"""安全每日一题 题库 — 钓鱼 + 恶意软件. Curated security-awareness, single-answer.""" from __future__ import annotations QUESTIONS: list[dict] = [ {"prompt": "收到一封声称来自 IT 部门、要求点击链接「立即验证账号否则停用」的邮件，最恰当的做法是？", "options": [{"key": "A", "text": "通过官方渠道核实，不点邮件里的链接"}, {"key": "B", "text": "立即点击链接按提示操作"}, {"key": "C", "text": "把账号密码回复给发件人"}, {"key": "D", "text": "转发给同事让他们也验证"}], "correct_key": "A", "explanation": "制造紧迫感、诱导点击链接或索取凭据是典型钓鱼手法，应通过官方渠道独立核实。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件正文里的链接文字显示为公司官网，但鼠标悬停后状态栏显示的是一个陌生域名，说明什么？", "options": [{"key": "A", "text": "只是浏览器显示错误，可放心点击"}, {"key": "B", "text": "链接显示文字可被伪造，真实跳转地址才是关键，很可能是钓鱼"}, {"key": "C", "text": "两个地址一样，无需在意"}, {"key": "D", "text": "陌生域名说明是公司新站点"}], "correct_key": "B", "explanation": "链接的可见文字与真实跳转地址可以不同，悬停查看真实域名是识别钓鱼的关键手段。", "category": "phishing", "qtype": "single"}, {"prompt": "一条短信称你的快递异常，需点击链接「补缴运费并更新地址」，你并没有等待的快递，应如何处理？", "options": [{"key": "A", "text": "点开链接填写银行卡信息补缴"}, {"key": "B", "text": "回拨短信里的电话确认"}, {"key": "C", "text": "不点击链接，直接删除或通过官方 App 核实物流"}, {"key": "D", "text": "把链接转发到工作群提醒大家点开看看"}], "correct_key": "C", "explanation": "冒充快递、索取运费或个人信息是常见短信钓鱼（smishing），应通过官方渠道核实而非点链接。", "category": "phishing", "qtype": "single"}, {"prompt": "自称银行客服的来电要求你报出手机收到的短信验证码以「验证身份」，正确做法是？", "options": [{"key": "A", "text": "把验证码截图发给对方"}, {"key": "B", "text": "为配合验证如实报出验证码"}, {"key": "C", "text": "报出验证码但只报前三位"}, {"key": "D", "text": "拒绝提供验证码并挂断，主动拨打银行官方客服核实"}], "correct_key": "D", "explanation": "正规机构绝不会索要短信验证码，索要验证码即为语音钓鱼（vishing）诈骗。", "category": "phishing", "qtype": "single"}, {"prompt": "收到「CEO」邮件，紧急要求你私下尽快给某供应商账户转一笔款、且先别告诉别人，这属于？", "options": [{"key": "A", "text": "商务邮件诈骗（BEC），应通过电话等第二渠道当面核实"}, {"key": "B", "text": "正常的紧急业务，应立即照办"}, {"key": "C", "text": "只要金额不大就可以先转"}, {"key": "D", "text": "回邮件问清楚账号后即可转账"}], "correct_key": "A", "explanation": "冒充高管、强调紧急保密并催促转账是典型 BEC 诈骗，必须通过独立第二渠道核实。", "category": "phishing", "qtype": "single"}, {"prompt": "如何辨别一个仿冒登录页面？以下哪个是最可靠的判断依据？", "options": [{"key": "A", "text": "页面有公司 Logo 就一定是真的"}, {"key": "B", "text": "仔细核对浏览器地址栏的完整域名是否为官方域名"}, {"key": "C", "text": "页面很漂亮就可信"}, {"key": "D", "text": "只要有 HTTPS 小锁就绝对安全"}], "correct_key": "B", "explanation": "Logo、样式、HTTPS 都可被伪造，核对地址栏完整域名才是识别仿冒站点的关键。", "category": "phishing", "qtype": "single"}, {"prompt": "下列哪个域名最可能是仿冒 pingcap.com 的钓鱼域名？", "options": [{"key": "A", "text": "www.pingcap.com"}, {"key": "B", "text": "docs.pingcap.com"}, {"key": "C", "text": "pingcap-secure-login.com"}, {"key": "D", "text": "pingcap.com/help"}], "correct_key": "C", "explanation": "在正牌品牌词后拼接额外词并使用完全不同的主域名，是典型的仿冒域名手法。