The following description of configuring elog management, which one is wrong? (single selection).

At present, elog supports manual addition and automatic discovery of two ways to manage FW The manual addition method requires SNMP parameters to be configured on the FW.

By default eLog does not parse session creation logs, if you need to parse and display session creation logs on eLog, you need to configure them on the collector.

At present, elog supports manual addition and automatic discovery of two ways to manage FW The manual addition method requires SNMP parameters to be configured on the FW.

The time zone and time on FW must be consistent with the time zone and time on the eLog cold collector, otherwise the log viewing results will be affected.

If FW simultaneously imports session aging logs, session new logs, and periodic session logs This will cause an increase in the number of logs received by eLog Consume eLog storage space.

The following describes vulnerabilities and identification and assessment Which one is incorrect?(single selection).

Vulnerability points are divided into two types: technical vulnerabilities and management vulnerabilities. The management vulnerability identification image is only for the management part of the organization

In the technical vulnerability point, identify the vulnerable point of the application system From the audit mechanism Audit storage and access control policies. Data integrity Identification Password protection and other aspects for identification.

Vulnerability identification is also called vulnerability identification, and weakness is the existence of capital itself If there is no corresponding threat, the weakness itself will not cause damage to capital.

Vulnerability points are divided into two types: technical vulnerabilities and management vulnerabilities. The management vulnerability identification image is only for the management part of the organization

The severity of the technical vulnerability of an asset is affected by the organization's management vulnerability. Therefore, the vulnerability of assets should also be assigned with reference to the severity of technical management and organizational management vulnerabilities.

With the following description of the database auditing system, which option is wrong? (single selection).

Usually carry out direct deployment, extract messages and records.

Detect abnormal operations of legitimate users.

Usually carry out direct deployment, extract messages and records.

Ability to analyze operational behavior that does not contain threat signatures.

Support deployment in cloud environment, and the strategy is matched as needed Rules are on demand.

Which of the following descriptions of user management is wrong? (single selection).

User management cannot control a user's access to specific resources.

User management can control the resources that users access.

Management is a basic safety management.

Administrators can manage users' use of resources through AAA.

User management cannot control a user's access to specific resources.

In the following description of the principles of network trapping defense, which are correct?(multiple selection).

Installing threats against network weapons, network trapping defense technology, can use deception to make the attack execute special commands in the trapping system

For the detection behavior in the early stage of the attack, you can use deception to burst into defense. By creating various traps to mislead the attacker. Cause attackers to misunderstand the network structure, attack targets, and vulnerabilities.

Network trapping technology can disguise the actual business and vulnerabilities to mislead the attacker, so that the attacker can infiltrate the trapping system.

Installing threats against network weapons, network trapping defense technology, can use deception to make the attack execute special commands in the trapping system

In the face of viruses, worms, WebShell these weaponized attack methods, can use misleading methods to make the attack traffic be diverted to trap probe O

For the detection behavior in the early stage of the attack, you can use deception to burst into defense. By creating various traps to mislead the attacker. Cause attackers to misunderstand the network structure, attack targets, and vulnerabilities.

Network trapping technology can disguise the actual business and vulnerabilities to mislead the attacker, so that the attacker can infiltrate the trapping system.

Take the following description of safety measures Which one is wrong? (single selection).

B/S architecture model and C/S class of database audit Implement a two-layer (presentation layer, data access layer) architecture

Security audit can identify risks by analyzing threat logs

Security audit is usually divided into database audit, behavior audit and operation and maintenance audit

Security audit is generally a post-event audit, because permission management and authorization are the core of security audit

B/S architecture model and C/S class of database audit Implement a two-layer (presentation layer, data access layer) architecture

The following describes the authorization of the log license Which is correct? (single selection).

Sandbox detection logs include local sandbox and cloud sandbox detection logs, and cloud sandbox detection requires license authorization

The generation of anti-virus logs has nothing to do with license authorization

The generation of intrusion prevention logs has nothing to do with license authorization

The generation of audit logs has nothing to do with license authorization

Sandbox detection logs include local sandbox and cloud sandbox detection logs, and cloud sandbox detection requires license authorization

Common database security audit techniques according to technical characteristics What are the categories that can be divided into? (multiple selection).

Log-based estimation technology

Audit technology based on network monitoring

Log-based estimation technology

Audit technology based on network monitoring

Which of the following options does not reflect the advanced characteristics of APT attacks? (single selection).

