I85PREP
⌘ K
Ruankao Information Security Engineer (Intermediate) study materials
Ruankao Information Security Engineer (Intermediate) study resources

Ruankao Information Security Engineer (Intermediate) practice questions

One question at a time. Build your Ruankao Information Security Engineer (Intermediate) understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity, access and cryptographic protection

AES is a block cipher whose block size is always 128 bits. Which set lists the standard AES key lengths?

  1. 128 bits only, matching the SM4 key size exclusively
  2. 512, 1024, and 2048 bits
  3. 56, 64, and 80 bits
  4. 128, 192, and 256 bits Correct answer.

Explanation

FIPS-197 AES uses a 128-bit block with key lengths 128, 192, or 256 bits (AES-128/192/256). 56-bit is the DES effective key. SM4 also uses a 128-bit key, but AES is not limited to that single length. 512–2048-bit sizes are typical of RSA moduli, not AES keys.

Question 2Identity, access and cryptographic protection

How many AES rounds are used when the key length is 128 bits?

  1. 32
  2. 10 Correct answer.
  3. 12
  4. 14

Explanation

AES-128 uses 10 rounds, AES-192 uses 12 rounds, and AES-256 uses 14 rounds. 32 rounds is the SM4 round count, not AES. Matching key length to round count is a frequent 软考 calculation-style item.

Question 3Identity, access and cryptographic protection

Which statement correctly identifies the Chinese commercial algorithms SM2, SM3, and SM4?

  1. SM2 is a 128-bit block cipher, SM3 is an elliptic-curve signature scheme, and SM4 is a 256-bit hash
  2. SM2 is elliptic-curve public-key cryptography, SM3 is a 256-bit hash, and SM4 is a 128-bit block cipher with a 128-bit key Correct answer.
  3. SM2, SM3, and SM4 are three names for AES-256
  4. SM2 is a stream cipher only, SM3 is DES, and SM4 is RSA-2048

Explanation

In the Chinese commercial cryptography suite used throughout 软考: SM2 is elliptic-curve public-key cryptography (signature, key exchange, encryption), SM3 is a 256-bit hash function, and SM4 is a 128-bit block cipher with a 128-bit key (32 rounds). They are not AES aliases and are not DES/RSA.

Question 4Identity, access and cryptographic protection

RSA public modulus n is the product of two primes p and q. If p = 5 and q = 11, what is n?

  1. 40
  2. 55 Correct answer.
  3. 80
  4. 16

Explanation

RSA defines n = p × q. 5 × 11 = 55. Euler's totient φ(n) = (p − 1)(q − 1) = 40 is a different value used later to find the private exponent d. 16 is p + q + 0 padding noise; 80 is unrelated.

Question 5Identity, access and cryptographic protection

For RSA primes p = 5 and q = 11, what is Euler's totient φ(n) used when computing the private exponent d?

  1. 16
  2. 45
  3. 55
  4. 40 Correct answer.

Explanation

φ(n) = (p − 1)(q − 1) = 4 × 10 = 40. The public exponent e must be coprime to 40, and d satisfies e × d ≡ 1 (mod 40). 55 is n itself, not φ(n).

Question 6Identity, access and cryptographic protection

RSA uses n = 55 and φ(n) = 40. If the public exponent e = 3, which private exponent d satisfies 3d ≡ 1 (mod 40)?

  1. 37
  2. 11
  3. 13
  4. 27 Correct answer.

Explanation

Need 3d = 40k + 1. For k = 2, 3d = 81, so d = 27, and 81 − 80 = 1. Check: 3 × 27 = 81 ≡ 1 (mod 40). 11 gives 33, 13 gives 39 ≡ −1, and 37 gives 111 ≡ 31, none of which are 1 mod 40.

Question 7Identity, access and cryptographic protection

RSA encryption is c ≡ m^e (mod n). With n = 55, e = 3, and plaintext m = 7, what is the ciphertext c?

