secbench-hf/SecBench huggingface dataset:
领域/Domain: 身份与访问控制
Question: 在访问控制策略中，以下哪项最能防止内部员工非法访问敏感的财务数据？
Options:
应用数据备份策略以防止数据丢失
实施基于角色的访问控制(RBAC)
执行隐私合规培训，提高员工意识
采用加密技术隐藏数据内容
Answer: B
领域/Domain: 身份与访问控制
Question: Which format is the most commonly used standard for exchanging information within a federated identity system?
Options:
XML
HTML
SAML
JSON
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种协议主要用于企业级环境，允许用户在多个不同的服务提供者之间进行身份验证，而只需要登录一次？
Options:
OAuth2.0
OpenID Connect
SAML协议
HTTP Digest Authentication
Answer: C
领域/Domain: 身份与访问控制
Question: This is a common security issue that is  extremely hard to control in large environments. It occurs when a user has  more computer rights, permissions, and privileges that what is required for  the tasks the user needs to fulfill. What best describes this scenario?
这是一个在大型环境中常见的非常难以控制的安全问题。它发生在当用户拥有超出完成任务需要的更多的计算机权利、许可和特权。这说的是？
Options:
Excessive Rights 过多的权利
Excessive Access 过多的访问
Excessive Permissions 过多的许可
Excessive Privileges 过多的特权
Answer: D
领域/Domain: 身份与访问控制
Question: The Reference Validation Mechanism that ensures the authorized access relationships between subjects and objects is implementing which of thefollowing concept:
Options:
The reference monitor.
Discretionary Access Control.
The Security Kernel.
Mandatory Access Control.
Answer: A
领域/Domain: 身份与访问控制
Question: In the context of Biometric authentication, there is a quick way to compare the accuracy of devices. In general, the devices that have the lowestvalue would be the most accurate. Which of the following would be used to compare accuracy of devices?
Options:
the CER is used.
the FRR is used
the FAR is used
the FER is used
Answer: A
领域/Domain: 身份与访问控制
Question: As with logical access controls, audit logs should be produced and monitored for physical access controls. Which of the following statements is correct about auditing physical access?
Options:
Unsuccessful access attempts should be logged but only need to be reviewed by a security guard.
Only successful access attempts should be logged and reviewed.
Only unsuccessful access attempts during unauthorized hours should be logged and reviewed.
All unsuccessful access attempts should be logged and reviewed.
Answer: D
领域/Domain: 身份与访问控制
Question: What kind of certificate is used to validate a user identity?
Options:
Public key certificate
Attribute certificate
Root certificate
Code signing certificate
Answer: A
领域/Domain: 身份与访问控制
Question: 在OAuth 2.0中，授权码流程的主要目的是什么？
Options:
直接向资源服务器请求资源
通过授权服务器安全地获取访问令牌
向用户展示广告
收集用户数据
Answer: B
领域/Domain: 身份与访问控制
Question: 在多因素认证中，以下哪种方法不被视为第二因素？
Options:
短信验证码
记住我（Remember Me）功能
生物特征（如指纹）
硬件安全令牌
Answer: B
领域/Domain: 身份与访问控制
Question: Which of the following benets does Role Based Access Control (RBAC) provide for the access review process?
Options:
Lowers the amount of access requests after review
Gives more control into the revocation phase
Gives more ne-grained access analysis to accesses
Lowers the number of items to be reviewed
Answer: C
领域/Domain: 身份与访问控制
Question: 在访问控制模型中，以下哪项原则是指用户只能访问他们被授权访问的信息和资源？
Options:
最小权限原则
职责分离原则
需要知道原则
审计日志原则
Answer: C
领域/Domain: 身份与访问控制
Question: What is the MOST effective method to  enhance security of a Single Sign-On (SSO) solution that interfaces with  critical systems?
下面哪个是最有效的方法，来增强关键系统的单点登录解决方案的安全性？
Options:
High performance encryption algorithms
高性能加密算法
Reusable tokens for application-level authentication
应用级认证的可重用令牌
Transport Layer Security (TLS) for all communications
所有通信采用TLS加密
Two-factor authentication
双因素验证
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪个协议允许不同认证系统的互操作性？
Options:
SAML (Security Assertion Markup Language)
OAuth 2.0
FIDO (Fast IDentity Online)
Kerberos
Answer: A
领域/Domain: 身份与访问控制
Question: 以下哪种技术可以防止未经授权的用户访问特定资源？
Options:
SSL\\/TLS证书
数据备份与恢复策略
访问控制列表（ACL）
哈希函数
Answer: C
领域/Domain: 身份与访问控制
Question: Which security model uses division of operations into different parts and requires different users to perform each part?
Options:
Bell-LaPadula model
Biba model
Clark-Wilson model
Non-interference model
Answer: C
领域/Domain: 身份与访问控制
Question: 在多因素认证中，哪种因素最难被攻击者伪造？
Options:
基于知识的密码
基于拥有的硬件令牌
基于生物识别的指纹
基于位置的GPS坐标
Answer: C
领域/Domain: 身份与访问控制
Question: Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution ofsecret keys and provides additional access control support?
Options:
SESAME
RADIUS
KryptoKnight
TACACS+
Answer: A
领域/Domain: 身份与访问控制
Question: Which of the following access control models introduces user security clearance and data classification?
Options:
Role-based access control
Discretionary access control
Non-discretionary access control
Mandatory access control
Answer: D
领域/Domain: 身份与访问控制
Question: 双因素认证与多因素认证的主要区别是什么？
Options:
双因素认证不需要密码
多因素认证只使用生物识别
双因素认证使用两种认证因素，而多因素认证使用两种以上
多因素认证不包括令牌认证
Answer: C
领域/Domain: 身份与访问控制
Question: Alice and Bob want to use the Internet to communicate privately. They each have theirown asymmetric key pairs and want to use them to create temporary symmetric keys foreach connection or session. Which of the following will enable them to do this?
Options:
Remote Authentication Dial-In User Service (RADIUS)
Rivest-Shamir-Adelman (RSA) encryption
Diffie-Hellman exchange
Terminal Access Controller Access-Control System (TACACS)
Answer: C
领域/Domain: 身份与访问控制
Question: 在用户权限管理中，以下哪种做法最不利于防止内部威胁？
Options:
根据员工角色和职责分配最小权限
定期审查和更新用户权限
为所有员工设置统一的高权限账户
实施多因素认证（MFA）
Answer: C
领域/Domain: 身份与访问控制
Question: To control access by a subject (an active entity such as  individual or process) to an object (a passive entity such as a file)  involves setting up:
Options:
Access Rules
Access Matrix
Identification controls
Access terminal
Answer: A
领域/Domain: 身份与访问控制
Question: Tanya is working with the company’s internal software development team. Before a user of an application can access files located on the company’s centralized server, the user must present a valid one-time password, which is generated through a challenge/response mechanism. The company needs to tighten access control for these files and reduce the number of users who can access each and every file. The company is looking to Tanya and her team for solutions to better protect the data that has been classified and deemed critical to the company’s missions. Tanya has also been asked to implement a single sign-on technology for all internal users, but she does not have the budget to implement a public key infrastructure.
Which of the following best describes what is currently in place?
Options:
Capability-based access system
Synchronous tokens that generate one-time passwords
RADIUS
Kerberos
Answer: A
领域/Domain: 身份与访问控制
Question: What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?
Options:
Authentication
Identification
Authorization
Confidentiality
Answer: B
领域/Domain: 身份与访问控制
Question: A periodic review of user account management should NOT determine:
Options:
conformity with the concept of least privilege.
whether active accounts are still being used.
strength of user-chosen passwords.
whether management authorizations are up-to-date.
