I85PREP
⌘ K
CISP-DSG study materials
CISP-DSG study resources

CISP-DSG practice questions

One question at a time. Build your CISP-DSG understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security foundations, governance and Chinese context

In information security assurance (信息安全保障), which triad describes the three core security properties that data-security governance programs are designed to protect?

  1. Authentication, authorization, and accounting (AAA)
  2. Prevention, detection, and recovery only
  3. Identification, authentication, and non-repudiation only
  4. Confidentiality, integrity, and availability (CIA / 机密性、完整性、可用性) Correct answer.

Explanation

The CIA triad-confidentiality (机密性), integrity (完整性), and availability (可用性)-is the foundational set of information-security properties taught in CISP-DSG information-security knowledge. Data-security governance maps classification, technical controls, and operational processes to these three properties rather than treating any one of them as sufficient by itself.

Question 2Security foundations, governance and Chinese context

In information-security risk analysis, what is the correct relationship among an asset, a threat, and a vulnerability?

  1. A threat is a weakness in a control, and a vulnerability is an external attacker
  2. An asset is any control device, and risk exists only after an incident occurs
  3. A threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk arises where they meet an asset Correct answer.
  4. A vulnerability is always a person, and a threat is always a technical defect

Explanation

CISP-DSG information-security assessment treats risk as the combination of an asset’s value, a threat that could cause harm, and a vulnerability that could be exploited. Controls reduce likelihood or impact; they do not redefine those three elements.

Question 3Security foundations, governance and Chinese context

Which statement best describes availability (可用性) as an information-security property for data assets?

  1. Data can be read by anyone on the network so that business is never delayed
  2. Data is stored in plaintext so restoration never requires keys
  3. Authorized users and processes can access data and services when needed, within agreed continuity requirements Correct answer.
  4. Availability is achieved solely by encrypting backups

Explanation

Availability means authorized subjects can obtain data and services when required, which is why backup, high availability, and disaster recovery sit inside CISP-DSG data-security technology. It is not the same as unrestricted public access, and encryption of backups protects confidentiality of copies rather than creating availability by itself.

Question 4Security foundations, governance and Chinese context

A data warehouse job silently changes numeric totals in a report without adding or deleting rows. Which CIA property is primarily violated?

  1. Confidentiality, because the report became readable
  2. Availability, because the warehouse was offline
  3. Non-repudiation only, because no user signed the job
  4. Integrity (完整性), because data was altered in an unauthorized or undetected way Correct answer.

Explanation

Integrity is the property that data has not been unauthorizedly created, changed, or destroyed. Silent alteration of totals is a classic integrity failure even when the system remains up and the data is not disclosed to outsiders.

Question 5Security foundations, governance and Chinese context

The PDRR information-assurance model organizes security activities into which four functions?

  1. Policy, people, process, and products
  2. Plan, do, check, and act only
  3. Identify, protect, detect, and govern only
  4. Protection, detection, response, and recovery (防护、检测、响应、恢复) Correct answer.

Explanation

PDRR is a widely taught assurance model in Chinese information-security knowledge: protection (防护), detection (检测), response (响应), and recovery (恢复). CISP-DSG candidates should be able to place data-security controls into these functions rather than treating security as a single preventive wall.

Question 6Security foundations, governance and Chinese context

Which statement correctly distinguishes preventive, detective, and corrective controls in an information-security program?

  1. Detective controls are always technical, and preventive controls are always administrative
  2. Corrective controls replace the need for backups
  3. Preventive controls stop incidents before they occur, detective controls identify incidents or violations, and corrective controls restore a secure state Correct answer.
  4. Preventive controls are used only after an incident is confirmed

Explanation

CISP-DSG supporting knowledge expects candidates to classify controls by function: prevent unauthorized action, detect that something happened, and correct or recover afterward. A data-security program needs all three functions; encryption or DLP blocking is preventive, audit logs and alerts are detective, and restore or patching is corrective.

Question 7Security foundations, governance and Chinese context

What does the least-privilege principle (最小权限原则) require when granting access to data systems?