  1. 21
  2. 13 Correct answer.
  3. 343
  4. 7

Explanation

Compute 7³ = 343. Reduce modulo 55: 55 × 6 = 330, and 343 − 330 = 13, so c = 13. Leaving 343 unreduced is not a residue modulo 55. 21 and 7 are unrelated remainders.

Question 8Identity, access and cryptographic protection

Which property must a cryptographic hash such as SM3 or SHA-256 provide so that finding any two distinct messages with the same digest is infeasible?

  1. Reversible diffusion so the digest can be decrypted with a public key
  2. Output length equal to the AES-128 key size only
  3. Deterministic expansion of the digest back to the original file
  4. Collision resistance Correct answer.

Explanation

Collision resistance means it is infeasible to find m1 ≠ m2 with H(m1) = H(m2). Preimage resistance is about inverting a given digest; second-preimage resistance is about matching a given message. Hashes are one-way and not decrypted. SM3 and SHA-256 both output 256 bits, not 128.

Question 9Identity, access and cryptographic protection

What is the output length of the SM3 hash function used in Chinese commercial cryptography?

  1. 256 bits Correct answer.
  2. 512 bits
  3. 128 bits
  4. 160 bits

Explanation

SM3 produces a 256-bit digest, the same length as SHA-256. 128 bits is MD5 (broken) or an SM4/AES block. 160 bits is SHA-1 (broken for collisions). 512 bits is SHA-512, not SM3.

Question 10Identity, access and cryptographic protection

In a digital envelope (数字信封) used to send a large file, which hybrid pattern does 软考 cryptography expect?

  1. Apply Caesar substitution to the file and RSA to the filename
  2. Encrypt the whole file with the recipient's RSA/SM2 private key only
  3. Generate a random AES or SM4 session key, encrypt the file with that symmetric key, and encrypt the session key with the recipient's public key Correct answer.
  4. Hash the file with SM3 and discard the plaintext

Explanation

A digital envelope uses hybrid cryptography: a random symmetric session key (AES or SM4) encrypts bulk data efficiently, and the recipient's public key (RSA or SM2) encrypts only that short session key. Private keys decrypt; they are not used to encrypt to a recipient. Hashing is not encryption. Classical ciphers are not the 软考 envelope construction.

Question 11Identity, access and cryptographic protection

ECB mode is used to encrypt a 1 MiB BMP image with SM4. Why is this a poor engineering choice even though SM4 is a strong cipher?

  1. SM4 cannot encrypt more than 16 bytes in any mode
  2. ECB encrypts identical plaintext blocks to identical ciphertext blocks, leaking patterns in the image Correct answer.
  3. SM4 in ECB automatically provides SM2 non-repudiation
  4. ECB is required by 等保2.0 for all images

Explanation

Block ciphers in ECB have no IV/counter, so repeated 16-byte blocks (common in images) produce repeated ciphertext and visible structure. Use CBC/CTR/GCM (or SM4 in a mode with an IV). SM4's 128-bit block can encrypt arbitrary length as a sequence of blocks. ECB is not a signature mode and is not mandated by 等保.

Question 12Identity, access and cryptographic protection

Diffie–Hellman key exchange by itself does not authenticate peers. Which attack does 软考 expect you to name, and what is the usual mitigation?

  1. DDoS; mitigate with SM3 only
  2. Cold-boot; mitigate with a longer modulus alone
  3. SQL injection; mitigate with parameterized queries
  4. Man-in-the-middle; mitigate by authenticating the exchange (signatures/certificates, as in IKE/TLS) Correct answer.

Explanation

Anonymous DH is vulnerable to MITM: the attacker completes DH with each side. IKE and TLS bind DH (or ECDH/SM2 key exchange) to signatures and certificates. SQL injection and DDoS are different problems; a longer modulus without authentication still allows MITM.

Question 13Identity, access and cryptographic protection

AES-256 uses a 256-bit key. How many bytes is that key, and how many AES rounds are applied?

