OG0-091 V9.02_formatted Number: 235
Passing Score: 800
Time Limit: 120 min
File Version: V9.02
Exam : OG0-091
Title : TOGAF 9 Part 1
Version : V9.02
Exam A
QUESTION 1
According to TOGAF, Which of the following are the architecture domains that are commonly accepted subsets of an overall enterprise architecture?
A.Application, Business, Data, Technology
B.Capability, Segment, Strategic
C.Context, Definition, Governance, Transformation
D.Definition, Realization, Transition, Vision
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 2
Which one of the following statements about the structure of the TOGAF 9 document is true.?
A.Part I describes the TOGAF approach to Enterprise Architecture
B.Part II describes the definitions of terms used and the changes between versions of TOGAF
C.Part III describes requirements management and is considered to be the core of TOGAF
D.Part IV describes the ADM: a collection of guidelines and techniques used in TOGAF 9
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 3
According to TOGAF, Which one of the following best describes an enterprise architecture?
A.An architecture of a commercial organization
B.An architecture that consists of more than one subsidiary company
C.An architecture that crosses multiple systems, and multiple functional groups within the enterprise
D.The highest level of architecture that can be achieved in a given organization
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 4
In TOGAF, What is the difference between an artifact and a deliverable?
A.An artifact contains one or more deliverables
B.Artifacts and deliverables are synonymous; there is no difference between them
C.Deliverables are prepared by the Project Manager, whereas artifacts are defined by the Architect
D.Deliverables are reusable, whereas artifacts are unique to a given architecture project
E.Deliverables are specified as contractual outputs from a project, whereas artifacts are not
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 5
Which one of the following lists the main components within the TOGAF Architecture Repository?
https://www.doczj.com/doc/b54590421.html,anizational Metamodel, Architecture Capability, Architecture Landscape, Best Practices, Reference
Library, Compliance Strategy
B.Architecture Metamodel, Organizational Capability Model, Application Landscape, SIB, Reference
Library, Governance Model
C.Business Metamodel, Architecture Capability, Architecture Landscape, SIB, Reference Library,
Governance Log
D.Architecture Metamodel, Architecture Capability, Architecture Landscape, SIB, Reference Library,
Governance Log
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 6
According to the TOGAF Document Categorization Model, Which category describes a technique that is referenced by processes categorized as TOGAF Core and TOGAF Mandated?
A.TOGAF Guidelines and Techniques
B.TOGAF Recommended
C.TOGAF Supporting
D.TOGAF Extension
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 7
Which of the following reasons best describes why the ADM numbering scheme for versioning output is an example and not mandatory?
A.To show the evolution of deliverables
B.To permit adaptation as required
C.To enable use with the Architecture Content Framework
D.To support change management
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 8
According to TOGAF, where should architecture governance artifacts be stored?
A.In the Integrated Information Infrastructure Reference Model
B.In the Standards Information Base
C.In the Foundation Architecture
D.In the Architecture Repository
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 9
Which one of the following best describes the implications of TOGAF being a generic framework?
A.The organization must utilize an architecture tool in order to tailor the templates for use
B.It must be adapted to satisfy organization specific requirements
C.It can be utilized by most enterprises without further customization
D.It can only be used for enterprise level architecture projects
E. It should only be employed under the
supervision of highly trained consultants
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 10
Which of the following is the architecture domain that describes the logical software and hardware capabilities?
A.Application Architecture
B.Business Architecture
C.Data Architecture
D.Technology Architecture
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 11
Which section of the TOGAF document describes the processes, skills and roles to establish and operate an architecture function within an enterprise?
A.Part II: Architecture Development Method
B.Part III: ADM Guidelines and Techniques
C.Part IV: Architecture Content Framework
D.Part VI: TOGAF Reference Models
E.Part VII: Architecture Capability Framework
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 12
Which one of the following is NOT an element of an architecture framework?
A. A common vocabulary
B. A list of recommended standards
C. A method for designing an information system in terms of building blocks
D. A set of structuresWhichcan be used to develop a broad range of architectures
E. A system development lifecycle method for software engineering
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 13
Which one of the following describes classification methods for architecture and solution artifacts within the Architecture Repository?
A.Architecture Landscape
B.Architecture Vision
C.Enterprise Continuum
https://www.doczj.com/doc/b54590421.html,ernance Log
E.Standards Information Base
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 14
Complete the sentence. To promote effective architectural activity within the enterprise, TOGAF 9 recommends the establishment of a(n) _____
A.Enterprise Architecture Capability
B.IT Governing Board
C.Program Management Office
D.Quality Assurance department
E.Service Management department
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 15
According to the TOGAF Document Categorization Model, Which category is for resources NOT referenced by content within the other categories?
A.TOGAF Core
B.TOGAF Extension
C.TOGAF Mandatory
D.TOGAF Recommended
E.TOGAF Supporting
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 16
Which phase of the ADM is used to finalize a set of transition architectures that will support implementation?
A.Phase D
B.Phase E
C.Phase F
D.Phase G
E.Phase H
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 17
Complete the sentence. TOGAF 9 Part III provides techniques, such as developing principles and gap analysis, to support tasks within the ______
A.Architecture Capability Framework
B.Architecture Continuum
C.Architecture Development Method
D.Architecture Landscape
E.Architecture Repository
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 18
According to TOGAF, the recommended dimensions used to define the scope of an architecture include all the following, except:
A.Architecture Domains
B.Enterprise Focus
C.Level of Detail
D.Subject Matter
E.Time Period
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 19
What level of the Architecture Landscape provides a long-term summary view of the entire enterprise?
A.Capability Architecture
B.Operational Architecture
C.Segment Architecture
D.Strategic Architecture
E.Tactical Architecture
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 20
What part of the Architecture Repository holds specifications toWhich architectures must conform?
A.Standards Information Base
B.Enterprise Continuum
https://www.doczj.com/doc/b54590421.html,ernance Log
D.Architecture Landscape
E.Reference Library
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 21
An association of companies has defined a data model for sharing inventory and pricing information. Which of the following best describes where this model would fit in the Architecture Continuum?
A.Foundation Architecture
https://www.doczj.com/doc/b54590421.html,mon Systems Architecture
C.Industry Architecture
https://www.doczj.com/doc/b54590421.html,anization Specific Architecture
E.Product Line Architecture
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 22
In the Solutions Continuum, Which of the following is the correct order of Solutions from most-specific to most-generic?
https://www.doczj.com/doc/b54590421.html,mon Systems, Foundation, Industry, Organization-Specific
https://www.doczj.com/doc/b54590421.html,anization-Specific, Industry, Foundation, Common Systems
C.Foundation, Common Systems, Industry, Organization-Specific
D.Industry, Foundation, Common Systems, Organization-Specific
https://www.doczj.com/doc/b54590421.html,anization-Specific, Industry, Common Systems, Foundation
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 23
Which one of the following is a key objective of Phase A of the TOGAF ADM?
