I85PREP
⌘ K
CISAW Security Operations (OM) study materials
CISAW Security Operations (OM) study resources

CISAW Security Operations (OM) practice questions

One question at a time. Build your CISAW Security Operations (OM) understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security operations, monitoring and response

Which set matches CISAW daily security-operations content (日常运维)?

  1. Annual strategy offsites only
  2. Routine inspection, fault handling, security audit, and security bulletins/notices Correct answer.
  3. Only designing a new corporate mascot
  4. Only writing the original business-case document

Explanation

Daily security-operations work can include routine inspection, fault handling, security auditing and relevant security notices. These activities maintain and observe the actual service and its protection controls; the answer does not assert an official current examination weighting.

Question 2Security operations, monitoring and response

What is the main purpose of routine security inspection (例行巡检) in OM daily operations?

  1. To generate tickets with no observation of system state
  2. To replace all backups with screenshots of the login page
  3. To obtain operations-object status on a planned cycle, find hidden faults and control drift, and record evidence before users are impacted Correct answer.
  4. To disable monitoring so dashboards stay green

Explanation

Routine inspection is planned, scoped, and recorded. It compares live state to baselines (availability, patch, config, capacity, security events). Fake tickets, screenshot-only 'backups,' and disabled monitoring defeat the purpose.

Question 3Security operations, monitoring and response

A daily-operations fault-handling principle that CISAW expects is:

  1. Reboot production first, never record, never identify root cause
  2. Ignore P1 outages until the next annual audit
  3. Always make untracked live edits on Friday night with no rollback
  4. Triage by impact and urgency, restore service with a controlled method, record actions, and then pursue root-cause and recurrence control Correct answer.

Explanation

Daily fault handling uses priority, controlled recovery, evidence, and follow-through. Unrecorded reboots and untracked weekend edits are operations-security failures even if the site returns.

Question 4Security operations, monitoring and response

What should a security audit activity in daily operations examine?

  1. Whether privileged actions, log completeness, and control operation match policy, with retained evidence Correct answer.
  2. Only whether the SOC coffee machine is clean
  3. The CEO's personal tax return
  4. Whether operators can guess production passwords from a wiki

Explanation

安全审计 in daily OM is operational audit of whether people and systems complied with policy: privileged use, log integrity, control health. It is not facilities housekeeping, personal tax, or a password-sharing exercise.

Question 5Security operations, monitoring and response

When a vendor issues a critical vulnerability bulletin, what is the CISAW-appropriate daily-operations response to 安全通告?

  1. Delete the bulletin so nobody worries
  2. Intake, assess applicability to operations objects, assign patch/mitigate/accept with a deadline, and track closure Correct answer.
  3. Forward it to the entire internet including exploit details for unpatched CII
  4. Wait five years regardless of exploitability

Explanation

Security notices are a daily-ops channel: receive, scope, decide, and close. Suppression, reckless public exploit sharing against unpatched CII, or infinite delay are not the handling principle.

Question 6Security operations, monitoring and response

Which monitoring design best matches CISAW operations implementation?

  1. No logs, no alerts, and a hope that users will phone the CEO
  2. Sample one ping every leap year
  3. Collect logs and telemetry from operations objects, correlate (SIEM/SOC), alert on agreed use cases, and retain records at least as long as CSL requires Correct answer.
  4. Store logs for ten minutes then overwrite

Explanation

Implementation monitoring is continuous collection, correlation, and actionable alerting, with retention meeting Cybersecurity Law's six-month floor (and longer if sector rules demand). Hope-based or tiny-sample monitoring is not OM practice.

Question 7Security operations, monitoring and response

A defensible production patching sequence in CISAW OM is:

  1. Patch production at random during peak, no ticket, no rollback
  2. Never patch Level-3 systems because patches always reduce security
  3. Publish unpatched exploit POCs on the customer portal
  4. Inventory applicability, test in a representative environment, change-approve, patch in a window, verify, and retain a rollback path Correct answer.

