例如通过匹配签名或特征？

Answer: 基于行为的检测

Answer: 基于异常的检测

Answer: 基于签名的检测

Answer: 基于统计的检测


Question: 一个VLAN可以看作是一个：

Answer: 冲突域

Answer: 广播域

Answer: 管理域

Answer: 阻塞域


Question: 在入侵检测系统(IDS)中，以下哪种检测方法主要用于识别网络流量中的异常行为？

Answer: 签名检测

Answer: 统计异常检测

Answer: 状态协议分析

Answer: 基于规则的检测


Question: 在渗透测试防御策略中，以下哪项最直接地防止攻击者利用系统中的漏洞进行横向移动？

Answer: 强化操作系统配置

Answer: 实施多因素认证

Answer: 使用网络分段

Answer: 应用入侵预防系统


Question: 在防火墙中，哪种功能用于阻止未经授权的网络访问？

Answer: 流量分析

Answer: 状态检查

Answer: 日志记录

Answer: 应急响应计划


Question: 以下哪种安全协议应用可以防止数据在传输过程中被窃取或篡改？

Answer: IPSec

Answer: TLS（Transport Layer Security）

Answer: SSH（Secure Shell）

Answer: NAC（Network Access Control）


Question: Which of the following is most likely to be useful in detecting intrusions?

Answer: Access control lists

Answer: Security labels

Answer: Audit trails

Answer: Information security policies


Question: 网络微分段在零信任架构中的主要作用是什么？

Answer: 增加网络带宽

Answer: 减少网络延迟

Answer: 限制横向移动

Answer: 提高数据传输速度


Question: 在进行无线网络协议分析时，以下哪种协议被广泛认为安全性较低？

Answer: WPA3

Answer: WPA2

Answer: WPA

Answer: WEP


Question: 与 http1.0 相比，http1.1 的优点不包括（ ）。

Answer: 减少了 rtts 数量

Answer: 支持持久连接

Answer: 减少了 tcp 慢启动次数

Answer: 提高了安全性


Question: Data in motion is commonly

Answer: Using a RESTful protocol for transmission

Answer: Stored in registers

Answer: Being transmitted across the network

Answer: Stored in external storage devices


Question: RIP 协议默认的路由更新周期是()秒。

Answer: 30

Answer: 60

Answer: 90

Answer: 100


Question: 安全协议在网络安全中扮演什么角色？

Answer: 用于加密和解密数据

Answer: 作为网络设备的物理保护

Answer: 用于网络流量的负载均衡

Answer: 作为网络攻击的直接防御手段


Question: 在实现虚拟私有网络（VPN）时，以下哪种技术主要用于加密和保护数据传输？

Answer: IPsec协议

Answer: HTTP隧道

Answer: 身份验证头（AH）

Answer: 简单网络管理协议（SNMP）


Question: 哪种技术可以帮助检测那些在正常行为模式之外的操作，可能表明存在网络入侵或内部威胁？

Answer: 签名检测

Answer: 异常行为检测

Answer: 预防措施

Answer: 事件响应流程


Question: At which OSI/ISO layer is an encrypted authentication between a client software package and a firewall performed?

Answer: Network layer

Answer: Session layer

Answer: Transport layer

Answer: Data link layer


Question: 与 HTTP 相比, HTTPS 协议将传输的内容进行加密，更加安全。 HTTPS 基于（ ） 安全协议 。

Answer: RSA

Answer: DES

Answer: SSL

Answer: SSH


Question: 以下哪种措施可以防止中间人攻击，但不能防止数据被窃听？

Answer: 使用HTTPS协议

Answer: 实施证书验证

Answer: 启用SSL\/TLS的前向保密

Answer: 禁用HTTP明文通信


Question: 在HTTPS协议中，用于加密和解密通信的密钥交换技术是？

Answer: 哈希函数

Answer: 公钥加密

Answer: SSL\\/TLS协议

Answer: 数字证书


Question: 网络的可用性是指（ ）。

Answer: 网络通信能力的大小

Answer: 用户用于网络维修的时间

Answer: 网络的可靠性

Answer: 用户可利用网络时间的百分比


Question: 在DNSSEC中，哪个密钥用于验证DNS数据的签名？

Answer: KSK（Key Signing Key）

Answer: ZSK（Zone Signing Key）

Answer: DS（Delegation Signer）记录

Answer: RSA密钥


Question: 以下哪种防火墙策略可以防止内部网络受到恶意电子邮件的传播？

Answer: 阻止所有出站邮件流量

Answer: 对所有入站邮件进行内容扫描

Answer: 仅允许已知安全的邮件服务器进行通信

Answer: 禁止所有包含附件的邮件


Question: 在对网络设备巡检中，检测到交换机端口有大量的 CRC 错包，结合错包呈现出不断上涨的趋势，下面故障原因中，不可能的是（）

Answer: 端口状态异常

Answer: 物理链路故障

Answer: 电磁干扰

Answer: 病毒攻击


Question: snmpv1 的管理信息结构定义的应用数据类型 time ticks 的单位是 （ ） 。

Answer: 1 秒

Answer: 0.1 秒

Answer: 0.01 秒

Answer: 1 毫秒


Question: 以下哪种防火墙配置可以防止恶意软件通过网络传播？

Answer: 允许所有出站流量

Answer: 阻止所有入站流量

Answer: 启用状态检测并应用安全策略

Answer: 仅允许HTTP和HTTPS流量


Question: 以下哪种防火墙策略最适合防止内部网络受到外部恶意软件的威胁？

Answer: 阻止所有出站流量

Answer: 允许所有入站流量，但仅限于特定端口

Answer: 仅允许已知安全的入站和出站流量

Answer: 允许所有入站和出站流量，但监控所有活动


Question: 在检测网络入侵时，哪种技术可以分析网络流量模式以识别异常行为？

Answer: 防火墙技术

Answer: 恶意软件分析

Answer: 入侵模式识别

Answer: 网络流量监测


Question: 在性能对比中，通常哪种类型的防火墙处理网络流量的速度更快？

Answer: 网络层防火墙

Answer: 应用层防火墙

Answer: 性能与类型无关

Answer: 两者速度相同


Question: Which of the following is the BEST type of authentication and encryption for a Secure Shell (SSH) implementation when network trac traversesbetween a host and an infrastructure device?