  1. Every employee receives administrator rights so work is never blocked
  2. Privileges are never revoked once granted
  3. Public data and core data use the same open access list
  4. Users and processes receive only the access necessary to perform authorized duties, and no more Correct answer.

Explanation

Least privilege limits each subject to the minimum rights needed for assigned tasks. In data-security governance it underpins role design, database accounts, and production-data access, and it is a standard supporting-technology control alongside authentication.

Question 8Security foundations, governance and Chinese context

What is the purpose of defense in depth (纵深防御) when protecting data processing systems?

  1. Rely on a single perimeter firewall so inner systems need no controls
  2. Encrypt data only after it has already been leaked
  3. Disable logging to improve performance
  4. Layer complementary controls so failure of one control does not expose the data asset Correct answer.

Explanation

Defense in depth stacks people, process, and technical controls-for example identity, network segmentation, encryption, DLP, and audit-so that no single failure is catastrophic. CISP-DSG treats data protection as a layered system, not a one-product purchase.

Question 9Security foundations, governance and Chinese context

The WPDRRC information-assurance model commonly taught in Chinese information-security knowledge adds which elements beyond basic protection, detection, response, and recovery?

  1. Only marketing and sales functions
  2. Only physical key management and paper shredding
  3. Warning/early warning (预警) and counterattack (反击), forming 预警、保护、检测、响应、恢复、反击 Correct answer.
  4. Only cloud vendor scorecards

Explanation

WPDRRC extends PDRR with warning/early warning (预警) and counterattack (反击), yielding the six-function Chinese assurance model 预警、保护、检测、响应、恢复、反击. CISP information-security knowledge uses this model to stress monitoring before an incident and lawful countermeasures afterward, not merely static protection.

Question 10Security foundations, governance and Chinese context

In CISP-style information-security knowledge, how should information assurance (信息安全保障) be distinguished from a single security product deployment?

  1. Assurance is only antivirus software on endpoints
  2. Assurance is achieved the day a firewall is purchased
  3. Assurance applies only to classified state secrets and never to enterprise data
  4. Assurance is a continuous combination of strategy, management, technology, and operations that keeps CIA properties at an acceptable level Correct answer.

Explanation

Information assurance is a process and system: policy and organization, technical measures, and ongoing operations (monitoring, assessment, improvement). CISP-DSG’s later governance class builds on this idea for data, so candidates should not equate assurance with buying one product.

Question 11Security foundations, governance and Chinese context

Which expression best captures how information-security risk is commonly assessed at a conceptual level?

  1. Risk exists only when regulators issue a fine
  2. Risk is independent of asset value
  3. Risk reflects the likelihood that a threat exploits a vulnerability and the impact on the asset or business Correct answer.
  4. Risk equals the number of firewalls installed

Explanation

Information-security assessment treats risk as a function of threat, vulnerability, likelihood, and impact on assets or mission. That model is what later data-security risk assessments (数据安全风险评估) specialize for data processing activities.

Question 12Security foundations, governance and Chinese context

When is a qualitative risk assessment more appropriate than insisting on a fully quantitative model?

  1. When the organization has already calculated exact annualized loss expectancy for every asset
  2. When no threats have been identified
  3. When impact and likelihood can be ranked with expert judgment but reliable loss frequencies or monetary data are not available Correct answer.
  4. When qualitative methods are forbidden by the Cybersecurity Law

Explanation

Qualitative assessment uses ordinal scales (for example high/medium/low) when data for precise frequencies and monetary loss is incomplete-the usual situation for many data-processing risks. Quantitative methods are valuable when trustworthy numbers exist, but CISP-DSG does not require inventing false precision.

Question 13Security foundations, governance and Chinese context

What is the purpose of China’s Multi-Level Protection Scheme (MLPS / 网络安全等级保护) for network operators?

  1. To replace the Data Security Law entirely
  2. To require every system to be treated as core data
  3. To eliminate the need for risk assessment
  4. To classify information systems by security-protection level and apply graded security obligations Correct answer.

Explanation

MLPS (等级保护) is the Cybersecurity Law baseline that grades networks and information systems and requires corresponding protection. The Data Security Law later says internet-based data processing should fulfill data-security duties on the basis of that MLPS foundation (DSL Article 27).

