I85PREP
⌘ K
CISAW SI study materials
CISAW SI study resources

CISAW SI practice questions

One question at a time. Build your CISAW SI understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application and data protection

In CISAW data security, what is the essential difference between symmetric and asymmetric cryptography?

  1. Symmetric algorithms work only on paper; asymmetric algorithms work only on radio
  2. Symmetric algorithms use one shared secret key; asymmetric algorithms use a public/private key pair Correct answer.
  3. Symmetric algorithms only hash; asymmetric algorithms only compress
  4. Symmetric algorithms require 网闸; asymmetric algorithms require RAID

Explanation

Symmetric cryptography (e.g., SM4, AES) uses a shared secret for both encryption and decryption. Asymmetric cryptography (e.g., SM2, RSA) uses a key pair: the public key encrypts or verifies, the private key decrypts or signs. SI designs use symmetric bulk encryption plus asymmetric key exchange/signatures.

Question 2Application and data protection

Which commercial cryptography (商用密码) algorithm is the SM-series block cipher used to protect confidentiality of data at rest or in bulk?

  1. SM4 Correct answer.
  2. SM3
  3. SM2
  4. MD5

Explanation

SM4 is the commercial 128-bit block cipher used for confidentiality. SM3 is the hash function; SM2 is the elliptic-curve public-key algorithm. SI specifications should not assign hashing or signature algorithms to bulk data-at-rest encryption.

Question 3Application and data protection

Which SM-series algorithm is the cryptographic hash function used for integrity checking and as a building block in SM2 signatures?

  1. SM4
  2. ZUC used as a 128-bit block cipher
  3. Base64
  4. SM3 Correct answer.

Explanation

SM3 is the commercial cryptographic hash (256-bit output). It provides integrity fingerprints and is used inside SM2 signature schemes. Hashing is one-way; it is not encryption and does not by itself keep data confidential.

Question 4Application and data protection

Which SM-series algorithm is the elliptic-curve public-key scheme used for digital signatures and key exchange in commercial cryptography?

  1. SM4
  2. CRC32
  3. SM2 Correct answer.
  4. SM3

Explanation

SM2 is the commercial elliptic-curve public-key algorithm. Typical SI uses include digital signatures, public-key encryption of small payloads, and key exchange to protect session keys for SM4. It is not a hash and not a bulk block cipher.

Question 5Application and data protection

For data in transit (传输中的数据) between a browser and a web application, which protocol family is the standard way to provide confidentiality and integrity on the session?

  1. SMTP without STARTTLS or an implicit TLS wrapper
  2. TLS (HTTPS when used on HTTP) Correct answer.
  3. Telnet without encryption
  4. FTP in cleartext PORT mode only

Explanation

TLS provides confidentiality, integrity, and server (and optionally client) authentication for data in transit. HTTPS is HTTP over TLS. Cleartext Telnet, FTP, and SMTP expose credentials and payloads on the path.

Question 6Application and data protection

Which control is primarily aimed at confidentiality of data at rest (静态数据) on a database server's disks?

  1. Transparent database or volume encryption using a managed key (for example SM4 or AES) so stolen media is unreadable Correct answer.
  2. A border 网闸 that ferries files between security domains
  3. An IDS sensor that only alerts on mirrored traffic
  4. A visitor badge printer in the lobby

Explanation

Data at rest is protected by storage/volume/database encryption and key management so that lost or stolen media does not yield plaintext. Boundary isolation and IDS are important but they do not encrypt the bytes on disk.

Question 7Application and data protection

A digital signature is created with the sender's private key. What does successful verification with the corresponding public key demonstrate?

  1. That the ciphertext can be decrypted by anyone on the path
  2. That the file was stored on encrypted disk
  3. That a firewall allowed the packet
  4. Integrity of the signed content and authenticity of the signer (and non-repudiation if the private key is uniquely bound to that signer) Correct answer.

Explanation

Signature verification proves the content has not been altered since signing (integrity) and that it was signed by the holder of the matching private key (authenticity). With a trustworthy identity binding, this also supports non-repudiation. It does not by itself encrypt the payload for confidentiality.

