没有合适的资源?快使用搜索试试~ 我知道了~
首页最新CISSP中英文对照观方习题集中文(第二版).pdf
最新CISSP中英文对照观方习题集中文(第二版).pdf

CISSP最新习题,需要加大力度练习,练习后配合书籍,在3——6个月即可通过,建议好好学习!建议好好学习!建议好好学习!建议好好学习!
资源详情
资源评论
资源推荐

2019 年 3 月
CISSP 习题集(第二版)

目录
一. D1:安全和风险管理 ................................................................................................................ 2
二. D2:资产安全 .......................................................................................................................... 41
三. D3:安全工程 .......................................................................................................................... 77
四. D4:通信与网络安全 ............................................................................................................ 116
五. D5:身份与访问管理 ............................................................................................................ 151
六. D6:安全评估与测试 ............................................................................................................ 186
七. D7:安全运营 ........................................................................................................................ 222
八. D8:软件开发安全 ................................................................................................................ 260
九. 综合测试一 ............................................................................................................................ 297
十. 综合测试二 ............................................................................................................................ 342
十一. 综合测试三 ........................................................................................................................ 384
十二. 综合测试四 ........................................................................................................................ 428
答案 .............................................................................................................................................. 472
一. D1:安全和风险管理 ............................................................................................................ 472
二. D2:资产安全 ........................................................................................................................ 490
三. D3:安全工程 ........................................................................................................................ 511
四. D4:通信与网络安全 ............................................................................................................ 528
五. D5:身份与访问管理 ............................................................................................................ 548
六. D6:安全评估与测试 ............................................................................................................ 568
七. D7:安全运营 ........................................................................................................................ 591
八. D8:软件开发安全 ................................................................................................................ 613
九. 综合测试一 ............................................................................................................................ 633
十. 综合测试二 ............................................................................................................................ 657
十一. 综合测试三 ........................................................................................................................ 682
十二. 综合测试四 ........................................................................................................................ 706

一. D1:安全和风险管理
1. 定量风险分析的最后一步是什么?
A. 确定资产价值
B. 确定年度发生率
C. 计算年度损失预期值
D. 进行成本/效益分析
1. What is the final step of a quantitative risk analysis?
A. Determine asset value.
B. Assess the annualized rate of occurrence.
C. Derive the annualized loss expectancy.
D. Conduct a cost/benefit analysis.
2. 将以下带有数字编号的无线攻击术语,与相应带有字母的描述进行匹配:
无线攻击术语
1. 恶意接入点
2. 重放
3. 邪恶双胞胎接入点攻击
4. 战争驾驶
描述:
A. 一种攻击,依赖于伪造一个欺骗合法接入点的 SSID 和 MAC 地址
B. 通过使用明显合法的 SSID,吸引新连接接入到接入点
C. 一种攻击,通过捕获通信中重传的信息并尝试访问目标系统
D. 使用检测工具查找无线网络的过程
2. Match the following numbered wireless attack terms with their appropriate lettered
descriptions:
Wireless attack terms
1. Rogue access point
2. Replay
3. Evil twin
4. War driving
Descriptions
A. An attack that relies on an access point to spoof a legitimate access point’s SSID
and Mandatory Access Control (MAC) address
B. An access point intended to attract new connections by using an apparently
legitimate SSID
C. An attack that retransmits captured communication to attempt to gain access to a
targeted system
D. The process of using detection tools to find wireless networks
3. 在数字千年版权法案(DMCA)中,用户在使用网络服务商的哪项服务时,如果遭到损
害,不要求互联网服务供应商快速做出响应?

A. 用户在供应商的服务器上存储信息
B. 供应商缓存信息
C. 客户在供应商的网络上传输信息
D. 在供应商搜索引擎中缓存信息
3. Under the Digital Millennium Copyright Act (DMCA), what type of offenses do not require
prompt action by an internet service provider after it receives a notification of infringement
claim from a copyright holder?
A. Storage of information by a customer on a provider’s server
B. Caching of information by the provider
C. Transmission of information over the provider’s network by a customer
D. Caching of information in a provider search engine
4. FlyAway Travel 在欧盟和美国都有办公点,且需要定期在这些办公点之间传输个人信息。
近期他们收到了欧盟客户的请求,要求终止他们的账户。根据“一般数据保护条例”(GDPR),
对于处理个人要求其数据不再传播或处理的个人信息状态,是哪一项需求?
A. 访问权限
B. 私有设计
C. 被遗忘的权利
D. 数据可移植性的权利
4. FlyAway Travel has offices in both the European Union (EU) and the United States and
transfers personal information between those offices regularly. They have recently
received a request from an EU customer requesting that their account be terminated.
Under the General Data Protection Regulation (GDPR), which requirement for processing
personal information states that individuals may request that their data no longer be
disseminated or processed?
A. The right to access
B. Privacy by design
C. The right to be forgotten
D. The right of data portability
5. 以下哪一项不是三个最常见的威胁建模技术之一?
A. 关注资产
B. 关注攻击者
C. 关注软件
D. 关注社会工程学
5. Which one of the following is not one of the three common threat modeling techniques?
A. Focused on assets
B. Focused on attackers
C. Focused on software
D. Focused on social engineering
6. 在美国各州的数据泄露法律中,个人身份可识别信息不包括以下哪一项?
A. 学生身份识别号
B. 社会安全号码

C. 驾驶执照号码
D. 信用卡号码
6. Which one of the following elements of information is not considered personally
identifiable information that would trigger most United States (U.S.) state data breach laws?
A. Student identification number
B. Social Security number
C. Driver’s license number
D. Credit card number
7. 《联邦量刑指南》在 1991 年规定:高级行政管理层对信息安全事件负有个人责任。该
规定的名称是什么?
A. 应尽职责规则
B. 个人责任规则
C. “谨慎人”规则
D. 应尽流程规则
7. In 1991, the Federal Sentencing Guidelines formalized a rule that requires senior
executives to take personal responsibility for information security matters. What is the
name of this rule?
A. Due diligence rule
B. Personal liability rule
C. Prudent man rule
D. Due process rule
8. 以下哪个身份验证因素和密码一同使用,从而实现多因素身份验证机制?
A. 用户名
B. 个人识别码(PIN)
C. 安全问题
D. 指纹扫描
8. Which one of the following provides an authentication mechanism that would be
appropriate for pairing with a password to achieve multifactor authentication?
A. Username
B. Personal identification number (PIN)
C. Security question
D. Fingerprint scan
9. 根据欧盟 GDPR,哪个美国政府机构负责管理欧盟与美国之间的隐私保护协议条款?
A. 国防部
B. 财政部
C. 国务院
D. 商务部
9. What United States government agency is responsible for administering the terms of
privacy shield agreements between the European Union and the United States under the
EU GDPR?
A. Department of Defense
剩余50页未读,继续阅读













安全验证
文档复制为VIP权益,开通VIP直接复制

评论5