  1. 16 bytes and 10 rounds
  2. 24 bytes and 12 rounds
  3. 32 bytes and 14 rounds Correct answer.
  4. 32 bytes and 32 rounds

Explanation

256 bits is 32 bytes. AES-256 uses 14 rounds. 16 bytes/10 rounds is AES-128; 24 bytes/12 rounds is AES-192; 32 rounds is SM4, not AES.

Question 14Identity, access and cryptographic protection

SM4 uses which block size, key size, and round count?

  1. 128-bit block, 128-bit key, 32 rounds Correct answer.
  2. 128-bit block, 256-bit key, 14 rounds (that is AES-256)
  3. 256-bit block, 256-bit key, 64 rounds
  4. 64-bit block, 56-bit key, 16 rounds (that is DES)

Explanation

SM4 is a 128-bit block cipher with a 128-bit key and 32 Feistel rounds (GB/T 32907). DES is 64/56/16. AES-256 is 128/256/14. There is no 256-bit-block SM4.

Question 15Security integration, physical environment and media

During requirements analysis for that HIS, which asset list is the MOST complete for a 软考 risk/requirements case?

  1. Business data (EMR), application servers, databases, network/security devices, computer-room facilities, and supporting people/process assets Correct answer.
  2. Only the brand of the waiting-room TVs
  3. Only open-source licenses
  4. Only the public website HTML files

Explanation

Risk assessment inventories information assets, software, hardware, facilities, and people/process assets that support the business. A website-only or TV-only list under-scopes HIS. License tracking is useful but not the asset inventory.

Question 16Security integration, physical environment and media

A bank wants a perimeter design with public online banking in a DMZ, internal core banking on a separate segment, and centralized logs. Which placement is CORRECT?

  1. Expose the core database with a public IP and rely on obscurity
  2. Disable the inner firewall so DMZ hosts can route freely inland
  3. Put the internet-facing web servers on the same VLAN as the core database with no firewall
  4. Place web servers in a DMZ between outer and inner firewalls; keep core DB on the trusted zone; send logs to 安全管理中心 Correct answer.

Explanation

Solution design for 等保 uses regional boundary controls: public services in a DMZ, databases inland, dual-homed firewalls, and centralized audit in the management center. Combining web and DB on one VLAN, public DB IPs, or removing the inner firewall collapses 安全区域边界.

Question 17Security integration, physical environment and media

Where should a reverse-proxy WAF be deployed to protect an internet-facing website farm?

  1. On the printer VLAN only
  2. Only on an analyst's laptop after hours
  3. Inline in front of the web servers (typically in the DMZ) so HTTP/HTTPS is inspected before origin Correct answer.
  4. Exclusive to the tape library robot

Explanation

A WAF must see application traffic, so it sits inline (or as a reverse proxy) in front of the website. Laptop-only, tape-library, or printer-VLAN placements cannot inspect client HTTP to the origins.

Question 18Security integration, physical environment and media

A /24 network 192.168.10.0/24 must be split into four equal subnets. What prefix length and host count per subnet result?

  1. /24 still, because splitting is impossible
  2. /25 with 128 addresses (126 hosts) each
  3. /26 with 64 addresses (62 usable hosts) each Correct answer.
  4. /28 with 16 addresses each, yielding 16 subnets not 4

Explanation

Four equal subnets need 2 extra prefix bits: /24 + 2 = /26. Each /26 has 2^(32-26) = 64 addresses and 62 usable hosts (subtract network and broadcast). /25 yields only two subnets. /28 yields sixteen subnets of 16 addresses.

Question 19Security integration, physical environment and media

Host 10.20.30.70 has mask 255.255.255.192. Which network address is it on?