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件附件是一个名为「工资单.pdf.exe」的文件，你应该？", "options": [{"key": "A", "text": "双击打开看看工资"}, {"key": "B", "text": "复制到 U 盘带回家打开"}, {"key": "C", "text": "先改名去掉 .exe 再打开"}, {"key": "D", "text": "不要打开，可执行文件伪装成文档是恶意附件的常见套路，应上报"}], "correct_key": "D", "explanation": "双扩展名把可执行文件伪装成文档是恶意附件常见手法，不应打开并应上报安全团队。", "category": "phishing", "qtype": "single"}, {"prompt": "在公共场所看到一张海报，二维码贴纸盖住了原有内容并称「扫码领福利」，正确做法是？", "options": [{"key": "A", "text": "被覆盖的二维码来源不明，可能是二维码钓鱼，不扫"}, {"key": "B", "text": "扫码看看有什么福利"}, {"key": "C", "text": "扫码后输入公司账号领取"}, {"key": "D", "text": "扫码并授权访问通讯录"}], "correct_key": "A", "explanation": "在正规物料上覆盖二维码贴纸是 quishing（二维码钓鱼）常见手法，来源不明不应扫描。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件称「你中了大奖，请先支付一笔手续费或税费即可领取」，这是？", "options": [{"key": "A", "text": "真实中奖，尽快付款"}, {"key": "B", "text": "典型的中奖钓鱼诈骗，不要付款，直接删除"}, {"key": "C", "text": "先付一半手续费试试"}, {"key": "D", "text": "提供银行卡号让对方直接打奖金"}], "correct_key": "B", "explanation": "以中奖为诱饵、要求先付费或索取账户信息是经典诈骗套路，绝不应付款或泄露信息。", "category": "phishing", "qtype": "single"}, {"prompt": "识别钓鱼邮件时，下列哪一项最值得警惕？", "options": [{"key": "A", "text": "邮件用词礼貌"}, {"key": "B", "text": "邮件带有公司页脚"}, {"key": "C", "text": "发件人显示名是同事，但真实邮箱地址是陌生外部域名"}, {"key": "D", "text": "邮件是纯文本格式"}], "correct_key": "C", "explanation": "显示名可任意伪造，真实发件地址与显示名不符是钓鱼的重要信号。", "category": "phishing", "qtype": "single"}, {"prompt": "你怀疑收到了钓鱼邮件，公司安全团队最希望你做的是？", "options": [{"key": "A", "text": "直接删除，什么都不说"}, {"key": "B", "text": "按邮件里的「取消订阅」退订"}, {"key": "C", "text": "回复发件人质问对方"}, {"key": "D", "text": "通过举报按钮或官方渠道上报给安全团队"}], "correct_key": "D", "explanation": "上报可帮助安全团队封堵威胁并提醒他人，回复或点退订反而会暴露你的活跃状态。", "category": "phishing", "qtype": "single"}, {"prompt": "钓鱼邮件常见的「紧迫感话术」是指？", "options": [{"key": "A", "text": "用「24 小时内不处理账号将被永久删除」等施压让你来不及思考"}, {"key": "B", "text": "详细解释来龙去脉"}, {"key": "C", "text": "附上真实的合同编号"}, {"key": "D", "text": "礼貌地询问你的意见"}], "correct_key": "A", "explanation": "制造时间压力让受害者绕过理性判断是钓鱼常用心理战术，遇到应放慢并核实。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件让你「登录查看重要文件」，链接指向 docs-google.secure-file.ru，你应？", "options": [{"key": "A", "text": "登录后查看文件"}, {"key": "B", "text": "识别出这是伪装成 Google 的可疑域名，不登录并上报"}, {"key": "C", "text": "输入邮箱但不输密码试试"}, {"key": "D", "text": "把公司邮箱和密码填进去"}], "correct_key": "B", "explanation": "把知名品牌词拼进陌生主域名（真实域名是 secure-file.ru）是仿冒登录页典型特征。", "category": "phishing", "qtype": "single"}, {"prompt": "关于在不同网站使用相同密码，正确的安全观念是？", "options": [{"key": "A", "text": "方便记忆，应尽量复用同一个密码"}, {"key": "B", "text": "只要密码够长就可以到处复用"}, {"key": "C", "text": "一处泄露会殃及全部账号，应为每个重要账号使用唯一密码并开启多因素认证"}, {"key": "D", "text": "工作和个人账号用同一密码没关系"}], "correct_key": "C", "explanation": "密码复用会让一次钓鱼泄露波及所有账号，唯一密码加多因素认证可显著降低风险。", "category": "phishing", "qtype": "single"}, {"prompt": "钓鱼者获取了你某网站的密码后，为什么开启了多因素认证（MFA）仍能大幅降低风险？", "options": [{"key": "A", "text": "MFA 