Question 14Security foundations, governance and Chinese context

How many protection levels does the MLPS (等级保护) system use for grading network and information systems?

  1. Two levels only (open and secret)
  2. Three levels matching general, important, and core data
  3. Five levels (第一级 to 第五级) Correct answer.
  4. Ten levels matching ISO/IEC 27001 control clauses

Explanation

MLPS grades systems into five protection levels. Data classification and grading (一般数据、重要数据、核心数据) is a related but distinct DSL/GB/T 43697 scheme; CISP-DSG candidates must not collapse the two grading systems into one.

Question 15Security foundations, governance and Chinese context

What is the primary objective of a vulnerability assessment (脆弱性评估 / 漏洞扫描与分析) in information-security assessment?

  1. To prove that no residual risk remains
  2. To replace incident response
  3. To publish all findings on the public internet immediately
  4. To identify weaknesses that threats could exploit so they can be prioritized and remediated Correct answer.

Explanation

Vulnerability assessment finds and ranks weaknesses in systems, applications, or processes. It feeds risk treatment and MLPS/data-security improvement; it does not by itself prove zero residual risk or replace response capability.

Question 16Security foundations, governance and Chinese context

How should MLPS (等级保护) evaluation be distinguished from a data-security risk assessment (数据安全风险评估)?

  1. They are identical procedures with identical outputs
  2. MLPS applies only to personal information, and data-security risk assessment applies only to paper files
  3. A data-security risk assessment replaces MLPS for internet-connected systems
  4. MLPS grades and evaluates network/information-system protection; a data-security risk assessment evaluates risks of data-processing activities against data classification and legal duties Correct answer.

Explanation

MLPS is system-centric graded protection under the Cybersecurity Law. Data-security risk assessment is activity- and data-centric under the Data Security Law (especially important-data processors). DSL Article 27 requires internet data processing to build data-security duties on the MLPS foundation, so the two are complementary rather than interchangeable.

Question 17Security foundations, governance and Chinese context

What is the distinctive purpose of an information-security audit compared with a one-time risk assessment?

  1. An audit is only a vulnerability scan
  2. A risk assessment always issues a legal penalty, and an audit never reviews evidence
  3. An audit independently examines whether stated policies, controls, and records actually operate, while a risk assessment estimates threat, vulnerability, and impact Correct answer.
  4. Audits are used only for financial statements and never for security

Explanation

Assessment estimates risk to decide treatment; audit tests conformity and operating effectiveness against criteria (policy, MLPS, DSL/PIPL, or standards). CISP-DSG later uses both ideas in data-security assessment and compliance evaluation (合规测评).

Question 18Security foundations, governance and Chinese context

What is the legitimate purpose of a penetration test (渗透测试) in information-security assessment?

  1. To attack production systems without authorization in order to embarrass administrators
  2. To replace encryption and access control
  3. To export important data overseas for analysis
  4. To simulate authorized, scoped adversarial techniques so the organization can find exploitable paths and improve defenses Correct answer.

Explanation

Penetration testing is a controlled, authorized assessment method that attempts exploitation within an agreed scope. It is not a substitute for baseline controls and must itself follow authorization, data-minimization, and DSL/PIPL rules.

Question 19Security foundations, governance and Chinese context

How does a penetration test differ from an automated vulnerability scan?

  1. A scan always exploits every finding in production without a rules of engagement document
  2. They produce identical evidence and can always be substituted for each other
  3. A scan mainly enumerates potential weaknesses; a penetration test attempts controlled exploitation to validate real attack paths and business impact Correct answer.
  4. A penetration test never requires written authorization if the tester is an employee

Explanation

Scans are broad and often noisy; penetration tests prove whether weaknesses are exploitable and what data or processes can actually be reached. Both need authorization; employee status does not replace a defined scope and rules of engagement, especially on production data systems.

Question 20Security foundations, governance and Chinese context

After compensating controls are implemented, what is residual risk (剩余风险)?