  1. 10.20.30.0/26
  2. 10.20.30.64/26 Correct answer.
  3. 10.20.30.128/26
  4. 10.20.30.70/32 only, with no subnet

Explanation

255.255.255.192 is /26 (block size 64). Subnets on 10.20.30.0 are .0, .64, .128, .192. 70 falls in 64–127, so the network is 10.20.30.64/26 (broadcast 10.20.30.127). Design cases use this to place ACL objects.

Question 20Security integration, physical environment and media

How many usable IPv4 host addresses are in 172.16.4.0/27?

  1. 30 Correct answer.
  2. 27
  3. 14
  4. 32

Explanation

A /27 has 2^(32-27) = 32 addresses. Subtract the network and broadcast addresses: 30 usable hosts. 27 is the prefix length, not the host count. 14 would be a /28 (16 − 2).

Question 21Security integration, physical environment and media

A jump/bastion host is being added. Which deployment judgment is CORRECT?

  1. The bastion shares the DMZ web farm's database credentials
  2. Administrators should SSH to every production host from the internet; the bastion is optional decoration
  3. Internet admin paths terminate on the bastion (MFA, logging, command audit); production hosts accept admin sessions only from the bastion network Correct answer.
  4. The bastion should run a public recursive DNS resolver and mail open relay

Explanation

A bastion concentrates and audits privileged access: strong auth, session recording, and no direct internet-to-host admin. Extra internet services and shared web DB credentials enlarge its blast radius.

Question 22Security integration, physical environment and media

A Level-3 design is missing 安全管理中心 centralized collection of firewall, IPS, and server audit logs. Which judgment is CORRECT?

  1. Only SNMP interface counters are required; security logs are optional
  2. Local logs on each device with no aggregation fully meet Level-3 集中管控
  3. Level 3 requires centralized monitoring and aggregation/analysis of audit data in the management center, with retention meeting legal/standard minima Correct answer.
  4. Logs may be discarded after 24 hours if disk is small

Explanation

安全管理中心 at Level 3 adds 安全管理 and 集中管控 on top of system/audit management: collect logs from network, security, and compute devices, analyze them, and retain them (commonly taught as at least six months, and in line with Cybersecurity Law logging duties). Local-only logs, 24-hour wipe, and SNMP-only monitoring fail those items.

Question 23Cyber-risk identification and analysis

等保2.0 basic requirements are specified in which standard?

  1. ISO 9001 quality-management only
  2. GB/T 22239-2019 Correct answer.
  3. PCI DSS v4 only
  4. RFC 1918

Explanation

GB/T 22239-2019 is 《信息安全技术 网络安全等级保护基本要求》, the 等保2.0 basic-requirements standard. Companion standards include GB/T 22240 (grading), GB/T 25070 (design), and GB/T 28448 (evaluation). PCI DSS, RFC 1918, and ISO 9001 are not 等保2.0.

Question 24Cyber-risk identification and analysis

How many protection levels does 等保2.0 define, and which level is commonly required for important civic, financial, or healthcare production systems with serious social impact?

  1. Three levels; Level 1 is used for national core systems
  2. Five levels (第一级 to 第五级); Level 3 (第三级, 监督保护) is typical for important systems with serious impact Correct answer.
  3. Seven EAL levels copied from Common Criteria with no Chinese filing
  4. A single unclassified level for all internet systems

Explanation

Classified protection uses five levels. Level 1 is autonomous protection for low impact; Level 3 is supervised protection for systems whose damage would cause serious harm to social order or public interest - the usual target for important hospital HIS, e-government, and similar systems, with police filing and typically annual evaluation. Level 5 is special control for national core systems.

Question 25Cyber-risk identification and analysis

等保2.0 technical requirements are organized as which five classes (一个中心, 三重防护 plus physical environment)?

  1. Only ISO 27001 Annex A clauses 5 through 8
  2. SMTP, IMAP, POP3, FTP, and Telnet
  3. RAID 0, RAID 1, RAID 5, RAID 6, and RAID 10
  4. 安全物理环境, 安全通信网络, 安全区域边界, 安全计算环境, 安全管理中心 Correct answer.