Explanation

Patching is daily/optimization work under change control. Applicability, test, approval, verification, and rollback protect availability while closing vulnerabilities-the MLPS vulnerability-and-risk control point. Random peak changes and never-patch policies both fail.

Question 8Security operations, monitoring and response

Which backup practice is unacceptable for a Level-3 operations object?

  1. A single never-tested local copy on the same disk as production, overwritten daily, with no restore procedure Correct answer.
  2. Identified important data with off-site real-time backup, documented restore tests, and hot redundancy of important processing
  3. Documented backup frequency, media, retention, and restore owners
  4. Periodic restore drills recorded as operations evidence

Explanation

MLPS Level 3 expects off-site real-time backup and hot redundancy, plus management of what is backed up and how it is restored. Same-disk, untested, procedure-less copies fail both technical and management backup controls.

Question 9Security operations, monitoring and response

What must a production change process include under CISAW OM / MLPS change management?

  1. Anyone may change anything at any time if they feel confident
  2. Request, impact/risk assessment, approval, implementation window, verification, and a tested back-out from failed change Correct answer.
  3. Verbal hallway permission with no ticket
  4. Deleting logs after every change so history stays empty

Explanation

GB/T 22239 change management requires approval, control of the change path, and procedures to abort and recover from failed change, with drills when needed. Hallway changes and log wiping destroy operations security.

Question 10Security operations, monitoring and response

Emergency response inside CISAW operations implementation should cover which chain?

  1. Only printing a binder that is never exercised
  2. Waiting until the press calls, then denying everything
  3. Preparedness (organization, plans, classification, drills), monitoring and warning, disposal, recovery, and after-action improvement Correct answer.
  4. Reimaging every laptop in the country regardless of impact

Explanation

OM emergency-within-ops is comprehensive application: measures and process spanning prepare–monitor–handle–recover–learn. Unused binders, press-only responses, and unscoped national reimaging are not that chain.

Question 11Security operations, monitoring and response

During an in-progress ransomware event on a payment system, what is the first operations action among the following?

  1. Wipe all backups immediately so nothing remains to restore
  2. Post the decryption-demand details on social media with customer lists
  3. Disable all logging to 'reduce noise'
  4. Contain: isolate affected segments/hosts per the plan while preserving forensic images and confirmed-clean backups Correct answer.

Explanation

Emergency disposal prioritizes containment and evidence/backup preservation so recovery remains possible. Destroying backups, leaking customer data, or blinding logs worsen impact and compliance exposure.

Question 12Security operations, monitoring and response

What is the aim of optimization and improvement (优化改善) in CISAW operations implementation?

  1. Planned tuning of performance, architecture, or controls against measured gaps, with review, a trial window, and residual-issue handling Correct answer.
  2. Randomly reboot devices weekly with no hypothesis or rollback
  3. Deleting all baselines so drift cannot be detected
  4. Removing MFA because it slows tickets

Explanation

Optimization is a controlled activity: target, steps, owners, metrics, risk/rollback, review, and trial observation. It is not unplanned reboots or control removal. It interfaces with daily ops and emergency lessons.

Question 13Security operations, monitoring and response

Supervisory assessment (监管评估) in CISAW implementation is best described as:

  1. Ignoring SLA and control evidence because 'the team is busy'
  2. Checking whether daily ops, emergency, and optimization actually meet policy, SLA, and MLPS/evaluation findings, and feeding gaps back Correct answer.
  3. A motivational speech with no measurements
  4. Deleting evaluation reports before regulators arrive

Explanation

监管评估 is how the owner (and sometimes a supervisor/regulator/evaluator) verifies that implementation is real. It uses evidence against policy and grade. The outline mastery is 'understand.' Destroying reports is concealment, not assessment.

Question 14Security operations, monitoring and response

Which 4A capability is the operations-implementation control for privileged production access?

