« 返回题库列表2026 CISSP英文题库及答案｜最新考试问题+真题PDF汇总
问题 #1
Jill is establishing a companywide sales program that will require different user groups with different privileges to access information on a centralized database. How should the security manager secure the database?
A. Increase the database's security controls and provide more granularity.
B. Implement access controls that display each user's permissions each time they access the database.
C. Change the database's classification label to a higher security status.
D. Decrease the security so that all users can access the information as needed.
问题 #2
As his company's CISO, George needs to demonstrate to the Board of Directors the necessity of a strong risk management program. Which of the following should George use to calculate the company's residual risk?
A. threats × vulnerability × asset value = residual risk
B. SLE × frequency = ALE, which is equal to residual risk
C. (threats × asset value × vulnerability) × control gap = residual risk
D. (total risk - asset value) × countermeasures = residual risk
问题 #3
Authorization creep is to access controls what scope creep is to software development. Which of the following is not true of authorization creep?
A. Users have a tendency to request additional permissions without asking for others to be taken away.
B. It is a violation of "least privilege."
C. It enforces the "need-to-know" concept.
D. It commonly occurs when users transfer to other departments or change positions.
问题 #4
For what purpose was the COSO framework developed?
A. To address fraudulent financial activities and reporting
B. To help organizations install, implement, and maintain CobiT controls
C. To serve as a guideline for IT security auditors to use when verifying compliance
D. To address regulatory requirements related to protecting private health information
问题 #5
Susan, an attorney, has been hired to fill a new position at Widgets Inc. The position is Chief Privacy Officer (CPO). What is the primary function of her new role?
A. Ensuring the protection of partner data
B. Ensuring the accuracy and protection of company financial information
C. Ensuring that security policies are defined and enforced
D. Ensuring the protection of customer, company, and employee data
问题 #6
A security manager has instructed a system administrator to wipe files on a hard disk. This means that the administrator needs to:
A. Perform a low-level format on the hard disk
B. Use a degausser to re-align the magnetic storage material on the hard disk
C. Use a tool to overwrite files multiple times
D. Perform a high-level format on the hard disk
问题 #7
The Object Request Architecture (ORA) is a high-level framework for a distributed environment. It consists of four components. Which of the following items is NOT one of those components?
A. Object Request Brokers (ORBs)
B. Object Services
C. Application Objects
D. Application Services
问题 #8
Which one of the following protocols CANNOT be used for full duplex Wide Area Network (WAN) communications?
A. Synchronous Data Link Control (SDLC)
B. Serial Line Internet Protocol (SLIP)
C. Point-to-Point Protocol (PPP)
D. High-Level Data Link Control (HDLC)
问题 #9
Jared plays a role in his company's data classification system. In this role, he must practice due care when accessing data and ensure that the data is used only in accordance with allowed policy while abiding by the rules set for the classification of th
A. Data owner
B. Data custodian
C. Data user
D. Information systems auditor
问题 #10
Which of the following is NOT a characteristic of a distributed data processing (DDP) approach?
A. Consists of multiple processing locations that can provide alternatives for
B. Distances from user to processing resource are transparent to the user.
C. Security is enhanced because of networked systems.
D. Data stored at multiple, geographically separate locations is easily available to the user.
问题 #11
An organization has experienced several virus infections on its desktop workstations. Which of the following remedies would NOT be effective to reduce virus infections?
A. Install an anti-virus gateway web proxy server
B. Install anti-virus on its e-mail servers
C. Install anti-virus central management console
D. Install anti-virus on its web servers
问题 #12
The most effective way to confirm whether backups function properly is:
A. Confirming the presence of error messages in backup logs
B. Confirming the absence of error messages in backup logs
C. Testing the ability to backup data onto backup media
D. Testing the ability to restore data from backup media
问题 #13
An organization’s data classification policy includes handling procedures for data at each level of sensitivity. The IT department backs up all data onto magnetic tape, resulting in tapes that contain data at all levels of sensitivity. How should these ba
A. According to procedures for the lowest sensitivity level
B. According to procedures for the highest sensitivity level
C. According to procedures in between the lowest and highest sensitivity levels
D. Data handling procedures do not apply to backup media, only original media
问题 #14
A security manager is concerned that lost key cards can be used by an intruder to gain entrance to a facility. What measure can be used to prevent this?