  1. Proof that the original risk register can be deleted
  2. A type of risk that laws require to be exactly zero
  3. Risk that remains after treatment and must be accepted, transferred, or further reduced by management decision Correct answer.
  4. Only the risk of physical fire

Explanation

Residual risk is what remains after chosen controls. Information-security and data-security governance both require management to accept, transfer, or treat that remainder rather than pretending controls erase all risk.

Question 21Security foundations, governance and Chinese context

Under Article 23 of the PRC Cybersecurity Law (网络安全法, as amended effective 1 January 2026; formerly Article 21), for how long must network operators retain relevant network logs at a minimum?

  1. Not less than 24 hours
  2. Not less than 7 days
  3. Not less than six months (不少于六个月) Correct answer.
  4. Logs may be discarded immediately after each shift

Explanation

Cybersecurity Law Article 23 (Article 21 before the 2025 amendment took effect on 1 January 2026) requires technical measures to monitor and record network status and cybersecurity events, and to retain relevant logs for not less than six months. That statutory floor is a staple of CISP-DSG cybersecurity-supervision knowledge and of later data-security operations.

Question 22Security foundations, governance and Chinese context

Under Article 39 of the PRC Cybersecurity Law (as amended effective 1 January 2026; formerly Article 37), where must personal information and important data collected and generated by critical information infrastructure (CII / 关键信息基础设施) operators during domestic operations be stored, as a rule?

  1. In any country chosen by the cloud vendor
  2. Only on employee laptops
  3. Only in anonymized marketing spreadsheets
  4. Within the territory of the People’s Republic of China, with outbound provision subject to security assessment Correct answer.

Explanation

CSL Article 39 (Article 37 before the 2025 amendment took effect on 1 January 2026) requires CII operators to store personal information and important data collected and produced in domestic operations inside China. If outbound provision is truly necessary, a security assessment is required under the rules then in force. DSL Article 31 points CII important-data outbound management back to the Cybersecurity Law.

Question 23Security foundations, governance and Chinese context

Which set of duties does Cybersecurity Law Article 23 (formerly Article 21) impose on network operators as a graded-protection baseline?

  1. Only purchasing imported encryption without internal rules
  2. Only annual marketing campaigns
  3. Exemption from all data-security duties if MLPS paperwork exists
  4. Internal security management and responsible persons, technical attack-prevention measures, monitoring and log retention, and data classification, backup, and encryption measures Correct answer.

Explanation

Article 23 of the amended Cybersecurity Law lists internal systems and persons in charge, technical measures against viruses and attacks, monitoring plus log retention, and measures such as data classification, backup, and encryption. Those CSL duties are the supervision backbone that CISP-DSG then extends with DSL data-lifecycle controls.

Question 24Security foundations, governance and Chinese context

Which professional-ethics expectation applies to CISP-series registered personnel, including CISP-DSG holders?

  1. Use privileged access to browse colleagues’ personal data for curiosity
  2. Share exam or registration materials in violation of CNITSEC rules if asked by a friend
  3. Protect entrusted information, stay within authorized duties, and refuse unlawful instructions to leak or misuse data Correct answer.
  4. Ignore conflicts of interest because governance is only a technical problem

Explanation

CISP registration includes agreement to professional ethics: protect confidentiality of entrusted data, act within authorization, and support lawful cybersecurity and data-security obligations. Governance personnel with broad data access are high-risk if ethics fail.

Question 25Security foundations, governance and Chinese context

How do the Cybersecurity Law (网络安全法), Data Security Law (数据安全法), and Personal Information Protection Law (个人信息保护法) relate for a network data processor?

  1. PIPL repeals the Cybersecurity Law
  2. DSL applies only to paper archives, and CSL applies only to personal information
  3. CSL is the network and CII/MLPS backbone; DSL governs data processing and 数据分类分级 for all data; PIPL adds special rules for personal information-processors often must satisfy all three Correct answer.
  4. A processor may choose any one of the three laws and ignore the others

Explanation

The three laws are complementary. CSL addresses networks, MLPS, and CII. DSL addresses data processing activities and classification/grading, including important and core data. PIPL is the special law for personal information. Personal information is still data, so DSL and CSL duties can apply at the same time as PIPL.