Answer: C
领域/Domain: 身份与访问控制
Question: 在多因素认证中，以下哪一项通常不被视为一个独立的认证因素？
Options:
生物识别信息（如指纹）
用户知道的信息（如密码）
用户拥有的物品（如智能包）
用户的地理位置
Answer: D
领域/Domain: 身份与访问控制
Question: 在零信任安全模型中，以下哪项原则强调了用户只能访问完成其工作所需的最小权限资源？
Options:
微分段
最小权限
持续验证
多因素认证
Answer: B
领域/Domain: 身份与访问控制
Question: 零信任原则的核心理念是什么？
Options:
信任所有内部网络流量
默认情况下不信任任何内部或外部网络流量，直到经过验证
仅信任内部网络流量
信任所有外部网络流量
Answer: B
领域/Domain: 身份与访问控制
Question: 在多因素认证中，以下哪种安全协议通常用于确保设备与服务器之间的通信安全？
Options:
TLS（传输层安全）
FTP（文件传输协议）
HTTP（超文本传输协议）
IMAP（Internet消息访问协议）
Answer: A
领域/Domain: 身份与访问控制
Question: 在多级安全模型中，以下哪种访问控制机制允许用户访问与其安全级别相匹配或更低级别的信息？
Options:
强制访问控制（MAC）
自主访问控制（DAC）
基于角色的访问控制（RBAC）
访问控制列表（ACL）
Answer: A
领域/Domain: 身份与访问控制
Question: Which authentication technique BEST protects against hijacking?
Options:
Static authentication
Continuous authentication
Robust authentication
Strong authentication
Answer: B
领域/Domain: 身份与访问控制
Question: 在零信任安全模型中，以下哪项不是持续验证的关键组成部分？
Options:
实时监控用户行为
定期进行风险评估
基于角色的访问控制
动态调整访问策略
Answer: C
领域/Domain: 身份与访问控制
Question: 在网络安全中，哪种技术用于确保用户身份的真实性？
Options:
安全协议
防火墙技术
身份验证
入侵检测
Answer: C
领域/Domain: 身份与访问控制
Question: 在移动设备的身份认证机制中，以下哪项不是常见的认证因素？
Options:
知识因素（如密码）
拥有因素（如智能卡）
生物特征因素（如指纹）
地理位置因素
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪种身份验证模型允许用户通过提供与他们身份相关联的物理设备来验证自己的身份？
Options:
基于知识的身份验证
基于拥有的身份验证
基于行为的身份验证
基于身份的加密
Answer: B
领域/Domain: 身份与访问控制
Question: 在基于角色的访问控制(RBAC)模型中，以下哪项不是RBAC的核心组成部分？
Options:
角色定义
权限分配
用户组管理
会话管理
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪一项能有效验证交易的发起人？
Options:
在发起人和接收者之间使用加密密码。
使用接收者的公钥加密交易。
使用可移植文档格式封装交易内容。
使用来源者的私钥对交易执行数字签名。
Answer: D
领域/Domain: 身份与访问控制
Question: Which of the following is an example of discretionary access control?
Options:
Identity-based access control
Task-based access control
Role-based access control
Rule-based access control
Answer: A
领域/Domain: 身份与访问控制
Question: 安全认证机制的主要目的是什么？
Options:
提高邮件发送速度
防止未经授权的访问
增加邮件附件的大小限制
减少邮件服务器的负载
Answer: B
领域/Domain: 身份与访问控制
Question: 下面哪个是检查时间/使用时间（TOC/TOU）问题的实例？
Options:
A user whose profile has been revoked logs on using the password of a  valid user of the system.
A user logs on with a valid profile which is revoked without termination  of the session.
A user session is terminated immediately after the user profile is  revoked.
A user session is not validated until after the log on.
Answer: B
领域/Domain: 身份与访问控制
Question: 以下哪种权限管理策略有助于防止内部威胁并确保最小权限原则？
Options:
所有用户都拥有系统管理员权限
根据角色分配权限
用户可以自由共享他们的账户和密码
每个用户对所有资源都有完全访问权限
Answer: B
领域/Domain: 身份与访问控制
Question: 以下哪种访问控制模型允许管理员根据用户角色分配权限，以管理大量用户的访问权限？
Options:
强制访问控制（MAC）
自主访问控制（DAC）
基于属性的访问控制（ABAC）
角色基础访问控制（RBAC）
Answer: D
领域/Domain: 身份与访问控制
Question: 在零信任环境中，以下哪项措施不是用来增强身份验证和访问控制的？
Options:
使用生物识别技术
实施网络微隔离
采用单点登录系统
应用基于角色的访问控制
Answer: B
领域/Domain: 身份与访问控制
Question: 以下哪种访问控制策略是零信任网络架构的关键组成部分？
Options:
最小权限原则
基于角色的访问控制（RBAC）
强制访问控制（MAC）
所有用户都具有管理员权限
Answer: A
领域/Domain: 身份与访问控制
Question: Which of the following can best dene the "revocation request grace period"?
Options:
The period of time allotted within which the user must make a revocation request upon a revocation reason
Minimum response time for performing a revocation by the CA
Maximum response time for performing a revocation by the CA
Time period between the arrival of a revocation request and the publication of the revocation information
Answer: C
领域/Domain: 身份与访问控制
Question: Terminal Access Controller Access-Control System (TERMINALAccessControllerAccess-ControlSystem, TACACS), during the authentication process, the client sends a START packet to the server, which includes information about the type of authentication being performed, the user name, etc. The START packet is only used at the beginning of an authentication session The START packet is used only at the beginning of an authentication session, and the sequence number is always (). After the server receives the START packet, it sends back a REPLY packet indicating whether the authentication continues or ends.
Options:
0
1
2
4
Answer: B
领域/Domain: 身份与访问控制
Question: Which item is not part of a Kerberos authentication implementation?
Options:
Message authentication code
Ticket granting service
Authentication service
Users, programs, and services
Answer: A
领域/Domain: 身份与访问控制
Question: RADIUS incorporates which of the following services?
Options:
Authentication server and PIN codes.
Authentication of clients and static passwords generation.
Authentication of clients and dynamic passwords generation.
Authentication server as well as support for Static and Dynamic passwords.
Answer: D
领域/Domain: 身份与访问控制
Question: 在SSO系统中，令牌机制的主要作用是什么？
Options:
用于存储用户的登录信息
用于加密和解密用户数据
用于在不同服务间传递认证和授权信息
用于监控用户行为
Answer: C
领域/Domain: 身份与访问控制
Question: 访问控制列表（ACL）的主要作用是什么？
Options:
记录用户登录历史
定义用户身份认证方式
指定哪些用户或系统可以访问特定资源
监控系统性能
Answer: C
领域/Domain: 身份与访问控制
Question: 在权限模型中，以下哪项不是访问控制列表（ACL）的主要功能？
Options:
定义用户对特定资源的访问权限
实现基于角色的访问控制（RBAC）
记录用户对资源的访问历史
控制用户对资源的读写操作
Answer: B
领域/Domain: 身份与访问控制
Question: Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplishe
Options:
through access control mechanisms that require identication and authentication and through the audit function.
through logical or technical controls involving the restriction of access to systems and the protection of information.
through logical or technical controls but not involving the restriction of access to systems and the protection of information.
through access control mechanisms that do not require identication and authentication and do not operate through the audit function.
Answer: A
领域/Domain: 身份与访问控制
Question: 以下哪种身份验证机制对防止网络欺诈最有效？
Options:
单一因素身份验证（如密码）
双因素身份验证（如密码+短信验证码）
基于IP地址的身份验证
基于用户行为的身份验证
Answer: B
领域/Domain: 身份与访问控制
Question: A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
Options:
Concern that the laser beam may cause eye damage.
The iris pattern changes as a person grows older.
There is a relatively high rate of false accepts.
The optical unit must be positioned so that the sun does not shine into the aperture.