A. Implement PIN pads at card reader stations
B. Implement video surveillance at card reader stations
C. Implement man traps at card reader stations
D. Implement RFID sensors at card reader stations
问题 #15
An organization is located in an area that experiences frequent power blackouts. What will the effect of an electric generator be in this circumstance?
A. The organization will have a continuous supply of electric power.
B. The organization will have to establish fuel supply contracts with at least two fuel suppliers.
C. Electric utility blackouts will result in short electric power outages for the organization.
D. An electric generator will be of no help in this situation.
问题 #16
Which choice below is the MOST accurate description of a warm site?
A. A backup processing facility with adequate electrical wiring and air conditioning, but no hardware or software installed
B. A backup processing facility with most hardware and software installed, which can be operational within a matter of days
C. A backup processing facility with all hardware and software installed and 100% compatible with the original site, operational within hours
D. A mobile trailer with portable generators and air conditioning
问题 #17
The following concerns usually apply to what type of architecture? - Desktop systems can contain sensitive information that may be at risk of being exposed. - Users may generally lack security awareness. - Modems present a vulnerability to dial-in attacks
A. Distributed
B. Centralized
C. Open system
D. Symmetric
问题 #18
Which of the following BEST describes a block cipher?
A. A symmetric key algorithm that operates on a variable-length block of plaintext and transforms it into a fixed-length block of ciphertext
B. A symmetric key algorithm that operates on a fixed-length block of plaintext and transforms it into a fixed-length block of ciphertext
C. An asymmetric key algorithm that operates on a variable-length block of plaintext and transforms it into a fixed-length block of ciphertext
D. An asymmetric key algorithm that operates on a fixed-length block of plaintext and transforms it into a fixed-length block of ciphertext
问题 #19
Which statement below is accurate about the reasons to implement a layered security architecture?
A. A layered security approach is not necessary when using COTS products.
B. A good packet-filtering router will eliminate the need to implement a layered security architecture.
C. A layered security approach is intended to increase the work-factor for an attacker.', "D. A layered approach doesn't really improve the security posture of the organization.
问题 #20
Security measures that protect message traffic independently on each communication path are called:
A. Link oriented
B. Procedure oriented
C. Pass-through oriented
D. End-to-end oriented
问题 #21
Covert channel analysis is required for
A. Systems processing Top Secret or classified information.
B. A Trusted Computer Base with a level of trust B2 or above.
C. A system that can be monitored in a supervisor state.
D. Systems that use exposed communication links.
问题 #22
Which of the following is NOT a property of a one-way hash function?
A. It converts a message of a fixed length into a message digest of arbitrary length.
B. It is computationally infeasible to construct two different messages with the same digest
C. It converts a message of arbitrary length into a message digest of a fixed length
D. Given a digest value, it is computationally infeasible to find the corresponding message
问题 #23
Which of the following Internet Protocol (IP) security headers are defined by the Security Architecture for IP (IPSEC)?
A. The IPv4 and IPv5 Authentication Headers
B. The Authentication Header Encapsulating Security Payload
C. The Authentication Header and Digital Signature Tag
D. The Authentication Header and Message Authentication Code
问题 #24
warns that disinfecting the file can damage it. What course of action should be taken?
A. Replace the file with the original version from master media
B. Proceed with automated disinfection
C. Research the virus to see if it is benign
D. Restore an uninfected version of the patched file from backup media
问题 #25
A proxy based firewall has which one of the following advantages over a firewall employing stateful packet inspection?
A. It has a greater throughput.
B. It detects intrusion faster.
C. It has greater network isolation.
D. It automatically configures the rule set.
问题 #26
What setup should an administrator use for regularly testing the strength of user passwords?
A. A networked workstation so that the live password database can easily be accessed by the cracking program
B. A networked workstation so the password database can easily be copied locally and processed by the cracking program
C. A standalone workstation on which the password database is copied and processed by the cracking program
D. A password-cracking program is unethical; therefore it should not be used.
问题 #27
When establishing a violation tracking and analysis process, which one of the following parameters is used to keep the quantity of data to manageable levels?
A. Quantity baseline
B. Maximum log size
C. Circular logging
D. Clipping levels
问题 #28
In the DoD reference model, which layer conforms to the OSI transport layer?
A. Process/Application Layer
B. Host-to-Host Layer
C. Internet Layer
D. Network Access Layer
问题 #29
Which statement below is NOT true about the difference between cut-through and store-and-forward switching?