A.To create a roadmap that describes the evolution of the architecture over time
B.To prepare a Solution Architecture for the enterprise
C.To define an IT Strategy that maps out the technology infrastructure
D.To allocate the resources needed to implement the architecture project
E.To articulate an Architecture Vision
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 24
What document is used to initiate a TOGAF ADM cycle?
A.Architecture Roadmap
B.Statement of Architecture Work
C.Architecture Landscape
D.Request for Architecture Work
E.Architecture Vision
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 25
According to TOGAF, Which of the following is the usual approach for developing the Baseline Business Architecture if no architecture or few architecture assets exist?
A.Bottom up
B.Envisioning
C.Extensive
D.Refactoring
E.Top down
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 26
Which phase of the TOGAF ADM is the first phase directly concerned with the planning for the implementation of the target architecture(s)?
A.Phase D
B.Phase E
C.Phase F
D.Phase G
E.Phase H
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 27
Which phase of the ADM focuses on the governance and management of the Architecture Contracts that cover the overall implementation and deployment process?
A.Requirements Management
B.Phase E
C.Phase F
D.Phase G
E.Phase H
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 28
Complete the sentence. A server consolidation project that does not change the operating characteristics of the applications would require _____.
A. a complete ADM cycle
B. a complete re-architecting change
C. a full revision of the enterprise architecture
D.an incremental change
E. a simplification change
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 29
Which one of the following is an objective of the Preliminary Phase of the ADM?
A.To define, scope and prioritize architecture tasks
B.To define the architecture principles
C.To develop a Target Business Architecture
D.To obtain management commitment for this cycle of the ADM
E.To prioritize work packages
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 30
In the Preliminary Phase, Which of the following drives the requirements and performance metrics when scoping the enterprise architecture work?
A.Architecture governance
B.Business imperatives
C.Solution architecture
D.Service level agreements
E.Time horizon
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 31
The Requirements Management Phase is responsible forWhich one of the following activities?
A.Addressing requirements
B.Disposal of resolved requirements
C.Generating requirements
D.Managing the flow of requirements
E.Prioritizing requirements
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 32
Complete the sentence. The Business Transformation Readiness Assessment technique is primarily focused on ___
A.determining if the organization is ready to accept change
B.planning the migration steps needed to achieve the transformation
C.ensuring that there are adequate trained developers and engineers to implement the solution
D.ensuring that there is sufficient financial capacity to execute the desired transformation
E.determining if there is adequate stakeholder support for the implementation process
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 33
Which of the following statements does NOT correctly describe Architecture Principles?
A.They are most effective when they are embraced and used across the organization
B.They are based on enterprise principles
C.They are detailed policies that prescribe behaviors and requirements
D.Even though they may appear generic, they should be tailored to reflect an organization's culture and
goals
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 34
Complete the sentence. All of the following are sections of the recommended template for defining Architecture Principles, except ___________
https://www.doczj.com/doc/b54590421.html,
B.Statement of Principle
C.Rationale
D.Enforcement Policy
E.Implications
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 35
Which one of the following lists the five quality criteria for defining Architecture Principles?
A.Rational, Explained, Precise, Stated, Identifiable
https://www.doczj.com/doc/b54590421.html,prehensive, Future proof, Short, Concise, Consistent
C.Open, Enabling, Flexible, Agile, Dynamic
D.Stable, Understandable, Complete, Robust, Consistent
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 36
Complete the sentence. The key purpose of Gap Analysis is to _____
A.establish quality parameters for the architecture
B.identify potential missing or overlapping functions
C.validate nonfunctional requirements
D.identify commercial building blocks to be purchased
E.determine the required service levels for the architecture
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 37
Complete the sentence. In a gap analysis, a building block that appears in the Target Architecture but does not appear in the Baseline Architecture indicates _____
A.nonconformant solution building blocks
B.an error has occurred and the architecture must be re-evaluated
C.requirements have not been properly documented
D.functionality that should be eliminated
E. a new function that must be built or procured
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 38
Complete the sentence. All of the following are parts of the conceptual structure of the TOGAF Architecture Governance Framework, except ______
A.Content
B.Context
C.Process Flow Control
D.Repository
E.Vision
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 39
Complete the sentence. The Architecture Board is typically responsible and accountable for achieving all of the following goals except ___________
A.ensuring consistency between sub-architectures
B.approving the strategic business plans proposed by individual organization units within the enterprise
C.enforcement of architecture compliance
D.identifying and approving components for reuse
E.providing the basis for all decision-making with regard to changes to the architecture
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 40
Which of the following best describes the purpose of an architecture compliance review?
A.To review the validity of a project's Architecture Vision
B.To review a project for compliance to external laws and regulations
C.To review a project against established architecture criteria and business objectives
D.To ensure that stakeholder concerns are being addressed by a project
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 41
TOGAF provides guidelines on how to use the ADM to establish an architecture capability.Which one of the following is NOT a correct guideline?
https://www.doczj.com/doc/b54590421.html,e the same approach as with any other capability
B.Regard the establishment as an ongoing practice
C.Apply the ADM with the specific vision to establish the practice
D.Treat the establishment as a one-off project
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 42
Which one of the following is defined by TOGAF as: the fundamental organization of a system embodied in its components, their relationship to each other, and the principles guiding its design and evolution?
A.Architecture
B.Metamodel
C.Model
D.Ontology
E.Pattern
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 43
Complete the sentence. In TOGAF, architecture viewpoints represent ______
A.observations of the CIO/CTO
B.opinions of the sponsors
C.observations of the architect staff
D.concerns of stakeholders
E.stakeholder requirements
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 44
Which one of the following statements about TOGAF Building Blocks is NOT true?
A.They should not be reused in other enterprise architecture projects
B.They should have stable, published interfaces that allow other building block to interoperate with them
C.They are packages of functionality intended to meet the business needs across the organization
D.They have defined boundaries
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 45
Which pair of the following responses best completes the sentence? Architecture building blocks ____, where as Solution Building blocks ____
A.are assembled; are single function components
B.are single function components; are groups of architecture building blocks
C.are reusable; are not reusable
D.define the architecture; provide the existing legacy system
E.define functionality; define the implementation of functionality
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 46
According to TOGAF, Which of the following best describes the purpose of the Architecture Definition Document?
A.An agreement between development partners and sponsors on the deliverables
B. A description to allow measurement of the compliance of the implementation
C. A description to communicate the intent of the architect
D. A document that triggers the start of an architecture development cycle
E. A set of general rules and guidelines
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 47
According to TOGAF, who usually initiates a Request for Architecture Work?
A.The architecture organization
B.The CIO/CTO
C.The corporate governance board
D.The senior management
E.The sponsoring organization
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 48
Which of the following is a true statement about the TOGAF Technical Reference Model?