Answer: D
领域/Domain: 身份与访问控制
Question: 公司的呼叫中心 IT 政策要求为所有用户指定独一无二的用户账户。如果发现并非所有当前用户均符合此要求，最适当的建议是什么？
Options:
让营运管理人员审批当前配置。
确保现有的所有账户都有审计轨迹。
为所有员工实施独立的用户账户。
修改IT政策以允许使用共享账户。
Answer: C
领域/Domain: 身份与访问控制
Question: Which of the following accurately describes Identity as a  Service (IDaaS)?
Options:
A form of single sign-on (SSO) that spans multiple entities in an  enterprise
A form of SSO that spans multiple independent enterprises
A way to provide SSO without multiple forms of authentication
A way to demonstrate identity without having to sign on
Answer: B
领域/Domain: 身份与访问控制
Question: 在零信任安全模型中，以下哪项措施最直接地对应于威胁情报的利用？
Options:
定期进行内部网络扫描以发现异常活动
实施多因素认证以增强用户身份验证
基于风险的访问控制，利用威胁情报对用户和设备进行动态评估
建立入侵检测系统（IDS）以监控网络流量
Answer: C
领域/Domain: 身份与访问控制
Question: Which of the following controls related to physical security is NOT an administrative control?
Options:
Personnel controls
Alarms
Training
Emergency response and procedures
Answer: B
领域/Domain: 身份与访问控制
Question: 在文件系统中，以下哪种权限模型允许管理员为每个用户分配特定的文件访问权限？
Options:
基于角色的访问控制（RBAC）
强制访问控制（MAC）
自主访问控制（DAC）
基于策略的访问控制（PBAC）
Answer: C
领域/Domain: 身份与访问控制
Question: Revocation and reissuing of compromised credentials is impossible for which of the following authentication techniques?
Options:
Biometric data.
Picture passwords.
Personal identification number.
Radio frequency identification.
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪种访问控制策略允许管理员定义一组规则，根据用户属性、时间、网络位置等来控制访问？
Options:
自主访问控制
强制访问控制
基于策略的访问控制
基于角色的访问控制
Answer: C
领域/Domain: 身份与访问控制
Question: 生物识别技术中，以下哪项不属于常见的生物特征？
Options:
指纹识别
虹膜扫描
声音识别
密码输入
Answer: D
领域/Domain: 身份与访问控制
Question: A password is a technique used to obfuscate, where the user wants normal (recognizable) information to be transformed into unrecognizable information. However, this unrecognizable information can be partially reprocessed and recovered and cracked. Xiaogang is a new employee of a company, and the company requires him to register an account for the company's website. Xiaogang uses a safer password, so which one of the following options is the most secure ()
Options:
Use the same password as the username
Select a passphrase that can be found in any dictionary or language
Select any passphrase related to personal information
Takes a mix of numbers, letters and special symbols and is easy to memorize.
Answer: D
领域/Domain: 身份与访问控制
Question: 在认证协议中，以下哪种协议提供了前向保密性？
Options:
SSL\/TLS
Kerberos
RADIUS
LDAP
Answer: A
领域/Domain: 身份与访问控制
Question: 某windows系统用户名为Admin，该系统开启了账户策略中的口令符合复杂性的策略，并限制密码长度最小值为6个字符，以下哪个口令是符合策略要求会被系统接受的（）
Options:
Admin246!
a135!
AdILN153!
2w3e4dfg
Answer: C
领域/Domain: 身份与访问控制
Question: 多因素认证通常包含以下哪三种类型的因素？
Options:
知识因素、所有权因素、生物特征因素
知识因素、行为因素、环境因素
知识因素、所有权因素、位置因素
知识因素、行为因素、生物特征因素
Answer: B
领域/Domain: 身份与访问控制
Question: Of the following, what is the primary item that a capability table is based upon?
Options:
A subject
An object
A product
An application
Answer: A
领域/Domain: 身份与访问控制
Question: The three classic ways of authenticating yourself to the  computer security software are by something you know, by something you have,  and by
something:
Options:
you need.
non-trivial
you are.
you can get.
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种情况体现了权限继承的概念？
Options:
在Windows域环境中，用户账户被添加到一个具有特定权限的组
在Linux系统中，使用chown命令更改文件的所有者
在数据库中，创建一个新的表并设置其默认权限
在Web服务器上，为特定目录设置访问控制列表
Answer: A
领域/Domain: 身份与访问控制
Question: 在防止钓鱼攻击中，哪种身份验证方法可以提供额外的安全层，使得即使用户密码被窃取，攻击者也无法轻易访问系统？
Options:
一次性密码
静态密码
基于知识的身份验证
基于拥有的身份验证
Answer: A
领域/Domain: 身份与访问控制
Question: 分析表明，攻击者通过TLS  VPN网关获得了访问网络的权限后侵入了网络。攻击者是在猜出了用户名并使用了暴力破解得到了密码后获得访问权限的。以下哪一项最有助于降低这一风险？
Options:
在VPN上实施强密码验证
将VPN和集中身份存储集成
改用IPsec VPN
使用双因素验证
Answer: D
领域/Domain: 身份与访问控制
Question: Kerberos can prevent which one of the following attacks?
Options:
Tunneling attack.
Playback (replay) attack.
Destructive attack.
Process attack.
Answer: B
领域/Domain: 身份与访问控制
Question: 88. What technique do API developers most commonly use to limit  access to an API to autho-rized individuals and applications?
Options:
Encryption
Input validation
API keys
IP filters
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种身份验证模型允许用户使用单一的凭据登录，然后可以访问多个相互信任的网络服务？
Options:
单点登录（SSO）模型
基于生物特征的身份验证模型
基于令牌的身份验证模型
基于挑战-响应的身份验证模型
Answer: A
领域/Domain: 身份与访问控制
Question: Which of the following elements is NOT included in a Public Key Infrastructure (PKI)?
Options:
Timestamping
Repository
Certificate revocation
Internet Key Exchange (IKE)
Answer: D
领域/Domain: 身份与访问控制
Question: 在基于角色的访问控制（RBAC）模型中，以下哪项不是角色定义的关键组成部分？
Options:
角色名称
角色权限
角色成员
角色审计
Answer: D
领域/Domain: 身份与访问控制
Question: 在RBAC中，角色层次结构的作用是什么？
Options:
限制用户只能访问特定资源
定义角色之间的继承关系
管理用户的登录时间
控制系统的审计日志
Answer: B
领域/Domain: 身份与访问控制
Question: 以下哪种方法属于实体所有的鉴别方法（）。
Options:
用户通过自己设置的口令登录系统，完成身份鉴别
用户使用个人指纹，通过指纹识别系统的身份鉴别
用户利用和系统协商的秘密函数，对系统发送挑战进行正确应答，通过身份鉴别
用户使用智能卡完成身份鉴别
Answer: D
领域/Domain: 身份与访问控制
Question: What is the usual order of an access management process?
Options:
Access-authorization-authentication
Authentication-authorization-access
Authorization-authentication-access
Authentication-access-authorization
Answer: B
领域/Domain: 身份与访问控制
Question: Access control provides users with maximum sharing of system resources based on the management of user access rights to prevent unauthorized tampering with and misuse of information, the following does not belong to the role of access control ()
Options:
Ensure that users work properly under the system's security policy
Deny unauthorized access to illegal users
Denial of unauthorized access to legitimate users
Denial of normal access to legitimate users
Answer: D
领域/Domain: 身份与访问控制
Question: 权限管理中，以下哪种策略可以有效防止权限提升攻击？
Options:
最小权限原则
权限继承
权限合并
权限轮换
Answer: A
领域/Domain: 身份与访问控制
Question: Which of the following remote access authentication systems is the MOST robust?