A. A store-and-forward switch reads the whole packet and checks its validity before sending it to the next destination.
B. Both methods operate at layer two of the OSI reference model.
C. A cut-through switch reads only the header on the incoming data packet.
D. A cut-through switch introduces more latency than a store-and-forward switch.
问题 #30
Which utility below can create a server-spoofing attack?
A. DNS poisoning
B. C2MYAZZ
C. Snort
D. BO2K
问题 #31
Which choice below does NOT accurately describe the difference between multimode and single-mode fiber optic cabling?
A. Multi-mode fiber propagates light waves through many paths, single-mode fiber propagates a single light ray only.
B. Multi-mode fiber has a longer allowable maximum transmission distance than single-mode fiber.
C. Single-mode fiber has a longer allowable maximum transmission distance than multi-mode fiber.
D. Both types have a longer allowable maximum transmission distance than UTP Cat 5.
问题 #32
Which of the following is NOT a characteristic of a cryptographic hash function, H (m), where m denotes the message being hashed by the function H?
A. H (m) is collision free.
B. H (m) is difficult to compute for any given m.
C. The output is of fixed length.
D. H (m) is a one-way function.
问题 #33
A security manager wishes all new laptops purchased by his organization to include a security cryptoprocessor. What hardware should be required?
A. Floating point co-processor
B. Smart card reader
C. Fingerprint reader
D. Trusted Platform Module (TPM)
问题 #34
Organizations that implement two-factor authentication often do not adequately plan. One result of this is:
A. Some users will lose their tokens, smart cards, or USB keys
B. Some users will store their tokens, smart cards, or USB keys with their computers, thereby defeating one of the advantages of two-factor authentication
C. Users will have trouble understanding how to use two-factor authentication
D. The cost of implementation and support can easily exceed the cost of the product itself
问题 #35
The use of retina scanning as a biometric authentication method has not gained favor because:
A. It is inconvenient to use retina scanning in a darkened room
B. Many users cannot hold their eye open long enough for a scan to complete
C. Users are uncomfortable holding their eye very near the biometric scanning device
D. The human retina changes significantly over time
问题 #36
A security engineer has recently installed a biometric system, and needs to tune it. Currently the biometric system is rejecting too many valid, registered users. What adjustment does the security engineer need to make?
A. Increase the False Accept Rate
B. Reduce the False Accept Rate
C. Increase the False Reject Rate
D. Reduce the False Reject Rate
问题 #37
Which of the following offers security to wireless communications?
A. S-WAP
B. WTLS
C. WSP
D. WDP
问题 #38
The purpose of digitally signing a Browser Helper Object (BHO) is:
A. To prove its origin
B. To prove that it is not malicious
C. To prove that it can be trusted
D. To prove that it was downloaded properly
问题 #39
Sally is responsible for key management within her organization. Which of the following incorrectly describes a principle of secure key management?
A. Keys should be backed up or escrowed in case of emergencies.
B. The more a key is used, the shorter its lifetime should be.
C. Less secure data allows for a shorter key lifetime.
D. Keys should be stored and transmitted by secure means.
问题 #40
Mandy needs to calculate how many keys must be generated for the 260 employees using the company's PKI asymmetric algorithm. How many keys are required?
A. 33,670
B. 520
C. 67,340
D. 260
问题 #41
What is the company benefit, in terms of risk, for people taking a vacation of a specified minimum length?
A. Reduces stress levels, thereby lowering insurance claims.
B. Improves morale, thereby decreasing errors.
C. Increases potential for discovering frauds.
D. Reduces dependence on critical individuals.
问题 #42
Which one of the following can be identified when exceptions occur using operations security detective controls?
A. Unauthorized people seeing confidential reports.
B. Unauthorized people destroying confidential reports.
C. Authorized operations people performing unauthorized functions.
D. Authorized operations people not responding to important console messages.
问题 #43
Removing unnecessary processes, segregating inter-process communications, and reducing executing privileges to increase system security is commonly called
A. Hardening
B. Segmenting
C. Aggregating
D. Kerneling
问题 #44
Which of the following protocols operates at the session layer (layer 5)?
A. RPC
B. IGMP
C. LPD
D. SPX
问题 #45
Hannah has been assigned the task of installing Web access management (WAM) software. What is the best description for what WAM is commonly used for?