Answer: Lightweight Directory Access Protocol (LDAP)

Answer: Public-key cryptography

Answer: Remote Authentication Dial-In User Service (RADIUS)

Answer: Private-key cryptography


Question: 网络足迹追踪中，以下哪种技术主要用于确定网络活动的源头？

Answer: IP地址追踪

Answer: 浏览器历史记录分析

Answer: 社交媒体监控

Answer: 网络流量分析


Question: 在进行数据分析以识别潜在的网络攻击时，以下哪种技术最不常用？

Answer: 机器学习算法

Answer: 关联规则学习

Answer: 深度学习模型

Answer: 线性回归分析


Question: The switch feature used to implement switch port mirroring is: ( )

Answer: PERMIT LIST

Answer: PVLAN

Answer: VTP

Answer: SPAN


Question: 在网络管理中要防止各种安全威胁。在 snmp 中无法预防的安全威胁是（ ）。

Answer: 篡改管理信息：通过改变传输中的 snmp 报文实施未经授权的管理操作

Answer: 通信分析：第三者分析管理实体之间的通信规律，从而获取管理信息

Answer: 假冒合法用户：未经授权的用户冒充授权用户，企图实施管理操作

Answer: 消息泄露：snmp 引擎之间交换的信息被第三者偷听


Question: 在防御APT攻击时，以下哪个策略有助于防止数据窃取？

Answer: 仅使用物理安全措施，如安全门禁系统。

Answer: 定期进行安全意识培训，教育员工识别网络钓鱼攻击。

Answer: 关闭所有不必要的网络服务和端口。

Answer: 仅依赖防火墙阻止所有外部流量。


Question: 以下哪个是TLS协议中的安全漏洞？

Answer: 弱加密算法

Answer: 证书撤销列表（CRL）

Answer: 数字签名

Answer: 对称加密


Question: 集线器也称为HUB，它的工作原理是把一个端口上收到的数据广播发送到其他所有端口上。是一个工作在（）的设备。

Answer: 传输层

Answer: 网络层

Answer: 数据链路层

Answer: 物理层


Question: 下列 ip 地址中，属于私网地址的是（ ）。

Answer: 100.1.32.7

Answer: 192.178.32.2

Answer: 172.17.32.15

Answer: 172.35.32.244


Question: Both de facto and proprietary interior protocols are in use today. Which of the following is a proprietary interior protocol that chooses the best path between the source and destination?

Answer: IGRP

Answer: RIP

Answer: BGP

Answer: OSPF


Question: 在企业环境中，访问控制列表（ACL）通常用于实现哪种级别的访问控制？

Answer: 基于角色的访问控制（RBAC）

Answer: 网络流量过滤和控制

Answer: 应用程序权限管理

Answer: 操作系统级别的用户权限


Question: 在企业网络中，访问控制列表(ACL)通常用于实现以下哪种功能？

Answer: 阻止内部网络用户访问互联网

Answer: 仅允许特定端口的入站流量

Answer: 加密网络传输数据

Answer: 检测和阻止病毒


Question: 在访问控制列表（ACL）中，以下哪项不是常见的访问控制操作？

Answer: 允许

Answer: 拒绝

Answer: 加密

Answer: 审计


Question: 以下哪种技术用于确保数据在传输过程中不被篡改？

Answer: DES

Answer: RSA

Answer: MD5

Answer: TLS


Question: 在模拟攻击时，以下哪种活动是用于发现网络中可利用的漏洞？

Answer: 权限提升

Answer: 密码破解

Answer: 网络扫描

Answer: 数据隐藏


Question: Which of the following media is MOST resistant to EMI interference?

Answer: microwave

Answer: ber optic

Answer: twisted pair

Answer: coaxial cable


Question: 在基于异常的入侵检测系统中，以下哪项技术主要用于识别正常行为模式？

Answer: 误用检测

Answer: 统计模型

Answer: 签名匹配

Answer: 深度学习


Question: 以下哪种技术可以帮助分析网络流量模式，以识别潜在的攻击活动？

Answer: 静态代码分析

Answer: 行为基线建立

Answer: 恶意软件沙箱

Answer: 端口扫描


Question:
Brad is a new security administrator within a retail company. He is discovering several issues that his security team needs to address to better secure their organization overall. When reviewing different web server logs, he finds several HTTP server requests with the characters “%20” and “../”. The web server software ensures that users input the correct information within the forms that are presented to them via their web browsers. Brad identifies that the organization has a two-tier network architecture in place, which allows the web servers to directly interact with the back-end database.
Pertaining to the network architecture described in the previous scenario, which of the following attack types should Brad be concerned with?

Answer: Parameter validation attack

Answer: Injection attack

Answer: Cross-site scripting

Answer: Database connector attack


Question: 以下哪项被公认为是网络管理的关键要素之一？

Answer: 配置和变更管理。

Answer: 拓扑映射。

Answer: 监控工具的应用。

Answer: 代理服务器故障排除。


Question: 如果想知道配置了哪种路由协议，应使用的命令是（） 。

Answer: router>show router protocol ，

Answer: router (ciinfig)>show ip protocol

Answer: router (config)>#show router protocol

Answer: router >show ip protocol


Question: 在 tcp 协议中，采用（ ）来区分不同的应用进程。

Answer: 端口号

Answer: ip 地址

Answer: 协议类型

Answer: mac 地址


Question:
访问控制列表（acl）配置如下，如果来自因特网的 http 报文的目标地址是 162．15．10．10，经过这个 acl 过滤后会出现什么情况？（）。
Router#show access-lists
Extended IP access list 110
10 deny tcp 162.15.0.0 0.0.255.255 any eq telnet
20 deny tcp 162.15.0.0 0.0.255.255 any eq smtp
30 deny tcp 162.15.0.0 0.0.255.255 any eq http
40 permit tcp 162.15.0.0 0.0.255.255 any