Question 26Security foundations, governance and Chinese context

The Data Security Law establishes a data-security review (数据安全审查) concept for data-processing activities that affect or may affect national security. What is the correct governance implication?

  1. Processors may skip review if they use a foreign cloud brand
  2. Review is only a marketing badge and has no legal effect
  3. Activities that affect or may affect national security can be subject to national data-security review, and related decisions must be followed Correct answer.
  4. Review applies only to employee birthday lists

Explanation

DSL provides for data-security review of processing activities that affect or may affect national security. CISP-DSG governance work must identify whether processing (including outbound provision or large-scale platform processing) could trigger that national-security track rather than treating all data as ordinary commercial data.

Question 27Security foundations, governance and Chinese context

In China’s standards system used in information-security supervision, how should a mandatory national standard (GB) be distinguished from a recommended national standard (GB/T)?

  1. GB/T documents are always optional even when a law or regulation makes a specific GB/T obligatory in a context
  2. GB and GB/T have identical legal force in every case
  3. Only international ISO standards may be used for data security in China
  4. GB standards are mandatory national standards; GB/T standards are recommended, unless laws, regulations, or contracts make a GB/T binding for a given activity Correct answer.

Explanation

GB (国家标准) without T is mandatory; GB/T is recommended. CISP-DSG still studies GB/T 35273, GB/T 37988, and GB/T 43697 because they are the technical language of classification, PI protection, and DSMM, and because regulators or contracts may require them even when they are recommended standards.

Question 28Security foundations, governance and Chinese context

Under the PRC Cryptography Law (密码法), which statement correctly describes commercial cryptography (商用密码) for ordinary data-security engineering?

  1. Commercial cryptography may never be used to protect personal information
  2. SM4 is classified as core state-secret cryptography and may not be used in commercial systems
  3. Commercial cryptography is the cryptography used to protect information that is not state-secret core or ordinary cryptography, and it is the usual basis for enterprise data encryption such as SM series algorithms Correct answer.
  4. The Cryptography Law bans all encryption of important data

Explanation

The Cryptography Law divides cryptography into core (核心密码), ordinary (普通密码), and commercial (商用密码). Commercial cryptography protects information other than state secrets and is the lawful toolkit for enterprise data security, including SM2, SM3, and SM4. CISP-DSG supporting technology focuses on this commercial layer, not on state-secret cryptosystems.

Question 29Security foundations, governance and Chinese context

In PRC cybersecurity supervision (网络安全监管), which description of institutional roles is most accurate for CISP-DSG candidates?

  1. Only municipal tax bureaus grade data as core data
  2. CNITSEC issues all PIPL administrative penalties nationwide
  3. Cyberspace, public-security, industry, and specialized testers each have statutory or authorized roles; CNITSEC (中国信息安全测评中心) is the evaluation and CISP registration body, not the sole all-purpose regulator Correct answer.
  4. A single private training school is the national data-security regulator

Explanation

Supervision is multi-agency: national cyberspace authorities coordinate cybersecurity and data-related rules, public security administers MLPS and many enforcement actions, industry regulators supervise sector data, and CNITSEC provides evaluation, testing, and personnel registration (including CISP-DSG). Candidates should not treat CNITSEC as a substitute for CAC or MPS legal powers.

Question 30Security foundations, governance and Chinese context

When a data-security incident (数据安全事件) occurs, which response sequence matches PRC data and cybersecurity duties at a principles level?

  1. Wait until media reports appear before containing the incident
  2. Delete all logs first so investigators cannot reconstruct events
  3. Only notify overseas parent companies and never notify PRC authorities
  4. Immediately take disposal measures, remediate, notify users when required, and report to competent authorities according to applicable rules Correct answer.

Explanation

DSL Article 29 and related CSL/PIPL incident rules require immediate disposal, remediation of defects, informing users where required, and reporting to competent authorities. CISP-DSG operations knowledge treats incident handling as a legal duty, not optional PR.

Question 31Security foundations, governance and Chinese context

Which statement correctly identifies the SM4 algorithm used in commercial cryptography supporting technology?