A.The TOGAF Architecture Development Method mandates the use of the Technical Reference Model
for large complex architecture projects
B.The Technical Reference Model is an integral part of the TOGAF Architecture Development Method
C.The Technical Reference Model should not be modified
D.The Technical Reference Model includes a set of graphical models and a corresponding taxonomy
E.The Technical Reference Model provides a direct mapping to the Zachman Framework
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 49
Complete the sentence. The Integrated Information Infrastructure Reference Model (III-RM) is an example of a (n) ______ Architecture reference model
A.Application
B.Business
C.Data
D.Technology
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 50
Complete the sentence. According to TOGAF, the simplest way of thinking about the Enterprise Continuum is as a _____
A.Configuration Database
B.library of architecture artifacts
C.Requirements Management System
D.Standards Information Base
E.view of the Architecture Repository
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 51
What class of architectural information within the Architecture Repository defines processes that support governance of the Architecture Repository?
A.Architecture Capability
B.Architecture Landscape
C.Architecture Metamodel
https://www.doczj.com/doc/b54590421.html,ernance Log
E.Reference Library
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 52
Which one of the following is the most generic artifact in the Architecture Continuum?
https://www.doczj.com/doc/b54590421.html,mon Systems Architecture
B.Foundation Architecture
C.Industry Architecture
https://www.doczj.com/doc/b54590421.html,anization Specific Architecture
E.Product Line Architecture
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 53
Complete the sentence. As the architecture evolves, the assets in the Solutions Continuum progress towards a (n) _____
https://www.doczj.com/doc/b54590421.html,mon Systems Architecture
B.Industry Specific Architecture
C.Foundation Solution
https://www.doczj.com/doc/b54590421.html,anization Specific Solution
E.Technology Neutral Implementation
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 54
In which ADM phase are the business principles, business goals and strategic drivers first validated?
A.Preliminary Phase
B.Phase A
C.Phase B
D.Phase H
E.Requirements Management Phase
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 55
Which one of the following best describes a primary use of the Architecture Vision document?
A. A checklist for compliance reviews
B.An evaluation tool to select vendors to conduct a proof of concept demonstration
C. A tool for calculating detailed cost estimates
D. A tool for project planning the implementation activities
E. A tool for selling the benefits of the proposed capability to stakeholders
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 56
Which of the following is NOT an objective for Phase B, Business Architecture?
A.Defining the Strategic Business Plan
B.Describing the Baseline Business Architecture
C.Developing the Target Business Architecture
D.Selecting relevant viewpoints for key stakeholders
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 57
Which one of the following is NOT an objective for Phase C, Data Architecture?
A.Defining an architecture that can be understood by the stakeholders
B.Defining an architecture that is complete and consistent
C.Defining an architecture that is stable
D.Defining data entities that are normalized to minimize update anomalies
E.Defining data entities relevant to the enterprise
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 58
Which one of the following is the most relevant model for use in Phase C, Application Architecture?
A.The ARTS data model
B.The Integrated Information Infrastructure Reference Model
C.The Resource-Event-Agent model
D.The STEP framework
E.The TOGAF Technical Reference Model
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 59
In Phase G, What document establishes the connection between the architecture organization and the implementation organization?
A.Architecture Contract
B.Architecture Landscape
C.Architecture Roadmap
D.Requirements Impact Statement
E.Transition Architecture
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 60
Which one of the following is NOT part of the approach to Phase H Architecture Change Management?
A.Business Scenarios
B.Capacity Measurement
C.Change Management
D.Measuring Business Growth
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 61
When determining the requirements for enterprise architecture work in the Preliminary Phase, Which of the following is not a business imperative that should be considered?
A.Business requirements
B.Cultural aspirations
C.Forecast financial requirements
D.Strategic Intent
E.Technical elegance
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 62
Which phase of the ADM is an on-going activity that is visited throughout a TOGAF architecture project?
A.Architecture Change Management
B.Implementation governance
C.Migration planning
D.Preliminary Phase
E.Requirements Management
Correct Answer: E
Section: (none)
Explanation
Explanation/Reference:
QUESTION 63
Which of the following statements best describes risk management in the ADM?
A.Risk analysis is best conducted in the Architecture Vision phase so that the risk is eliminated in
subsequent phases
B.Risk analysis should be carried out first in the Migration Planning phase
C. Risk analysis is outside the
scope of enterprise architecture projects
C.Risk is pervasive in all enterprise architecture activity and should be managed in all phases of the ADM
D.The only risks that are within the scope of enterprise architecture are technological risks
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 64
Which of the following best describes capability based planning?
A. A business planning technique that focuses on business outcomes
B. A business planning technique that focuses on horizontal capabilities
C. A business planning technique that focuses on vertical capabilities
D. A human resource planning technique that focuses on capable architects
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 65
Which of the following is a technique recommended by TOGAF to help identify and understand requirements?
A.Architecture Maturity Models
B.Business Scenarios
C.Gap Analysis
D.Mind Maps
E.SWOT Analysis
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 66
Which one of the following provides a foundation for making architecture and planning decisions, framing policies, procedures, and standards, and supporting resolution of contradictory situations?
A.Architecture principles
B.Buy lists
C.Procurement policies
D.Requirements
E.Stakeholder concerns
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 67
Which one of the following is recommended to define requirements and articulate the Architecture Vision created in Phase A?
A.Business scenario
B.Impact analysis
C.Mission statement
D.Requirements analysis
E.Solution architecture
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 68
Gap Analysis is a technique used in Phases B, C, D and E.Which one of the following statements best describes the gap analysis technique?