  1. Advertising, art, athletics, and astronomy
  2. Allow-all anonymous Telnet from the internet
  3. Authentication, authorization, account, and audit of administrative sessions, typically via a bastion/jump host Correct answer.
  4. A shared paper notebook of root passwords

Explanation

Chinese operations practice uses 4A (认证, 授权, 账号, 审计) platforms and bastion hosts so every admin session is identified, permitted, accounted, and recorded. GB/T 22239 requires approval and immutable logs for ops-tool use. Anonymous Telnet and paper password books fail that control.

Question 15Security operations, monitoring and response

GB/T 22239-2019 malware-prevention management for operations typically requires:

  1. Unauthorized consumer AV with never-updated signatures and no policy
  2. Disabling all host protection to speed batch jobs permanently
  3. Trusting email attachments because 'users are careful'
  4. Authorized anti-malware use, signature/engine updates, and regular scanning as specified in operations procedures Correct answer.

Explanation

MLPS malware-prevention management specifies authorized software, library updates, and regular detection. Permanent disablement and hope-based email handling are not the control.

Question 16Security operations, monitoring and response

Configuration management in daily security operations should:

  1. Maintain approved baselines, control deviations through change, and detect unauthorized drift Correct answer.
  2. Allow undocumented live drift as the only source of truth
  3. Store the gold baseline only in an engineer's memory
  4. Reset devices to factory defaults every hour

Explanation

MLPS configuration management and OM daily ops both need a known-good baseline. Drift detection is how inspection and audit find silent risk. Memory-only or hourly factory resets are not configuration management.

Question 17Security operations, monitoring and response

A SOC L1 analyst sees a confirmed malware beacon from a workstation to an unknown foreign IP. What is the correct next implementation step?

  1. Ignore it because availability still looks fine
  2. Follow the playbook: contain the host, escalate to L2/IR, preserve evidence, and notify per event-classification rules Correct answer.
  3. Format the SIEM database to clear the alert
  4. Email the suspected attacker asking them to stop

Explanation

Daily monitoring hands off to emergency-within-ops when an event is confirmed. Containment, escalation, evidence, and notification match OM emergency measures. Availability-only thinking misses confidentiality/integrity events.

Question 18Security operations, monitoring and response

China's national cybersecurity-incident scheme commonly grades incidents as:

  1. Only 'tiny' and 'invisible'
  2. Only colors of office furniture
  3. Particularly major, major, relatively large, and general (特别重大, 重大, 较大, 一般) Correct answer.
  4. A single unlabeled bucket called 'later'

Explanation

National emergency plans for network-security incidents use four grades: 特别重大, 重大, 较大, and 一般. OM emergency procedures must classify so notification, command, and recovery scale correctly.

Question 19Security operations, monitoring and response

MLPS 2.0 emergency-plan management at Level 3 expects which extra practices beyond merely having a document?

  1. Never train or drill, and never revise the plan
  2. A plan written in disappearing ink
  3. A plan that covers only cafeteria fire drills and ignores information systems
  4. Regular training and drills for relevant personnel, plus periodic reassessment and revision of the plan Correct answer.

Explanation

Level 3 emergency-plan control points add training, drills, and periodic re-evaluation on top of having handling and recovery procedures. Unused or off-topic plans fail the control.

Question 20Security operations, monitoring and response

Media handling in operations implementation, consistent with GB/T 22239, requires that devices with storage being retired or reused:

  1. Be completely cleared or securely overwritten so sensitive data and authorized software cannot be recovered Correct answer.
  2. Be sold on a second-hand market with residual customer data intact
  3. Be tossed in household trash without records
  4. Be given to visitors as souvenirs

Explanation

MLPS media/equipment controls require sanitization before disposal or reuse. Residual data on retired disks is a classic operations-security leak path.

Question 21Security operations, monitoring and response

A change is approved for a firewall rule. Implementation fails halfway. What does CISAW/MLPS change management require next?

