29. Which of the following types of malware infects critical operating system files, often replacing them with malicious ones?
(A) Rootkit
(B) Trojan
(C) Boot sector virus
(D) Ransomware

30. One of your users calls you in a panic because he has just seen a pop-up message on his computer screen that states that all of the files on the system are encrypted, and that he must pay to have them decrypted or lose them forever. You back up the user's files on a daily basis and update the antivirus signatures every other day. What is the best course of action to take in this case? (A) Pay the fee the ransomware is asking for. (B) Notify the authorities at once and attempt to update the antivirus signature with the latest release. (C) Wipe the computer's hard drives and restore the user's files from backup. (D) Reboot the computer.

31. Which of the following attacks involves sending false IP-to-MAC address mappings to a host, causing it to communicate with the attacker's machine instead of the legitimate one? (A) XMAS attack (B) Pharming (C) DNS poisoning (D) ARP poisoning

32. In a watering hole type of attack, which web site is an attacker most likely compromise? (A) An organization's official web site (C) A user's social media site (B) A site with a name very similar to the victim's web site (D) A site frequented by the users of a victim organization to 

33. All of the following are characteristics of host hardening, except: (A) Minimum needed functionality (B) Maximum level of privileges for each user (C) Patched and updated (D) Removal of unnecessary applications

34. Which of the following should always be considered when configuring a host? (A) Allowing access to configuration of management interfaces and configuration utilities(B) Maximum functionality for user accounts(C) Principle of least privilege(D) Shared passwords for administrative groups of users

35.  You have an external DNS server that has been the target of a lot of traffic directed at SMTP lately. The server is required to make and respond to name resolution queries only. You examine the configuration of the server and find that the sendmail utility is configured and running on the host, and the server is also listening for inbound connections on TCP port 25. Which of the following actions should you take? (A) Disable sendmail and any other program using TCP port 25. (B) Configure sendmail to send and receive e-mail from designated hosts only. (C) Disable the name resolution services on the host. (D) Configure DNS service to block inbound e-mail into the host.

36. Which of the following systems is normally required in high-security environments, and is used to address multilevel security requirements? (A) 256-bit encryption (B) Biometric authentication (C) Single Sign-On capability (D) Trusted operating system

37. To prevent an application from being installed or executed on a host, ______be implemented. (A) blacklisting (B) greylisting (C) whitelisting (D) protected memory execution 

38. Which of the following should you do before installing a patch on a production host in an enterprise environment? (A) Install host-based firewall and IDS applications. (B) Test the patch. (C) Determine the urgency of the patch and install it immediately if it is a critical security update. (D) Get approval from the end user.

39. Different groups in your organization require certain applications and security configuration settings that are unique to each group. You install a standard baseline image to the host computers for all the different groups. A developer group now complains that their applications do not work as they require, and that the security settings are too restrictive for them. They are able to document and show the necessity for less-restrictive security settings. Which of the following is your best course of action? (A) Make changes to each individual host within the developer group to accommodate their needs. (B) Withdraw the requirement for a standard baseline since it cannot be enforced without impacting productivity. (C) Require that the developer group change their procedures and applications to fit with the new standard baseline image. (D) Create a specialized baseline image that applies only to the developer group, and ensure that everyone else gets the standard baseline image.

114年 - 114 教育部公費留學考試試題：資訊安全概論#135195

113年 - [非官方正解]113 國立清華大學_碩士班考試入學試題:資訊安全#130695

113年 - 113 教育部公費留學考試試題：資訊安全概論#125716

112年 - [非官方正解]112 國立清華大學碩士班考試入學試題_資訊安全研究所：資訊安全#130782

112年 - 112 教育部公費留學考試試題：資訊安全概論#125717

111年 - [非官方正解]111 國立清華大學碩士班考試入學試題_資訊安全研究所：資訊安全#130742

111年 - 111 教育部_公費留學考試：資訊安全概論#125712

110年 - [非官方正解]109 國立清華大學_碩士班考試入學試題_資訊安全研究所：資訊安全#130996

110年 - 110 教育部公費留學考試試題：資訊安全概論#125719

110年 - [非官方正解]110 國立清華大學碩士班考試入學試題_資訊安全研究所:資訊安全#105636