A. Control external entities requesting access through X.500 databases
B. Control external entities requesting access to internal objects
C. Control internal entities requesting access through X.500 databases
D. Control internal entities requesting access to external objects
问题 #46
There are several types of password management approaches used by identity management systems. Which of the following reduces help-desk call volume, but is also criticized for the ease with which a hacker could gain access to multiple resources if a passw
A. Management password reset
B. Self-service password reset
C. Password synchronization
D. Assisted password reset
问题 #47
Which of the following does not describe privacy-aware role-based access control?
A. It is an example of a discretionary access control model.', "B. Detailed access controls indicate the type of data that users can access based on the data's level of privacy sensitivity.", 'C. It is an extension of role-based access control.
D. It should be used to integrate privacy policies and access control policies.
问题 #48
Which of the following statements pertaining to packet filtering is NOT true?
A. It is based on ACLs.
B. It is not application dependent.
C. It operates at the network layer.
D. It keeps track of the state of a connection.
问题 #49
What was the direct predecessor to Standard Generalized Markup Language (SGML)?
A. Hypertext Markup Language (HTML)
B. Extensible Markup Language (XML)
C. LaTeX
D. Generalized Markup Language (GML)
问题 #50
Brian has been asked to work on the virtual directory of his company's new identity management system. Which of the following best describes a virtual directory?
A. Meta-directory
B. User attribute information stored in an HR database
C. Virtual container for data from multiple sources
D. A service that allows an administrator to configure and manage how identification takes place
问题 #51
Which of the following correctly describes a federated identity and its role within identity management processes?
A. A nonportable identity that can be used across business boundaries
B. A portable identity that can be used across business boundaries
C. An identity that can be used within intranet virtual directories and identity stores
D. An identity specified by domain names that can be used across business boundaries
问题 #52
Phishing and pharming are similar. Which of the following correctly describes the difference between phishing and pharming?
A. Personal information is collected from victims through legitimate-looking Web sites in phishing attacks, while personal information is collected from victims via e-mail in pharming attacks.
B. Phishing attacks point e-mail recipients to a form where victims input personal information, while pharming attacks use pop-up forms at legitimate Web sites to collect personal information from victims.', "C. Victims are pointed to a fake Web site with a domain name that looks similar to a legitimate site's in a phishing attack, while victims are directed to a fake Web site as a result of a legitimate domain name being incorrectly translated by the DNS server in a pharming attack.", 'D. Phishing is a technical attack, while pharming is a type of social engineering.
问题 #53
Security countermeasures should be transparent to users and attackers. Which of the following does not describe transparency?
A. User activities are monitored and tracked without negatively affecting system performance.
B. User activities are monitored and tracked without the user knowing about the mechanism that is carrying this out.
C. Users are allowed access in a manner that does not negatively affect business processes.
D. Unauthorized access attempts are denied and logged without the intruder knowing about the mechanism that is carrying this out.
问题 #54
The importance of protecting audit logs generated by computers and network devices is highlighted by the fact that it is required by many of today's regulations. Which of the following does not explain why audit logs should be protected?
A. If not properly protected, these logs may not be admissible during a prosecution.
B. Audit logs contain sensitive data and should only be accessible to a certain subset of people.
C. Intruders may attempt to scrub the logs to hide their activities.
D. The format of the logs should be unknown and unavailable to the intruder.
问题 #55
One drawback of Application Level Firewall is that it reduces network performance due to the fact that it must analyze every packet and:
A. decide what to do with each application.
B. decide what to do with each user.
C. decide what to do with each port.
D. decide what to do with each packet.
问题 #56
Harrison is evaluating access control products for his company. Which of the following is not a factor he needs to consider when choosing the products?
A. Classification level of data
B. Level of training that employees have received
C. Logical access controls provided by products
D. Legal and regulation issues
问题 #57
A Security Parameter Index (SPI) and the identity of the security protocol (AH or ESP) are the components of:
A. SSL
B. IPSec
C. S-HTTP
D. SSH-2
问题 #58
There are several types of intrusion detection systems (IDSs). What type of IDS builds a profile of an environment's normal activities and assigns an anomaly score to packets based on the profile?
A. State-based
B. Statistical anomaly-based
C. Misuse detection system
D. Protocol signature-based
问题 #59
A rule-based IDS takes a different approach than a signature-based or anomaly-based system. Which of the following is characteristic of a rule-based IDS?