没什么用"}, {"key": "B", "text": "MFA 会删除钓鱼邮件"}, {"key": "C", "text": "MFA 会自动帮你改密码"}, {"key": "D", "text": "仅有密码还不足以登录，攻击者还需第二因素，登录会被阻止"}], "correct_key": "D", "explanation": "多因素认证要求密码之外的第二凭据，即使密码泄露攻击者也难以登录。", "category": "phishing", "qtype": "single"}, {"prompt": "同事在即时通讯里发来一个短链接说「这个太好笑了你看看」，但语气和平时不太一样，应？", "options": [{"key": "A", "text": "账号可能被盗，先通过其他方式向本人确认再决定是否点击"}, {"key": "B", "text": "是同事发的，直接点开"}, {"key": "C", "text": "点开并帮忙转发给更多人"}, {"key": "D", "text": "点开并按提示登录账号"}], "correct_key": "A", "explanation": "熟人账号被盗后群发恶意链接很常见，异常时应换渠道向本人核实。", "category": "phishing", "qtype": "single"}, {"prompt": "以下哪种做法能最有效地在点击前确认一个链接是否安全？", "options": [{"key": "A", "text": "看链接长不长"}, {"key": "B", "text": "悬停或长按查看真实目标地址，核对是否为可信官方域名"}, {"key": "C", "text": "凭感觉判断"}, {"key": "D", "text": "只要有人转发过就安全"}], "correct_key": "B", "explanation": "查看链接真实跳转地址并核对官方域名，是点击前判断安全性的可靠方法。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件自称人力资源部，附带一个「薪酬调整表」要求你开启宏才能查看，正确做法是？", "options": [{"key": "A", "text": "开启宏查看内容"}, {"key": "B", "text": "启用宏但看完就关"}, {"key": "C", "text": "不要启用宏，诱导启用宏常用于投递恶意代码，应先核实"}, {"key": "D", "text": "把文件发给全组一起看"}], "correct_key": "C", "explanation": "诱导「启用宏才能查看」是投递宏病毒的常见钓鱼套路，应保持宏禁用并核实来源。", "category": "phishing", "qtype": "single"}, {"prompt": "「鱼叉式钓鱼」（spear phishing）与普通钓鱼的主要区别是？", "options": [{"key": "A", "text": "只通过短信发送"}, {"key": "B", "text": "只是错别字更多"}, {"key": "C", "text": "只发给陌生人"}, {"key": "D", "text": "针对特定个人量身定制、包含真实细节，因而更具迷惑性"}], "correct_key": "D", "explanation": "鱼叉式钓鱼针对特定目标定制内容、掺入真实信息，比群发钓鱼更难识别。", "category": "phishing", "qtype": "single"}, {"prompt": "你在公司登录页输入密码后被跳转到一个略有不同的地址再次要求登录，应？", "options": [{"key": "A", "text": "警惕可能落入了中间人钓鱼页面，停止输入并立即修改密码、上报安全团队"}, {"key": "B", "text": "再输一次密码"}, {"key": "C", "text": "多试几次直到成功"}, {"key": "D", "text": "把密码也告诉客服"}], "correct_key": "A", "explanation": "重复索要凭据、地址异常是凭据窃取的信号，应停止输入并尽快改密和上报。", "category": "phishing", "qtype": "single"}, {"prompt": "收到一封「发票」邮件，发件人域名把字母 o 换成了数字 0（如 c0mpany.com），这叫？", "options": [{"key": "A", "text": "正常写法"}, {"key": "B", "text": "近似域名/字符仿冒（typosquatting），是钓鱼特征，应警惕"}, {"key": "C", "text": "公司改名了"}, {"key": "D", "text": "邮件系统的编码问题"}], "correct_key": "B", "explanation": "用形近字符仿冒合法域名是 