  1. Leave the device in a half-applied unknown state and go home
  2. Execute the documented back-out, restore a known-good policy, verify service, and record the failure for review Correct answer.
  3. Disable all logging and retry random rules until something works
  4. Announce that change management is cancelled forever

Explanation

Failed-change recovery is an explicit MLPS change-management requirement. Unknown half-states are availability and security incidents. Logging must continue so the failure can be reviewed.

Question 22Security operations, monitoring and response

Which daily-operations record set best supports both CSL logging duty and later effectiveness assessment?

  1. No records, because 'we remember'
  2. A single sticky note discarded each evening
  3. Inspection logs, fault tickets, change records, backup/restore results, and privileged-session audit trails retained for at least six months Correct answer.
  4. Screenshots of a green dashboard with no raw logs

Explanation

Implementation must leave evidence. CSL sets a six-month log floor; OM review later needs tickets and restore results to compute indicators. Memory, nightly sticky notes, and dashboard screenshots are not sufficient records.

Question 23Security operations, monitoring and response

Optimization finds that MFA fatigue is causing help-desk delays. Which improvement is CISAW-aligned?

  1. Permanently disable MFA on all CII consoles
  2. Print passwords on badges
  3. Share one OTP token across the whole night shift
  4. Tune enrollment, add phishing-resistant authenticators where feasible, staff the desk for peak, and keep MFA as a required control Correct answer.

Explanation

Optimization improves delivery without deleting required controls. MFA remains an execution-layer control for privileged CII access; the process and tooling around it can be improved. Shared OTPs and printed passwords increase operations-security risk.

Question 24Security operations, monitoring and response

Which statement correctly places emergency response inside CISAW OM versus the CISAW Emergency Service direction?

  1. OM tests emergency-within-operations (prepare, monitor, handle, recover as part of running the system); the Emergency Service direction is a deeper specialist CSIRT track Correct answer.
  2. OM never mentions emergency work; all incidents are ignored
  3. OM laboratory items replace the entire national CNCERT function
  4. Emergency Service candidates are forbidden from knowing daily inspection

Explanation

The OM outline includes 应急响应保障 as an implementation topic, not a full CSIRT professional syllabus. CISAW Emergency Service is the specialist direction. Operators still must run in-life emergency measures.

Question 25Security operations, monitoring and response

In the CISAW Security Operations (安全运维方向, OM) model, what is the primary meaning of security operations (安全运维) as distinct from ordinary IT operations?

  1. Applying security management and technical controls throughout the information-system operations lifecycle so confidentiality, integrity, and availability are maintained in production Correct answer.
  2. Running the data center with the lowest possible headcount and no security tooling
  3. Performing a one-time penetration test before go-live and then handing the system to an unmanaged help desk
  4. Encrypting backups only, while leaving live operations, identities, and changes uncontrolled

Explanation

CISAW treats 安全运维 as operations of the information system that are planned and executed with security methods: people, process, platform, and controls stay in force after go-live. Ordinary IT operations that ignore security attributes, or a one-time pre-production test, do not meet that definition. The 2021 outline tests this as a comprehensive-application concept, not a slogan.

Question 26Security operations, monitoring and response

Which statement best captures operations security (运维安全) in the CISAW OM outline?

  1. It is only the physical lock on the computer-room door
  2. It is the discipline of identifying, treating, and monitoring risks that the operations process itself may introduce to systems, data, and service continuity Correct answer.
  3. It is a marketing name for outsourced SOC ticket handling
  4. It replaces the need for security operations because tools will auto-remediate every fault

Explanation

运维安全 focuses on risks derived from doing operations: privileged misuse, unsafe changes, vendor remote access, incomplete backups, and unmonitored tooling. CISAW places risk assessment, treatment, and process monitoring in this mode. It complements 安全运维 rather than replacing it.

Question 27Security operations, monitoring and response

How does the CISAW outline treat the relationship between security operations (安全运维) and operations security (运维安全)?