  1. SM4 is a hash algorithm that always produces a 256-bit digest
  2. SM4 is an identity-based public-key algorithm identical to SM9
  3. SM4 is only a digital-signature algorithm and cannot encrypt data
  4. SM4 is a 128-bit block cipher used as a symmetric encryption algorithm (对称密码) Correct answer.

Explanation

SM4 is China’s commercial symmetric block cipher with a 128-bit block (and 128-bit key). CISP-DSG supporting technology uses it for data-at-rest and data-in-transit encryption, distinct from SM3 hashing and SM2 public-key operations.

Question 32Security foundations, governance and Chinese context

What is the role of SM3 in a data-security technical system?

  1. SM3 is a stream cipher used to encrypt database tables in place of SM4
  2. SM3 is a role-based access-control model
  3. SM3 is the PIPL definition of sensitive personal information
  4. SM3 is a commercial cryptographic hash function (杂凑算法) used for integrity checking and as a building block for signatures Correct answer.

Explanation

SM3 is the commercial hash algorithm (256-bit digest). It supports integrity verification, password protection constructions, and SM2 digital signatures. Hashing is one-way and is not a substitute for reversible encryption when data must be recovered.

Question 33Security foundations, governance and Chinese context

Identity authentication (身份鉴别) classically combines which three factor types?

  1. Something you outsource, something you tweet, and something you guess
  2. Only a shared group password posted on a wall
  3. Only the MAC address of a printer
  4. Something you know, something you have, and something you are (知识、持有、生物特征) Correct answer.

Explanation

Knowledge (password/PIN), possession (token/smart card/phone), and inherence (biometric) are the classic authentication factors. Multi-factor authentication uses at least two different types and is a core CISP-DSG supporting-technology control for data access.

Question 34Security foundations, governance and Chinese context

What is the defining idea of role-based access control (RBAC / 基于角色的访问控制)?

  1. Every user is given every permission to reduce help-desk tickets
  2. Access is decided only by physical door keys
  3. RBAC forbids the use of least privilege
  4. Permissions are assigned to roles, and users obtain permissions by being assigned to roles Correct answer.

Explanation

RBAC inserts roles between users and permissions so that job functions, not one-off accounts, carry rights. It is the usual model for enterprise data platforms and is easier to audit than purely discretionary per-user ACLs when roles match real duties.

Question 35Security foundations, governance and Chinese context

How does discretionary access control (DAC / 自主访问控制) differ from mandatory access control (MAC / 强制访问控制)?

  1. MAC always allows owners to share data publicly
  2. DAC is only used for SM4 key wrapping
  3. They are different names for the same RBAC role catalog
  4. DAC lets resource owners grant or revoke access; MAC enforces system-wide labels and clearances that users cannot override at will Correct answer.

Explanation

In DAC, owners (or their delegates) set ACLs. In MAC, the system enforces classification labels and subject clearances, which is why MAC appears in high-assurance and some government systems. CISP-DSG supporting technology expects this distinction even when most enterprises primarily run RBAC plus DAC on databases.

Question 36Security foundations, governance and Chinese context

In mandatory access control, a subject with a lower clearance requests read access to an object labeled at a higher classification. What should the system do?

  1. Allow the read because curiosity is a business need
  2. Allow the read if the object owner emails an informal yes
  3. Deny the read because MAC prevents subjects from reading above their clearance (no read-up) Correct answer.
  4. Convert the object to public general data automatically

Explanation

Classic MAC (Bell–LaPadula style confidentiality) forbids read-up: a subject may not read an object at a higher label than the subject’s clearance. Informal owner email does not override labels, which is the point of MAC compared with DAC.

Question 37Security foundations, governance and Chinese context

Why is multi-factor authentication (MFA / 多因子认证) stronger than a password-only login for data-platform administrators?

  1. MFA means using the same password twice
  2. MFA replaces the need to revoke accounts of leavers
  3. MFA makes authorization logs unnecessary
  4. MFA uses at least two different factor types, so theft of a password alone is not sufficient Correct answer.