typosquatting，需逐字核对域名以免上当。", "category": "phishing", "qtype": "single"}, {"prompt": "陌生人发邮件自称招聘方，让你在私人链接上传身份证、银行卡照片以「入职验证」，应？", "options": [{"key": "A", "text": "尽快上传以免错失机会"}, {"key": "B", "text": "只上传身份证不传银行卡"}, {"key": "C", "text": "正规流程不会在入职前索要此类敏感证件照片，拒绝并核实招聘方真实性"}, {"key": "D", "text": "上传到对方给的网盘链接"}], "correct_key": "C", "explanation": "以招聘为名索取敏感证件是常见诈骗，应通过官方渠道核实且不轻易提供证件信息。", "category": "phishing", "qtype": "single"}, {"prompt": "关于点击邮件里的「退订/取消订阅」链接，对可疑钓鱼邮件而言正确的认识是？", "options": [{"key": "A", "text": "退订能帮你杀毒"}, {"key": "B", "text": "点退订一定能停止骚扰"}, {"key": "C", "text": "退订链接永远安全"}, {"key": "D", "text": "可疑邮件里的退订链接也可能是陷阱，点击会暴露活跃度或触发恶意页面，应改用举报/删除"}], "correct_key": "D", "explanation": "钓鱼邮件的退订链接可能用于确认邮箱有效或投毒，对可疑邮件应举报删除而非点击。", "category": "phishing", "qtype": "single"}, {"prompt": "老板通过陌生手机号发微信/短信让你「帮忙买几张购物卡并把卡密拍给他」，应？", "options": [{"key": "A", "text": "这是冒充领导的礼品卡诈骗，先通过已知可信渠道当面/电话核实"}, {"key": "B", "text": "赶紧买好把卡密发过去"}, {"key": "C", "text": "先买一张试试真假"}, {"key": "D", "text": "回消息问是不是老板本人即可"}], "correct_key": "A", "explanation": "冒充领导索要礼品卡卡密是高发诈骗，务必通过已知可信渠道核实身份。", "category": "phishing", "qtype": "single"}, {"prompt": "为防范钓鱼，收到要求「更新支付/收款账户信息」的供应商邮件时最稳妥的做法是？", "options": [{"key": "A", "text": "直接按邮件里的新账户付款"}, {"key": "B", "text": "使用此前存档的可信联系方式主动致电供应商核实变更"}, {"key": "C", "text": "回复该邮件确认后即可"}, {"key": "D", "text": "看邮件签名有公章就照办"}], "correct_key": "B", "explanation": "变更收款账户是 BEC 高发点，应用独立可信联系方式核实，不能只回邮件确认。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件正文全是图片、没有可选中的文字，且图片里嵌了一个大按钮让你点击，这可能是？", "options": [{"key": "A", "text": "说明邮件更正式"}, {"key": "B", "text": "只是发件人喜欢用图片"}, {"key": "C", "text": "为规避文本检测的钓鱼手法，应提高警惕、勿点按钮"}, {"key": "D", "text": "图片邮件一定安全"}], "correct_key": "C", "explanation": "整封用图片承载内容常用于规避关键词过滤，配合诱导按钮是钓鱼常见形态。", "category": "phishing", "qtype": "single"}, {"prompt": "关于「HTTPS 小锁」，正确的安全认识是？", "options": [{"key": "A", "text": "有小锁就代表网站是官方且完全可信的"}, {"key": "B", "text": "小锁能拦截钓鱼"}, {"key": "C", "text": "有小锁就可以放心输入密码"}, {"key": "D", "text": "小锁只表示传输被加密，钓鱼站点也能申请证书，仍需核对域名"}], "correct_key": "D", "explanation": "HTTPS 只保证传输加密，钓鱼站同样可获得证书，判断可信仍须核对域名与来源。", "category": "phishing", "qtype": "single"}, {"prompt": "接到自称「公检法」的电话，称你涉案要求转账到「安全账户」自证清白，应？", "options": [{"key": "A", "text": "这是典型冒充公检法诈骗，公检法绝不会电话要求转账，应挂断并报警"}, {"key": "B", "text": "立即转账配合调查"}, {"key": "C", "text": "先转一部分表示配合"}, {"key": "D", "text": "把银行卡和密码告诉对方"}], "correct_key": "A", "explanation": "真实公检法不会电话办案或要求转账到「安全账户」，此为经典冒充诈骗。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件署名是你认识的合作方，但要求把回复发到一个私人邮箱地址，应？", "options": [{"key": "A", "text": "照要求发到私人邮箱"}, {"key": "B", "text": "要求改用私人邮箱是账号被冒充/劫持的信号，应通过原有可信邮箱或电话核实"}, {"key": "C", "text": "先发非敏感内容试探"}, {"key": "D", "text": "把附件也一并发过去"}], "correct_key": "B", "explanation": "诱导改用私人/外部邮箱常用于绕过监控和实施冒充，应通过原有可信渠道核实。", "category": "phishing", "qtype": "single"}, {"prompt": "以下哪种是最安全地访问网银或公司系统的方式？", "options": [{"key": "A", "text": "点击邮件或搜索广告里的链接进入"}, {"key": "B", "text": "点别人分享的登录链接"}, {"key": "C", "text": "在浏览器手动输入官方网址或使用官方书签/官方 