Answer: 由于行 30 拒绝，报文被丢弃

Answer: 由于行 40 允许，报文被接受

Answer: 由于 acl 末尾隐含的拒绝，报文被丢弃

Answer: 由于报文源地址未包含在列表中，报文被接受


Question: 在安全防护措施中，以下哪项是用于防止未授权访问的关键技术？

Answer: 数据加密

Answer: 防火墙

Answer: 入侵检测系统

Answer: 反病毒软件


Question: 在渗透测试中，哪种扫描技术最适合在不引起注意的情况下发现网络上的开放端口和服务？

Answer: 全面扫描

Answer: 隐秘扫描

Answer: 漏洞评估

Answer: 网络测绘


Question: 以下哪种防火墙配置可以防止内部网络的恶意活动对外部网络造成影响？

Answer: 设置出站过滤规则，阻止所有非必要的传出流量

Answer: 设置入站过滤规则，阻止所有外部连接请求

Answer: 启用状态检测，仅允许已知安全的连接

Answer: 启用网络地址转换（NAT），隐藏内部IP地址


Question: This OSI layer has a service that negotiates transfer syntax and translates data to and from the transfer syntax for users, which may representdata using different syntaxes. At which of the following layers would you nd such service?

Answer: Session

Answer: Transport

Answer: Presentation

Answer: Application


Question: 以下哪种技术是IDS\\/IPS系统中用于识别潜在威胁的关键组件？

Answer: 深度包检查

Answer: 数据加密

Answer: 身份验证

Answer: 负载均衡


Question: 以下哪一项是网络入侵检测技术:

Answer: 端口扫描

Answer: 网络欺骗

Answer: 统计异常

Answer: 协议分析


Question: Which of the following protocols is designed to send individual messages securely?

Answer: Kerberos

Answer: Secure Electronic Transaction (SET).

Answer: Secure Sockets Layer (SSL).

Answer: Secure HTTP (S-HTTP).


Question: 网络产品和服务安全审查的主要目的是什么？

Answer: 提高产品价格

Answer: 确保网络产品和服务的质量

Answer: 确保网络产品和服务的供应链安全

Answer: 增加企业负担


Question: 在 tcp/ip 网络中，为各种公共服务保留的端口号范围是（ ）。

Answer: 1～255

Answer: 256~1023

Answer: 1~1023

Answer: 1024~65535


Question: 在虚假网站检测中，以下哪种技术可以帮助验证网站的合法性？

Answer: 检查网站的SSL证书

Answer: 查看网站的访问量

Answer: 依赖搜索引擎的排名

Answer: 根据网站的视觉设计判断


Question: 在SSL\/TLS协议中，以下哪种加密算法通常用于握手过程中的密钥交换？

Answer: AES

Answer: RSA

Answer: DES

Answer: SHA-256


Question: 以下哪种方法不是网络钓鱼攻击的常见手段？

Answer: 伪造知名网站的登录页面以获取用户凭据

Answer: 通过电子邮件发送带有恶意附件的钓鱼邮件

Answer: 利用安全浏览器插件来保护用户免受钓鱼攻击

Answer: 通过社交媒体诱骗用户点击含有恶意链接的消息


Question: 配置路由器端口，应该在哪种提示符下进行？ （ ）

Answer: r1(config)#

Answer: r1(config-in)#

Answer: r1(config-intf)#

Answer: r1(config-if)#


Question: 以下哪种防火墙策略可以防止未经授权的电子邮件进出企业网络？

Answer: 阻止所有SMTP流量

Answer: 应用内容过滤规则

Answer: 只允许内部IP地址发送邮件

Answer: 关闭所有邮件服务器的端口


Question: Event monitoring tools (security information and event management [SIEM]/securityinformation management [SIM]/security event management [SEM]) can aid in which ofthe following efforts?

Answer: Detecting ambient heating, ventilation, and air-conditioning (HVAC) problems

Answer: Ensuring proper cloud migration

Answer: Deciding risk parameters

Answer: Protecting all physical entry points against the threat of fire


Question: FTP 协议默认使用的数据端口是（）。

Answer: 20

Answer: 80

Answer: 25

Answer: 23


Question: 在入侵检测系统（IDS）中，哪种类型可以实时监控网络流量以检测潜在的攻击？

Answer: 基于主机的IDS（HIDS）

Answer: 基于网络的IDS（NIDS）

Answer: 基于行为的IDS

Answer: 基于签名的IDS


Question: Tom is responsible for ensuring the security of network  transactions. His business all uses TLS, which can prevent what kind of  attack and what specific method can be used to achieve it?

Answer: Eavesdropping, TEMPEST

Answer: Man-in-the-middle attack, VPN

Answer: Packet injection, encryption

Answer: Eavesdropping, encryption


Question: 以下哪种技术可以阻止未经授权的网络访问，但可能无法检测到内部攻击？

Answer: 入侵模式识别

Answer: 防火墙技术

Answer: 恶意软件分析

Answer: 网络流量监测


Question: Encryption can happen at different layers of an operating system and network stack. Where does PPTP encryption take place?

Answer: Data link layer

Answer: Within applications

Answer: Transport layer

Answer: Data link and physical layers


Question: Which of the following is not a fundamental role of a firewall O .

Answer: incommunicado

Answer: containment

Answer: antivirus

Answer: record (in sports etc)


Question: 以下哪种技术可以帮助NIDS识别特定的已知攻击？

Answer: 机器学习

Answer: 模式匹配

Answer: 行为基线分析

Answer: 数据流分析


Question: 网络 122.21.136.0/24 和 122.21.143.0/24 经过路由汇聚，得到的网络地址是（ ） 。

Answer: 122.21.136.0/22

Answer: 122.21.136.0/21

Answer: 122.21.143.0/22

Answer: 122.21.128.0/24


Question: 在入侵检测系统中，特征提取的主要目的是什么？

Answer: 提高网络带宽

Answer: 减少系统资源消耗

Answer: 从网络流量中提取用于检测入侵的关键信息

Answer: 增强用户界面的友好性


Question: 以太网协议中使用了二进制指数后退算法，这个算法的特点是（ ）。

Answer: 容易实现，工作效率高

Answer: 在轻负载下能提高网络的利用率

Answer: 在重负载下能有效分解冲突

Answer: 在任何情况下不会发生阻塞


Question: 8. Jake has been told that there is a layer 3 problem with his  network. Which of the following isassociated with layer 3 in the OSI model?