A. Uses IF/THEN programming within expert systems
B. Identifies protocols used outside of their common bounds
C. Compares patterns to several activities at once
D. Can detect new attacks
问题 #60
Alex works for a chemical distributor that assigns employees tasks that separate their duties and routinely rotates job assignments. Which of the following best describes the differences between these countermeasures?
A. They are the same thing with different titles.', "B. They are administrative controls that enforce access control and protect the company's resources.", 'C. Separation of duties ensures that one person cannot perform a high-risk task alone, and job rotation can uncover fraud because more than one person knows the tasks of a position.
D. Job rotation ensures that one person cannot perform a high-risk task alone, and separation of duties can uncover fraud because more than one person knows the tasks of a position.
问题 #61
There are several different types of centralized access control protocols. Which of the following is illustrated in the graphic that follows?
A. Diameter
B. Watchdog
C. RADIUS
D. TACACS+
问题 #62
An access control matrix is used in many operating systems and applications to control access between subjects and objects. What is the column in this type of matrix referred to as?
A. Capability table
B. Constrained interface
C. Role-based value
D. ACL
问题 #63
The Payment Card Industry Data Security Standard (PCI DSS) requires encryption of credit card in which circumstances:
A. Stored in databases, stored in flat files, and transmitted over public and private networks
B. Stored in databases, and transmitted over public networks
C. Stored in databases, stored in flat files, and transmitted over public networks
D. Stored in databases, and transmitted over public and private networks
问题 #64
Which type of attack involves the alteration of a packet at the IP level to convince a system that it is communicating with a known entity in order to gain access to a system?
A. TCP sequence number attack
B. IP spoofing attack
C. Piggybacking attack
D. Teardrop attack
问题 #65
Which risk management methodology uses the exposure factor multiplied by the asset value to determine its outcome?
A. Annualized Loss Expectancy
B. Single Loss Expectancy
C. Annualized Rate of Occurrence
D. Information Risk Management
问题 #66
An organization has experienced several virus infections on its desktop workstations. Which of the following remedies would NOT be effective to reduce virus infections?
A. Install an anti-virus gateway web proxy server
B. Install anti-virus on its e-mail servers
C. Install anti-virus central management console
D. Install anti-virus on its web servers
问题 #67
Host-based IDSs normally utilize information from which of the following sources?
A. Operating system audit trails and system logs
B. Operating system audit trails and network packets
C. Network packets and system logs
D. Operating system alarms and system logs
问题 #68
Hash total uses an algorithm that provides a checksum of the data in ___________ format:
A. ASCII
B. Numerical
C. Unicode
D. Hexadecimal
问题 #69
What should you do to the user accounts as soon as employment is terminated?
A. Disable the user accounts and have the data kept for a specified period of time
B. Maintain the user accounts and have the data kept for a specified period of time
C. Disable the user accounts and erase immediately the data kept
D. No Answer is Correct
问题 #70
What is called an attach where the attacker spoofs the source IP address in an ICMP ECHO broadcast packet so it seems to have originated at the victim's system, in order to flood it with REPLY packets?
A. SYN flood attack
B. Smurf attack
C. Ping of Dead Attack
D. Denial of Service (DOS) Attack
问题 #71
To ensure that integrity is attainted through the Clark and Wilson model, certain rules are needed. These rules are:
A. Processing rules and enforcement rules.
B. Integrity-bouncing rules.
C. Certification rules and enforcement rules.
D. Certification rules and general rules.
问题 #72
In which situation would TEMPEST risks and technologies be of MOST interest?
A. Where high availability is vital.
B. Where the consequences of disclose are very high.
C. Where countermeasures are easy to implement
D. Where data base integrity is crucial
问题 #73
Certain types of attacks have been made more potent by which of the following advances to microprocessor technology?
A. Increased circuits, cache memory, and multiprogramming
B. Dual mode computation
C. Direct memory access I/O
D. Increases in processing power
问题 #74
Virtual storage combines RAM and secondary storage for system memory. Which of the following is a security concern pertaining to virtual storage?
A. More than one process uses the same resource.
B. It allows cookies to remain persistent in memory.
C. It allows for side-channel attacks to take place.
D. Two processes can carry out a denial-of-service.
问题 #75
Which of the following is a common association of the Clark-Wilson access model?