App 进入"}, {"key": "D", "text": "在陌生 Wi-Fi 弹窗里登录"}], "correct_key": "C", "explanation": "手动输入官方网址或用可信书签/官方 App，可避免落入伪造链接或仿冒站点。", "category": "phishing", "qtype": "single"}, {"prompt": "对方发来一个云文档共享通知，点开后要求「输入你的邮箱密码以查看」，应？", "options": [{"key": "A", "text": "输入密码查看文档"}, {"key": "B", "text": "输入邮箱不输密码"}, {"key": "C", "text": "输入密码但故意打错一位"}, {"key": "D", "text": "正规云文档不会要你在第三方页面输入邮箱密码，这是钓鱼，应关闭并上报"}], "correct_key": "D", "explanation": "让你在文档页面另行输入邮箱密码是典型凭据钓鱼，正规服务不会如此要求。", "category": "phishing", "qtype": "single"}, {"prompt": "关于钓鱼邮件里常见的「你的邮箱空间已满，点此扩容」提示，正确做法是？", "options": [{"key": "A", "text": "不点邮件链接，直接登录官方邮箱系统或联系 IT 核实容量"}, {"key": "B", "text": "登录扩容页面输入账号密码"}, {"key": "C", "text": "点击扩容以免收不到邮件"}, {"key": "D", "text": "把邮件转给同事让他们帮忙扩容"}], "correct_key": "A", "explanation": "「空间已满/需扩容」是常见诱饵，应通过官方系统或 IT 核实而非点击邮件链接。", "category": "phishing", "qtype": "single"}, {"prompt": "在收到看似合法的登录二次验证请求（MFA 推送）但你本人并未登录时，应？", "options": [{"key": "A", "text": "点「同意」省事"}, {"key": "B", "text": "拒绝该请求，说明密码可能已泄露，应立即改密并上报（谨防 MFA 疲劳轰炸）"}, {"key": "C", "text": "多点几次同意让提示消失"}, {"key": "D", "text": "忽略不管"}], "correct_key": "B", "explanation": "非本人发起的 MFA 推送意味着密码可能已泄露，攻击者在做 MFA 轰炸，应拒绝并改密上报。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件要求你「确认」下面一长串个人信息（工号、身份证号、手机号）是否正确，应？", "options": [{"key": "A", "text": "如实补全并回复确认"}, {"key": "B", "text": "只确认工号"}, {"key": "C", "text": "以确认为名收集个人信息是钓鱼常见手法，不回复并核实来源"}, {"key": "D", "text": "把信息发到邮件里的表单"}], "correct_key": "C", "explanation": "以「核对/确认」为名诱导补全个人信息是信息收集型钓鱼，应核实来源后再决定。", "category": "phishing", "qtype": "single"}, {"prompt": "关于「钓鱼演练」邮件（公司安全团队模拟发送），下列理解正确的是？", "options": [{"key": "A", "text": "演练邮件可以随便点，不会有后果"}, {"key": "B", "text": "演练邮件应转发给全公司"}, {"key": "C", "text": "只要是演练就一定安全，可输入密码"}, {"key": "D", "text": "演练意在训练识别能力，应像对待真实邮件一样谨慎核实并上报可疑邮件"}], "correct_key": "D", "explanation": "钓鱼演练用于培养识别与上报习惯，正确反应是像对待真邮件一样谨慎并上报。", "category": "phishing", "qtype": "single"}, {"prompt": "你不确定一封邮件是否为钓鱼，但它索要凭据或转账，最稳妥的原则是？", "options": [{"key": "A", "text": "存疑时通过独立官方渠道核实，核实前不点击、不提供凭据、不转账"}, {"key": "B", "text": "宁可信其无，先照做"}, {"key": "C", "text": "凭直觉猜一下"}, {"key": "D", "text": "问发件人本人邮件里给的电话"}], "correct_key": "A", "explanation": "存疑即停、独立核实，是应对钓鱼的黄金原则；用邮件内提供的联系方式核实并不可靠。", "category": "phishing", "qtype": "single"}, {"prompt": "「水坑攻击」式钓鱼是指？", "options": [{"key": "A", "text": "在水边放二维码"}, {"key": "B", "text": "攻击者攻陷目标群体常访问的合法网站，等受害者上门中招"}, {"key": "C", "text": "只攻击游泳馆网站"}, {"key": "D", "text": "群发大量垃圾邮件"}], "correct_key": "B", "explanation": "水坑攻击通过攻陷目标