Explanation

MFA combines distinct factor types (for example password plus token or biometric). It raises the cost of credential stuffing and phishing against privileged data administrators, which is why it is a standard supporting control in data-security technical requirements.

Question 38Security foundations, governance and Chinese context

In public-key digital signatures (数字签名) used with SM2 or similar algorithms, which key performs which operation?

  1. The signer encrypts the whole original file with a public hash directory
  2. Anyone may sign with the verifier’s public key
  3. The signer’s public key creates the signature, and the private key verifies it
  4. The signer’s private key creates the signature, and the corresponding public key verifies it Correct answer.

Explanation

A digital signature is produced with the signer’s private key, typically over a hash (for example SM3) of the message; verification uses the signer’s public key. That construction provides integrity and non-repudiation support for data-security processes such as approval workflows and code or document signing.

Question 39Security foundations, governance and Chinese context

In a PKI (公钥基础设施), what is the purpose of a certificate revocation list (CRL) or OCSP after a certificate is issued?

  1. To extend every certificate automatically for 50 years without review
  2. To replace the certification authority with a shared password
  3. To convert asymmetric algorithms into SM4
  4. To publish or query whether a still-unexpired certificate has been revoked (for example after key compromise) before relying on it Correct answer.

Explanation

Issuance is not enough: relying parties must check revocation because a private key may be compromised or a holder may leave. CRLs and OCSP are the usual PKI mechanisms. Data-security technical systems that use TLS or internal PKI must include this check, not only install certificates.

Question 40Security foundations, governance and Chinese context

When protecting a database of important data, how should encryption in transit be combined with encryption at rest?

  1. Encrypting disks makes TLS unnecessary on public networks
  2. TLS makes backup encryption unnecessary
  3. Hashing column values with SM3 is always sufficient instead of encryption when data must later be decrypted
  4. TLS or equivalent protects data moving on networks; at-rest encryption (for example SM4/TDE) protects stored files and backups-both are needed because they cover different states Correct answer.

Explanation

Data exists in motion, at rest, and in use. Transport encryption and storage encryption close different leakage paths (network sniffing versus stolen disks or backup media). Hashing is one-way and cannot replace encryption when plaintext must be recovered for business use.

Question 41Cyber-risk identification and analysis

What is the central purpose of a data-security governance and assurance framework (数据安全治理与保障框架)?

  1. To buy a single DLP product and declare the program complete
  2. To align strategy, organization, policies, technology, and operations so data is protected according to classification and law throughout its lifecycle Correct answer.
  3. To outsource all legal responsibility to an overseas vendor
  4. To avoid appointing any data-security owner

Explanation

CISP-DSG’s largest knowledge class is governance: a framework that connects leadership, management systems, technical systems, and operations. Tools implement the framework; they are not the framework.

Question 42Cyber-risk identification and analysis

Why is data classification and grading (数据分类分级) treated as a foundation of data-security governance in China?

  1. Because all data must receive identical open access
  2. Because protection intensity, access, outbound rules, and assessment duties depend on data category and level (一般数据、重要数据、核心数据) Correct answer.
  3. Because classification replaces the need for encryption
  4. Because GB/T 43697 forbids grading

Explanation

DSL Article 21 creates a national classification and grading protection system. GB/T 43697-2024 details general, important, and core data. Governance uses those results to set control strength; without grading, programs either over-control everything or under-protect important/core data.

Question 43Cyber-risk identification and analysis

In a data-security management system, how should policy (策略), standard (标准), and procedure/specification (规范) typically be layered?

  1. Policies state management intent and rules; standards set measurable technical or process criteria; procedures specify how staff execute the work Correct answer.
  2. Procedures always outrank national law
  3. Standards are only posters in the lobby
  4. The three documents must be identical word for word

Explanation

CISP-DSG management-system knowledge separates intent (policy), criteria (standards, including GB/T and internal baselines), and executable steps (procedures/norms). Mixing them produces un-auditable documents.

Question 44Cyber-risk identification and analysis

Under Data Security Law Article 27, what organizational duty applies to processors of important data (重要数据的处理者)?