A.It highlights areas of stakeholder concern
B.It highlights the impacts of change
C.It highlights services that are yet to be developed
D.It highlights services that are available
E.It highlights different viewpoints
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
P109 企业风险管理—整合框架和内部控制—整合框架之间的关系 1992年，COSO（反虚假财务报告委员会的赞助组织委员会）发布了《内部控制—整合框架》，该框架建立了内部控制结构，并提供评价工具，从而使企业和其他主体可以评估其控制系统。该框架定义了有效进行内部控制的五个相互关联的要素。 内部控制—整合框架将内部控制定义为一个过程，该控制过程受到企业董事会、管理层和全体职工的影响，旨在提供合理保证，以实现下列目标： ?经营的效率和效果 ?财务报告的可靠性 ?法律法规的遵循性 本附录概述了内部控制框架和企业风险管理框架之间的关系。 对内部控制的拓展 内部控制是企业风险管理的主要组成部分。相比较而言，企业风险管理的内容则更为深入，它扩展和详述了内部控制的范畴，这使企业风险管理成为了更加全面关注风险的更加健全的概念。由于企业主体和其他组织只关注自身的内部控制，从而使内部控制—整合框架仍然有重要的影响。 目标分类 内部控制—整合框架细分了三种目标—运营目标，财务报告目标和合规性目标。企业风险管理也细分了三种类似的目标类别—运作目标，报告目标和合规目标。在内部控制框架中，报告类别被认为与公布的财务报表的可靠性相关。在企业风险管理框架中，报表的范畴被明显的扩展，涉及了主体编制的所有在内部和外部使用的报表。包括管理层内部使用的报告和那些对外发布的报告,以及给其他利益相关者的报告和监管申报材料等, 其范围也从财务报表拓展为不仅包含更加广泛的财务信息,而且还包含非财务信息。 P110 企业风险管理—整合框架增加了一个高层次的目标，即战略目标。战略目标来源于主体的规划，同时运营、报表和合规性的目标都要与之一致。企业风险管理被应用于战略制定以及其他三类目标的实现。 企业风险管理框架还引入了风险偏好和风险承受能力的概念。风险偏好是在主体实现目标或制定规划过程中所愿意承担的广义风险的数量，它为战略制定及相关目标的实现提供了参考。在确定风险承受能力过程中，管理层需考虑相关目标的重要性，并将其与企业风险偏好相协调。在风险承受能力范围内经营有助于确保该主体能保持在它的风险偏好之内，进而确保该主体将会实现其目标 风险组合观点 风险组合未包含在内部控制框架之内。对企业内每个单位而言，其风险可能落在该单位的风险容忍度范围内，但从企业总体来看，总风险可能超过企业总体的风险偏好范围。因此，应从企业总体的风险组合的观点看待风险。 组成部分 在加强关注风险的同时，企业风险管理框架将内部控制的风险评估扩展为四个组成部分—目标设定（内部控制的先决条件）、事项识别、风险评估和风险应对。 内部环境 在论述环境组成方面，企业风险管理框架讨论了一种主体风险管理理念，即一整套共同的信念和态度。描述了主体如何考虑风险，反映了它的价值观，并影响其文化和经营风格。如上所述，此框架包含了风险偏好的概念，风险承受能力更加明确的印证了这一点。 考虑到董事会的决定性作用及其构成，为了使企业风险管理更加有效，企业风险管理框架将
1 智慧城市安全体系框架 智慧城市安全体系框架以安全保障措施为视角，从智慧城市安全战略保障、智慧城市安全技术保障、智慧城市安全管理保障、智慧城市安全建设运营保障和智慧城市安全基础支撑五个方面给出了智慧城市安全要素，如图1所示。 图1 智慧城市安全体系框架 a)智慧城市安全战略保障 智慧城市安全战略保障要素包括国家法律法规、政策文件及标准规范。通过智慧城市安全战略保障可以指导和约束智慧城市的安全管理、技术与建设运营活动。 b)智慧城市安全管理保障 智慧城市安全管理保障是实现智慧城市协调管理、协同运作、信息融合和开放共享的关键。本标准参考了信息安全管理体系并结合智慧城市特征，梳理出智慧城市安全管理要素，包括决策规划、组织管理、协调监督、评价改进。 c)智慧城市安全技术保障
智慧城市安全技术保障以建立城市纵深防御体系为目标，从物联感知层、网络通信层、计算与存储层、数据及服务融合层以及智慧应用层五个层次采用多种安全防御手段实现对系统的防护、检测、响应和恢复，以应对智慧城市安全技术风险。智慧城市安全技术保障的功能要素包括防护、检测、响应和恢复。 ——物联感知层安全涉及了关键信息基础设施领域，例如，天气、水、电、气、交通、建筑等重要控制系统中感知设备和执行设备的安全。 ?感知设备安全是保证智慧城市应用于实现基础设施、环境、设备和人员的识别和信息采集与监控的设备，保证信息采集安全，实时为上层提供准确感知数据。 ?执行设备安全是保证应用于智慧城市的基础设施、环境、设备和人员等要素管理和控制过程的执行设备按照既定的指令提供正常的功能。 ——网络通信层安全包含了互联网、电信网、卫星通信网络以及多网融合的网络设施和通信传输的安全，还包含了智慧城市用户网络接入安全。 ——计算与存储层安全包括计算资源安全、软件资源安全以及存储安全。 ?计算资源安全是指可提供数据计算能力物理的计算机、服务器设备和虚拟化安全。 ?软件资源安全是指可为上层数据和应用提供公共服务能力的基础软件，包括操作系统、数据库系统、中间件和资源管理软件等的安全。 ?存储资源安全是指可提供物理和虚拟的数据存储和数据保护能力的服务器安全。 ——数据及服务融合层安全包含了数据内容安全、数据融合安全和服务融合安全。 ?数据内容安全是指不同行业数据信息内容本身的安全。 ?数据融合安全是指数据融合过程中从数据采集与汇聚、数据整合与处理、数据挖掘与分析、数据管理与治理过程的安全。 ?服务融合安全是指支撑智慧城市应用的基础技术服务在融合过程中包括服务聚集、服务管理、服务整合和服务使用的安全。 ——智慧应用层安全包含了智慧城市中多领域和产业的应用系统的安全、应用软件、网站安全、应用开发安全等。 d)智慧城市安全建设运营保障 智慧城市安全建设运营保障是指对智慧城市关键信息基础设施中系统和网络、城市信息资产、智慧城市公共基础信息平台以及业务安全工程建设以及运行状态的监测与维护。确保在智慧城市建设运营过程中智慧城市基础设施、智慧城市信息平台、应用系统及其运行环境和状态发生变化时，
COSO风险管理框架中文版 概览 一些公司和企业的管理者已经在企业内部建立了一系列确认和管理风险的过程，而现在有许多企业也已经开始或正在考虑建立自己的确认和管理风险的过程。虽然管理者已经掌握了大量的企业风险管理的信息（包括大量公开出版的文献），但实务中却并不存在统一的术语，而且也很少有普遍接受的原则可供管理者在构建一个有效的风险管理框架时作为指南。 COSO 委员会已经认识到对企业风险管理概念性指南的需要，因而该委员会发起了一个建立一个概念性的、适当的风险管理框架的计划，旨在支持企业建立或评判企业风险管理过程的项目提供完整的原则、能用的术语和实务操作指南。另一相关的目标是使构建的这个框架可以作为管理者、董事、主管人员、学者和其他相关人员更好地理解企业风险管理及其优点和局限性提供一个统一的基础，以便在风险管理问题方面进行有效地交流。 本概览列出了企业风险管理框架的关键内容，包括企业风险管理的定义、内容和基本原则，风险管理的优点、局限性以及各相关方的地位和职责。本概览还强调企业风险管理的相关性和其与COSO 内部控制报告的关系。如果想更加深入地了解有关知识，请看企业风险管理框架的全文。 （一）企业风险管理的相关性 企业风险管理的基本前提是每一个企业，无论是盈利组织、非盈利组织，还是政府机构，其存在的目的都是为其利益相关方带来价值。所有的企业都要面对不确定性。对企业管理者而言，所面临的挑战是在追求企业利益相关方价值增长的同时，决定企业准备接受的不确定性的程度。不确定性既代表风险，也代表机遇，既存在使企业增值的可能，也存在使企业减值的风险。风险管理框架就是为管理者提供一个框架，使其能够有效处理不确定性及相应的风险和机遇，进而提高企业创造价值的能力。 1．不确定性 企业经营的环境中有许多因素都会给企业带来不确定性，如全球化、技术、法规、企业重构、多变的市场以及竞争等。不确定性来源于无法明确地决定潜在事项将要发生的可能性及其相应结果。 2．价值 从战略的制定到企业的日常经营，管理者的决策会创造、保持或减少企业的价值。决策的本质就是确认风险和机遇，它要求企业的管理1应在考虑企业内、外部环境的因素的基础上，对企业的稀缺资源进行配置，并且根据环境的不断变化来调整企业的活动。 当企业的利益相关方取得其相应价值的可确认收益时，企业的价值也得到实现。对于公司而言，当股东承认由于股价上扬所带来的价值时，他们也就承认了企业的价值。对于政府机构，当该机构以一个可接受的成本所提供的服务的收益得到确认时，机构的价值就得以实现。对于非盈利组织的利益相关方而言，当他们确认组织所提供的社会福利的价值时，他们也就承认了该组织的价值。企业风险管理使管理者能够创造持久的价值并能够将创造价值的信息传递给利益相关方。 3．企业风险管理的优点 所有企业都是在有风险的环境下经营，而不是企业风险管理使企业面临这样的环境。企业风险管理是使管理者能够在充满风险的环境中更加有效地经营。 企业风险管理使企业的管理者能够： （1）将风险偏好和企业的战略结合在一起。 从广义来讲，风险偏好是一个公司或企业在追求其目标的过程中愿意接受的风险的程度。管理者在评估企业的战略方案时首先要考虑企业的风险偏好，其后，在制定与企业战略相对应的目标和建立一定的机制管理相应的风险时也应考虑企业的风险偏好。 （2）将企业成长、风险和收益联系起来 经济主体在企业价值保值、增值的过程中也要接受相应的风险，同时预期补偿风险的相应收益。企业风险管理提高了企业确认和评估风险的能力，进而使企业能够确定相对于企业成长性和收益目标而言的风险的可接受水平。 （3）增加风险反应决策
当今时代是一个自动化时代，交通灯控制等很多行业的设备都与计算机密切相关。因此，一个好的交通灯控制系统，将给道路拥挤、违章控制等方面给予技术革新。随着大规模集成电路及计算机技术的迅速发展，以及人工智能在控制技术方面的广泛运用，智能设备有了很大的发展，是现代科技发展的主流方向。本文介绍了一个智能交通灯系统的设计。该智能交通灯控制系统可以实现的功能有：对某市区的四个主要交通路口进行监控；各路口有固定的工作周期，并且在道路拥挤时中控中心能改变其周期；对路口违章的机动车能够即时拍照，并提取车牌号。在世界范围内，一个以微电子技术，计算机和通信技术为先导的，以信息技术和信息产业为中心的信息革命方兴未艾。而计算机技术怎样与实际应用更有效的结合并有效的发挥其作用是科学界最热门的话题，也是当今计算机应用中空前活跃的领域。本文主要从单片机的应用上来实现十字路口交通灯智能化的管理，用以控制过往车辆的正常运作。 The times is a automation times nowadays , traffic light waits for much the industry
equipment to go hand in hand with the computer under the control of. Therefore, a good traffic light controls system , will give road aspect such as being crowded , controlling against rules to give a technical improvement. With the fact that the large-scale integrated circuit and the computer art promptness develop, as well as artificial intelligence broad in the field of control technique applies, intelligence equipment has had very big development , the main current being that modern science and technology develops direction. The main body of a book is designed having introduced a intelligence traffic light systematically. The function being intelligence traffic light navar's turn to be able to come true has: The crossing carries out supervisory control on four main traffic of some downtown area; Every crossing has the fixed duty period , charges centre for being able to change it's period and in depending on a road when being crowded; The motor vehicle breaking rules and regulations to the crossing is able to take a photo immediately , abstracts and the vehicle shop sign. Within world range, one uses the microelectronics technology , the computer and the technology communicating by letter are a guide's , centering on IT and IT industry information revolution is in the ascendant. But, how, computer art applies more effective union and there is an effect's brought it's effect into play with reality is the most popular topic of conversation of scientific community , is also that computer applications is hit by the unparalleled active field nowadays. The main body of a book is applied up mainly from slicing machine's only realizing intellectualized administration of crossroads traffic light , use opera tion in controlling the vehicular traffic regularity.