Question 8Application and data protection

Which key-management (密钥管理) practice is appropriate in a CISAW SI design?

  1. Email the same private key to all administrators in cleartext and never rotate it
  2. Print private keys on the equipment room whiteboard for convenience
  3. Generate keys with a strong generator, store them in a protected module or HSM, rotate them, separate duties, and destroy them at end of life Correct answer.
  4. Hard-code a single production SM4 key in application source code committed to a public repository

Explanation

CISAW data-security items include key-management methods: generation, distribution, storage, use, rotation, backup of secrets, and destruction. Hardware security modules (HSM) or equivalent protected key stores, plus dual control, are standard SI choices. Embedding or broadcasting private keys defeats cryptography.

Question 9Application and data protection

Why is a cryptographic hash (such as SM3) unsuitable as the only protection for a confidential file at rest?

  1. Hashes can only be computed on wireless links
  2. A hash is a one-way fingerprint; it does not conceal the original file contents Correct answer.
  3. SM3 is a stream cipher that always leaks the key in the first block
  4. Hashes are illegal under the Cryptography Law

Explanation

Hash functions provide integrity (and, with a key, authentication via HMAC-style constructions). They do not encrypt. Confidential files at rest need a cipher such as SM4/AES plus key management; a hash can be stored alongside to detect tampering.

Question 10Application and data protection

In a hybrid cryptosystem used for data in transit, what is the usual role split between SM2 (or RSA/ECC) and SM4 (or AES)?

  1. The asymmetric algorithm protects or agrees the session key; the symmetric algorithm encrypts the bulk payload Correct answer.
  2. The symmetric algorithm signs the certificate; the asymmetric algorithm compresses video
  3. Both algorithms must hash the payload twice and then discard the ciphertext
  4. SM4 replaces TLS record protection while SM2 replaces IP routing

Explanation

Asymmetric operations are relatively slow and are used to authenticate parties and protect a short session key. Symmetric ciphers then encrypt the high-volume payload. TLS and IPsec both follow this hybrid pattern, which CISAW treats as a typical algorithm application method.

Question 11Application and data protection

Which pair correctly matches recovery-oriented data-security metrics used in fault-tolerance and disaster recovery (容错容灾)?

  1. RPO is the number of firewalls; RTO is the number of 网闸 devices
  2. RPO is CPU frequency; RTO is disk RPM
  3. RPO is a cryptographic mode; RTO is a hash length
  4. RPO (recovery point objective) is the acceptable data-loss window; RTO (recovery time objective) is the acceptable downtime window Correct answer.

Explanation

RPO bounds how much data (measured in time) may be lost; it drives backup/replication frequency. RTO bounds how long services may be down; it drives standby architecture and runbooks. SI designs must set both against business impact, then choose backup, clustering, and alternate-site measures.

Question 12Application and data protection

Why is RAID disk mirroring (for example RAID 1) not a substitute for a backup and restore process in CISAW data security?

  1. RAID automatically ships tapes to another city every hour
  2. RAID 1 is identical to an air-gapped backup vault
  3. RAID protects against some disk failures but not against deletion, corruption, malware, or site loss, which backups and off-site copies address Correct answer.
  4. RAID 1 encrypts data with SM2 so backups are illegal

Explanation

Fault tolerance (容错) keeps a system running through component failure. Disaster recovery (容灾) restores data and services after a damaging event. RAID is local redundancy; ransomware, accidental DROP TABLE, or a computer-room fire still require independent backups and tested restores.

Question 13Application and data protection

Which anti-spam (反垃圾邮件) technique verifies that a sending mail server is authorized for the message's domain in DNS?

  1. A physical mantrap at the computer-room door
  2. SPF (Sender Policy Framework) records checked by the receiving server Correct answer.
  3. RAID 5 parity calculation on the mail spool
  4. SM4-ECB encryption of the mailbox quota

Explanation

SPF publishes which hosts may send mail for a domain. Receivers use it, often with DKIM signatures and DMARC policy, to reduce spoofed spam. CISAW data-security content includes anti-spam technology as an application of data-origin protection on mail.