  1. They are forbidden from appointing any security staff
  2. They shall designate a data-security responsible person and a management body and implement data-security protection responsibility Correct answer.
  3. They may rely only on an overseas intern as the sole owner
  4. They must delete all important data within 24 hours of collection

Explanation

DSL Article 27 requires important-data processors to clearly designate a data-security officer and management organization and to implement protection responsibility. This is a core CISP-DSG governance fact and is echoed in later network-data regulations.

Question 45Cyber-risk identification and analysis

How should a PIPL personal-information protection officer role be distinguished from a DSL important-data security responsible person?

  1. They are always the same statutory office created by a single article in the Cryptography Law
  2. PIPL’s officer focuses on personal-information processing compliance; DSL’s responsible person focuses on important-data protection-one organization may need both capabilities, possibly in one team but not by assuming the laws are identical Correct answer.
  3. Only listed overseas companies ever need either role
  4. Appointing either role waives classification and encryption

Explanation

PIPL requires a PI protection officer when processing reaches the conditions specified by the national cyberspace authority. DSL independently requires a data-security responsible person for important-data processors. CISP-DSG governance must map both, not collapse them into a foreign “DPO” slogan that ignores PRC statutory text.

Question 46Cyber-risk identification and analysis

A practical data-security governance architecture is often described as combining which three systems?

  1. Only sales, branding, and office decoration
  2. A management system, a technical system, and an operations/operations-assurance system working together Correct answer.
  3. Only encryption, ignoring policy and monitoring
  4. Only annual speeches without controls

Explanation

Chinese data-security governance practice (and CISP-DSG’s management-plus-technology-plus-operations outline) treats 管理体系, 技术体系, and 运营 as a set. Policies without tools fail; tools without operations and owners fail.

Question 47Cyber-risk identification and analysis

Who should be accountable for establishing data-security strategy and resourcing in an organization?

  1. Only an unpaid intern on a three-month rotation
  2. Leadership/management with authority to assign owners, budget, and enforcement, not only the IT help desk Correct answer.
  3. Any anonymous forum user
  4. A terminated contractor with revoked accounts

Explanation

DSL and PIPL place duties on organizations that determine purposes and means of processing. CISP-DSG governance expects senior ownership; help-desk execution without authority cannot fulfill statutory protection responsibility.

Question 48Cyber-risk identification and analysis

According to Data Security Law Article 21, on what basis does the state implement data classification and grading protection (数据分类分级保护)?

  1. Only on the brand of the storage vendor
  2. On data’s importance to economic and social development and the harm if it is tampered with, destroyed, leaked, or illegally obtained or used Correct answer.
  3. Only on whether the data is stored in JSON
  4. Random lottery among departments

Explanation

DSL Article 21 bases graded protection on importance and on harm to national security, public interest, or lawful rights of individuals and organizations. It also identifies national core data (国家核心数据) for even stricter management and coordinates important-data catalogs.

Question 49Cyber-risk identification and analysis

How does the Personal Information Protection Law define personal information (个人信息)?

  1. Only a person’s blood type stored on paper
  2. Various information related to an identified or identifiable natural person recorded electronically or otherwise, excluding anonymized information Correct answer.
  3. Any data about a legal-person company without natural persons
  4. Only state-secret documents

Explanation

PIPL defines PI as information relating to identified or identifiable natural persons in any recording form, and it excludes information after anonymization (匿名化). This definition drives CISP-DSG compliance evaluation for PI processing.

Question 50Cyber-risk identification and analysis

Which statement correctly describes sensitive personal information (敏感个人信息) under PIPL?

  1. PI that, once leaked or illegally used, easily harms personal dignity or personal/property safety, including biometrics, medical health, financial accounts, whereabouts, and PI of minors under 14 Correct answer.
  2. Any publicly listed stock price
  3. Only a company’s unified social credit code
  4. All general data under GB/T 43697

Explanation

PIPL Article 28 defines sensitive PI by harm potential and lists typical categories; Article 31 treats PI of children under 14 as sensitive. Processing generally requires a specific purpose, necessity, strict protection, and separate consent when consent is the legal basis.