Answer: IP addresses

Answer: TCP and UDP protocols

Answer: MAC addresses

Answer: Sending and receiving bits via hardware


Question: 在防火墙配置中，以下哪种策略可以有效阻止内部网络的未授权访问？

Answer: 允许所有出站流量

Answer: 允许所有入站流量

Answer: 拒绝所有入站流量，仅允许特定出站流量

Answer: 拒绝所有出站流量，仅允许特定入站流量


Question: 特洛伊木马攻击的威胁类型属于（）

Answer: 授权侵犯威胁

Answer: 渗入威胁

Answer: 植入威胁

Answer: 旁路控制威胁


Question: 在企业网络中，以下哪种网络拓扑结构最不利于安全实施？

Answer: 星型拓扑，所有设备连接到中央交换机

Answer: 环形拓扑，数据沿着环路单向传输

Answer: 总线型拓扑，所有设备共享同一传输介质

Answer: 树型拓扑，分层结构，每个分支有独立的子网


Question: ieee 802.11 标准定义的 peer to peer 网络是（ ）。

Answer: 一种需要 ap 支持的无线网络

Answer: 一种不需要有线网络和接入点支持的点对点网络

Answer: 一种采用特殊协议的有线网络

Answer: 一种高速骨干数据网络


Question: 在SSL\/TLS的安全握手过程中，以下哪个步骤不是必需的？

Answer: 客户端发送加密算法的列表

Answer: 服务器发送服务器证书

Answer: 双方交换应用数据

Answer: 服务器发送服务器Hello消息


Question: 在SSL\\/TLS协议的握手过程中，客户端发送什么来提议加密算法和协议版本？

Answer: ClientKeyExchange消息

Answer: ClientHello消息

Answer: ChangeCipherSpec消息

Answer: ServerHelloDone消息


Question: 在网络安全中，以下哪种技术主要用于检测和防止未经授权的网络流量进入或离开网络？

Answer: 密码学

Answer: 防火墙

Answer: 漏洞利用

Answer: 反击策略


Question: 以下哪种威胁类型通常需要入侵检测系统（IDS）来检测并预防？

Answer: 拒绝服务攻击（DoS）

Answer: 社会工程学攻击

Answer: 内部人员的恶意活动

Answer: 物理安全威胁


Question: 在部署入侵防御系统（IPS）时，以下哪项不是考虑的关键因素？

Answer: 系统的检测准确率

Answer: 系统的响应速度

Answer: 系统的用户界面设计

Answer: 系统的误报率


Question: Which of the following is an advantage that UDP has over TCP?

Answer: UDP is connection-oriented whereas TCP is not.

Answer: UDP is more reliable than TC

Answer: UDP is faster than TC

Answer: UDP makes a better effort to deliver packets.


Question: 在HTTPS协议中，哪个步骤确保了客户端与服务器之间的身份验证并建立加密通信？

Answer: 握手协议中的证书交换

Answer: HTTP请求的加密

Answer: 会话密钥的生成

Answer: TCP连接的建立


Question: 如果使用不当，以下哪项最有可能成为拒绝服务攻击的帮凶？

Answer: 路由器配置和规则。

Answer: 内部网络的设计。

Answer: 路由器系统软件的更新。

Answer: 审计测试和审查技术。


Question: 以下哪种做法对于防止Web服务器被利用为肉鸡加入僵尸网络最无效？

Answer: 保持操作系统和Web服务器软件的更新

Answer: 关闭不必要的网络服务

Answer: 在服务器上运行无密码的SSH服务

Answer: 实施严格的访问控制列表（ACL）


Question: 以下哪种情况可能导致HTTPS中的中间人攻击（Man-in-the-Middle, MITM）？

Answer: 使用自签名的服务器证书

Answer: 使用预共享密钥（PSK）

Answer: 客户端支持前向安全性

Answer: 服务器和客户端都使用最新的TLS版本


Question: 以下哪种情况不是防火墙配置的主要目标？

Answer: 阻止未经授权的外部访问

Answer: 允许内部用户访问所有外部资源

Answer: 保护内部网络免受恶意软件攻击

Answer: 限制特定服务的流量


Question:
Bella, a security professional working at an IT firm,
finds that a security breach has occurred while transferring important  files. Sensitive data,
employee usernames, and passwords are shared in plaintext, paving the way  for hackers to perform successful session hijacking. To address this
situation, Bella implemented a protocol that sends data using encryption  and digital certificates.
Which of the following protocols is used by Bella?

Answer: FTPS

Answer: FTP

Answer: HTTPS

Answer: IP


Question: 下列那一项用于探测和纠正错误，以便于在网络上传输的完整性和机密性被维持，且可组织非授权的链路拦截。

Answer: 服务端安全

Answer: 传输安全

Answer: 客户端安全

Answer: 信息安全。


Question: Application Layer Firewalls operate at the:

Answer: OSI protocol Layer seven, the Application Layer.

Answer: OSI protocol Layer six, the Presentation Layer.

Answer: OSI protocol Layer five, the Session Layer.

Answer: OSI protocol Layer four, the Transport Layer.