Options:
TACACS+
RADIUS
PAP
TACACS
Answer: A
领域/Domain: 身份与访问控制
Question: 零信任网络架构中，以下哪项措施不是用于增强身份验证的安全性？
Options:
单点登录（SSO）
生物识别技术
细粒度访问控制
智能卡认证
Answer: C
领域/Domain: 身份与访问控制
Question: 访问控制列表（ACL）是实现访问控制的一种机制，以下哪项不是ACL的主要功能？
Options:
定义用户对资源的访问权限
记录用户的访问历史
控制用户对资源的访问方式
限制用户对资源的访问时间
Answer: B
领域/Domain: 身份与访问控制
Question: The Terminal Access Controller Access Control System (TACACS) employs which of the following?
Options:
a user ID and static password for network access
a user ID and dynamic password for network access
a user ID and symmetric password for network access
a user ID and asymmetric password for network access
Answer: A
领域/Domain: 身份与访问控制
Question: Zhao, a graduate of a university majoring in computer science and technology, is applying for a job in a large enterprise and is asked by the interview manager to give his design ideas for an access control model for the enterprise's information system. If he wants to implement an autonomous access control function for an information system with a large number of users, among the following options, the most appropriate model or approach he should take among the following options from the point of view of time and resource consumption is ().
Options:
BLP model
Biba model
Competency List (CL)
Access Control Lists (ACLs)
Answer: D
领域/Domain: 身份与访问控制
Question: 关于权限与认证，以下哪种说法是错误的？
Options:
多因素认证提高了账户安全性
基于角色的访问控制（RBAC）允许根据用户角色分配权限
明文存储密码可以简化用户找回密码的过程
限制默认账户的权限可以减少攻击面
Answer: C
领域/Domain: 身份与访问控制
Question: 在权限模拟攻击中，攻击者通常试图做什么？
Options:
获取对受害者计算机的物理访问
欺骗用户下载恶意软件
模仿合法用户的身份以获取敏感信息
利用软件漏洞执行远程代码
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种访问控制策略可以防止未经授权的员工访问高级管理人员的电子邮件？
Options:
基于角色的访问控制（RBAC）
强制访问控制（MAC）
自由访问控制（DAC）
多级安全（MLS）
Answer: A
领域/Domain: 身份与访问控制
Question: 为确保输入的密码符合由字母和数字组成这一安全政策要求，信息系统审计师应建议：
Options:
更改公司政策。
定期更改密码。
使用自动化密码管理工具。
进行安全意识培训。
Answer: C
领域/Domain: 身份与访问控制
Question: 在身份验证机制中，以下哪种方法主要用于确保用户身份的真实性？
Options:
基于角色的访问控制（RBAC）
单点登录（SSO）
多因素认证（MFA）
访问控制列表（ACL）
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪项是防止身份盗用的最有效策略之一？
Options:
定期更改所有账户的密码，并使用复杂的密码
仅在公共Wi-Fi网络上进行敏感的在线交易
忽略来自未知来源的电子邮件和消息
在所有设备上禁用多因素认证
Answer: A
领域/Domain: 身份与访问控制
Question: 在权限与认证机制中，以下哪种方法可以防止会话劫持攻击？
Options:
使用复杂的密码策略
实施多因素认证
定期更新服务器软件
使用会话ID的随机性和短生命周期
Answer: D
领域/Domain: 身份与访问控制
Question: 在零信任安全模型中，下列哪项措施不属于持续监控的范畴？
Options:
实时日志分析
定期安全审计
用户行为分析
网络流量监控
Answer: B
领域/Domain: 身份与访问控制
Question: Which of the following statements pertaining to biometrics is FALSE?
Options:
User can be authenticated based on behavior.
User can be authenticated based on unique physical attributes.
User can be authenticated by what he knows.
A biometric system's accuracy is determined by its crossover error rate (CER).
Answer: C
领域/Domain: 身份与访问控制
Question: 在身份验证的多因素认证中，以下哪项不属于常见的认证因素？
Options:
知识因素（如密码）
所有权因素（如手机接收的短信验证码）
生物特征因素（如指纹）
物理位置因素（如用户所在城市）
Answer: D
领域/Domain: 身份与访问控制
Question: 拥有高度机密信息访问权限的某个员工已辞职。离职时，应首先进行以下哪一项？
Options:
与员工进行离职面谈。
确保已制定接任计划。
撤销该员工对所有系统的访问权限。
审查该员工的工作历史记录。
Answer: C
领域/Domain: 身份与访问控制
Question: 在检测到端点上的可疑登录活动时，哪种身份验证技术最有助于确认用户身份的合法性？
Options:
静态密码
多因素认证
IP地址白名单
会话固定
Answer: B
领域/Domain: 身份与访问控制
Question: Director Zhang's computer using Windows 7 operating system, he often logged on the user name zhang, director Zhang to his personal folder set the permissions for only zhang this user has access to this directory, the administrator in a maintenance inadvertently zhang this user deleted, and then re-established a user named zhang, director Zhang zhang this user logged on to the system and found that he could not access his original personal folder because () After logging on to the system with the user name zhang, Director Zhang finds that he cannot access his original personal folder because ()
Options:
Any new user needs to be authorized to access files on the system
Windows does not consider the newly created user zhang to be the same user as the original user zhang, and therefore does not have access to the
When a user is deleted, the folder created by that user is also automatically deleted, and the new user cannot find the original user's folder and therefore cannot access it.
The newly created user zhang will inherit the permissions of the original user, and will not be able to access the folder because it is encrypted.
Answer: B
领域/Domain: 身份与访问控制
Question: Which of the following is most relevant to determining the  maximum effective cost of access control?
Options:
the value of information that is protected
management's perceptions regarding data importance
budget planning related to base versus incremental spending.
the cost to replace lost data
Answer: A
领域/Domain: 身份与访问控制
Question: Which of the following techniques can be used to implement role-based access control to protect the confidentiality of data in a database?
Options:
Encryption
View
Hash
Masking
Answer: B
领域/Domain: 身份与访问控制
Question: Which of the following Condentiality, Integrity, Availability (CIA) attribute supports the principle of least privilege by providing access toinformation only to authorized and intended users?
Options:
Condentiality
Integrity
Availability
Accuracy
Answer: A
领域/Domain: 身份与访问控制
Question: 在操作系统中，访问控制列表（ACL）主要用于实现哪种类型的权限管理？
Options:
限制特定用户对网络资源的访问
防止恶意软件通过网络传播
加密存储在硬盘上的数据
监控和记录用户活动
Answer: A
领域/Domain: 身份与访问控制
Question: 信息系统审计师最有可能以什么身份查看应用哈希函数？
Options:
身份认证。
识别。
授权。
加密。
Answer: A
领域/Domain: 身份与访问控制
Question: 在零信任安全模型中，以下哪项措施有助于限制用户对资源的访问权限？
Options:
完全开放权限
最小权限原则
无限制的网络访问
定期共享密码
Answer: B
领域/Domain: 身份与访问控制
Question: 为了防止未授权访问，以下哪种策略通常被用于限制对敏感数据的访问？
Options:
防火墙策略
数据加密
入侵检测系统（IDS）
访问控制
Answer: D
领域/Domain: 身份与访问控制
Question: Which of the following MUST be scalable to address security concerns raised by the integration of third-party identity services?
Options:
Mandatory Access Controls (MAC)
Enterprise security architecture
Enterprise security procedures
Role Based Access Controls (RBAC)
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪种方法可以防止权限模拟攻击，确保用户只能访问他们被授权的资源？
Options:
实施多因素认证
使用SSL\\/TLS加密所有通信
实现基于角色的访问控制（RBAC）
定期进行密码破解尝试
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种身份验证模型允许用户通过提供两种或更多种类型的凭据来验证自己的身份，提高了安全性？
Options:
单因素认证
多因素认证
基于知识的身份验证
基于拥有的身份验证
Answer: B
领域/Domain: 身份与访问控制
Question: 在保护网络安全时，哪种措施主要用于确保用户身份的真实性？
Options:
防火墙技术
加密通信
身份验证
安全更新与补丁
Answer: C
领域/Domain: 身份与访问控制
Question: What are the two general types of proximity identification devices?