COSO内部控制整体框架简介 1992年美国反虚假财务报告委员会管理组织（COSO）发布了《内部控制—综合框架》以帮助企业和其他实体评估并加强内部控制系统。此后，《内部控制—综合框架》被首席执行官、理事会成员、监管者、准则制定者、职业组织以及其他人士视为内部控制方面合理的综合框架。 同时，财务报告和相关立法以及监管环境也发生了变革。值得注意的是，2002年美国颁布了《萨班斯法案》。其中，《萨班斯法案》第404号条款要求公众公司管理层每年对其财务报告内部控制的效果进行评估和报告。 随着情况的发展和时间的推移，这项框架到今天仍然是有效的，遵从《萨班斯法案》第404号条款的各种规模的公众公司管理层仍继续沿用。然而，较小型公众公司在面对执行第404号条款的挑战时，承受了意料之外的成本。为了指导较小型公众公司执行第404条款，美国反虚假财务报告委员会管理组织于2006年发布了《较小型公众公司财务报告内部控制指南》（以下简称《指南》）。 《指南》并非是对《内部控制—综合框架》的取代亦或修改，而是就如何应用提供了指导。就如何按照成本效率原则使用《内部控制—综合框架》设计和执行财务报告内部控制方面，《指南》为较小型公众公司提供了指导（当然《指南》也同样适用于大型公司）。尽管《指南》本意上是为了帮助管理层建立和维持财务
报告内部控制的有效性而制定的，但它同样有助于管理层按照监管者的评估要求对内部控制效果进行更有效率地评估。 《指南》分为三部分，第一部分是概要，向公司董事会和高层管理人员介绍了整个文件的主要内容。 第二部分介绍了较小型公众公司在财务报告内部控制方面的主要观点，其中描述了公司的特征，这些特征是如何影响内部控制的、较小型公众公司面临的挑战以及管理层如何使用《内部控制—综合框架》。此外，还从《内部控制—综合框架》中提炼了20个基本原则，并介绍了较小型公众公司以符合成本效率的方式应用这些原则的相关态度、方法和实例。 第三部分提供了解释性工具以帮助管理层对内部控制进行评估。管理者可能会使用这些解释性工具以确定公司是否已有效地应用了这些原则。 高层管理人员将对第一部分“概要”和第二部分“主要观点”的概述章节比较感兴趣，并在必要的情形下参考第二部分的其它章节，而其他管理人员将把第二部分“主要观点”和第三部分“解释性工具”作为指导其具体工作的指南。 一、“较小型”公众公司的特征 尽管人们希望能够在小型、中型和大型公司之间划定一条的“清晰的界限”，但《指南》并未提供此类定义。它使用了“较小型公众公司”而非“小型公众公司”，这意味着《指南》适用于更大范围内的公司。《指南》对“较小型公众公司”的特征作
英文 Because of the rapid development of our economy resulting in the car number of large and medium-sized cities surged and the urban traffic, is facing serious test, leading to the traffic problem increasingly serious, its basically are behaved as follows: traffic accident frequency, to the human life safety enormous threat, Traffic congestion, resulting in serious travel time increases, energy consumption increase; Air pollution and noise pollution degree of deepening, etc. Daily traffic jams become people commonplace and had to endure. In this context, in combination with the actual situation of urban road traffic, develop truly suitable for our own characteristics of intelligent signal control system has become the main task. Preface In practical application at home and abroad, according to the actual traffic signal control application inspection, planar independent intersection signal control basic using set cycle, much time set cycle, half induction, whole sensor etc in several ways. The former two control mode is completely based on planar intersection always traffic flow data of statistical investigation, due to traffic flow the existence of variable sex and randomicity, the two methods have traffic efficiency is low, the scheme, the defects of aging and half inductive and all the inductive the two methods are in the former two ways based on increased vehicle detector and according to the information provided to adjust cycle is long and green letter of vehicle, it than random arrived adaptability bigger, can make vehicles in the parking cord before as few parking, achieve traffic flowing effect In modern industrial production,current,voltage,temperature, pressure, and flow rate, velocity, and switch quantity are common mainly controlled parameter. For example: in metallurgical industry, chemical production, power engineering, the papermaking industry, machinery and food processing and so on many domains, people need to transport the orderly control. By single chip microcomputer to control of traffic, not only has the convenient control, configuration simple and flexible wait for an advantage, but also can greatly improve the technical index by control quantity, thus greatly improve product quality and quantity. Therefore, the monolithic integrated circuit to the traffic light control problem is an industrial production we often encounter problems. In the course of industrial production, there are many industries have lots of traffic equipment, in the current system, most of the traffic control signal is accomplished by relays, but relays response time is long, sensitivity low, long-term after use, fault opportunity increases greatly, and adopts single-chip microcomputer control, the accuracy of far greater than relays, short response time, software reliability, not