Question: 下列关于链路加密的叙述，哪一项是错误的？

Answer: 它加密所有数据都是沿着一个特定的通信路径

Answer: 信息从传输的一端到另一端，始终处于加密状态

Answer: 数据包中用户信息、标题、追踪器、地址和路由信息都是加密的

Answer: 它能够提供防止数据包被嗅探和窃听。


Question: 以下哪种防火墙配置策略可以防止内部网络受到外部攻击？

Answer: 仅允许特定的出站连接

Answer: 允许所有入站和出站连接

Answer: 仅允许特定的入站连接

Answer: 阻止所有网络连接


Question: 以下哪种安全措施主要用于防止未授权的网络流量进入内部网络？

Answer: 应用级防火墙

Answer: 异常检测系统

Answer: 入侵签名更新

Answer: 日志分析响应策略


Question: 以下哪种防火墙技术提供了最精细的访问控制，能够跟踪和基于每个连接的状态信息进行决策？

Answer: 网络层过滤

Answer: 应用网关

Answer: 状态检测

Answer: 访问控制列表


Question: 在TLS协议中，以下哪个组件用于确保邮件传输的完整性？

Answer: 对称加密

Answer: 非对称加密

Answer: 消息认证码（MAC）

Answer: 数字证书


Question: 在 snmpv2 错误类型中，表示管理对象不可访问的是 （）。

Answer: noaccess

Answer: generr

Answer: wrong value

Answer: nocreation


Question: 以下哪种方法最不适用于防止网络钓鱼攻击？

Answer: 安装并更新反钓鱼插件

Answer: 对所有电子邮件进行加密

Answer: 训练员工识别钓鱼尝试

Answer: 禁用端点上的JavaScript


Question: Asynchronous Communication transfers data by sending:

Answer: bits of data sequentially

Answer: bits of data sequentially in irregular timing patterns

Answer: bits of data in sync with a heartbeat or clock

Answer: bits of data simultaneously


Question: Which of the following is considered an internal redundancy  for a data center?

Answer: Power distribution units

Answer: Network circuits

Answer: Power substations

Answer: Generators


Question: 与 ripv1 相比，ripv2 的改进是（ ）。

Answer: 采用了可变长子网掩码

Answer: 使用 spf 算法计算最短路由

Answer: 广播发布路由更新信息

Answer: 采用了更复杂的路由度量算法


Question: What common security issue is often overlooked by wireless  phones?

Answer: They can allow attackers to access wireless networks.

Answer: Their signals are rarely encrypted, so they can be easily  eavesdropped.

Answer: They are rarely patched and vulnerable to malware attacks.

Answer: They use unauthorized frequencies.


Question: In the "Access Control" application of the firewall, the access relationship between the intranet, extranet and DMZ is: ( )

Answer: The intranet can access the extranet

Answer: Intranet access to the DMZ

Answer: The DMZ has access to the intranet.

Answer: The DMZ can be accessed from outside the network


Question: In order to ensure the privacy and integrity of the data, connections between rewalls over public networks should use:

Answer: Screened subnets

Answer: Digital certicates

Answer: An encrypted Virtual Private Network

Answer: Encryption


Question: 在网络入侵检测系统中，数据流分析主要用于：

Answer: 识别特定的攻击模式

Answer: 监控和分析网络流量的统计特性

Answer: 预防已知的恶意软件

Answer: 实时阻断可疑连接


Question: 观察交换机状态指示灯是初步判断交换机故障的检测方法，以下关于交换机状态指示灯的描述中，错误的是（）。

Answer: 交换机指示灯显示红色表明设备故障或者告警，需要关注和立即采取行动

Answer: STCK 指示灯绿色表示接口在提供远程供电

Answer: SYS 指示灯亮红色表明交换机可能存在风扇或温度告警

Answer: 交换机业务接口对应单一指示灯，常亮表示连接，快闪表示数据传送


Question: 在TCP\\/IP协议中，由于TCP协议提供可靠的连接服务，采用（）来创建一个TCP连接；采用（）来断开TCP连接。

Answer: 三次握手三次挥手

Answer: 三次握手四次挥手

Answer: 四次握手三次挥手

Answer: 四次握手四次挥手


Question: 在 snmp 和 cmip 是网络界最重要的网络管理协议， （ ） 是错误的。

Answer: snmp 和 cmip 采用的检索方式不同。

Answer: snmp 和 cmip 信息获取方式不同。

Answer: snmp 和 cmip 采用的抽象语法符号不同。

Answer: snmp 和 cmip 传输层支持协议不同。


Question: 以下哪种攻击方式是通过向目标系统发送大量请求，使其无法处理正常流量，从而导致服务不可用？

Answer: 跨站脚本攻击（XSS）

Answer: SQL注入攻击

Answer: 拒绝服务攻击（DoS）

Answer: 分布式拒绝服务攻击（DDoS）


Question: 以下网络攻击中，（）属于被动攻击

Answer: 拒绝服务攻击

Answer: 重放

Answer: 假冒

Answer: 流量分析


Question: Which of the following is NOT a function performed by the record protocol of TLS?

Answer: Encryption

Answer: Acceleration

Answer: Authentication

Answer: Compression


Question: 以下哪种技术可以防止中间人攻击，确保数据在传输过程中的完整性和来源真实性？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希函数

