官方习题第三版_在线真题试卷与模拟练习_官方习题第三版

What important function do senior managers normally fill on a business continuity planning team?
高级经理通常在业务连续性规划团队中担任哪些重要职能？

You are the CISO for a major hospital system and are preparing to sign a contract with a software as a service （SaaS） email vendor and want to perform a control assessment to ensure that its business continuity planning measures are reasonable. What type of audit might you request to meet this goal?
您是大型医院系统的CISO，正准备与软件即服务（SaaS）电子邮件供应商签订合同，并希望执行控制评估，以确保其业务连续性规划措施合理。为了达到这一目标，您可能会要求什么类型的审核？

Gary is analyzing a security incident and, during his investigation, encounters a user who denies having performed an action that Gary believes he did perform. What type of threat has taken place under the STRIDE model?
Gary正在分析一个安全事件，在调查过程中，遇到一个用户，他否认执行了Gary认为自己确实执行的操作。在STERID模型下发生了什么类型的威胁？

Beth is the security administrator for a public school district. She is implementing a new stu-dent information system and is testing the code to ensure that students are not able to alter their own grades. What principle of information security is Beth enforcing?
Beth是一个公立学区的安全管理员。她正在实施一个新的学生信息系统，并正在测试代码，以确保学生不能改变自己的成绩。信息安全的原则是什么？

Which one of the following issues is not normally addressed in a service-level agreement （SLA）?
以下哪一个问题通常不会在服务级别协议（SLA）中解决？

Joan is seeking to protect a piece of computer software that she developed under intellectual property law. Which one of the following avenues of protection would not apply to a piece of software?
琼正在寻求保护她根据知识产权法开发的一款计算机软件。以下哪种保护途径不适用于软件？

Juniper Content is a web content development company with 40 employees located in two offices: one in New York and a smaller office in the San Francisco Bay Area. Each office has a local area network protected by a perimeter firewall. The local area network （LAN） con-tains modern switch equipment connected to both wired and wireless networks.

Juniper内容是一个网络内容开发公司，有40名员工，位于两个办公室：一个在纽约，一个较小的办公室在旧金山湾地区。每个办公室都有一个由外围防火墙保护的局域网。局域网（LAN）包含连接到有线和无线网络的现代交换设备。

Each office has its own file server, and the information technology （IT） team runs software every hour to synchronize files between the two servers, distributing content between the offices. These servers are primarily used to store images and other files related to web content developed by the company. The team also uses a SaaS-based email and document collabora-tion solution for much of their work.

在两台服务器之间同步文件，在办公室之间分发内容。这些服务器主要用于存储与公司开发的web内容相关的图像和其他文件。该团队还将基于SaaS的电子邮件和文档协作解决方案用于他们的大部分工作。

You are the newly appointed IT manager for Juniper Content, and you are working to aug-ment existing security controls to improve the organization’s security.

您是新任命的Juniper Content的IT经理，您正在努力改进现有的安全控制，以提高组织的安全性。

Users in the two offices would like to access each other’s file servers over the internet. What control would provide confidentiality for those communications?

两个办公室的用户希望通过互联网访问彼此的文件服务器。什么样的控制将为这些通信提供保密性？

Juniper Content is a web content development company with 40 employees located in two offices: one in New York and a smaller office in the San Francisco Bay Area. Each office has a local area network protected by a perimeter firewall. The local area network （LAN） con-tains modern switch equipment connected to both wired and wireless networks.

Juniper内容是一个网络内容开发公司，有40名员工，位于两个办公室：一个在纽约，一个较小的办公室在旧金山湾地区。每个办公室都有一个由外围防火墙保护的局域网。局域网（LAN）包含连接到有线和无线网络的现代交换设备。

Each office has its own file server, and the information technology （IT） team runs software every hour to synchronize files between the two servers, distributing content between the offices. These servers are primarily used to store images and other files related to web content developed by the company. The team also uses a SaaS-based email and document collabora-tion solution for much of their work.

在两台服务器之间同步文件，在办公室之间分发内容。这些服务器主要用于存储与公司开发的web内容相关的图像和其他文件。该团队还将基于SaaS的电子邮件和文档协作解决方案用于他们的大部分工作。

You are the newly appointed IT manager for Juniper Content, and you are working to aug-ment existing security controls to improve the organization’s security.

您是新任命的Juniper Content的IT经理，您正在努力改进现有的安全控制，以提高组织的安全性。

You are also concerned about the availability of data stored on each office’s server. You would like to add technology that would enable continued access to files located on the server even if a hard drive in a server fails. What control allows you to add robustness without adding additional servers?

您还担心存储在每个办公室服务器上的数据的可用性。您希望添加一种技术，即使服务器中的硬盘出现故障，也可以继续访问服务器上的文件。什么样的控制允许您在不添加额外服务器的情况下增加健壮性？

Juniper Content is a web content development company with 40 employees located in two offices: one in New York and a smaller office in the San Francisco Bay Area. Each office has a local area network protected by a perimeter firewall. The local area network （LAN） con-tains modern switch equipment connected to both wired and wireless networks.