Options:
Biometric devices and access control devices
Swipe card devices and passive devices
Preset code devices and wireless devices
User-activated devices and system sensing devices
Answer: D
领域/Domain: 身份与访问控制
Question: 在使用复杂度不高的口令时，容易产生弱口令的安全脆弱性，被攻击者利用从而破解用户账户，下列设置的口令中，（）具有最好的口令复杂度。
Options:
morrison
Wm.S*F2m5@
27776394
wangjing1977
Answer: B
领域/Domain: 身份与访问控制
Question: Lenny is a new security manager for a retail company that is  expanding its functionality to its partners and customers. The company’s CEO  wants to allow its partners’ customers to be able to purchase items through  the company’s web stores as easily as possible. The CEO also wants the  company’s partners to be able to manage inventory across companies more  easily. The CEO wants to be able to understand the network traffic and  activities in a holistic manner, and he wants to know from Lenny what typeof technology should be put into place to allow for a more proactive  approach to stopping malicious traffic if it enters the network. The company  is a high-profile entity constantly dealing with zero-day attacks.Lenny has a meeting with the internal software developers who are  responsible for implementing the necessary functionality within the web-based  system. Which of the following best describes the two items that Lenny needs  to be prepared to discuss with this team?
Options:
Service Provisioning Markup Language and the Extensible Access Control  Markup Language
Standard Generalized Markup Language and the Generalized Markup  Language
Extensible Markup Language and the Hypertext Markup Language
Service Provisioning Markup Language and the Generalized Markup  Language
Answer: A
领域/Domain: 身份与访问控制
Question: 在权限模型中，以下哪个概念用于确保进程或服务不能滥用其权限？
Options:
权限降级
特权隔离
最小权限原则
访问控制列表
Answer: B
领域/Domain: 身份与访问控制
Question: Who or what determines if an organization is going to operate under a discretionary, mandatory, or nondiscretionary access control model?
Options:
Administrator
Security policy
Culture
Security levels
Answer: B
领域/Domain: 身份与访问控制
Question: OAuth身份验证协议主要用于实现什么功能？
Options:
在用户设备上加密本地数据
验证用户身份并授权第三方应用访问资源
创建数字签名以验证消息来源
生成哈希函数以验证数据完整性
Answer: B
领域/Domain: 身份与访问控制
Question: 在某大型且复杂的组织中设计了一个新业务应用程序，并且业务主管要求基于“按需知密”原则查看各种报告。在以下访问控制方法中，哪项是实现该要求的最佳方法？
Options:
强制访问控制。
基于角色的访问控制。
自主访问控制。
单点登录。
Answer: B
领域/Domain: 身份与访问控制
Question: 在身份验证过程中，以下哪种方法可以提供最高等级的安全性？
Options:
单因素身份验证（如密码）
双因素身份验证（如密码+短信验证码）
多因素身份验证（如密码+生物特征+硬件令牌）
基于知识的身份验证（如安全问题）
Answer: C
领域/Domain: 身份与访问控制
Question: 以下哪种访问控制策略允许系统跟踪并记录用户对资源的访问行为？
Options:
强制访问控制
自主访问控制
权限分配
审计与追踪
Answer: D
领域/Domain: 身份与访问控制
Question: Which of the following offers advantages such as the ability  to use stronger passwords, easier password administration, one set of  credential, and
faster resource access?
Options:
Smart cards
Single Sign-On (SSO)
Symmetric Ciphers
Public Key Infrastructure (PKI)
Answer: B
领域/Domain: 身份与访问控制
Question: Which of the following choices describe a Challenge-response tokens generation?
Options:
A workstation or system that generates a random challenge string that the user enters into the token when prompted along with the properPI
A workstation or system that generates a random login id that the user enters when prompted along with the proper PI
A special hardware device that is used to generate ramdom text in a cryptography system.
The authentication mechanism in the workstation or system does not determine if the owner should be authenticated.
Answer: A
领域/Domain: 身份与访问控制
Question: 以下哪种授权策略可以防止未授权用户访问特定的系统资源？
Options:
多因素认证
最小权限原则
零信任网络
访问控制列表(ACL)
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪一项是最小授权原则的运用？
Options:
建立岗位轮换机制
监控和评审特权会话
建立VPN隧道连接
建立沙箱环境
Answer: D
领域/Domain: 身份与访问控制
Question: 以下哪种情况体现了身份认证中的“知道”因素？
Options:
使用指纹解锁手机
接收并输入短信验证码
插入智能卡进行身份验证
通过面部识别进入安全区域
Answer: B
领域/Domain: 身份与访问控制
Question: When is a security guard the best choice for a physical access control mechanism?
Options:
When discriminating judgment is required
When intrusion detection is required
When the security budget is low
When access controls are in place
Answer: A
领域/Domain: 基础软硬件与技术
Question: 以下关于 cpu 的叙述中，错误的是 （ ） 。
Options:
cpu 产生每条指令的操作信号并将操作信号送往相应的部件进行控制
程序控制器 pc 除了存放指令地址，也可以临时存储算术/逻辑运算结果
cpu 中的控制器决定计算机运行过程的自动化
指令译码器是 cpu 控制器中的部件
Answer: B
领域/Domain: 基础软硬件与技术
Question: 3GPP标准中，哪种加密算法被广泛用于保护移动通信的安全？
Options:
AES（Advanced Encryption Standard）
DES（Data Encryption Standard）
RSA（Rivest-Shamir-Adleman）
SHA-256（Secure Hash Algorithm 256）
Answer: A
领域/Domain: 基础软硬件与技术
Question: The Diffie-Hellman algorithm is primarily used to provide which of the following?
Options:
Confidentiality
Key Agreement
Integrity
Non-repudiation
Answer: B
领域/Domain: 基础软硬件与技术
Question: What can be dened as a momentary low voltage?
Options:
spike
blackout
sag
fault
Answer: C
领域/Domain: 基础软硬件与技术
Question: 5G 采用的正交振幅调制（Quadrature Amplitude Modulation,QAM）技术中，2560QAM 的一个载波上可以调制（）比特信息。
Options:
2
4
6
8
Answer: D
领域/Domain: 基础软硬件与技术
Question: 下面关于 rs-232-c 标准的描述中，正确的是（ ）。
Options:
可以实现长距离远程通信
可以使用 9 针或 25 针 d 型连接器
必须采用 24 根线韵电缆进行连接
诵常用于连接并行打印机
Answer: B
领域/Domain: 基础软硬件与技术
Question: a=17,b=2,则满足 a 与 b 取模同余的是（ ）。
Options:
4
5
6
7
Answer: B
领域/Domain: 基础软硬件与技术
Question: What would you get from running the command dig ns domain.com?
Options:
Mail exchanger records for domain.com
Name server records for domain.com
Caching name server for domain.com
IP address for the hostname ns
Answer: B
领域/Domain: 基础软硬件与技术
Question: 计算机运行过程中，CPU 需要与外设进行数据交换。采用（）控制技术时，CPU 与外设可并行工作。
Options:
程序查询方式和中断方式
中断方式和 DMA 方式
程序查询方式和 DMA 方式
程序查询方式、中断方式和 DMA 方式
Answer: B
领域/Domain: 基础软硬件与技术
Question: Which software development model is actually a meta-model that incorporates a number of the software development models?