Question 14Application and data protection

DKIM (DomainKeys Identified Mail) reduces forged spam by which cryptographic mechanism?

  1. The sending domain's private key signs headers and body hashes; receivers verify with the domain's published public key Correct answer.
  2. The receiver decrypts the entire mailbox with a shared SM4 key printed in the DNS TXT record
  3. The message is hashed with CRC32 only, with no key
  4. The firewall rewrites every From: header to postmaster

Explanation

DKIM is a public-key signature over selected mail fields. It supports authenticity and integrity of the message as sent by the domain, complementing SPF and DMARC. The public key is published in DNS; the private key must remain on the authorized signer.

Question 15Application and data protection

Across the data lifecycle (数据采集、存储、传输、使用、共享、销毁), which destruction practice is appropriate for decommissioned disks that held important data?

  1. Reformatting only the first partition table in the GUI and selling the disk immediately
  2. Unplugging the network cable while leaving plaintext disks in an unlocked cabinet
  3. Copying the disks to a public cloud 'recycle bin' and considering them destroyed
  4. Cryptographic erasure of the media encryption key and/or physical destruction or approved sanitization before reuse or disposal Correct answer.

Explanation

Data security spans the lifecycle, including destruction. Approved sanitization, cryptographic erasure when strong media encryption was used, or physical destruction prevents residual data recovery. A casual format does not reliably sanitize modern media.

Question 16Application and data protection

A PKI (public key infrastructure) in an SI project is used mainly to do which job?

  1. Store backup tapes inside the CA's private key
  2. Convert SM3 hashes into SM4 keys by reversing the hash
  3. Bind public keys to identities through certificates issued by a trusted CA, enabling signature verification and encrypted key exchange Correct answer.
  4. Replace all firewalls with a single shared password

Explanation

PKI issues, distributes, revokes, and validates certificates so relying parties can trust that a public key belongs to a named entity. That binding is what makes SM2/RSA signatures and TLS server authentication usable at enterprise scale. Hashes are not reversible into symmetric keys.

Question 17Application and data protection

An SI design encrypts a database volume with SM4 but stores the volume key in a world-readable file next to the data. What is the main cryptographic failure?

  1. Volume encryption illegally substitutes for 网闸 isolation
  2. Key management: the confidentiality of the cipher is only as strong as protection of the key Correct answer.
  3. The SM4 block size is too small to encrypt a volume regardless of the key
  4. SM4 cannot encrypt data at rest by definition

Explanation

Algorithm choice is wasted if the key is exposed. CISAW treats key management as a first-class data-security topic: keys need generation quality, access control, possible HSM storage, rotation, and audit. SM4 is suitable for volume encryption when the key is protected.

Question 18Application and data protection

Which statement about HMAC-style keyed hashing versus a bare SM3 digest is correct for protecting a software update package in transit?

  1. A bare digest can be recomputed by an attacker who modifies the package; a signature or keyed MAC binds integrity to a secret or private key the attacker does not have Correct answer.
  2. A bare SM3 digest already provides non-repudiation because hashes are unique to the author
  3. HMAC decrypts the package so that only the firewall can read it
  4. Keyed hashing is forbidden when TLS is used on any hop

Explanation

An unkeyed hash only detects accidental change if the attacker cannot also replace the published digest. An attacker who controls the distribution path can change both. Digital signatures (SM2) or a keyed MAC bind integrity to a key. TLS protects the hop but does not by itself authenticate the publisher of a package.

Question 19Application and data protection

A production database requires near-zero RPO and a short RTO after a computer-room outage. Which data-protection architecture best matches those objectives?

  1. A single local RAID 0 stripe with no backup
  2. Weekly full backups stored on a shelf beside the primary server, with no restore tests
  3. Deleting transaction logs to speed failover
  4. Synchronous or near-synchronous remote replication to a standby site, plus tested failover, rather than only nightly tapes in the same room Correct answer.

Explanation

Near-zero RPO needs replication that commits data off-site at or near primary commit time. Short RTO needs a standby that can take over. Same-room RAID or untested local tapes fail both a site disaster and the CISAW requirement to apply 容错容灾 methods, not merely name them.

