信息安全工程师当天每日一练试题地址：http://www.cnitpm.com/exam/ExamDay.aspx?t1=6

往期信息安全工程师每日一练试题汇总：http://www.cnitpm.com/class27-6-1.aspx

信息安全工程师每日一练试题（2017/12/21）在线测试：http://www.cnitpm.com/exam/ExamDay.aspx?t1=6&day=2017/12/21

信息安全工程师每日一练试题内容（2017/12/21）

试题1：

下面关于ARP木马的描述中，错误的是  （ ）  。
A、ARP木马利用ARP协议漏洞实施破坏
B、ARP木马发作时可导致网络不稳定甚至瘫痪
C、ARP木马破坏网络的物理连接
D、ARP木马把虚假的网关MAC地址发给受害主机

试题解析与讨论：http://www.cnitpm.com/st/89663087.html
试题参考答案：C

试题2：

信息安全策略应该全面地保护信息系统整体的安全，网络安全体系设计是逻辑设计工作的重要内容之一，可从物理线路安全、网络安全、系统安全、应用安全等方面来进行安全体系的设计与规划。其中，数据库的容灾属于（）的内容
A、物理线路安全与网络安全  
B、网络安全与系统安全
C、物理线路安全与系统安全 
D、系统安全与应用安全

试题解析与讨论：http://www.cnitpm.com/st/121014166.html
试题参考答案：D

试题3：

信息系统安全风险评估是通过数字化的资产评估准则完成的，它通常会覆盖人员安全、人员信息、公共秩序等方面的各个要素，以下不会被覆盖的要素是（）
A、立法及规章未确定的义务
B、金融损失或对业务活动的干扰
C、信誉的损失
D、商业及经济的利益

试题解析与讨论：http://www.cnitpm.com/st/192663219.html
试题参考答案：A

试题4：

防止擅自使用资料档案的最有效的预防方法是:（）
A.自动化的档案访问入口
B.磁带库管理
C.使用访问控制软件
D.锁定资料馆

试题解析与讨论：http://www.cnitpm.com/st/260813631.html
试题参考答案：C

试题5：

通过向被攻击者发送大量的ICMP回应请求，消耗被攻击者的资源来进行响应，直至被攻击者再也无法处理有效地网络信息流时，这种攻击称之为：（）
A．Land攻击
B．Smurf 攻击
C．PingofDeath攻击
D．ICMPFlood

试题解析与讨论：http://www.cnitpm.com/st/2685020920.html
试题参考答案：D

试题6：

下列哪一项安全控制措施不是用来检测未经授权的信息处理活动的：（）
A．设置网络连接时限
B．记录并分析系统错误日志
C．记录并分析用户和管理员操作日志
D．启用时钟同步

试题解析与讨论：http://www.cnitpm.com/st/2685415999.html
试题参考答案：A

试题7：

（1）is the science of hiding information. Whereas the goal of cryptography is to make data unreadable by a third party. the goal of steganography is to hide the data from a third party. In this article, I will discuss what steganography is, what purposes it serves, and will provide an example using available software.
There are a large number of steganographic （2）that most of us are familiar with (especially if you watch a lot of spy movies), ranging from invisible ink and microdots to secreting a hidden message in the second letter of each word of a large body of text and spread spectrum radio communication. With computers and networks, there are many other ways of hiding informations, such as:
Covert channels (c,g, Loki and some distributed denial-of-service tools use the Internet Control （3）Protocol, or ICMP, as the communication channel between the “bad guy”and a compromicyed system)
Hidden text within Web pages
Hiding files in “plain sight”(c,g. what better place to “hide”a file than with an important sounding name in the c:\winnt system32 directory)
Null ciphers(c,g, using the first letter of each word to form a hidden message in an otherwise innocuous text)
steganography today, however, is significantly more （4）than the example about suggest, allowing a user to hide large amounts of information within image and audio. These forms of steganography often are used in conjunction with cryptography so the information is double protected; first it is encrypted and then hidden so that an advertisement first. find the information ( an often difficult task in and of itself) and the decrypted it.
The simplest approach to hiding data within an image file is called （5）signature insertion. In this method, we can take the binary representation of the hidden data and the bit of each byte within the covert image. If we are using 24-bit color the amount and will be minimum and indiscriminate to the human eye.
（1）A、Cryptography
B、Geography
C、Stenography
D、Steganography
（2）A、methods
B、software
C、tools
D、services
（3）A、Member
B、Management
C、Message
D、Mail
（4）A、powerful
B、sophistication
C、advanced
D、easy
（5）A、least
B、most
C、much
D、less

试题解析与讨论：http://www.cnitpm.com/st/2851420507.html
试题参考答案：A、A、C、B、A

试题8： Which of the following append themselves to files as a protection against viruses? 
A、Behavior blockers 
B、Cyclical redundancy checkers (CRCs) 
C、Immunizers 
D、Active monitors 
试题解析与讨论：http://www.cnitpm.com/st/2960026313.html
试题参考答案：C

试题9： Which of the following disaster recovery/continuity plan components provides the GREATEST assurance of recovery after a disaster? 
A、The alternate facility will be available until the original information processing facility is restored. 
B、User management is involved in the identification of critical systems and their associated critical recovery times. 
C、Copies of the plan are kept at the homes of key decision-making personnel. 
D、Feedback is provided to management assuring them that the business continuity plans are indeed workable and that the procedures are current. 
试题解析与讨论：http://www.cnitpm.com/st/2974412053.html
试题参考答案：A

试题10： 《计算机信息系统安全保护等级划分准则》（GB17859——1999）中规定了计算机系统安全保护能力的五个等级，其中要求对所有主体和客体进行自主和强制访问控制的是（）
A.用户自助保护级
B.系统审计保护级
C.安全标记保护级
D.结构化保护级试题解析与讨论：http://www.cnitpm.com/st/326885401.html
试题参考答案：C