because working time reduced its performance sake, compared with, this solution has the high feasibility. About AT89C51 (1)function characteristics description: AT89C51 is a low power consumption, high performance CMOS8 bit micro-controller, has the 8K in system programmable Flash memory. Use high-density Atmel company the beltpassword nonvolatile storage technology and manufacturing, and industrial 80S51 product instructions and pin fully compatible. Chip Flash allow program memory in system programmable, also suitable for conventional programmer. In a single chip, have dexterous 8 bits CPU and in system programmable Flash, make AT89C51 for many embedded control application system provides the high flexible, super efficient solution. AT89C51 has the following standard function: 8k bytes Flash, 256 bytes RAM, 32-bit I/O mouth line, the watchdog timer, two data pointer, three 16 timer/counter, a 6 vector level 2 interrupt structure, full-duplex serial port, piece inside crystals timely clock circuit. In addition, AT89C51 can drop to 0Hz static logic operation, support two software can choose power saving mode. Idle mode, the CPU to stop working, allowing the RAM, timer/counter, serial ports, interruption continue to work. Power lost protection mode, RAM content being saved, has been frozen, microcontroller all work stop, until the next interruption or hardware reset so far. As shown in
c o s o企业风险管理整合 框架 集团标准化办公室：[VV986T-J682P28-JP266L8-68PNN]
公司治理·内部控制前沿译丛 企业风险管理——整合框架 （美）COSO 制定发布 方红星王宏译 大连 制定发布机构简介 COSO是Treadway委员会（Treadway Commission，即反欺诈财务报告全国委员会（National Commission on Fraudulent Financial Reporting），通常根据其首任主席的姓名而称为Treadway委员会）的发起组织委员会（Committee of Sponsoring Organizations）的简称。Treadway委员会由美国注册会计师协会（AICPA）、美国会计学会（AAA）、国际财务经理协会（FEI）、内部审计师协会（IIA）和管理会计师协会（IMA）等5个组织于1985年发起成立。1987年，Treadway委员会发布一份报告，建议其发起组织共同协作，整合各种内部控制的概念和定义。1992年，COSO发布了着名的《内部控制——整合框架》（1994年作出局部修订），成为内部控制领域最为权威的文献之一。2003年7月，COSO发布了《企业风险管理——整合框架（征求意见稿）》，经过一年多的意见反馈、研究和修改，2004年9月发布了最终的文本。本书就是按照2004年9月正式发布的文本进行翻译的。 译者简介
方红星，东北财经大学会计学院教授，博士，兼任东北财经大学出版社社长，编审，东北财经大学内部控制与风险管理研究中心研究员，三友会计研究所所长。主要学术兼职有财政部会计准则委员会咨询专家、中国会计学会理事、中国成本研究会理事、中国注册会计师审计准则组成员、中国会计学会财务成本分会常务理事及多家学术期刊编委。 王宏，西南财经大学会计学院博士研究生，现就职于财政部会计司综合处，近年来主要致力于内部会计控制等方面的理论和政策研究。 中文版前言 在内部控制和风险管理的演进过程之中，COSO的突出贡献是举世公认的。它在1992年所发布的、并于1994年作出局部修正的《内部控制——整合框架》，已经成为世界通行的内部控制权威文献，被国际和各国审计准则制定机构、银行监管机构和其他方面所采纳。 2003年7月，COSO发布了《企业风险管理——整合框架》的征求意见稿，引起了广泛的关注，我国也有一些学者撰文介绍了相关的情况。诚然，企业风险管理整合框架并没有立即取代内部控制整合框架，但是它涵盖和拓展了后者。因此，对新的框架进行深入研究和探讨，具有十分重要的价值。2004年9月，正式的最终文本发布之后，由于着作权保护和其他方面的原因，在国内很难取得该框架最终定稿的版本。而许多学者继续按照征求意见稿来进行转述、介绍和研究，已经显得不合适了。为此，我们通过积极联络和多方努力，最终获得了正式授权，得以将这份重要的文献翻译成中文并在国内公开出版。 长期以来，尤其是在2001年前后一系列令人瞩目的公司丑闻爆发之后，关于内部控制的研究和立法行动深受社会各界的重视和关注，我国也概莫能外。我国的有关部门在几年前就已经开始了制定企业内部会计控制规范的积极尝试。目前，关于研究和制定企业内部控制指
《网络安全技术》考试题库 1. 计算机网络安全所面临的威胁分为哪几类？从人的角度，威胁网络安全的因素有哪些？ 答：计算机网络安全所面临的威胁主要可分为两大类：一是对网络中信息的威胁，二是对网络中设备的威胁(2分)。从人的因素考虑，影响网络安全的因素包括：（1）人为的无意失误。(1分) （2）人为的恶意攻击。一种是主动攻击，另一种是被动攻击。(1分) （3）网络软件的漏洞和“后门”。 (1分) 2．网络攻击和防御分别包括哪些内容？ 答:网络攻击：网络扫描、监听、入侵、后门、隐身； 网络防御：操作系统安全配置、加密技术、防火墙技术、入侵检测技术。 4.分析TCP/IP协议，说明各层可能受到的威胁及防御方法。 答：网络层：IP欺骗欺骗攻击，保护措施：防火墙过滤、打补丁；传输层：应用层：邮件炸弹、病毒、木马等，防御方法：认证、病毒扫描、安全教育等。6．请分析网络安全的层次体系。 答：从层次体系上，可以将网络安全分成四个层次上的安全：物理安全、逻辑安全、操作系统安全和联网安全。 7.请分析信息安全的层次体系。 答：信息安全从总体上可以分成5个层次：安全的密码算法，安全协议，网络安全，系统安全以及应用安全。 10.请说明“冰河”木马的工作方式。 答：病毒通过修改系统注册表，通过执行文本文件的双击打开操作，驻留病毒程序，伺机实现远端控制目的。 【应用题】 1.简述防范远程攻击的技术措施。 答：防范远程攻击的主要技术措施有防火墙技术、数据加密技术和入侵检测技术等。(2分) （1）防火墙技术。用来保护计算机网络免受非授权人员的骚扰和黑客的入侵。(1分) （2）数据加密技术。数据加密技术已经成为所有通信安全的基石。(1分) （3）入侵检测技术。是一种防范远程攻击的重要技术手段，能够对潜在的入侵动作做出记录，并且能够预测攻击的后果。(1分) 2.防范远程攻击的管理措施有那些？ 答：防范远程攻击的管理措施： (1) 使用系统最高的安全级别。高安全等级的系统是防范远程攻击的首选。(2分) (2) 加强内部管理。为对付内部产生的黑客行为，要在安全管理方面采取措施。(2分) (3) 修补系统的漏洞。任何系统都是有漏洞的，应当及时堵上已知的漏洞并及时发现未知的漏洞。(1分) 3.简述远程攻击的主要手段。 答：远程攻击的手段主要有： （1）缓冲区溢出攻击。(1分) （2）口令破解。又称口令攻击，口令是网络安全防护的第一道防线。(1分) （3）网络侦听。是指在计算机网络接口处截获网上计算机之间通信的数据。(1分) （4）拒绝服务攻击。是一种简单的破坏性攻击。(1分) （5）欺骗攻击。(1分) 4. 简述端口扫描技术的原理。 答：端口扫描向目标主机的TCP/IP服务端口发送探测数据包，并记录目标主机的响应(1分)。