Question 20Application and data protection

Which application of cryptography is appropriate when two SI-managed sites must exchange bulk files over a public WAN while also authenticating the sending gateway?

  1. SM3 hashing of filenames only, leaving file contents in cleartext
  2. Relying on RFC 3514 'evil bit' as the only confidentiality mechanism
  3. IPsec or TLS with mutual authentication, using asymmetric identities to protect a symmetric session key that encrypts the files Correct answer.
  4. Cleartext FTP plus an SM3 checksum emailed on the same path as the files

Explanation

Bulk confidentiality on a public path needs a symmetric cipher; gateway authentication needs certificates or similar asymmetric identities. IPsec and TLS are the standard protocol vehicles. A checksum on the same unauthenticated path can be replaced together with the file.

Question 21Security foundations, governance and Chinese context

In CISAW information-security fundamentals, which three attributes form the classic CIA triad (信息安全三要素)?

  1. Confidentiality (机密性), integrity (完整性), and availability (可用性) Correct answer.
  2. Authentication (鉴别), authorization (授权), and accounting (审计)
  3. Warning (预警), detection (检测), and recovery (恢复)
  4. Identification (标识), encryption (加密), and backup (备份)

Explanation

The classic information-security triad is confidentiality (机密性), integrity (完整性), and availability (可用性). CISAW training treats these as the core attributes that later CIA-plus properties (authenticity, non-repudiation, controllability) extend rather than replace.

Question 22Security foundations, governance and Chinese context

Which statement best describes confidentiality (机密性) as used in CISAW information-security fundamentals?

  1. Information can be modified by any system user so that it stays current
  2. Information services remain reachable even when cryptographic keys are published
  3. Information is destroyed immediately after it is transmitted
  4. Information is disclosed only to authorized entities and remains hidden from unauthorized entities Correct answer.

Explanation

Confidentiality (机密性) means information is not disclosed to unauthorized persons, processes, or devices. Encryption, access control, and need-to-know are typical supporting controls; they serve this attribute rather than redefine it.

Question 23Security foundations, governance and Chinese context

A hospital information system must remain usable during a regional power event. Which CIA attribute is the integration team primarily protecting?

  1. Non-repudiation (抗抵赖)
  2. Steganography (隐写术)
  3. Availability (可用性) Correct answer.
  4. Confidentiality (机密性)

Explanation

Availability (可用性) is the property that authorized users can access information and services when needed. Power redundancy, UPS, clustering, and disaster recovery are typical SI measures that support this attribute.

Question 24Security foundations, governance and Chinese context

In CISAW risk vocabulary, which statement correctly distinguishes threat (威胁), vulnerability (脆弱性), and risk (风险)?

  1. A threat, a vulnerability, and a risk are three names for the same residual score after treatment
  2. A threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk is the combination of that possibility with consequence Correct answer.
  3. A threat is a missing patch, a vulnerability is an attacker, and risk is a firewall rule
  4. A threat is always a natural disaster, a vulnerability is always a virus, and risk is always residual after encryption

Explanation

CISAW fundamentals require understanding definitions and classification of risk, threat, and vulnerability. A threat (威胁) is a potential cause of an unwanted incident; a vulnerability (脆弱性) is a weakness that a threat may exploit; risk (风险) reflects the combination of likelihood and impact, not any one of those elements alone.

Question 25Security foundations, governance and Chinese context

Which of the following is a common information-security threat (常见威胁) that a CISAW SI engineer should expect to see in requirements analysis?

  1. Phishing that tricks a privileged operator into revealing credentials Correct answer.
  2. A documented residual-risk acceptance signed by the asset owner
  3. A correctly configured UPS in the computer room
  4. A completed SSE-CMM assurance argument

Explanation

Common threats include social-engineering (phishing), malware, insider misuse, denial of service, and physical intrusion. SI requirements analysis starts from such threats plus asset value and known weaknesses, not from completed assurance artifacts.

Question 26Security foundations, governance and Chinese context

The CISAW unified assurance model extends PDR into WPDRRC. What do the six WPDRRC capability links represent?