常访问的可信站点来投毒，因此即便是熟悉站点也需保持系统更新与警惕。", "category": "phishing", "qtype": "single"}, {"prompt": "收到「你的密码将于今天过期，点此立即修改」的邮件，最安全的修改方式是？", "options": [{"key": "A", "text": "点邮件链接修改"}, {"key": "B", "text": "把新旧密码回复给发件人"}, {"key": "C", "text": "不点邮件链接，自行进入官方系统的账号设置修改密码"}, {"key": "D", "text": "在邮件表单里填写新密码"}], "correct_key": "C", "explanation": "密码到期提醒是常见诱饵，应自行进入官方系统修改，切勿通过邮件链接或回复操作。", "category": "phishing", "qtype": "single"}, {"prompt": "关于社交工程，下列哪种说法最准确？", "options": [{"key": "A", "text": "只要装了杀毒软件就不会被社工"}, {"key": "B", "text": "社工只发生在邮件里"}, {"key": "C", "text": "只有技术小白才会中招"}, {"key": "D", "text": "社工利用人的信任、恐惧、好奇等心理，技术手段无法完全替代人的警惕"}], "correct_key": "D", "explanation": "社会工程攻击针对人性弱点，仅靠技术防护不够，个人警惕与核实同样关键。", "category": "phishing", "qtype": "single"}, {"prompt": "在公司停车场捡到一张写着「机密-薪酬」的 U 盘，钓鱼/社工角度最安全的做法是？", "options": [{"key": "A", "text": "不要插入任何设备，直接交给 IT/安全团队处理"}, {"key": "B", "text": "带回家用私人电脑打开"}, {"key": "C", "text": "插到电脑看看是谁的"}, {"key": "D", "text": "插到同事电脑上帮忙找失主"}], "correct_key": "A", "explanation": "以诱饵标签引人插入的 U 盘（baiting）可能带毒，绝不插入，应交安全团队处理。", "category": "phishing", "qtype": "single"}, {"prompt": "邮件要求你扫描正文里的二维码来「登录企业系统」，相比直接给链接，二维码钓鱼更危险在于？", "options": [{"key": "A", "text": "二维码本身能自动杀毒"}, {"key": "B", "text": "二维码通常在手机打开，绕过了电脑端的安全过滤，且真实网址不可见"}, {"key": "C", "text": "二维码不会指向恶意网站"}, {"key": "D", "text": "二维码比链接更正规"}], "correct_key": "B", "explanation": "二维码隐藏真实网址并常在防护较弱的手机端打开，是 quishing 更隐蔽的原因。", "category": "phishing", "qtype": "single"}, {"prompt": "关于向他人（哪怕是「IT 管理员」）透露自己的账号密码，正确原则是？", "options": [{"key": "A", "text": "对管理员可以说"}, {"key": "B", "text": "只在电话里说没关系"}, {"key": "C", "text": "任何人都不应索取你的密码，正规 IT 不需要你的密码即可提供支持，绝不透露"}, {"key": "D", "text": "写在便签上给对方"}], "correct_key": "C", "explanation": "正规 IT 支持无需知道你的密码，任何索要密码的行为都应视为钓鱼/社工。", "category": "phishing", "qtype": "single"}, {"prompt": "如果你不小心在钓鱼页面输入了公司账号密码，事后第一时间应该？", "options": [{"key": "A", "text": "当作没发生，观望一下"}, {"key": "B", "text": "等系统提示异常再说"}, {"key": "C", "text": "只把电脑关机"}, {"key": "D", "text": "立即修改该密码及复用了同密码的账号，并第一时间上报 IT/安全团队"}], "correct_key": "D", "explanation": "凭据可能已泄露，应立即改密（含复用处）并上报，以便安全团队及时止损。", "category": "phishing", "qtype": "single"}, {"prompt": "下列哪种邮件迹象组合最应让你怀疑是钓鱼？", "options": [{"key": "A", "text": "陌生外部发件地址 + 紧迫施压 + 索要凭据/转账 + 