Explanation

GB/T 22239-2019 technical classes are 安全物理环境, 安全通信网络, 安全区域边界, 安全计算环境, and 安全管理中心. The slogan '一个中心、三重防护' highlights the management center plus communication network, regional boundary, and computing environment. Mail protocols and RAID levels are not those classes.

Question 26Cyber-risk identification and analysis

等保2.0 安全管理中心 implements three-admin separation. Which trio is correct?

  1. Marketing, sales, and finance with no technical split
  2. DHCP, DNS, and NTP operators as the three legal roles
  3. System administrator, security administrator, and audit administrator (系统管理员, 安全管理员, 审计管理员) Correct answer.
  4. Only a single shared root account for all duties

Explanation

三权分立 assigns 系统管理员 (accounts, resources, backup), 安全管理员 (policies, security configuration), and 审计管理员 (log review, audit integrity) so no one person can both commit and conceal a change. A shared root account is the anti-pattern 等保 is designed to stop.

Question 27Cyber-risk identification and analysis

A Level-3 system remote-administration channel currently sends passwords in Telnet. Which 等保 安全计算环境 identity-authentication requirement is being missed?

  1. Telnet is mandatory so auditors can tcpdump passwords
  2. All remote admin must use anonymous FTP
  3. Identity uniqueness is satisfied by sharing one telnet account named 'admin'
  4. Remote management must prevent authentication secrets from being sniffed in transit (use SSH/HTTPS/VPN), and Level 3 typically requires stronger than reusable passwords alone for important logons Correct answer.

Explanation

Level-3 identity discrimination requires unique IDs, complexity, lockout, and protection of remote authentication against eavesdropping. Telnet fails the last point. Shared 'admin' fails uniqueness. FTP anonymous is not an admin channel.

Question 28Cyber-risk identification and analysis

For a typical 等保 Level-3 object, how often is classified-protection evaluation (等级测评) expected in routine operation?

  1. Only when a journalist requests it
  2. Every 10 years regardless of change
  3. Once at commissioning, then never again
  4. At least annually (and after major changes), which is the usual Level-3 cycle taught in 软考 Correct answer.

Explanation

Practice and 软考 teaching: Level 2 about every two years, Level 3 annually, plus evaluation after major changes. Level 3 is 监督保护 with ongoing oversight, not a one-time commissioning stamp.

Question 29Cyber-risk identification and analysis

ISO/IEC 27001 is used in a 软考 management case as:

  1. A packet-filter algorithm
  2. An information security management system (ISMS) standard using a PDCA cycle and a control set (Annex A), complementary to - not a replacement for - 等保2.0 filing Correct answer.
  3. The only acceptable substitute for police 备案 at Level 3
  4. A hash function with a 27001-bit digest

Explanation

ISO/IEC 27001 specifies ISMS requirements (context, leadership, planning, support, operation, evaluation, improvement - PDCA) and references Annex A controls (detailed in ISO 27002). It can organize management work alongside 等保 but does not replace statutory classified-protection grading and filing.

Question 30Security foundations, governance and Chinese context

In 软考 network-information-security teaching, which CIA property is primarily provided by encrypting payroll files so unauthorized readers cannot recover the plaintext?

  1. Integrity
  2. Availability
  3. Confidentiality Correct answer.
  4. Non-repudiation (抗抵赖)

Explanation

Confidentiality (机密性) is the property that information is not disclosed to unauthorized subjects. Encryption is the classic technical control for confidentiality because ciphertext is unreadable without the key. Integrity is about unauthorized modification, availability is about timely usable access, and 抗抵赖 is about proving origin or receipt, typically with digital signatures.

Question 31Security foundations, governance and Chinese context

A backup operator publishes an SM3 digest of a firmware image so installers can detect unauthorized alteration. Which security property is the digest mainly enforcing?