Answer: 数字签名


Question: 以下哪种技术可以防止中间人攻击，确保移动设备与服务器之间的通信安全？

Answer: IPSec

Answer: WPA3

Answer: HTTPS

Answer: MAC 地址过滤


Question: 局域网（LAN）管理员通常不应承担以下哪项责任？

Answer: 承担最终用户责任。

Answer: 向最终用户经理报告工作。

Answer: 承担编程责任。

Answer: 负责LAN安全管理。


Question: 在HTTPS中，客户端和服务器如何使用非对称加密来保证通信安全？

Answer: 客户端使用服务器的公钥加密数据，服务器使用私钥解密

Answer: 服务器使用客户端的公钥加密数据，客户端使用私钥解密

Answer: 客户端和服务器都使用对方的公钥加密数据

Answer: 客户端和服务器都使用自己的私钥加密数据


Question: 为了弥补 wep 协议的安全缺陷，wpa 安全认证方案增加的机制是（）。

Answer: 共享密钥认证

Answer: 临时密钥完整性协议

Answer: 较短的初始化向量

Answer: 采用更强的加密算法


Question: 设信道带宽为 5000Hz，采用 PCM 编码，采样周期为 125μs，每个样本量化为 256 个等级，则信道的数据速率为（）。

Answer: 0Kb/s

Answer: 40Kb/s

Answer: 56Kb/s

Answer: 64Kb/s


Question: 入侵防御系统(IPS)与IDS相比，最大的区别是什么？

Answer: IPS需要更多的硬件资源

Answer: IPS能够主动阻止检测到的攻击

Answer: IPS只监控内部网络流量

Answer: IPS不产生警报


Question: 以下哪种防火墙技术可以检查进出网络的数据包内容，以阻止恶意流量？

Answer: 包过滤

Answer: 应用网关

Answer: 状态检测

Answer: 深度包检查（DPI）


Question: 以下哪种安全协议可以有效防止中间人攻击，保护用户在浏览网页时的数据安全？

Answer: TLS（Transport Layer Security）

Answer: FTP（File Transfer Protocol）

Answer: HTTP（Hypertext Transfer Protocol）

Answer: IMAP（Internet Message Access Protocol）


Question: The VPN tunneling protocol that belongs to Layer 2 is ().

Answer: IPSeC

Answer: PPTP

Answer: GRE

Answer: IPv4


Question: 企业使用虚拟私有网络（VPN）的主要目的是什么？

Answer: 在内部网络中实施访问控制

Answer: 在不安全的公共网络上创建安全的通信通道

Answer: 阻止所有外部网络访问

Answer: 替代传统的物理网络基础设施


Question: 以下哪种技术可以加密DNS查询，以防止在公共网络上被窃听？

Answer: DNS-over-HTTPS (DoH)

Answer: TLS

Answer: IPsec

Answer: WPA2


Question: 在HTTPS的加密算法中，以下哪项不是常用的对称加密算法？

Answer: AES

Answer: RSA

Answer: 3DES

Answer: Blowfish


Question: 以下哪种加密通信技术用于在TLS\\/SSL协议中创建安全的会话密钥？

Answer: AES

Answer: RSA

Answer: DH（Diffie-Hellman）

Answer: SHA-256


Question: 以下哪种方法最不利于检测内部网络中的DNS异常行为？

Answer: 实施DNS流量深度包检测

Answer: 依赖外部DNS解析服务

Answer: 设置DNS日志和审计

Answer: 使用入侵检测系统（IDS）监控DNS流量


Question: 在防火墙配置中，哪种策略有助于防止钓鱼网站通过网络传播？

Answer: 启用入侵检测和预防系统（IDPS）

Answer: 实施严格的出站流量过滤

Answer: 启用端口转发

Answer: 允许所有HTTPS连接


Question: 在HTTPS协议中，用于加密和解密通信的密钥交换机制是？

Answer: 公钥加密

Answer: 私钥解密

Answer: 哈希函数

Answer: 数字证书


Question: Why might a network administrator choose distributed virtual switches instead of stand-alone switches for network segmentation?

Answer: To standardize on a single vendor

Answer: To ensure isolation of management trac

Answer: To maximize data plane eciency

Answer: To reduce the risk of conguration errors


Question: Which of the following is used to detect and correct errors in  order to maintain the integrity and confidentiality of data transmitted over  a network, and to prevent unauthorized link interception?

Answer: Client security

Answer: Transmission security

Answer: Server security

Answer: Information security.


Question: 以下哪种技术可以防止恶意代码通过网络传播，并在数据包到达目的地之前进行检查？

Answer: 防火墙技术

Answer: 蜜罐系统

Answer: 入侵响应

Answer: 安全协议


Question: 以下哪种攻击方式是针对特定个人或组织的网络钓鱼攻击？

Answer: 电子邮件钓鱼

Answer: 网站克隆

Answer: 社会工程学

Answer: 鱼叉式网络钓鱼


Question: 在安全架构设计中，以下哪种技术用于确保数据在传输过程中的安全性？

Answer: SSL\\/TLS协议

Answer: HTTP基本认证

Answer: 哈希函数

Answer: 入侵检测系统（IDS）


Question: 以下哪项是与使用点对点计算有关的最大问题？

Answer: 病毒感染。

Answer: 数据泄露。

Answer: 网络性能问题。

Answer: 未经授权使用软件。


Question: 在相隔 20km 的两地间通过电缆以 100Mb/s 的速率传送 1518 字节长的以太帧，从开始发送到接收完数据需要的时间约是（）（信号速率为 200m/us）。

Answer: 131us

Answer: 221us

Answer: 1310us

Answer: 2210us


Question: Fire suppression systems are often linked to a detection system. Common detectionsystems include all of the following except .

Answer: Heat

Answer: Pressure

Answer: Flame

Answer: Smoke


Question: 在HTTPS协议中，哪种技术用于在客户端和服务器之间建立安全的通信信道？

Answer: 对称加密

Answer: 非对称加密

Answer: 哈希函数

Answer: TLS\/SSL协议


Question: 以下哪种网络监控技术主要用于检测异常行为，防止内部威胁？

Answer: 入侵检测系统（IDS）

Answer: 防火墙

Answer: 数据泄露防护（DLP）系统

Answer: 行为分析系统


Question: 以下哪种网络安全设备可以防止未经授权的网络访问并过滤恶意流量？

Answer: 身份验证服务器

Answer: 入侵检测系统

Answer: 防火墙

Answer: 安全信息和事件管理（SIEM）系统


Question: SNMP trap是通过哪个协议端口上报的？

Answer: TCP,161

Answer: UDP,161

Answer: TCP,162

Answer: UDP,162


Question: 以下哪种访问控制列表（ACL）策略可以防止未经授权的内部用户访问特定服务器？

Answer: 源地址过滤

Answer: 目的地地址过滤

Answer: 端口过滤

Answer: MAC地址过滤


Question: 在网络层中，用于过滤数据包并控制哪些流量可以进出网络的机制是？

Answer: 应用网关

Answer: 状态检测

Answer: 访问控制列表

Answer: 虚拟私人网络


Question: If you receive a RST packet back from a target host, what do you know about your target?

Answer: The target is using UDP rather than TCP.