可疑链接或附件"}, {"key": "B", "text": "来自同事、内容与日常工作相符"}, {"key": "C", "text": "公司内部通知、无外链"}, {"key": "D", "text": "纯文字问候、无任何请求"}], "correct_key": "A", "explanation": "陌生发件人、紧迫话术、索要凭据或转账、可疑链接/附件同时出现是钓鱼的强信号。", "category": "phishing", "qtype": "single"}, {"prompt": "电脑突然弹窗称文件已被加密、需支付比特币才能解锁，这是哪类恶意软件？", "options": [{"key": "A", "text": "勒索软件（Ransomware）"}, {"key": "B", "text": "广告软件"}, {"key": "C", "text": "杀毒软件"}, {"key": "D", "text": "系统更新程序"}], "correct_key": "A", "explanation": "加密文件并勒索赎金是勒索软件的典型行为，应立即断网并上报，不要付赎金。", "category": "malware", "qtype": "single"}, {"prompt": "遭遇勒索软件加密后，关于「是否支付赎金」，安全界的普遍建议是？", "options": [{"key": "A", "text": "立即支付以尽快恢复"}, {"key": "B", "text": "不建议支付，付款不保证能解密还会助长犯罪，应断网、上报并用备份恢复"}, {"key": "C", "text": "先付一半"}, {"key": "D", "text": "和攻击者讨价还价后付款"}], "correct_key": "B", "explanation": "支付无法保证恢复且鼓励犯罪，正确应对是隔离、上报并依赖离线备份恢复。", "category": "malware", "qtype": "single"}, {"prompt": "防范勒索软件导致数据永久丢失，最有效的措施是？", "options": [{"key": "A", "text": "只依赖一直连接的移动硬盘"}, {"key": "B", "text": "把文件都放桌面"}, {"key": "C", "text": "把所有重要数据定期备份，并保留一份离线/隔离的备份"}, {"key": "D", "text": "把密码设得很长"}], "correct_key": "C", "explanation": "遵循可靠备份策略并保留离线副本，勒索软件即便加密在线数据也能从备份恢复。", "category": "malware", "qtype": "single"}, {"prompt": "发现自己电脑疑似中了病毒，第一步最应该做的是？", "options": [{"key": "A", "text": "继续正常办公"}, {"key": "B", "text": "重启几次看看是否自愈"}, {"key": "C", "text": "把文件拷到同事电脑备份"}, {"key": "D", "text": "断开网络连接以阻止扩散和外联，并联系 IT/安全团队"}], "correct_key": "D", "explanation": "断网可阻止恶意软件横向传播和向外回传，随后交由专业团队处置。", "category": "malware", "qtype": "single"}, {"prompt": "「木马（Trojan）」这类恶意软件的典型特征是？", "options": [{"key": "A", "text": "伪装成正常/有用的软件诱骗用户安装，实则在后台执行恶意行为"}, {"key": "B", "text": "会自我复制感染大量文件"}, {"key": "C", "text": "只显示广告"}, {"key": "D", "text": "是一种硬件"}], "correct_key": "A", "explanation": "木马伪装成合法程序骗取安装，从而在后台窃密或开后门，故不应安装来源不明软件。", "category": "malware", "qtype": "single"}, {"prompt": "「蠕虫（Worm）」区别于普通病毒的关键在于？", "options": [{"key": "A", "text": "必须手动双击才能运行"}, {"key": "B", "text": "能利用网络漏洞自我复制、无需用户操作即可在网络中传播"}, {"key": "C", "text": "只能感染一台机器"}, {"key": "D", "text": "对网络毫无影响"}], "correct_key": "B", "explanation": "蠕虫可自主利用漏洞在网络中横向传播，因此及时打补丁尤为重要。", "category": "malware", "qtype": "single"}, {"prompt": "关于操作系统和软件的安全更新（补丁），正确做法是？", "options": [{"key": "A", "text": "尽量拖延，越晚装越好"}, {"key": "B", "text": "永远不装以免出问题"}, {"key": "C", "text": "及时安装官方安全更新，以修补被恶意软件利用的漏洞"}, {"key": "D", "text": "只装第三方论坛提供的补丁"}], "correct_key": "C", "explanation": "安全补丁修补已知漏洞，及时更新能封堵蠕虫和漏洞利用型恶意软件的入口。", "category": "malware", "qtype": "single"}, {"prompt": "杀毒软件提示需要更新病毒库，你应该？", "options": [{"key": "A", "text": "关掉提示继续用旧库"}, {"key": "B", "text": "把杀毒软件的实时防护关掉"}, {"key": "C", "text": "卸载杀毒软件省资源"}, {"key": "D", "text": "及时更新病毒库，以便识别最新恶意软件"}], "correct_key": "D", "explanation": "病毒库需持续更新才能识别新型威胁，过期病毒库会漏检最新恶意软件。", "category": "malware", "qtype": "single"}, {"prompt": "某软件安装时提示会与杀毒软件冲突，让你「先临时关闭杀毒软件再安装」，应？", "options": [{"key": "A", "text": "要求关闭杀毒常是恶意软件规避查杀的手法，应拒绝并核实软件来源"}, {"key": "B", "text": "照做关闭杀毒后安装"}, {"key": "C", "