通过分析响应来判断服务端口是打开还是关闭，就可以得知端口提供的服务或信息(1分)。端口扫描也可以通过捕获本地主机或服务器的注入/流出IP数据包来监视本地主机运行情况(1分)。端口扫描只能对接收到的数据进行分析，帮助我们发现目标主机的某些内在的弱点，而不会提供进入一个系统的详细步骤。 (2分) 5. 缓冲区溢出攻击的原理是什么？ 答：缓冲区溢出攻击指的是一种系统攻击的手段，通过往程序的缓冲区写超出其长度的内容，造成缓冲区的溢出，从而破坏程序的堆栈，使程序转而执行其他指令，以达到攻击的目的。(3分) 缓冲区溢出攻击最常见的方法是通过使某个特殊程序的缓冲区溢出转而执行一个Shell，通过Shell的权限可以执行高级的命令。如果这个特殊程序具有System 权限，攻击成功者就能获得一个具有Shell权限的Shell，就可以对系统为所欲为了。(2分) 7.简述暴力攻击的原理。 答：使用穷举法破译密码等信息的一种方法，如：字典攻击、破解操作系统密码、破解邮箱密码、破解软件密码等。 9.简述缓冲区溢出的攻击原理。 答：当目标系统收到了超过其可接收的最大信息量时，会发生缓冲区溢出。易造成目标系统的程序修改，由此产生系统后门。 10.简述拒绝服务的种类和原理。 答：拒绝服务攻击主要是计算机网络带宽攻击和连通性攻击。通过耗用有限计算机资源，使得目标主机无法提供正常网络服务。 11.简述DDoS的特点及常用攻击手段。 答：攻击计算机控制着多台主机，对目标主机实施攻击，大量瞬时网络流量阻塞网络，使得目标主机瘫痪。12.留后门的原则是什么？ 答：原则就是让管理员看不到有任何特别的地方。13.列举后门的三种程序，并阐述其原理和防御方法。 答：1）远程开启TELNET服务（RTCS.VBE）工具软）件，防御方法：注意对开启服务的监护；2）建立WEB和TELNET服务（WNC.EXE），防御方法：注意对开启服务的监护；3）让禁用的GUEST用户具有管理权限（PSU.EXE 修改注册表），防御方法：监护系统注册表。 14.简述木马由来及木马和后门的差异。 答：木马是一种可以驻留在对方服务器系统中的程序（服务器端、客户端），其功能是通过客户端控制驻留在对方服务器中的服务器端。木马功能较强，具有远程控制功能，后门功能单一，只提供登录使用。 16.简述两种通过UNICODE漏洞，进行攻击的方式。
风险控制体系 第一部分：风险类别 依照风险的内容和来源，根据《中央企业全面风险管理指引》将企业风险分为：1．战略风险 2．财务风险 3．市场风险 4．运营风险 5．法律风险 结合我司现发展阶段，将公司风险控制系统主要划分为两大板块，即公司内部风险控制体系与公司业务风险控制体系。
? ?第二部分：内部控制体系的建立
一、战略风险控制 （详见行业分析调研报告） 二、财务风险控制 （详见公司财务管理制度） 三、运营风险控制 （详见公司各项管理制度） （一）建立内控岗位授权制度。对内控所涉及的各岗位明确规定授权的对象、条件、范围和额度等，任何组织和个人不得超越授权做出风险性决定； （二）建立内控报告制度。明确规定报告人与接受报告人，报告的时间、内容、频率、传递路线、负责处理报告的部门和人员等； （三）建立内控批准制度。对内控所涉及的重要事项，明确规定批准的程序、条件、范围和额度、必备文件以及有权批准的部门和人员及其相应责任； （四）建立内控责任制度。按照权利、义务和责任相统一的原则，明确规定各部门、岗位、人员应负的责任和奖惩制度； （五）建立内控考核评价制度。适当考虑把各业务风险管理执行情况与绩效薪酬挂钩； 四、法律风险
建立健全以总法律顾问制度为核心的企业法律顾问制度。大力加强企业法律风险防范机制建设，形成由企业决策层主导、企业法律顾问牵头、企业具体业务部分提供业务保障、全体员工共同参与的法律风险责任体系。 对合同审批的内部控制（关键词“公司公章、合同章的管理”）公司应制定严格的合同审批程序，以防止随意签署合同。 公司合同涉及到公司的法律责任、资金收付、税收支出等等，因此，必须严格执行完善的审批流程：此时的低效率有助于控制公司的风险、降低经办人员的责任。 1、对于常规合同，公司内部确定经领导、律师审核通过的标准文本；如果对方提出修改部分条款，需要走审批程序； 2、对于非常规合同，需要走经办人、经办部门经理、（财务总监）、法律顾问、总经理（乃至董事长）审批后，公司办公室、业务部门方可予以盖章。 3、主要审查： （1）合同主体；（2）业务的合法合规性；（3）交易价格是否公允、是否浮动、浮动的条款；（4）涉及到的全部税收计算；（5）相关约束商务条款是否合理；（6）权责利是否明确对等；（7）是否超过总经理、董事长、董事会的审批权限等等 第二部分：业务控制体系的建立
交通信号灯 当今，红绿灯安装在各个道口上，已经成为疏导交通车辆最常见和最有效的手段。社会的发展，人们的消费水平不断的提高，私人车辆不断的增加。人多、车多道路窄的道路交通状况已经很明显了。所以采用有效的方法控制交通灯是势在必行的。PLC 的智能控制原则是控制系统的核心，采用PLC把东西方向或南北方向的车辆按数量规模进行分档，相应给定的东西方向与南北方向的绿灯时长也按一定的规律分档. 这样就可以实现按车流量规模给定绿灯时长，达到最大限度的有车放行，减少十字路口的车辆滞流，缓解交通拥挤、实现最优控制，从而提高了交通控制系统的效率. PLC的应用正在不断地走向深入，同时带动传统控制检测日新月益更新。它具有结构简单、编程方便、可靠性高等优点，已广泛用于工业过程和位置的自动控制中。由于PLC具有对使用环境适应性强的特性，同时其内部定时器资源十分丰富，可对目前普遍使用的“渐进式”信号灯进行精确控制，特别对多岔路口的控制可方便地实现。因此现在越来越多地将PLC应用于交通灯系统中。 同时，PLC本身还具有通讯联网功能，将同一条道路上的信号灯组成一局域网进行统一调度管理，可缩短车辆通行等候时间，实现科学化管理。在实时检测和自动控制的PLC应用系统中，PLC往往是作为一个核心部件来使用。 .. 21世纪，PLC会有更大的发展。从技术上看，计算机技术的新成果会更多地应用于可编程控制器的设计和制造上，会有运算速度更快、存储容量更大、智能更强的品种出现；从产品规模上看，会进一步向超小型及超大型方向发展；从产品的配套性上看，产品的品种会更丰富、规格更齐全，完美的人机界面、完备的通信设备会更好地适应各种工业控制场合的需求；从市场上看，各国各自生产多品种产品的情况会随着国际竞争的加剧而打破，会出现少数几个品牌垄断国际市场的局面，会出现国际通用的编程语言；从网络的发展情况来看，可编程控制器和其它工业控制计算机组网构成大型的控制系统是可编程控制器技术的发展方向。目前的计算机集散控制系统DCS中已有大量的可编程控制器应用。伴随着计算机网络的发展，可编程控制器作为自动化控制网络和国际通用网络的重要组成部分，将在工业及工业以外的众多领域发挥越来越大的作用。
企业风险管理—— 整合框架 内容摘要（简体中文翻译：中国东北财经大学方红星教授）
内容摘要 企业风险管理的基础性前提是每一个主体的存在都是为它的利益相关者提供价值。所有的主体都面临不确定性，管理当局所面临的挑战就是在为增加利益相关者价值而奋斗的同时，要确定承受多大的不确定性。不确定性可能会破坏或增加价值，因而它既代表风险，也代表机会。企业风险管理使管理当局能够有效地应对不确定性以及由此带来的风险和机会，增进创造价值的能力。 当管理当局通过制订战略和目标，力求实现增长和报酬目标以及相关的风险之间的最优平衡，并且在追求所在主体的目标的过程中高效率和有效地调配资源时，价值得以最大化。企业风险管理包括： ? 协调风险容量（risk appetite）①与战略——管理当局在评价备选的战略、设定相关目标和建立相关风险的管理机制的过程中，需要考虑所在主体的风险容 量。 ? 增进风险应对决策——企业风险管理为识别和在备选的风险应对——风险回避、降低、分担和承受——之间进行选择提供了严密性。 ? 抑减经营意外和损失——主体识别潜在事项和实施应对的能力得以增强，抑减了意外情况以及由此带来的成本或损失。 ? 识别和管理多重的和贯穿于企业的风险——每一家企业都面临影响组织的不同部分的一系列风险，企业风险管理有助于有效地应对交互影响，以及整合式地应对多重风险。 ? 抓住机会——通过考虑全面范围内的潜在事项，促使管理当局识别并积极地实现机会。 ? 改善资本调配——获取强有力的风险信息，使得管理当局能够有效地评估总体资本需求，并改进资本配置。 企业风险管理所固有的这些能力帮助管理当局实现所在主体的业绩和赢利目标，防止资源损失。企业风险管理有助于确保有效的报告以及符合法律和法规，还有助于避免对主体声誉的损害以及由此带来的后果。总之，企业风险管理不仅帮助一个主体到达期望的目的地，还有助于避开前进途中的隐患和意外。 事项——风险与机会 事项可能会带来负面的影响，也可能会带来正面的影响，抑或二者兼而有之。带来负面影响的事项代表风险，它会妨碍价值创造或者破坏现有价值。带来正面影响的事项可能会抵消负面影响，或者说代表机会。机会是一个事项将会发生并对目标——支持价值创造或保持——的实现产生正面影响的可能性。管理当局把机会反馈到战略或目标制订过程中，以便制订计划去抓住机会。 ①也有人将其翻译为“风险偏好”、“风险需求”、“风险承受能力”等——译者注。