Answer: The destination port is open on the target host.

Answer: The source port in the RST message is closed.

Answer: The target expects the PSH flag to be set.


Question: Which of the following types of attacks occurs when an attacker successfully inserts an intermediary software or program between twocommunicating hosts?

Answer: Denial-of-service attack

Answer: Dictionary attack

Answer: Man-in-the-middle attack

Answer: Password guessing attack


Question: 在渗透测试中，哪种技术主要用于测试防火墙配置的有效性？

Answer: 端口扫描

Answer: 密码暴力破解

Answer: SQL注入

Answer: 拒绝服务攻击模拟


Question:
A company has an e-commerce website that carries out 60 percent of its annual revenue. Under the current circumstances, the annualized loss expectancy for a website against the threat of attack is $92,000. After implementing a new application-layer firewall, the new annualized loss expectancy would be $30,000. The firewall
costs $65,000 per year to implement and maintain.
What is the value of the firewall to the company?

Answer: $62,000

Answer: $3,000

Answer: –$62,000

Answer: –$3,000


Question: Communications and network security relates to transmission of which of the following?

Answer: voice

Answer: voice and multimedia

Answer: data and multimedia

Answer: voice, data and multimedia


Question: 识别恶意链接时，以下哪项特征最能表明链接可能是钓鱼攻击的一部分？

Answer: 链接的URL与官方网站的域名完全一致

Answer: 链接的URL中包含一连串随机字符

Answer: 链接在邮件正文中以可点击的图片形式出现

Answer: 链接的URL使用了顶级域名'.gov'或'.edu'


Question: 以下哪种技术主要用于检测网络中的未授权活动，例如嗅探敏感数据？

Answer: 漏洞扫描

Answer: 密码学原理

Answer: 网络嗅探

Answer: 防火墙技术


Question: 在电子邮件欺诈中，哪种技术常用于伪造发件人的电子邮件地址？

Answer: SMTP头篡改

Answer: DNS欺骗

Answer: 社会工程学

Answer: SSL解密


Question: 流量监控在网络安全中的作用是什么？

Answer: 提高网络带宽

Answer: 检测异常流量模式

Answer: 增加数据传输速度

Answer: 减少网络延迟


Question: 下面关于 manchester 编码的叙述中，错误的是（ ）。

Answer: manchester 编码是一种双相码

Answer: manchester 编码提供了比特同步信息

Answer: manchester 编码的效率为 50%

Answer: manchester 编码应用在高速以太网中


Question: Proxies work by transferring a copy of each accepted data packet from one network to another, thereby masking the:

Answer: data's payload.

Answer: data's details.

Answer: data's owner.

Answer: data's origin.


Question: 以下哪种操作是安全加固服务器的一部分，以防止未授权的远程访问？

Answer: 关闭不必要的服务和端口

Answer: 编写详尽的漏洞报告

Answer: 定期执行漏洞扫描

Answer: 开发自定义exploit


Question: 以下哪种技术主要用于确保在线通信过程中数据的机密性和完整性？

Answer: 防火墙

Answer: SSL\\/TLS 加密

Answer: 身份验证

Answer: 数据备份与恢复


Question: mpls 根据标记对分组进行交换，其标记中包含 （ ） 。

Answer: mac 地址

Answer: ip 地址

Answer: vlan 编号

Answer: 分组长度


Question: Which of these would be a reason why it is best for communications to originate from inside the infected network?

Answer: Antivirus

Answer: Virtual machines

Answer: Intrusion detection

Answer: Firewall


Question: 以下哪种技术可以防止未经授权的设备访问内部网络？

Answer: HTTPS协议

Answer: 身份验证

Answer: 防火墙

Answer: 数字证书


Question: Security event logs can best be protected from tampering by  which of the following?

Answer: Encrypting the contents using asymmetric key encryption

Answer: Ensuring every user has administrative rights on their own  workstations

Answer: Using remote logging over simplex communications media

Answer: Storing the event logs on DVD-RW


Question: 在网络防御中，哪种策略涉及限制对特定网络资源的访问，只允许授权用户和系统进行通信？

Answer: 防火墙

Answer: 访问控制列表

Answer: 入侵检测系统

Answer: 蜜罐技术


Question:
Several different tunneling protocols can be used in dial-up situations.

Which of the following would be best to use as a VPN tunneling solution?

Answer: L2P

Answer: PPTP

Answer: IPSec

Answer: L2TP


Question: If you were to notice operating system commands inside a DNS request while looking at a packet capture, what might you be looking at?

Answer: Tunneling attack

Answer: DNS amplification

Answer: DNS recursion

Answer: XML entity injection


Question: 防火墙技术演进中，以下哪项技术标志着从包过滤防火墙向状态检测防火墙的转变？

Answer: NAT（网络地址转换）

Answer: VPN（虚拟私人网络）

Answer: TCP状态检测

Answer: 应用层网关


Question: How does Encapsulating Security Payload (ESP) in transport mode affect in the Internet Protocol (IP)?

Answer: Authenticates the IP payload and selected portions of the IP header

Answer: Encrypts and optionally authenticates the complete IP packet

Answer: Encrypts and optionally authenticates the IP header, but not the IP payload

Answer: Encrypts and optionally authenticates the IP payload, but not the IP header


Question: Communications and network security relates to transmission of which of the following?

Answer: voice

Answer: voice and multimedia

Answer: data and multimedia

Answer: voice, data and multimedia


Question: If a private IP address is used for the corporate intranet, the ( ) technique should be used when it is necessary to connect to other branch offices with IPSec VPN.

Answer: tunnel technology

Answer: cryptography

Answer: Message Authentication Technology

Answer: digital signature technology


Question: Which one of the following considerations has the LEAST impact when considering transmission security?