A. Chinese Wall
B. Access tuple
C. Read up and write down rule
D. Subject and application binding
问题 #76
Which of the following correctly describes the relationship between the reference monitor and the security kernel?
A. The security kernel implements and enforces the reference monitor.
B. The reference monitor is the core of the trusted computing base, which is made up of the security kernel.
C. The reference monitor implements and enforces the security kernel.
D. The security kernel, aka abstract machine, implements the reference monitor concept.
问题 #77
The trusted computing base (TCB) ensures security within a system when a process in one domain must access another domain in order to retrieve sensitive information. What function does the TCB initiate to ensure that this is done in a secure manner?
A. I/O operational execution
B. Process deactivation
C. Execution domain switching
D. Virtual memory to real memory mapping
问题 #78
The Zachman Architecture Framework is often used to set up an enterprise security architecture. Which of the following does not correctly describe the Zachman Framework?
A. A two-dimensional model that uses communication interrogatives intersecting with different levels
B. A security-oriented model that gives instructions in a modular fashion
C. Used to build a robust enterprise architecture versus a technical security architecture
D. Uses six perspectives to describe a holistic information infrastructure
问题 #79
Which of the following best defines a virtual machine?
A. A virtual instance of an operating system
B. A piece of hardware that runs multiple operating system environments simultaneously
C. A physical environment for multiple guests
D. An environment that can be fully utilized while running legacy applications
问题 #80
Which of the following items should not be retained in an E-mail directory?
A. drafts of documents
B. copies of documents
C. permanent records
D. temporary documents
问题 #81
Bethany is working on a mandatory access control (MAC) system. She has been working on a file that was classified as Secret. She can no longer access this file because it has been reclassified as Top Secret. She deduces that the project she was working on
A. Covert storage channel
B. Inference attack
C. Noninterference
D. Aggregation
问题 #82
In the Common Criteria, a Protection Profile:
A. Specifies the security requirements and protections of the products to be evaluated.
B. Is also known as the Orange Book.
C. Is also known as the Target of Evaluation (TOE).
D. Specifies the mandatory protection in the product to be evaluated.
问题 #83
Virtualization offers many benefits. Which of the following incorrectly describes virtualization?
A. Virtualization simplifies operating system patching.
B. Virtualization can be used to build a secure computing platform.
C. Virtualization can provide fault and error containment.
D. Virtual machines offer powerful debugging capabilities.
问题 #84
Operating systems can be programmed to carry out different methods for process isolation. Which of the following refers to a method in which an interface defines how communication can take place between two processes and no process can interact with the o
A. Virtual mapping
B. Encapsulation of objects
C. Time multiplexing
D. Naming distinctions
问题 #85
Which of the following is not a responsibility of the memory manager?
A. Use complex controls to ensure integrity and confidentiality when processes need to use the same shared memory segments.
B. Limit processes to interact only with the memory segments assigned to them.
C. Swap contents from RAM to the hard drive as needed.
D. Run an algorithm to identify unused committed memory and inform the operating system that the memory is available.
问题 #86
Several types of read-only memory devices can be modified after they are manu`factured. Which of the following statements correctly describes the differences between two types of ROM?
A. PROM can only be programmed once, while EEPROM can be programmed multiple times.
B. A UV light is used to erase data on EEPROM, while onboard programming circuitry and signals erase data on EPROM.
C. The process used to delete data on PROM erases one byte at a time, while to erase data on an EPROM chip, you must remove it from the hardware.
D. The voltage used to write bits into the memory cells of EPROM burns out the fuses that connect individual memory cells, while UV light is used to write to the memory cells of PROM.
问题 #87
Widgets Inc.'s software development processes are documented and the organization is capable of producing its own standard of software processes. Which of the following Capability Maturity Model Integration levels best describes Widgets Inc.?
A. Initial
B. Repeatable
C. Defined
D. Managed
问题 #88
A forensics investigator has been asked to examine the workstation used by an employee who has been known to misbehave in the past. This investigation is related to more potential misconduct. What approach should the investigator take in this new investig
A. Approach this investigation objectively, without regard to the history of this employee’s conduct
B. Approach this investigation subjectively, given the history of this employee’s conduct
C. Assume the employee is guilty and search for evidence to support this
D. Assume the employee is innocent and search for evidence to refute this
问题 #89
A security manager wishes all new laptops purchased by his organization to include a security cryptoprocessor. What hardware should be required?