  1. They are mutually exclusive modes; an organization must pick only one
  2. Operations security is used only before go-live; security operations starts only after an incident
  3. They are complementary: security operations delivers secure service, while operations security controls risks created by that delivery process Correct answer.
  4. They are English translations of the same Chinese term and have identical control catalogs

Explanation

The 2021 outline requires comprehensive application of both modes and their relationship. 安全运维 is the secure way of running the system (subject, object, process, platform, activities). 运维安全 is the control of risks that those activities generate. Together they form the CISAW OM system, along with compliance and review.

Question 28Security operations, monitoring and response

In CISAW terms, which list correctly identifies core elements of the information-system security-operations model?

  1. Marketing slogans, sales quotas, and brand color palettes
  2. Only firewalls, with no people or process
  3. Shareholder dividends and quarterly earnings guidance
  4. Operations objects, security attributes, resources, and management Correct answer.

Explanation

Authorized CISAW OM teaching materials describe the model around operations objects (the systems and services being run), security attributes to be protected, resources used to operate, and management that binds them. People, process, and platform then instantiate that model. Non-security business artifacts are out of scope.

Question 29Security operations, monitoring and response

Which description of an information system is most consistent with CISAW OM foundations?

  1. An organized combination of people, processes, data, and information technology that collects, processes, stores, and delivers information to support business Correct answer.
  2. A single unmanaged spreadsheet on a personal laptop with no users, processes, or technology stack
  3. Any electrical appliance that happens to contain a microchip
  4. A printed policy binder that is never implemented on live systems

Explanation

CISAW's overview requires understanding information, systems, and information systems. An information system is the socio-technical whole-people, process, data, and IT-that supports business information handling. Isolated files, consumer appliances, or paper-only policies are not that whole.

Question 30Security operations, monitoring and response

A bank's production core runs 24×7. Security engineers patch, monitor, and recover it; a separate risk function reviews whether those privileged actions themselves leak data or cause outages. Which CISAW pairing does this illustrate?

  1. Only physical security, because the core is in a computer room
  2. Security operations for the production service, and operations security for risks created by the ops process Correct answer.
  3. Software secure-development lifecycle with no operations component
  4. A one-time MLPS grading exercise that never repeats

Explanation

Keeping the core available and protected is 安全运维. Scrutinizing whether patches, jump-host use, and vendor access create new risk is 运维安全. CISAW OM expects both on a live system. Grading, SSDLC, or physical-only views miss the two-mode relationship.

Question 31Security operations, monitoring and response

What is the most accurate CISAW-oriented definition of system operations (系统运维)?

  1. Discarding the system on the day of go-live so that no further work occurs
  2. Writing the original requirements specification before any code exists
  3. The planned, organized activities that keep an information system running, recoverable, and fit for business after it is placed in production Correct answer.
  4. Issuing a press release about a new product feature

Explanation

System operations is the in-life work-monitoring, maintenance, change, backup, and support-that keeps a production information system usable. CISAW then overlays security methods on that work. Requirements writing is construction; publicity is not operations.

Question 32Security operations, monitoring and response

Which security attributes should a CISAW security-operations model protect for operations objects?

  1. Only visual branding consistency on the public website
  2. Employee cafeteria menu variety
  3. The personal social-media follower count of the CIO
  4. Confidentiality, integrity, and availability of information and supporting systems, as required by the object's classification and business need Correct answer.

Explanation

Operations objects are protected for CIA (and related properties such as authenticity where the object requires it), scaled to classification (for example MLPS level) and business impact. Branding, cafeteria, and personal publicity are not security attributes in the CISAW model.

Question 33Security operations, monitoring and response

Where does a Security Operations Center (SOC) typically sit in the CISAW security-operations picture?