Answer: Network availability

Answer: Node locations

Answer: Network bandwidth

Answer: Data integrity


Question: 网络钓鱼是指(    )

Answer: 通过大量发送声称来自于银行或其他知名机构的欺骗性垃圾邮件，意图引诱收信人给出敏感信息。

Answer: 网上进行钓鱼活动

Answer: 通过网络组织钓鱼活动，从而获得利益

Answer: 以上都不是


Question: 使用（ ）协议远程配置交换机。

Answer: telnet

Answer: ftp

Answer: http

Answer: ppp


Question: 以下哪种安全防护策略可以防止恶意软件在企业网络中横向移动？

Answer: 多因素认证

Answer: 网络分段

Answer: 入侵检测系统

Answer: 端点杀毒软件


Question: A network-based vulnerability assessment is a type of test also referred to as:

Answer: An active vulnerability assessment.

Answer: A routing vulnerability assessment.

Answer: A host-based vulnerability assessment.

Answer: A passive vulnerability assessment.


Question: Which of the following statements pertaining to packet switching is incorrect?

Answer: Most data sent today uses digital signals over network employing packet switching.

Answer: Messages are divided into packets.

Answer: All packets from a message travel through the same route.

Answer: Each network node or point examines each packet for routing.


Question: 网络入侵检测系统（NIDS）在检测到异常活动时，通常会采取什么行动？

Answer: 自动阻止所有网络通信

Answer: 记录事件并通知管理员

Answer: 修改网络配置以防止进一步攻击

Answer: 立即执行响应机制，隔离受影响的系统


Question: 在HTTPS协议中，主要实现了哪种安全协议应用，以确保数据传输的机密性和完整性？

Answer: SSL\/TLS

Answer: IPSec

Answer: SSH

Answer: WPA2


Question: What is fragroute primarily used for?

Answer: Altering network routes

Answer: Capturing fragmented packets

Answer: Fragmenting application traffic

Answer: Fragmenting layer 2 and layer 3 headers


Question: 以下哪种传输协议在设计时考虑了数据安全和合规性，适合用于跨境数据传输？

Answer: FTP

Answer: HTTP

Answer: HTTPS

Answer: SMTP


Question: 哪种网络防护技术主要用于阻止未经授权的设备接入网络？

Answer: 入侵检测系统（IDS）

Answer: 访问控制列表（ACL）

Answer: 端点保护平台（EPP）

Answer: 蜜罐技术


Question: 以下哪种技术用于在不直接与目标交互的情况下发现网络服务？

Answer: 端口扫描

Answer: DNS侦察

Answer: SYN扫描

Answer: TCP全连接扫描


Question: 以下哪种技术主要用于防止网络足迹追踪，保护个人隐私？

Answer: IP匿名网络

Answer: 数据加密

Answer: 双因素认证

Answer: 入侵检测系统


Question: 虚拟专用网VPN是一种新型的网络安全传输技术，为数据传输和网络服务提供安全通道。VPN架构采用的多种安全机制中，不包括（  ）

Answer: 隧道技术

Answer: 信息隐藏技术

Answer: 密钥管理技术

Answer: 身份认证技术


Question: Lance has been brought in as a new security officer for a large  medical equipment company. He has been told that many of the firewalls and  IDS products have not been configured to filter IPv6 traffic; thus, many  attacks have been taking place without the knowledge of the security team.  While the network team has attempted to implement an automated tunneling  feature to take care of this issue, they have continually run into problems  with the network’s NAT device. Lance has also found out that caching attacks  have been successful against the company’s public-facing DNS server. He has  also identified that extra authentication is necessary for current LDAP  requests, but the current technology only provides password-based  authentication options.Which of the following is the best countermeasure for the attack type  addressed in the scenario?

Answer: DNSSEC

Answer: IPSec

Answer: Split server configurations

Answer: Disabling zone transfers


Question: 以下哪种安全审计方法最适合定期检查组织的网络配置以发现潜在弱点？

Answer: 人工审核

Answer: 自动化扫描工具

Answer: 社会工程学

Answer: 蜜罐技术


Question: 以下哪种网络钓鱼技巧通常用于欺骗用户点击恶意链接？

Answer: 社会工程学

Answer: 键盘记录器

Answer: 恶意软件感染

Answer: 拒绝服务攻击


Question: 如果要检查本机的 ip 协议是否工作正常，则应该 ping 的地址是（）。

Answer: 192.168.0.1

Answer: 10.1.1.1

Answer: 127.0.0.1

Answer: 128.0.1.1


Question: 当 tcp 实体要建立连接时，其段头中的（ ）标志置 1。

Answer: syn

Answer: fin

Answer: rst

Answer: urg


Question: 假设生产管理网络系统采用 b/s 工作方式，经常上网用户数为 150 个，每用户每分钟产生 8 个事务处理任务，平均事务量大小为 0.05mb，则这个系统需要的信息传输速率为（ ）。

Answer: 4mb/s

Answer: 6mb/s

Answer: 8mb/s

Answer: 12mb/s


Question: 以下哪种安全协议主要用于加密和保护通过互联网传输的敏感数据？

Answer: TLS（传输层安全）

Answer: SSH（安全外壳协议）

Answer: SNMP（简单网络管理协议）

Answer: FTP（文件传输协议）


Question: 在系统加固过程中，以下哪项操作最能增强系统的安全性？

Answer: 禁用不必要的服务和端口

Answer: 增加系统日志记录的详细程度

Answer: 安装尽可能多的安全软件

Answer: 允许所有用户远程访问


Question: 以下哪种防火墙技术可以检查进出网络的数据包的完整内容，包括应用层的数据？

Answer: 包过滤防火墙

Answer: 应用网关防火墙（也称为代理防火墙）

Answer: 状态检测防火墙

Answer: 电路级网关防火墙


Question: 以下哪种网络安全协议用于在不安全的网络上建立安全的HTTPS连接？

Answer: SSL（Secure Sockets Layer）

Answer: TLS（Transport Layer Security）

Answer: IPSec（Internet Protocol Security）

Answer: WPA2（Wi-Fi Protected Access 2）


Question: 以下哪种技术可以防止未经授权的网络监控，保护个人或组织的通信隐私？

Answer: 数据加密

Answer: 防火墙

Answer: 入侵检测系统

Answer: 反病毒软件