  1. Write, patch, detect, report, restore, and comply
  2. Wireless, physical, data, routing, RAID, and cryptography
  3. Watch, policy, DMZ, RADIUS, RBAC, and checksum
  4. Warning (预警), protection (保护), detection (检测), response (反应), recovery (恢复), and counter-attack (反击) Correct answer.

Explanation

CISAW training presents the evolution from PDR to WPDRRC. The six links are warning/预警, protection/保护, detection/检测, response/反应, recovery/恢复, and counter-attack/反击. They describe assurance activities around the protected object, not a product shopping list.

Question 27Security foundations, governance and Chinese context

Relative to the classic PDR model (protection, detection, response), what does WPDRRC add as explicit capability links?

  1. Only physical fences and guards
  2. Only SSE-CMM capability Level 5
  3. Warning (预警) before protection, plus recovery (恢复) and counter-attack (反击) after response Correct answer.
  4. Only encryption and digital signatures

Explanation

PDR covers protection, detection, and response. WPDRRC keeps those three and adds warning (前瞻脆弱性/威胁感知), recovery (业务与数据恢复), and counter-attack (取证与依法打击). CISAW uses this series as the unified assurance-link view.

Question 28Security foundations, governance and Chinese context

Under the PRC Cybersecurity Law (网络安全法), network operators of information systems in China are expected to implement which graded protection approach?

  1. Exemption from any protection grade if a firewall is purchased
  2. Cybersecurity classified protection (网络安全等级保护, MLPS) Correct answer.
  3. A voluntary US FedRAMP authorization in place of Chinese obligations
  4. Replacement of all Chinese standards with PCI DSS alone

Explanation

The Cybersecurity Law requires network operators to implement cybersecurity classified protection (网络安全等级保护, commonly MLPS). SI designs in China are therefore expected to align controls with the system's determined protection grade rather than with an unrelated foreign authorization scheme.

Question 29Security foundations, governance and Chinese context

The PRC Data Security Law (数据安全法) requires data to be protected according to its importance. Which grouping matches the law's classified-protection idea for data?

  1. Core data (核心数据), important data (重要数据), and general data (一般数据) Correct answer.
  2. Public data, secret data, and top-secret data as the only three MLPS grades
  3. Personal data, payment data, and health data as statutory encryption algorithms
  4. Hot data, warm data, and cold data as legal classification labels

Explanation

The Data Security Law establishes a classified and graded data-protection idea. Practice and implementing rules treat core data, important data, and general data as the operative importance classes. SI designs must match protection strength to that classification, not to storage-tier nicknames.

Question 30Security foundations, governance and Chinese context

When an SI project must protect identified natural persons' information in China, which law is the primary personal-information statute, distinct from the Data Security Law's focus on data as a national/organizational asset?

  1. Company Law (公司法) director-liability chapter
  2. Patent Law (专利法) disclosure rules
  3. Auction Law (拍卖法) notice rules
  4. Personal Information Protection Law (个人信息保护法, PIPL) Correct answer.

Explanation

PIPL (个人信息保护法) is the dedicated personal-information statute. The Data Security Law addresses data security more broadly (including important/core data). SI requirements for consent, purpose limitation, and sensitive personal information come from PIPL, not from unrelated commercial codes.

Question 31Security foundations, governance and Chinese context

The PRC Cryptography Law (密码法) divides cryptography into core (核心密码), common (普通密码), and commercial (商用密码) categories. Which statement is correct for ordinary enterprise SI projects that are not protecting state secrets?

  1. They are forbidden to encrypt any data at rest
  2. They may only use ROT13 because commercial cryptography is reserved for state secrets
  3. They use commercial cryptography (商用密码) products and algorithms such as the SM series where commercial-crypto rules apply Correct answer.
  4. They must deploy core cryptography (核心密码) on every public website

Explanation

Core and common cryptography protect state secrets and are not the commercial-SI toolkit. Ordinary information systems use commercial cryptography (商用密码), including SM2/SM3/SM4 where commercial-crypto and industry rules require them. SI engineers must not specify core cryptography for unclassified enterprise systems.