  1. As a people-process-technology capability that continuously monitors, triages, and coordinates response for operations objects Correct answer.
  2. As a one-person after-hours hobby with no process or tooling
  3. As a substitute for all backup, patching, and change management
  4. As an annual paper audit that never watches live telemetry

Explanation

A SOC is a support-platform and organizational pattern for continuous detection and coordination. It does not replace backup, patching, or change, and it is not a yearly paperwork exercise. CISAW OM implementation topics (monitoring, emergency-within-ops) assume this kind of capability exists or is sourced.

Question 34Security operations, monitoring and response

Compared with older CISAW OM papers, what did the 2021 revised outline change about how candidates must master topics?

  1. It removed all application and kept only true/false memorization
  2. It added a 'comprehensive application' mastery level and laboratory items so candidates must use knowledge on cases and operations tasks, not only recall Correct answer.
  3. It replaced the entire OM syllabus with English essay questions
  4. It made the sitting open-book with unlimited internet use

Explanation

CCRC's 2021 OM revision introduced laboratory items, shortened the sitting to 150 minutes, and added 综合应用 on top of 了解 and 理解. The intent is to test whether candidates can apply security-operations knowledge. The paper remains a closed-book Chinese mixed exam.

Question 35Security operations, monitoring and response

A team encrypts data at rest, but restores have never been tested and a single administrator can wipe production. Which CISAW reading is most accurate?

  1. Confidentiality work is complete, so the security-operations model is fully satisfied
  2. Encryption always guarantees availability
  3. Availability and integrity/control of privileged operations are still weak, so the model is only partly realized Correct answer.
  4. A single administrator with wipe rights is required by MLPS

Explanation

The CISAW model protects multiple attributes of operations objects. Encryption supports confidentiality but untested restores undermine availability, and unconstrained privileged wipe rights undermine integrity and operations security. MLPS actually pushes role separation, not a single all-powerful admin.

Question 36Security operations, monitoring and response

Which of the following is the best example of an operations object (运维对象) in CISAW OM?

  1. The cafeteria coffee machine maintenance contract
  2. The CEO's personal travel itinerary unrelated to IT
  3. A motivational poster in the SOC
  4. A graded business information system, its infrastructure, data, and the security mechanisms that keep it in service Correct answer.

Explanation

运维对象 are the information systems and supporting assets-hosts, networks, applications, data, and security devices-being operated. CISAW preparation also requires asset and business inventory to bound those objects. Non-IT facilities and decorations are not OM objects.

Question 37Security operations, monitoring and response

In the CISAW security-operations model, what role do 'resources' play?

  1. They are the people, tools, environments, information, and budget consumed to operate and protect operations objects Correct answer.
  2. They are optional decorations after the system is already insecure
  3. They are only open-source threat-intel Twitter feeds
  4. They are exclusively the organization's trademark portfolio

Explanation

Model resources include skilled operators, SOC/ITSM platforms, computer-room and network environments, runbooks and logs, and funded capacity. Without resourcing, the model cannot be executed. Narrowing 'resources' to social media or trademarks misses the operational meaning.

Question 38Security operations, monitoring and response

An outsourced vendor patches production through an unlogged shared root account. The SIEM still shows 'green' availability. What is the CISAW-correct diagnosis?

  1. Security operations and operations security are both fully successful because the site is up
  2. Availability-oriented operations may look healthy, but operations security has failed because the ops process itself is unauditable and over-privileged Correct answer.
  3. Shared root is required by ISO/IEC 27001
  4. Green SIEM dashboards legally waive Cybersecurity Law log-retention duties

Explanation

Uptime alone is not CISAW success. Unlogged shared root is a classic 运维安全 failure: the operations process can change or steal data without accountability. ISO/IEC 27001 and the Cybersecurity Law both expect identifiable, logged privileged activity, not dashboard cosmetics.

Question 39Security foundations, governance and Chinese context

Article 23 of the PRC Cybersecurity Law (网络安全法, as amended effective 1 January 2026; formerly Article 21) requires network operators, among other MLPS duties, to retain relevant network logs for at least how long?