Juniper内容是一个网络内容开发公司，有40名员工，位于两个办公室：一个在纽约，一个较小的办公室在旧金山湾地区。每个办公室都有一个由外围防火墙保护的局域网。局域网（LAN）包含连接到有线和无线网络的现代交换设备。

Each office has its own file server, and the information technology （IT） team runs software every hour to synchronize files between the two servers, distributing content between the offices. These servers are primarily used to store images and other files related to web content developed by the company. The team also uses a SaaS-based email and document collabora-tion solution for much of their work.

在两台服务器之间同步文件，在办公室之间分发内容。这些服务器主要用于存储与公司开发的web内容相关的图像和其他文件。该团队还将基于SaaS的电子邮件和文档协作解决方案用于他们的大部分工作。

You are the newly appointed IT manager for Juniper Content, and you are working to aug-ment existing security controls to improve the organization’s security.

您是新任命的Juniper Content的IT经理，您正在努力改进现有的安全控制，以提高组织的安全性。

Finally, there are historical records stored on the server that are extremely important to the business and should never be modifieD.You would like to add an integrity control that allows you to verify on a periodic basis that the files were not modifieD.What control can you add?

最后，服务器上存储的历史记录对业务极其重要，不应修改。您希望添加一个完整性控件，该控件允许您定期验证文件是否未被修改。您可以添加什么控件？

Beth is a human resources specialist preparing to assist in the termination of an employee.
Which of the following is not typically part of a termination process?
Beth是一名人力资源专家，准备协助解雇员工。以下哪项通常不是终止流程的一部分？

Frances is reviewing her organization’s business continuity plan documentation for complete-ness. Which one of the following is not normally included in business continuity plan doc-umentation?
Frances正在审查其组织的业务连续性计划文件，以确保其完整性。以下哪项通常不包括在业务连续性计划文档中？

An accounting employee at Doolittle Industries was recently arrested for participation in an embezzlement scheme. The employee transferred money to a personal account and then shifted funds around between other accounts every day to disguise the fraud for months. Which one of the following controls might have best allowed the earlier detection of this fraud?
Doolittle Industries的一名会计员工最近因参与挪用公款计划而被捕。该员工将资金转入个人账户，然后每天在其他账户之间转移资金，以掩饰欺诈行为长达数月之久。以下哪一项控制措施最有可能使该欺诈行为提前被发现？

Jeff would like to adopt an industry-standard approach for assessing the processes his orga-nization uses to manage risk. What maturity model would be most appropriate for his use?
Jeff希望采用行业标准方法来评估其组织用于管理风险的流程。哪种成熟度模型最适合他的使用？

Chris’ organization recently suffered an attack that rendered their website inacces-sible to paying customers for several hours. Which information security goal was most directly impacted?
克里斯的组织最近遭受了一次攻击，使得他们的网站在几个小时内无法向客户付款。哪个信息安全目标受到最直接的影响？

Yolanda is writing a document that will provide configuration information regarding the minimum level of security that every system in the organization must meet. What type of document is she preparing?
Yolanda正在编写一份文件，其中将提供有关组织中每个系统必须满足的最低安全级别的配置信息。她正在准备什么类型的文件？

Who should receive initial business continuity plan training in an organization?
谁应该在组织中接受初始业务连续性计划培训？

James is conducting a risk assessment for his organization and is attempting to assign an asset value to the servers in his data center. The organization’s primary concern is ensuring that it has sufficient funds available to rebuild the data center in the event it is damaged or destroyeD.Which one of the following asset valuation methods would be most appropriate in this situation?
James正在为其组织进行风险评估，并试图为其数据中心的服务器分配资产价值。该组织的首要关注点是确保有足够的资金在数据中心损坏或毁坏时重建数据中心。在这种情况下，以下哪种资产估值方法最合适？

Roger’s organization suffered a breach of customer credit card records. Under the terms of
PCI DSS, what organization may choose to pursue an investigation of this matter?
罗杰的组织遭到了客户信用卡记录的破坏。根据PCI DSS的条款，哪个组织可以选择对此事进行调查？

Rick recently engaged critical employees in each of his organization’s business units to ask
For their assistance with his security awareness program. They will be responsible for sharing security messages with their peers and answering questions about cybersecurity matters. What term best describes this relationship?
Rick最近让其组织各业务部门的关键员工参与到他的安全意识计划中，请求他们提供帮助。他们将负责与同行分享安全信息，并回答有关网络安全问题的问题。什么术语最能描述这种关系？

Frank discovers a keylogger hidden on the laptop of his company’s chief executive officer.What information security principle is the keylogger most likely designed to disrupt?
弗兰克在公司首席执行官的笔记本电脑上发现了一个键盘记录器。键盘记录器最有可能破坏的信息安全原则是什么？