  1. Integrity Correct answer.
  2. Availability
  3. Controllability (可控性)
  4. Confidentiality

Explanation

A cryptographic hash such as SM3 is a one-way digest. Comparing a freshly computed digest with the published value detects unauthorized modification, which is integrity (完整性). The digest is not a secret that hides the image, does not keep the download service online, and does not itself authorize who may install the image.

Question 32Security foundations, governance and Chinese context

A volumetric DDoS flood that saturates an e-commerce site's uplink so legitimate customers cannot complete checkout primarily violates which CIA property?

  1. Availability Correct answer.
  2. Authenticity
  3. Confidentiality
  4. Integrity

Explanation

Availability (可用性) is the property that authorized users can access information and services when needed. A volumetric DDoS consumes bandwidth or resources so the checkout service is unusable. The flood does not by itself disclose secrets or alter stored order records.

Question 33Security foundations, governance and Chinese context

Which 软考 security property is provided when a sender signs a contract hash with an SM2 private key so the sender cannot later deny having approved that exact document?

  1. Traffic-flow confidentiality
  2. Confidentiality
  3. Availability
  4. Non-repudiation (抗抵赖) Correct answer.

Explanation

Non-repudiation (抗抵赖) means a party cannot credibly deny origin or approval of a message. An SM2 digital signature is created with the sender's private key and verified with the corresponding public key, binding the signer to that document hash. Encryption hides content; availability keeps services reachable; traffic-flow confidentiality hides who talks to whom.

Question 34Security foundations, governance and Chinese context

Article 23 of the PRC Cybersecurity Law (网络安全法, as amended effective 1 January 2026; formerly Article 21) requires the state to implement which institutional system that 等保2.0 operationalizes for classified protection of networks?

  1. The commercial cryptography assessment system only
  2. The cybersecurity classified protection system (网络安全等级保护制度) Correct answer.
  3. A voluntary ISO/IEC 27001 registration system with no police filing
  4. A private-sector-only PCI DSS mandate

Explanation

Article 23 of the amended Cybersecurity Law - Article 21 in the 2016 text, renumbered when the 2025 amendment took effect on 1 January 2026 - states that the state implements the cybersecurity classified protection system (网络安全等级保护制度). 等保2.0 (notably GB/T 22239-2019) is the current technical/management standard set used to grade, file, construct, and evaluate systems. Commercial cryptography assessment (密评) is a related but distinct cryptography-law duty; ISO 27001 is voluntary internationally; PCI DSS is a card-brand standard, not the PRC legal classified-protection system.

Question 35Security foundations, governance and Chinese context

The PRC Data Security Law (数据安全法) organizes protection of data primarily through which mechanism that 软考 cases expect you to apply in engineering design?

  1. Data classification and grading (数据分类分级) with protection matched to importance and harm Correct answer.
  2. Encrypting only data that leaves China and leaving domestic copies in plaintext
  3. Replacing all access control with annual ISO audits
  4. Treating all data as a single unrestricted public resource

Explanation

The Data Security Law requires data to be classified and graded (数据分类分级) so protective measures match importance and the harm of leakage, tampering, or loss. Important data and core data carry heavier duties than ordinary data. Treating everything as public, encrypting only cross-border copies, or substituting audits for access control contradicts that graded-protection model.

Question 36Host and operating-system security

Which Linux hardening action BEST matches least privilege for a web service account?

  1. Disable auditd to save CPU
  2. Run the web server as root so it can bind port 80 without a capability drop
  3. Run the service as a dedicated unprivileged user, disable unused modules/ports, and keep sudo tightly controlled Correct answer.
  4. chmod 777 on /var/www so every local user can deploy

Explanation

OS hardening uses a dedicated service account, closed unused ports/services, patching, and constrained privilege escalation. Running as root, world-writable web roots, and disabled audit fail 等保 安全计算环境 identity, access-control, and audit points.

Question 37Host and operating-system security

On Linux, mode 0750 on a directory means which permissions for owner / group / others?