Question 32Security foundations, governance and Chinese context

GB/T 22239 is the principal national standard used in MLPS 2.0 (等保 2.0) baseline security requirements. What should an SI designer take from it?

  1. A rule that Grade 1 systems must use 网闸 to the public Internet
  2. Technical and management control baselines scaled to the system's protection grade, covering network, devices, applications, data, and management Correct answer.
  3. A mandatory list of exactly three firewall vendors that must be used at every grade
  4. A replacement of SSE-CMM process areas with PCI DSS requirement numbers

Explanation

GB/T 22239 provides classified protection baseline requirements (security general requirements) used in MLPS 2.0. SI scheme design maps the system's grade to those technical and management baselines. It does not freeze vendors or replace SSE-CMM.

Question 33Security foundations, governance and Chinese context

A threat exists, but the system has no exploitable vulnerability related to that threat. From a CISAW risk-process view, which conclusion follows?

  1. A harmful event from that threat-vulnerability pair does not materialize, so that particular risk is not realized Correct answer.
  2. Risk is automatically at the maximum because any threat equals maximum risk
  3. The SI team must still install every possible control regardless of impact
  4. Integrity is guaranteed even if backups are never tested

Explanation

Harmful events require a threat able to exploit a vulnerability with some impact. SSE-CMM and CISAW teaching stress that if the relevant vulnerability (or the threat) is absent, that risk path does not materialize. Residual risk still needs monitoring because threats and weaknesses change.

Question 34Security foundations, governance and Chinese context

Beyond CIA, CISAW information-security teaching also emphasizes authenticity and non-repudiation (抗抵赖). Which control pairing best supports those two properties together?

  1. A packet-filtering firewall that drops UDP
  2. A raised floor and FM-200 in the computer room
  3. RAID 0 striping without parity
  4. Digital signatures using the signer's private key, with verification using the corresponding public key and a trustworthy certificate Correct answer.

Explanation

Authenticity (the claimed source is genuine) and non-repudiation (the signer cannot credibly deny the act) are provided by public-key digital signatures bound to identity through a trustworthy certificate/PKI. Symmetric encryption alone does not give non-repudiation because both parties share the key.

Question 35Security foundations, governance and Chinese context

Which body is China's dedicated national technical committee for information-security standardization (信息安全标准化), commonly referenced when CISAW discusses related standards?

  1. World Health Organization (WHO)
  2. International Olympic Committee (IOC)
  3. National Information Security Standardization Technical Committee (TC260 / 全国信息安全标准化技术委员会) Correct answer.
  4. International Civil Aviation Organization (ICAO)

Explanation

CISAW fundamentals include related laws and standards. In China, TC260 (全国信息安全标准化技术委员会) coordinates information-security national standards (GB/T 22239, GB/T 20261, and related series). ISO/IEC and ITU are international counterparts, not substitutes for TC260's domestic role.

Question 36Network boundaries and protected communication

In CISAW boundary security (边界安全), a firewall (防火墙) is primarily used to do which job?

  1. Cool the computer room
  2. Issue CISAW certificates
  3. Enforce an access-control policy on traffic crossing a network boundary Correct answer.
  4. Replace SM3 hashing of stored files

Explanation

A firewall is a network-boundary control that permits, denies, or inspects traffic according to policy. CISAW SI treats firewalls as a core 网络边界安全 technology alongside 网闸, not as a physical HVAC or certification function.

Question 37Network boundaries and protected communication

What is a 网闸 (security isolation gateway / GAP) designed to do at a network boundary?

  1. Act as a UPS for the core switch
  2. Provide protocol-breaking, physically isolated information exchange so two networks are never IP-connected at the same time Correct answer.
  3. Forward TCP sessions statefully like a standard firewall while keeping a single shared routing table
  4. Hash passwords with SM3 inside a switch ASIC

Explanation

网闸 (安全隔离与信息交换系统) uses a ferry/gap so the trusted and untrusted sides are electrically disconnected except during a controlled, protocol-broken transfer. It is the CISAW-emphasized isolation device between different security domains, distinct from a firewall that routes or NATs IP flows.