  1. 24 hours
  2. Six months Correct answer.
  3. Six years with no backup
  4. Until the next business day only

Explanation

Cybersecurity Law Article 23(3) - Article 21(3) before the 2025 amendment took effect on 1 January 2026 - requires technical measures to monitor and record network status and security events, and to retain relevant network logs for not less than six months. That floor is a staple OM compliance item for logging architecture.

Question 40Security foundations, governance and Chinese context

Under the PRC Cybersecurity Law, where must a critical information infrastructure (CII) operator store personal information and important data collected and generated in the course of domestic operations?

  1. Only on personally owned foreign laptops
  2. Anywhere in the world with no conditions
  3. Within the territory of the People's Republic of China, with outbound provision subject to security assessment when business truly requires it Correct answer.
  4. Only on paper, never on systems

Explanation

Article 39 of the amended Cybersecurity Law - Article 37 in the 2016 text, renumbered when the 2025 amendment took effect on 1 January 2026 - requires CII operators to store in-country personal information and important data from domestic operations. Outbound transfer, if truly needed, follows the security-assessment path set by national cyberspace and related authorities. Unconditional foreign storage is non-compliant.

Question 41Security foundations, governance and Chinese context

Which national standard is the MLPS 2.0 baseline of cybersecurity classified-protection requirements used in CISAW OM compliance study?

  1. ISO 9001 quality management only
  2. A U.S. state driving-license pamphlet
  3. GB/T 19000 with no security content
  4. GB/T 22239-2019 Correct answer.

Explanation

GB/T 22239-2019 Information security technology-Baseline for classified protection of cybersecurity is the MLPS 2.0 basic-requirements standard. Its management class includes 安全运维管理 control points that OM candidates must know. ISO 9001 and unrelated pamphlets are not that baseline.

Question 42Security foundations, governance and Chinese context

How many security-operations-management control points does GB/T 22239-2019 list in the general requirements (including environment, assets, media, vulnerabilities, change, backup, incidents, emergency plans, and outsourcing)?

  1. Fourteen Correct answer.
  2. Two (passwords and screensavers only)
  3. One hundred identical copies of a firewall rule
  4. Zero, because MLPS 2.0 deleted all operations management

Explanation

MLPS 2.0 安全运维管理 comprises 14 control points: environment, assets, media, equipment maintenance, vulnerability and risk, network and system security, malware, configuration, cryptography, change, backup and recovery, security-event handling, emergency-plan management, and outsourced operations. OM compliance items often map onto this list.

Question 43Security foundations, governance and Chinese context

For a Level-3 classified-protection object, which backup/recovery technical expectation is characteristic of GB/T 22239-2019 compared with lower levels?

  1. No backups of any kind
  2. Off-site real-time backup of important data plus hot redundancy for important processing systems Correct answer.
  3. A single local USB copy left on the administrator's desk
  4. Printing the database to paper once per decade

Explanation

MLPS 2.0 scales backup: local at Level 1, off-site periodic at Level 2, and off-site real-time backup plus hot redundancy at Level 3 (Level 4 adds a disaster-recovery center with real-time switchover). OM implementation questions often use that ladder.

Question 44Security foundations, governance and Chinese context

The PRC Data Security Law (数据安全法) requires the state to protect data according to which approach?

  1. Treat all data as equally unimportant
  2. Publish all industrial data on an anonymous foreign blog
  3. Classification and grading protection, with important data catalogued and core data subject to stricter management Correct answer.
  4. Ban all backups of important data

Explanation

DSL Article 21 establishes data classification and grading. Important data is catalogued for enhanced protection; national core data related to security, the economic lifeline, livelihood, and major public interest is managed even more strictly. OM teams must know which data they operate and how it is graded.

Question 45Security foundations, governance and Chinese context

Which pairing of operations-service standards is explicitly in the CISAW OM compliance knowledge (运维服务标准)?