  1. rwx for owner, r-x for group, none for others Correct answer.
  2. rwx for everyone
  3. r-- for owner, --- for group and others
  4. r-x for owner, rwx for others

Explanation

Octal 7 = rwx, 5 = r-x, 0 = none. 0750 is therefore owner rwx, group r-x, others none - a common least-privilege directory mode. 0777 would be rwx for everyone.

Question 38Host and operating-system security

A Windows domain member used as a file server still has SMBv1 enabled. For hardening against wormable ransomware such as WannaCry/EternalBlue, the FIRST configuration change is:

  1. Expose SMBv1 to the internet so patches can be crowd-tested
  2. Share C$ to Everyone
  3. Turn off Windows Update permanently
  4. Disable SMBv1, apply security updates, and restrict SMB to authorized networks Correct answer.

Explanation

EternalBlue exploited SMBv1. Hardening disables SMBv1, patches, and limits SMB exposure. Publishing SMBv1, administrative shares to Everyone, or freezing updates recreates the 2017 outbreak conditions.

Question 39Host and operating-system security

SSH on a Linux bastion is hardened. Which setting is the BEST immediate improvement over defaults?

  1. Listen on port 22 and also enable Telnet in parallel
  2. Share the same private key in a public wiki
  3. PermitRootLogin yes and PasswordAuthentication yes from the internet
  4. Disable root login, require key-based (or MFA) authentication, and restrict source IPs Correct answer.

Explanation

Bastion hardening: no root SSH, keys or MFA instead of password spraying, and source restriction. Parallel Telnet and published private keys undo SSH's value.

Question 40Host and operating-system security

A case requires MAC on a Linux host so even root cannot freely ignore file sensitivity labels. Which technology is the 软考-appropriate answer?

  1. SELinux or an equivalent MAC framework enforcing mandatory labels Correct answer.
  2. Disabling the firewall
  3. World-writable /tmp with no sticky bit as a 'MAC equivalent'
  4. DAC chmod only

Explanation

MAC is implemented on Linux by SELinux (or AppArmor in a weaker mandatory style). chmod is DAC. Firewall state and /tmp permissions are different controls. 等保 安全计算环境 access control at higher levels expects mandatory or role mechanisms beyond owner discretion.

Question 41Security integration, physical environment and media

Which Bell-LaPadula (BLP) pair of rules is taught as the confidentiality model in 软考 security-architecture topics?

  1. No read up, no write down Correct answer.
  2. No read down, no write up
  3. Read and write are unrestricted if the user owns the file
  4. Write up is required so high labels always receive low data

Explanation

BLP protects confidentiality: the simple-security property forbids reading a higher label (no read up), and the *-property forbids writing to a lower label (no write down), which would leak high data. Biba reverses those directions for integrity. DAC owner grants are not BLP. Mandatory write-up is not the BLP confidentiality rule set.

Question 42Security integration, physical environment and media

The Biba integrity model forbids which pair of operations?

  1. No read down, no write up Correct answer.
  2. No execute of any labeled object
  3. No use of digital signatures
  4. No read up, no write down

Explanation

Biba protects integrity: do not read lower-integrity data (no read down) and do not write to higher-integrity objects (no write up), preventing contamination of high-integrity state. BLP uses the opposite directions for confidentiality. Biba does not ban execute or signatures.

Question 43Security integration, physical environment and media

Defense in depth (纵深防御) in a 软考 architecture answer is BEST described as:

  1. Encrypting backups and disabling all monitoring to reduce noise
  2. Trusting the internal LAN after VPN login with no further checks
  3. A single border firewall as the only control
  4. Layered complementary controls so failure of one layer does not expose the whole system Correct answer.

Explanation

纵深防御 stacks people, process, and technical layers (border, DMZ, host, application, data, management) so one failure is not catastrophic. A single firewall, disabling monitoring, or implicit trust after VPN login are the opposite of depth. 等保2.0's 'one center, three protections' is an instance of this idea.