Question 38Network boundaries and protected communication

A DMZ (demilitarized zone) on a firewalled boundary is used mainly to:

  1. Place externally reachable services in a segment that is neither fully trusted nor fully untrusted Correct answer.
  2. Store root cryptographic keys for SM2 in a public folder
  3. Disable all logging of inbound connections
  4. Replace physical perimeter fences

Explanation

A DMZ holds published services (web, mail, VPN portals) so that a compromise there does not automatically equal compromise of the internal trust domain. Firewall policies control DMZ–Internet and DMZ–intranet flows separately.

Question 39Network boundaries and protected communication

Which example is physical-boundary / perimeter security (周界安全) rather than a logical network firewall?

  1. A stateful packet filter on TCP/443
  2. An SM4 volume key
  3. An SPF DNS record
  4. Fences, gates, guards, CCTV, and intrusion sensors around the facility housing the computer room Correct answer.

Explanation

CISAW boundary security includes physical boundaries (周界) as well as logical ones. Facility perimeter controls keep unauthorized people from reaching equipment. Firewalls and DNS mail records are logical/data controls.

Question 40Network boundaries and protected communication

Host-boundary security (主机边界安全) is best illustrated by which control?

  1. A diesel generator
  2. A DKIM public key in DNS
  3. A host-based firewall that restricts which ports and peers a single server will accept Correct answer.
  4. A campus-wide OSPF area 0 design

Explanation

CISAW lists host-boundary security alongside network-boundary firewalls and 网闸. The host firewall, personal firewall, or local TCP wrapper is the last logical boundary of that computer.

Question 41Network boundaries and protected communication

How does a stateful inspection firewall differ from a stateless packet filter?

  1. It replaces identity authentication on hosts
  2. It tracks connection state so return traffic for allowed sessions can be passed without mirroring every rule in reverse Correct answer.
  3. It physically ferries files across an air gap like a 网闸
  4. It always decrypts TLS without a defined interception policy

Explanation

Stateless filters decide per packet. Stateful inspection maintains a connection table (TCP state, UDP/ICMP timeouts) and is the standard modern firewall behavior. It still forwards IP connectivity, unlike 网闸.

Question 42Network boundaries and protected communication

When should an SI scheme specify a 网闸 instead of (or in addition to) a firewall between two domains?

  1. When policy requires physical isolation and protocol break between different security domains, such as a high-protection network exchanging files with a lower-trust network Correct answer.
  2. When the only need is NAT of many internal users to the Internet with stateful HTTP inspection
  3. When the only need is to terminate TLS for a public website on the same LAN
  4. When the two hosts must share a live TCP session with the same routing table

Explanation

网闸 is selected where IP connectivity itself is unacceptable and only controlled, protocol-broken exchange (files, database sync, mail) is allowed. Ordinary Internet access, NAT, and TLS offload are firewall/proxy jobs. Forcing a live TCP session through a 网闸 contradicts its isolation purpose.

Question 43Network boundaries and protected communication

An application-layer proxy firewall (应用代理防火墙) protects a boundary mainly by:

  1. Forwarding bits at Layer 1 without IP addresses
  2. Acting as a diesel generator
  3. Storing SM2 private keys in the clear on the untrusted interface
  4. Terminating the client connection and opening a separate connection to the server, inspecting the application protocol Correct answer.

Explanation

A proxy breaks the client-server TCP session and can enforce application protocol rules (HTTP methods, SMTP commands). That protocol break is stronger than packet filters but is still not the physical isolation of a 网闸.

Question 44Network boundaries and protected communication

A next-generation firewall (NGFW) typically adds which capability beyond 5-tuple stateful filtering?

  1. Automatic issuance of CISAW professional-senior certificates
  2. Computer-room FM-200 discharge
  3. Application identification, user identity, and often integrated IPS/AV inspection Correct answer.
  4. Physical air-gap ferry of SCSI disks

Explanation

NGFWs retain stateful filtering and add application awareness, identity (often via directory integration), and threat inspection. They remain IP-connected boundary devices. Disk ferry and fire suppression are different control families.