Options:
The Waterfall model
The modied Waterfall model
The Spiral model
The Critical Path Model (CPM)
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在 OraclE中，将 scott 的资源文件改为 otherprofilE，下列哪个是正确的？(    )
Options:
ALTER PROFILEUSER scott otherprofilE
ALTER otherprofilEUSER scottPROFILE
ALTER USER scott PROFILEotherprofilE
ALTER scott USER PROFILEotherprofilE
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在硬盘结构中，哪个部分存储了文件系统的元数据，如文件分配表（FAT）或inode？
Options:
引导扇区
数据扇区
主引导记录（MBR）
超级块（Superblock）
Answer: D
领域/Domain: 基础软硬件与技术
Question: Which of the following does NOT concern itself with key management?
Options:
Internet Security Association Key Management Protocol (ISAKMP)
Diffie-Hellman (DH)
Cryptology (CRYPTO)
Key Exchange Algorithm (KEA)
Answer: C
领域/Domain: 基础软硬件与技术
Question: What does "System Integrity" mean?
Options:
The software of the system has been implemented as designed.
Users can't tamper with processes they do not own.
Hardware and firmware have undergone periodic testing to verify that they are functioning properly.
Design specifications have been verified against the formal top-level specification.
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following management shares does not exist ()
Options:
C$
D$
ADMIN$
1$
Answer: D
领域/Domain: 基础软硬件与技术
Question: 在 linux 中，更改用户口令的命令是（ ）
Options:
pwd
passwd
kouling
password
Answer: B
领域/Domain: 基础软硬件与技术
Question: The main current algorithms based on symmetric key systems are. ( )
Options:
RSA
DES
AES
DSA
Answer: BC
领域/Domain: 基础软硬件与技术
Question: In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?
Options:
Subordinate CA
Top Level CA
Big CA
Master CA
Answer: B
领域/Domain: 基础软硬件与技术
Question: Windows 中，在命令行输入（ ）命令可以得到如下的回显。Server: UnKnown
Adress: 159.47.11.80
xxx.edu.cn
primary name server = nsl.xxx.edu.cn responsible mail addr = mailxxx.edu.cn serial = 2020061746
refresh= 1200(20 mins)
retry= 7200(2 hours)
expire = 3600(1 hour)
default TTL = 3600(1 hour)
Options:
nslookup -type=A xxx.edu.cn
nslookup -type=CNAME xxx.edu.cn
nslookup -type=NS xxx.edu.cn
nlookup type=PTR xxx.edu.cn
Answer: C
领域/Domain: 基础软硬件与技术
Question: What does DEA stand for?
Options:
Data Encoding Algorithm
Data Encoding Application
Data Encryption Algorithm
Digital Encryption Algorithm
Answer: C
领域/Domain: 基础软硬件与技术
Question: 下列哪个命令可以显示出当前目录
Options:
echo $(pwd)
echo pwd
$pwd
pwd | echo
Answer: A
领域/Domain: 基础软硬件与技术
Question: The basic features of standardization are correctly understood ()
Options:
Standardization as an activity
The object of standardization is people, things and objects
The benefits of standardization can only be realized after application
All of the above is correct.
Answer: D
领域/Domain: 基础软硬件与技术
Question: 衡量系统可靠性的指标是（）。
Options:
周转时间和故障率λ
周转时间和吞吐量
平均无故障时间 MTBF 和故障率λ
平均无故障时间 MTBE 和吞吐量
Answer: C
领域/Domain: 基础软硬件与技术
Question: What is the PRIMARY purpose of using redundant array of inexpensive disks (RAID) level zero?
Options:
To improve system performance.
To maximize usage of hard disk space.
To provide fault tolerance and protection against le server hard disk crashes.
To implement integrity.
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在 windows 中，ping 命令的-n 选项表示 （ ） 。
Options:
ping 的次数
ping 的网络号
用数字形式显示结果
不要重复，只 ping 一次
Answer: A
领域/Domain: 基础软硬件与技术
Question: Most APIs will support a variety of different data formats or structures.However, the SOAP API will only support which one of the following data formats?
Options:
XML
XSLT
JSON
SAML
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在操作系统中，以下哪种加密技术最适合用于保护用户数据的机密性？
Options:
对称加密
非对称加密
哈希加密
数字签名
Answer: A
领域/Domain: 基础软硬件与技术
Question: 正交幅度调制 16-qam 的数据速率是码元速率的（）倍。
Options:
2
4
8
16
Answer: B
领域/Domain: 基础软硬件与技术
Question: What is the process that RAID Level 0 uses as it creates one large disk by using several disks?
Options:
striping
mirroring
integrating
clustering
Answer: A
领域/Domain: 基础软硬件与技术
Question: The message sender digitally signs the message using __________.
Options:
Your own private key
Your own public key
Counterparty's private key
Counterparty's public key
Answer: A
领域/Domain: 基础软硬件与技术
Question: 下列选项中， （ ） 不属于 windows 的网络应用程序接口（api）。
Options:
winsock
nfs
rpc
netbios
Answer: B
领域/Domain: 基础软硬件与技术
Question: What language is used in the Simple Object Access Protocol (SOAP) application designprotocol?
Options:
Hypertext Markup Language (HTML)
509
Extensible Markup Language (XML)
Hypertext Transfer Protocol (HTTP)
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在PKI中，不属于CA的任务是（）。
Options:
证书的颁发
证书的审批
证书的备份
证书的加密
Answer: D
领域/Domain: 基础软硬件与技术
Question: (    )是指电子系统或设备在自己正常工作产生的电磁环境下，电子系统或设备之间的相互之间的相互不影响的电磁特性。
Options:
电磁兼容性
传导干扰
电磁干扰
辐射干扰
Answer: A
领域/Domain: 基础软硬件与技术
Question: 基于组件的开发方法的主要优点是：
Options:
可以管理各种数据类型。
实现对复杂关系进行建模。
能够满足不断变化的环境需求。
支持多种开发环境。
Answer: D
领域/Domain: 基础软硬件与技术
Question: Which of the following statements about Type 1 hypervisors is true?
Options:
The hardware vendor and software vendor are different.
The hardware vendor and software vendor are the same
The hardware vendor provides an open platform for software vendors.
The hardware vendor and software vendor should always be different for the sake of security.
Answer: B
领域/Domain: 基础软硬件与技术
Question: 在 xdsl 技术中，能提供上下行信道非对称传输的技术是（ ）。
Options:
hdsl
adsl
sdsl
isdn dsl
Answer: B
领域/Domain: 基础软硬件与技术
Question: What information does a buffer overflow intend to control?
Options:
Stack pointer
Frame pointer
Instruction pointer
Buffer pointer
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在操作系统中，以下哪种安全模型主要用于实现访问控制，确保只有授权用户才能访问系统资源？
Options:
Bell-LaPadula模型
Biba完整性模型
Clark-Wilson完整性模型
Chinese Wall模型
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在安全套接层（SSL）协议中，下列哪项不是其主要功能？
Options:
数据加密
身份验证
数据压缩
数据完整性保护
Answer: C
领域/Domain: 基础软硬件与技术
Question: In which state must a computer system be operated to handle  input or output instructions?
Options:
Inter-process communication
State detection
User mode
Management mode
Answer: A
领域/Domain: 基础软硬件与技术
Question: 恶意代码是指为达到恶意目的而专门设计的程序或代码。以下恶意代码中，属于脚本病毒的是 （  ）。
Options:
Worm. Sasser, f
Trojan. Huigezi. a
Harm. formatC. f
Script. Redlof
Answer: D
领域/Domain: 基础软硬件与技术
Question: 如果主存容量为 16m 字节，且按字节编址，表示该主存地址至少应需要 （ ） 位。
Options:
16
20
24
32
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following choices describe a condition when RAM and Secondary storage are used together?