Question 44Security integration, physical environment and media

Which P2DR component states the rules that protection, detection, and response must implement?

  1. Packet fragmentation
  2. Policy Correct answer.
  3. Penetration test report only
  4. Physical key ceremony only

Explanation

P2DR is Policy, Protection, Detection, Response. Policy is the management core that defines what must be protected and how the other three operate. A pentest report is an assessment artifact, a key ceremony is a crypto-management event, and fragmentation is a networking behavior.

Question 45Identity, access and cryptographic protection

In Kerberos, what does the Authentication Server issue after a successful password-based (or key-based) authentication so the client can later request service tickets?

  1. A raw copy of the service's long-term key in plaintext email
  2. A firewall ACL line
  3. An X.509 end-entity certificate signed by SM2 only
  4. A Ticket-Granting Ticket (TGT) Correct answer.

Explanation

Kerberos AS issues a TGT (and a session key) after authenticating the client. The client then presents the TGT to the TGS to obtain service tickets. Kerberos is a symmetric-ticket protocol; it is not itself the issuance of an SM2 X.509 certificate, and it must not email service keys in plaintext.

Question 46Identity, access and cryptographic protection

Which combination is an example of multi-factor authentication (MFA)?

  1. Username only, because usernames are unique
  2. Password plus a second password stored in the same file
  3. Password (something you know) plus a one-time code from a token or phone (something you have) Correct answer.
  4. The same PIN typed twice

Explanation

MFA requires factors from different categories: knowledge, possession, or inherence (biometrics). A password plus a one-time token combines know + have. Two passwords or a repeated PIN are still a single knowledge factor. A username is an identifier, not an authenticator.

Question 47Identity, access and cryptographic protection

In PKI, which party issues and signs end-entity certificates that bind a public key to an identity?

  1. The relying party's web browser cache only
  2. A Certification Authority (CA) Correct answer.
  3. Any DHCP server
  4. The NTP pool

Explanation

A CA is the trusted issuer that signs certificates after registration/validation. Browsers store trust anchors and received certificates but do not issue organizational certificates. DHCP assigns addresses; NTP distributes time, which PKI needs for validity windows but is not the issuer.

Question 48Identity, access and cryptographic protection

A certificate is suspected compromised. Which PKI action should relying parties use to reject it before notAfter?

  1. Consult CRL or OCSP (and the CA's revocation status) and refuse revoked serials Correct answer.
  2. Extend notAfter by editing the client's clock backward
  3. Publish the CA private key so everyone can re-issue
  4. Ignore validity and trust any self-signed cert with the same CN

Explanation

Revocation uses CRLs or OCSP so verifiers reject the serial before expiry. Clock rollback, trusting random self-signed certs, and leaking the CA key all destroy PKI.

Question 49Network boundaries and protected communication

A packet-filtering firewall makes the basic allow/deny decision using which information?

  1. Full HTTP application payload and user identity cookies only
  2. Network/transport header fields such as IP addresses, protocol, and TCP/UDP ports Correct answer.
  3. The SM3 digest of the operator's badge photo
  4. The BIOS version of the destination host

Explanation

Classic packet filters inspect IP 5-tuple fields (addresses, protocol, ports) and related flags. They do not fully parse HTTP cookies or user identity; that is proxy/WAF/NGFW territory. Badge hashes and BIOS versions are not packet-filter inputs.

Question 50Network boundaries and protected communication

A stateful inspection firewall differs from a stateless packet filter because it:

  1. Tracks connection state so return traffic for an allowed session can be accepted without a mirror rule for every flow Correct answer.
  2. Can only filter UDP and never TCP
  3. Replaces the need for any default-deny rule
  4. Ignores TCP flags and treats every packet independently forever

Explanation

Stateful inspection maintains a connection table (for example TCP three-way handshake progress) and allows packets that belong to an established session. Stateless filters decide each packet in isolation. Stateful firewalls still need a default deny; they are not UDP-only.