Question 45Network boundaries and protected communication

Why is VLAN segmentation alone usually insufficient as the only boundary between an office LAN and a payment or Grade-III (三级) business system?

  1. VLANs replace identity authentication
  2. VLANs are logical LAN isolation and can be mis-bridged; higher-grade boundaries still need firewall/网闸 policy enforcement and monitored chokepoints Correct answer.
  3. VLANs automatically provide SM4 encryption of every frame
  4. VLANs are identical to 网闸 physical isolation

Explanation

VLANs reduce broadcast domains but remain on the same switched infrastructure unless additional controls exist. MLPS-style higher-grade boundaries require dedicated access-control devices, monitoring, and often isolation. SI designs use VLANs plus firewalls, not VLANs instead of boundaries.

Question 46Network boundaries and protected communication

A unidirectional gateway (单向导入/光闸 style isolation) is most appropriate when:

  1. Data must flow only from a low-trust or collection network into a high-trust network, with no return IP path Correct answer.
  2. Interactive SSH administration of the high-trust hosts from the Internet is required
  3. Both sides must maintain a single bidirectional TCP table
  4. The only goal is to NAT many users to IPv4 Internet

Explanation

Unidirectional isolation (often optical) is used for one-way import (for example security monitoring data entering a higher domain). Any required return channel would be a separate, tightly specified exception. Bidirectional administration and NAT are firewall/VPN use cases.

Question 47Network boundaries and protected communication

Which logical-boundary placement is the usual SI pattern for a site-to-site VPN concentrator?

  1. Inside the database engine as a stored procedure
  2. On the UPS serial console only
  3. As a replacement for SM3 file integrity on backups
  4. At the network boundary, with encrypted tunnels from peer gateways and decrypted traffic then subject to firewall policy before reaching internal segments Correct answer.

Explanation

A VPN extends a logical boundary across an untrusted carrier (often IPsec). After decryption, traffic must still hit firewall policy; a tunnel is not an automatic full-trust pipe. This is network-boundary security using a security protocol on the transmission carrier.

Question 48Network boundaries and protected communication

An SI design puts a 网闸 between a classified internal domain and the Internet, then also enables a 'transparent routing' mode so users can browse with ordinary TCP. What is the main conceptual error?

  1. Internet browsing requires RAID 0
  2. Classified domains must use Telnet to the Internet without isolation
  3. Transparent IP routing re-creates a live protocol path and undermines the physical-isolation purpose of 网闸 Correct answer.
  4. 网闸 is only legal on Grade 1 systems and forbidden on classified domains

Explanation

网闸 value is the gap and protocol break. If the device is configured as an ordinary router/firewall, the isolation guarantee collapses. Classified-to-Internet exchange, where permitted at all, uses tightly controlled ferry services (file, mail, fetch), not transparent TCP.

Question 49Network boundaries and protected communication

A WAF (web application firewall) is placed in front of a public web system. How does it relate to a network firewall in CISAW boundary design?

  1. The WAF generates SM2 root keys for the CA
  2. The network firewall enforces IP/port/session policy; the WAF inspects HTTP(S) application semantics such as injection and session abuse Correct answer.
  3. The WAF replaces 网闸 physical isolation for classified-to-Internet file exchange
  4. The WAF is a computer-room humidity sensor

Explanation

Defense in depth uses both network-boundary firewalls and application-boundary controls. A WAF is an HTTP-layer boundary control. It does not create a physical gap and must not be treated as a 网闸 equivalent.

Question 50Network boundaries and protected communication

Which host-boundary plus network-boundary pairing best limits east-west movement after a single workstation is compromised?

  1. Host firewall and EDR on the workstation, plus internal segmentation firewalls between user, server, and management zones Correct answer.
  2. A single perimeter firewall with all internal VLANs fully meshed and host firewalls disabled
  3. No internal controls because WPDRRC 'protection' only means a border router ACL
  4. Replacing all boundaries with a larger broadcast domain

Explanation

CISAW boundary security includes host boundaries as well as network and physical ones. After a foothold, east-west controls (micro-segmentation, internal firewalls, host firewalls) matter as much as the Internet edge. A single outer ACL is not a complete SI boundary design.