Options:
Primary storage
Secondary storage
Virtual storage
Real storage
Answer: C
领域/Domain: 基础软硬件与技术
Question: The following are not Unix operating system log files ()
Options:
wtmp\/wtmpx
SecEvent.
utmp\/utmpx
Lastlog
Answer: B
领域/Domain: 基础软硬件与技术
Question: Because ordinary cable introduces a toxic hazard in the event of re, special cabling is required in a separate area provided for air circulation forheating, ventilation, and air-conditioning (sometimes referred to as HVAC) and typically provided in the space between the structural ceiling and adrop-down ceiling. This area is referred to as the:
Options:
smoke boundary area.
re detection area.
plenum area.
intergen area.
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following is NOT an application or utility to apply and enforce baselines on a system?
Options:
Chef
GitHub
Puppet
Active Directory
Answer: B
领域/Domain: 基础软硬件与技术
Question: 下列叙述中，与提高软件可移植性相关的是 （ ） 。
Options:
选择时间效率高的算法
尽可能减少注释
选择空间效率高的算法
尽量用高级语言编写系统中对效率要求不高的部分
Answer: D
领域/Domain: 基础软硬件与技术
Question: 计算机在一个指令周期的过程中，为从内存读取指令操作码，首先要将（ ）的内容送到地址总线上。
Options:
指令寄存器（ir）
通用寄存器（gr）
程序计数器（pc）
状态寄存器（psw）
Answer: C
领域/Domain: 基础软硬件与技术
Question: 算术表达式 a+(b-c)*d 的后缀式是 （ ） （+、-、*表示算术的加、减、乘运算，运算符的优先级和结合性遵循惯例）。
Options:
b c – d * a +
a b c – d * +
a b + c – d *
a b c d – * +
Answer: B
领域/Domain: 基础软硬件与技术
Question: Who was involved in developing the first public key algorithm?
Options:
Adi Shamir
Ross Anderson
Bruce Schneier
Martin Hellman
Answer: D
领域/Domain: 基础软硬件与技术
Question: 如何创建软链接
Options:
ln
ln -s <文件名>
ln -h <文件名>
ln -s <source> <destination>
Answer: D
领域/Domain: 基础软硬件与技术
Question: 97. What software development concept was pioneered by the  Defense Department in the1990s as an effort to bring together diverse product development  teams?
Options:
Integrated product team
Agile methodology
Scrum approach
User stories
Answer: A
领域/Domain: 基础软硬件与技术
Question: Which of the following is based on the fact that it is hard to  factor large numbers into two original prime numbers?
Options:
ECC
RSA
DES
Diffie-Hellman
Answer: B
领域/Domain: 基础软硬件与技术
Question: 在程序执行过程中，cache 与主存的地址映像由 （ ） 。
Options:
硬件自动完成
程序员调度
操作系统管理
程序员与操作系统协同完成
Answer: A
领域/Domain: 基础软硬件与技术
Question: Which of the following RAID levels is not used in practice and was quickly superseded by the more exible levels?
Options:
RAID Level 0
RAID Level 1
RAID Level 2
RAID Level 7
Answer: C
领域/Domain: 基础软硬件与技术
Question: What is the main function of the Amnesic Incognito Live System or TAILS device?
Options:
It allows the user to run a self-contained computer from a USB device.
It accesses systems with a credential that leaves no discernable tracks.
It encrypts data stored on any computer on a network.
It causes a system to suspend its security protocols.
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在计算机系统中，构成虚拟存储器 （ ） 。
Options:
只需要一定的硬件资源便可实现
只需要一定的软件即可实现
既需要软件也需要硬件方可实现
既不需要软件也不需要硬件
Answer: C
领域/Domain: 基础软硬件与技术
Question: 某机器字长为 n，最高位是符号位，其定点整数的最大值为（ ）。
Options:
2n-1
2n-1-1
2n
2n-1
Answer: B
领域/Domain: 基础软硬件与技术
Question: Typically, when raised flooring is used as an air plenum, air isdirected through it.
Options:
Warm
Cold
Bleed
Exhaust
Answer: B
领域/Domain: 基础软硬件与技术
Question: 关于COTS(Commercial-Off-The-Shelf)商用现成品或技术，以下哪一项是正确的描述：
Options:
可以采购到的具有开放式标准定义的接口的软件或硬件产品，可以节省成本和时间。
供应商提供的现成的商业软件，用于可用性较高的工业控制环境
供应商根据企业的具体情况，具体要求而定制开发的软件。
美国国防采办项目要求必须使用国防部颁布的军用标准与军用规范。
Answer: A
领域/Domain: 基础软硬件与技术
Question: 设指令由取指、分析、执行 3 个子部件完成，每个子部件的工作周期均为△t ，采用常规标量单流水线处理机。若连续执行 10 条指令，则共需时间 （ ） △t 。
Options:
8
10
12
14
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following statements does not correctly describe  SOAP and Remote Procedure Calls?
Options:
SOAP was designed to overcome the compatibility and security issues  associated with Remote Procedure Calls.
Both SOAP and Remote Procedure Calls were created to enable  application-layer communication.
SOAP enables the use of Remote Procedure Calls for information exchange  between applications over the Internet.
HTTP was not designed to work with Remote Procedure Calls, but  SOAP
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在程序的执行过程中，cache 与主存的地址映像由()
Options:
专门的硬件自动完成
程序员进行调度
操作系统进行管理
程序员和操作系统共同协调完成
Answer: A
领域/Domain: 基础软硬件与技术
Question: 若文件系统容许不同用户的文件可以具有相同的文件名，则操作系统应采用 （ ）来实现。
Options:
索引表
索引文件
指针
多级目录
Answer: D
领域/Domain: 基础软硬件与技术
Question: 关于证书权威机构（CA），以下哪个描述是错误的？
Options:
CA是负责签发和管理数字证书的可信第三方
用户可以直接信任由顶级CA签发的证书
所有浏览器都内置了信任的CA列表
CA只能签发服务器证书，不能签发客户端证书
Answer: D
领域/Domain: 基础软硬件与技术
Question: RAID 技术中，磁盘容量利用率最低的是（）。
Options:
RAID0
RAID1
RAID5
RAID6
Answer: B
领域/Domain: 基础软硬件与技术
Question: (    )是指一切与有用信号无关的、不希望有的或对电器及电子设备产生不良影响的电磁发射。
Options:
电磁兼容性
传导干扰
电磁干扰
辐射干扰
Answer: C
领域/Domain: 基础软硬件与技术
Question: 哪个组件是软件容器系统的关键部分
Options:
客户端
执行环境
自动化控制器
操作系统
工作负载工具
Answer: B
领域/Domain: 基础软硬件与技术
Question: 设 16 位浮点数，其中阶符 1 位、阶码值 6 位、数符 1 位，尾数 8 位。若阶码用移码表示，尾数用补码表示，则该浮点数所能表示的数值范围是（ ） 。
Options:
-2^64 ~（1-2^{-8})2^64
-2^63~（1-2^{-8}）2^63
-(1-2^{-8})2^64 ~ (1-2^{-8})2^64
-(1-2^{-8})2^63 ~（1-2^{-8})2^63
Answer: B
领域/Domain: 基础软硬件与技术
Question: Which of the following is the default share that windows opens up ()
Options:
1$
IPC$
CD$
6!$
Answer: B
领域/Domain: 基础软硬件与技术
Question: What common element of a general‐purpose computing platform does an IoT not typically have?
Options:
Memory
Processor
External keyboards
Programs
Answer: C
领域/Domain: 基础软硬件与技术
Question: As cryptography continues to evolve, it gradually moves from an art to a science. Which of the following is not a stage in the development of cryptography ().
Options:
Classical code stage
Modern Cipher Stage
modern cryptographic stage
Contemporary Code Stages
Answer: D
领域/Domain: 基础软硬件与技术
Question: Which hardware vendor uses the term SPAN on switches?