  1. Only a restaurant hygiene checklist
  2. Only a fashion-season color standard
  3. A single undocumented tribal custom with no framework
  4. ITIL, ISO/IEC 20000, ISO/IEC 27001, and COBIT Correct answer.

Explanation

The 2021 OM outline lists operations-service standards at the 'know' level: ITIL, ISO/IEC 20000 (IT service management), ISO/IEC 27001 (ISMS), and COBIT (IT governance). Candidates should know what each is for, not mix them into one invented super-framework.

Question 46Security foundations, governance and Chinese context

What is the most accurate distinction among ITIL, ISO/IEC 20000, ISO/IEC 27001, and COBIT for CISAW OM?

  1. ITIL is a service-management best-practice framework; ISO/IEC 20000 is a certifiable SMS standard; ISO/IEC 27001 is a certifiable ISMS standard; COBIT is an IT-governance/control framework Correct answer.
  2. They are four names for the identical 14 MLPS control points
  3. COBIT replaces the Cybersecurity Law inside China
  4. ISO/IEC 27001 forbids all logging and change control

Explanation

Keep the four frameworks inside their own scopes. ITIL provides practices (historically service lifecycle; ITIL 4 uses the service-value system). ISO/IEC 20000 is the international SMS requirements standard. ISO/IEC 27001 is the ISMS requirements standard. COBIT structures governance and management objectives. None repeals PRC law.

Question 47Security foundations, governance and Chinese context

GB/T 20984 is the Chinese national standard family for which OM-relevant method?

  1. Office-chair ergonomics
  2. Information-security risk assessment Correct answer.
  3. Highway lane-marking paint
  4. Restaurant menu calorie labels

Explanation

GB/T 20984 (2007 'specification', 2022 'method') is China's information-security risk-assessment standard. CISAW risk-management direction goes deeper, but OM still uses it when assessing operations-process risk. Do not confuse it with unrelated GB/T product standards.

Question 48Security foundations, governance and Chinese context

Under GB/T 22239-2019, which administrator-role practice is expected for network and system security management?

  1. One shared 'admin' password posted on the SOC wall
  2. Disable all accounts including emergency break-glass
  3. Divide operations roles (for example system, security, and audit administrators), with distinct duties and accounts Correct answer.
  4. Allow every intern unrestricted domain admin on day one

Explanation

MLPS operations management requires dividing administrator roles and clarifying responsibility and privilege-commonly instantiated as system, security, and audit administrators with mutual constraint. Shared wall passwords and intern domain-admin are the opposite control.

Question 49Security foundations, governance and Chinese context

The PRC Cryptography Law (密码法) classifies cryptography into which three categories relevant to CII and operations product selection?

  1. Red, blue, and invisible ink only
  2. Password sticky notes, voicemail PINs, and cafeteria codes
  3. Only foreign consumer VPN brands
  4. Core cryptography, ordinary cryptography, and commercial cryptography Correct answer.

Explanation

The Cryptography Law divides 密码 into 核心密码, 普通密码, and 商用密码. CII and important systems are expected to use commercial cryptography products that have passed testing/certification where the law and supporting rules require it. OM product and key-management choices sit in that frame.

Question 50Security foundations, governance and Chinese context

A Level-3 system owner wants to hire an offshore team to operate the production cloud console from outside China with no extra controls. Which compliance reading is most defensible for CISAW OM?

  1. Non-compliant with typical MLPS 2.0 cloud-extension and CII/CSL expectations that operations locations and remote ops follow PRC rules; selection of outsourced operators must meet national requirements Correct answer.
  2. Always acceptable because the internet has no borders
  3. Required by ISO/IEC 27001 Annex A as the only allowed pattern
  4. Required by ITIL v3 Service Strategy

Explanation

GB/T 22239 cloud extensions expect the cloud platform's operations location to be in China and foreign-to-domestic ops to follow national rules. Outsourcing-management control points require nationally compliant vendor selection and contracts. CSL/CII duties cannot be waived by 'the internet has no borders.'