A. Floating point co-processor
B. Smart card reader
C. Fingerprint reader
D. Trusted Platform Module (TPM)
问题 #90
A multitasking operating system can have several processes running at the same time. What are the components within the processes that are shown in the graphic that follows?
A. Threads
B. Registers
C. Address buses
D. Process tables
问题 #91
Robert has been given the responsibility of installing doors that provide different types of protection. He has been told to install doors that provide failsafe, fail-secure, and fail-soft protection. Which of the following statements is true about secure
A. Fail-soft defaults to the sensitivity of the are
A.
B. Fail-safe defaults to locked.
C. Fail-secure defaults to unlocked.
D. Fail-secure defaults to double locked.
问题 #92
As with logical access controls, audit logs should be produced and monitored for physical access controls. Which of the following statements is correct about auditing physical access?
A. Unsuccessful access attempts should be logged but only need to be reviewed by a security guard.
B. Only successful access attempts should be logged and reviewed.
C. Only unsuccessful access attempts during unauthorized hours should be logged and reviewed.
D. All unsuccessful access attempts should be logged and reviewed.
问题 #93
Brad is installing windows on the storefront of a bank in an area known to be at risk of fires in the dry season. Which of the following is least likely to be true of the windows he is installing?
A. The glass has embedded wires.
B. They are made of glass-clad polycarbonate.
C. The window material is acrylic glass.
D. A solar window film has been added to them.
问题 #94
CCTV can use fixed focal length or varifocal lenses. Which of the following correctly describes the lenses used in CCTV?
A. A fixed focal length lens allows you to move between various fields of view with a single lens.
B. To cover a large area and not focus on specific items, use a large lens opening.
C. An auto-iris lens should be used in an area with fixed lighting.
D. A shallow depth of focus allows you to focus on smaller details.
问题 #95
Which of the following is a light-sensitive chip used in most of today's CCTV cameras?
A. Digital Light Processing
B. Cathode ray tube
C. Annunciator
D. Charged-coupled devices
问题 #96
John is installing a sprinkler system that makes use of a thermal-fusible link for a data center located in Canada. Which of the following statements is true of the system he's installing?
A. The pipes of a dry pipe system are filled with water when pressurized air within the pipes is reduced.
B. The pipes of a preaction system are filled with water when pressurized air within the pipes is reduced.
C. The sprinkler heads of a deluge system are wide open to allow a larger volume of water to be released in a shorter period.
D. The pipes in a wet pipe system always contain water.
问题 #97
A number of factors need to be considered when buying and implementing a CCTV system. Which of the following is the primary factor in determining whether a lens should have a manual iris or an auto-iris?
A. If the camera must be able to move in response to commands
B. If the environment has fixed lighting
C. If objects to be viewed are wide angle, such as a parking lot, or narrow, such as a door
D. The amount of light present in the environment
问题 #98
IDSs can detect intruders by employing electromechanical systems or volumetric systems. Which of the following correctly describes these systems?
A. Because they detect changes in subtle environmental characteristics, electromechanical systems are more sensitive than volumetric.
B. Electromechanical systems are less sensitive than volumetric systems, which detect subtle changes in environmental characteristics.
C. Electromagnetic systems deal with environmental changes such as ultrasonic frequencies, while volumetric systems can employ pressure mats or metallic foil in windows.
D. Electromagnetic systems are more sensitive because they detect a change or break in a circuit, while volumetric systems detect environmental changes.
问题 #99
What discipline combines the physical environment and sociology issues that surround it to reduce crime rates and the fear of crime?
A. Layered defense model
B. Target hardening
C. Crime Prevention Through Environmental Design
D. Natural access control
问题 #100
There are several types of volumetric IDSs. What type of IDS emits a measurable magnetic field that it monitors for disruptions?
A. Capacitance detector
B. Passive infrared system
C. Wave-pattern motion detectors
D. Photoelectric system
问题 #101
Sarah recently learned that the painting she inherited from a relative and hung in her downtown coffee shop is worth a lot of money. She is worried about its protection and wants to install an IDS. Which of the following intrusion detection systems is the
A. Acoustical detection system
B. Proximity detector
C. Photoelectric system
D. Vibration sensor
闽公网安备 35012102500533号
|
闽ICP备18010967号-7