API attacks follow the course of the cyber attack chain

Sending API attacks generally requires the power of large organizations

API attacks follow the course of the cyber attack chain

API attacks are generally more invisible Hide attacks by encrypting channels, for example

Zero-day vulnerabilities are used in API attacks

What are the common database intrusion detection techniques? (Multiple selection)

Intrusion detection technology based on known attack behaviors

Intrusion detection technology based on data mining

Statistical-based intrusion detection technology

Intrusion detection technology based on pattern matching

Intrusion detection technology based on known attack behaviors

Intrusion detection technology based on data mining

Statistical-based intrusion detection technology

Intrusion detection technology based on pattern matching

The following describes the guiding principles for information security management Which one is incorrect? (single selection).

the principle of reducing complexity in engineering principles is the most privileged mechanism that needs to implement access.

Information security requires active defense and comprehensive prevention.

It is necessary to comprehensively consider the constraints of social factors on information security.

It is necessary to clarify the responsibilities and verifiability of countries, enterprises and individuals for information security.

the principle of reducing complexity in engineering principles is the most privileged mechanism that needs to implement access.

Take the following about1, Icx.exe-slave 192.168.122.111:4444 192.168.122.128:33892, lex -listen 3456 3789What is the correct understanding? (Multiple selection)

In the second point, the server's port 3789 request is transmitted to port 3456

In the first point, forward the server's port 3389 data to 192.168.122.111: 4444

In the second point, the server's port 3456 request is transmitted to port 3389

In the second point, the server's port 3789 request is transmitted to port 3456

In the first point, forward the data on port 4444 of the server to 192.168.122.128:3389 ±

In the first point, forward the server's port 3389 data to 192.168.122.111: 4444

Which of the following can be guaranteed by K anonymization technology? (multiple selection).

The attacker cannot determine who a piece of data corresponds to

An attacker cannot infer whether a person is in the public data.

The attacker cannot confirm whether there is a sensitive attribute

Lack of diversity of sensitive data .

The attacker cannot determine who a piece of data corresponds to

An attacker cannot infer whether a person is in the public data.

The attacker cannot confirm whether there is a sensitive attribute

Which of the following attack methods of 24L can be used in the strike phase of the cyber attack chain? (multiple selection).

IP packet attack with routing record entries

The following is a humble description of transparent and reverse proxies Which items are correct?(multiple selection).

The deployment method of reverse proxy requires directing traffic to the WAF device.

The deployment method of transparent proxy is to connect devices in the network.

The deployment method of reverse proxy requires directing traffic to the WAF device.

The deployment method of transparent proxy requires directing traffic to the WAF device.

The deployment method of transparent proxy is to connect devices in the network.

The deployment method of reverse proxy is to connect devices in the network.

The following describes port scanning Which is wrong? (single selection).

When the scanner sends a Syn message If the peer does not reply, the peer port is down.

TCP port scanning uses the three-way handshake feature

The purpose of port scanning is to determine what kind of services are enabled on the peer host, so as to find an entry for intrusion.

When the scanner sends a Syn message If the peer does not reply, the peer port is down.

For UDP port scanning It is to determine whether the port is open by sending a UDP data packet to the peer with a specific port number and observing whether the ICMP port is unreachable packet.

Which of the following measures can protect against viruses that spread through zero-day vulnerabilities? (multiple selection).

Use situational awareness technology

In the capacity building of the security team, it is generally divided into management positions and technical posts, which of the following are not the key responsibilities of technical positions? (single selection).

Responsible for formulating enterprise-level information security technology planning and technical architecture.

Responsible for security vulnerability detection and protection.

Responsible for organizing the emergency handling of information security emergencies.

Responsible for formulating enterprise-level information security technology planning and technical architecture.

Responsible for organizing and carrying out information system security graded protection work

Which of the following scenarios is for network intrusion prevention? (multiple selection).

IDC or server cluster frontend.

Between branches of the company's network interconnection.

The boundary between the campus network and the Internet?

IDC or server cluster frontend.

The front end of the firewall for the exit of the corporate network.

Between branches of the company's network interconnection.

The boundary between the campus network and the Internet?

The following describes the configuration contents of the firewall file filtering feature Which one is wrong, (single selection).

Use the command display current-configuration to display configuration information for the default configuration file itself.

The administrator should first clarify which types of files need to be purged, and then select the types of files that the device can support Finally, fill in the remaining file types in "Custom extension".

When the default configuration file is referenced by the command line configuration security policy You need to enter the full profile name Otherwise, it cannot be successfully referenced.

Under the command line interface, you can view the configuration information in the default configuration file through the command display profile type url-filter.