Options:
HP
3COM
Cisco
Juniper
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following is NOT a property of a one-way hash function?
Options:
It converts a message of a fixed length into a message digest of arbitrary length.
It is computationally infeasible to construct two different messages with the same digest.
It converts a message of arbitrary length into a message digest of a fixed length.
Given a digest value, it is computationally infeasible to find the corresponding message.
Answer: A
领域/Domain: 基础软硬件与技术
Question: Compared to RSA, which of the following is true of Elliptic Curve Cryptography (ECC)?
Options:
It has been mathematically proved to be more secure.
It has been mathematically proved to be less secure.
It is believed to require longer key for equivalent security.
It is believed to require shorter keys for equivalent security.
Answer: D
领域/Domain: 基础软硬件与技术
Question: What is the maximum key size for the RC5 algorithm?
Options:
128 bits
256 bits
1024 bits
2040 bits
Answer: D
领域/Domain: 基础软硬件与技术
Question: (2) A basic principle of modern cryptography is that all codes reside in ().
Options:
coded text
secret key
encryption algorithm
decryption algorithm
Answer: B
领域/Domain: 基础软硬件与技术
Question: 在 PCM 中，若对模拟信号的采样值使用 64 级量化，则至少需使用（ ）位二进制。
Options:
4
5
6
7
Answer: C
领域/Domain: 基础软硬件与技术
Question: Compared with hardware cryptography, software cryptography is generally
Options:
less expensive and slower.
more expensive and faster.
more expensive and slower.
less expensive and faster.
Answer: A
领域/Domain: 基础软硬件与技术
Question: Along with humidity, temperature is crucial to a data center for optimal operations and protection of equipment.Which of the following is the optimal temperature range as set by ASHRAE?
Options:
69.8 to 86.0 degrees Fahrenheit (21 to 30 degrees Celsius)
51.8 to 66.2 degrees Fahrenheit (11 to 19 degrees Celsius)
64.4 to 80.6 degrees Fahrenheit (18 to 27 degrees Celsius)
44.6 to 60.8 degrees Fahrenheit (7 to 16 degrees Celsius)
Answer: C
领域/Domain: 基础软硬件与技术
Question: 正在发展的第四代无线通信技术推出了多个标准，下面的选项中不属于 4g 标准的是（ ）。
Options:
lte
wimaxii
wcdma
umb
Answer: C
领域/Domain: 基础软硬件与技术
Question: Setting thermostat controls by measuring the temperature willresult in the highest energy costs.
Options:
Server inlet
Return air
Under-floor
External ambient
Answer: B
领域/Domain: 基础软硬件与技术
Question: 在指令系统的各种寻址方式中，获取操作数最快的方式是()
Options:
直接寻址
间接寻址
立即寻址
寄存器寻址
Answer: C
领域/Domain: 基础软硬件与技术
Question: （ ）存储方式常使用 NFS 协议为 Linux 操作系统提供文件共享服务。
Options:
DAS
NAS
IP-SAN
FC-SAN
Answer: B
领域/Domain: 基础软硬件与技术
Question: A prolonged high voltage is
Options:
spike
blackout
surge
fault
Answer: C
领域/Domain: 基础软硬件与技术
Question: 在 Linux 系统中，为某一个文件在另外一个位置建立文件连接的命令为（ ）。
Options:
ln
vi
locatek
cat
Answer: A
领域/Domain: 基础软硬件与技术
Question: MySQL 安装程序会给出三种选择， 用户可以根据自身的需要选择一种适合的安装方式，以下哪些是正确的？(    )
Options:
Typical（典型安装）
Compact(最小安装 )
Full( 全部安装 )
Custom(选择安装 )
Answer: ABD
领域/Domain: 基础软硬件与技术
Question: 2017年11月，在德国柏林召开的第55次ISO\/IEC信息安全分技术委员会（SC27）会议上，我国专家组提出的（）算法一致通过成为国际标准。
Options:
SM2与SM3
SM3与SM4
SM4与SM9
SM9与SM2
Answer: D
领域/Domain: 基础软硬件与技术
Question: 安全内核的实质：
Options:
用户
进程
完整性
访问权限
Answer: D
领域/Domain: 基础软硬件与技术
Question: 若内存按字节编址，用存储容量为 32k x 8 比特的存储器芯片构成地址编号 a0000h 至 dffffh 的内存空间，则至少需要 （ ） 片。
Options:
4
6
8
10
Answer: C
领域/Domain: 基础软硬件与技术
Question: Which of the following is a widely used tool for code development, branching, and collaboration?
Options:
GitHub
Maestro
Orchestrator
Conductor
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在审计数据中心的安全性时，信息系统审计师应查明是否存在电压调节器，以确保：
Options:
防止硬件遭遇电涌。
在主电源中断时保持数据完整性。
在主电源中断时立即供电。
防止硬件遭遇长期电源波动。
Answer: A
领域/Domain: 基础软硬件与技术
Question: 在windows系统的命令提示符界面下用来删除文件的命令是（）
Options:
replace
del
dir
cd
Answer: B
领域/Domain: 基础软硬件与技术
Question: 要使 Samba 服务器在网上邻居中出现的主机为 smbserver，其配置文件 smb.conf 中应包含（ ） 。
Options:
workgroup=smbserver
netbios name=smbserver
server string=smbserver
guest account=smbserver
Answer: B
领域/Domain: 基础软硬件与技术
Question: Tim’s development team is designing a new operating system. One  of the requirements of the new product is that critical memory segments need  to be categorized as nonexecutable, with the goal of reducing malicious code  from being able to execute instructions in privileged mode. The team also  wants to make sure that attackers will have a difficult time predicting  execution target addresses.Which of the following best describes the type of technology the team  should implement to increase the work effort of buffer overflow  attacks?
Options:
Address space layout randomization
Memory induction application
Input memory isolation
Read-only memory integrity checks
Answer: A
领域/Domain: 基础软硬件与技术
Question: Which RAID Level often implements a one-for-one disk to disk ratio?
Options:
RAID Level 1
RAID Level 0
RAID Level 2
RAID Level 5
Answer: A
领域/Domain: 基础软硬件与技术
Question: What is an advantage of RSA over DSA?
Options:
It can provide digital signature and encryption functionality.
It uses fewer resources and encrypts faster because it uses symmetric  keys.
It is a block cipher rather than a stream cipher.
It employs a one-time encryption pad.
Answer: A
领域/Domain: 基础软硬件与技术
Question: Which of the following is the core of fiber optic cables made of?
Options:
PVC
Glass fibers
Kevlar
Teflon
Answer: B
领域/Domain: 基础软硬件与技术
Question: 以下关于类继承的说法中，错误的是（ ）。
Options:
通过类继承，在程序中可以复用基类的代码
在继承类中可以增加新代码
在继承类中不能定义与被继承类（基类）中的方法同名的方法
在继承类中可以覆盖被继承类（基类）中的方法
Answer: C
领域/Domain: 基础软硬件与技术
Question: 延长的高电压是？
Options:
猛增
停电
浪涌
故障
Answer: C
领域/Domain: 基础软硬件与技术
Question: Win+R打开运行后输入下列哪个选项可以打开注册表编辑器（）
Options:
mstsc
nslookup
regedit
regedit.msc
Answer: C
领域/Domain: 基础软硬件与技术
Question: What is the best description of a security kernel from a  security point of view?
Options:
Reference monitor
Resource manager
Memory mapper
Security perimeter
Answer: A
领域/Domain: 基础软硬件与技术
Question: A momentary high voltage is
Options:
spike
blackout
surge
fault
Answer: A
领域/Domain: 基础软硬件与技术
Question: What key size is used by the Clipper Chip?
Options:
40 bits
56 bits
64 bits
80 bits
Answer: D