text": "关闭杀毒并永久保持关闭"}, {"key": "D", "text": "把杀毒软件卸载后再装"}], "correct_key": "A", "explanation": "诱导关闭杀毒是恶意软件躲避检测的常见套路，合法软件通常无需你关闭防护。", "category": "malware", "qtype": "single"}, {"prompt": "想安装一款常用软件，最安全的下载来源是？", "options": [{"key": "A", "text": "搜索排在最前的广告链接"}, {"key": "B", "text": "官方网站或公司认可的应用商店/软件中心"}, {"key": "C", "text": "网盘里网友分享的破解版"}, {"key": "D", "text": "论坛帖子附件"}], "correct_key": "B", "explanation": "官方渠道与公司软件中心可确保软件未被篡改，第三方来源常夹带木马。", "category": "malware", "qtype": "single"}, {"prompt": "关于使用「破解版/激活工具（crack/keygen）」的软件，安全风险是？", "options": [{"key": "A", "text": "完全没有风险，还免费"}, {"key": "B", "text": "只要杀毒没报警就绝对安全"}, {"key": "C", "text": "破解工具常捆绑木马、后门或挖矿程序，风险极高，应使用正版"}, {"key": "D", "text": "破解版比正版更安全"}], "correct_key": "C", "explanation": "破解与激活工具是恶意软件重灾区，常内置后门或挖矿程序，应使用合法授权软件。", "category": "malware", "qtype": "single"}, {"prompt": "捡到或收到来历不明的 U 盘，正确做法是？", "options": [{"key": "A", "text": "插到工作电脑查看内容"}, {"key": "B", "text": "插到手机上看看"}, {"key": "C", "text": "格式化后自己用"}, {"key": "D", "text": "不要插入任何自己或公司的设备，交由 IT/安全团队处理"}], "correct_key": "D", "explanation": "来历不明的移动介质可能携带自动执行的恶意程序，绝不应插入，应交专业处理。", "category": "malware", "qtype": "single"}, {"prompt": "「间谍软件（Spyware）」的主要危害是？", "options": [{"key": "A", "text": "在你不知情时窃取账号、按键、浏览记录等隐私信息"}, {"key": "B", "text": "让电脑跑得更快"}, {"key": "C", "text": "帮你清理垃圾文件"}, {"key": "D", "text": "自动备份数据"}], "correct_key": "A", "explanation": "间谍软件潜伏窃取隐私与凭据，因此需靠正规来源软件与防护来防范。", "category": "malware", "qtype": "single"}, {"prompt": "浏览网页时弹出「您的电脑已中 5 个病毒，点此立即清理」的窗口，应？", "options": [{"key": "A", "text": "点击清理按钮"}, {"key": "B", "text": "这是恐吓式假警报（scareware），不要点击，关闭页面并用本机正规杀毒扫描"}, {"key": "C", "text": "按提示下载它推荐的杀毒软件"}, {"key": "D", "text": "输入信用卡购买它的清理服务"}], "correct_key": "B", "explanation": "网页弹窗式病毒警报是 scareware，点击或下载反而会安装恶意软件，应关闭并用本机杀毒。", "category": "malware", "qtype": "single"}, {"prompt": "关于 Office 文档「启用宏」的提示，从防恶意软件角度正确做法是？", "options": [{"key": "A", "text": "所有文档都启用宏更方便"}, {"key": "B", "text": "只要文件是别人发的就启用"}, {"key": "C", "text": "默认禁用宏，只有来源可信且确有需要时才谨慎启用"}, {"key": "D", "text": "把宏安全级别调到最低"}], "correct_key": "C", "explanation": "恶意宏是常见的文档型恶意软件载体，应默认禁用，仅在可信必要时启用。", "category": "malware", "qtype": "single"}, {"prompt": "电脑近期无故变慢、风扇狂转、CPU 常年满载，可能感染了？", "options": [{"key": "A", "text": "正常现象，无需理会"}, {"key": "B", "text": "是杀毒软件在帮忙"}, {"key": "C", "text": "说明电脑性能变好了"}, {"key": "D", "text": "可能是挖矿木马（cryptojacking）等恶意软件，应扫描排查并上报"}], "correct_key": "D", "explanation": "资源被异常占满可能是挖矿类恶意软件，应扫描排查并上报处理。", "category": "malware", "qtype": "single"}, {"prompt": "确认一台电脑已感染恶意软件，为防止在公司内网扩散，应优先？", "options": [{"key": "A", "text": "将受感染机器从网络隔离（断网/隔离网段），再由专业团队处置"}, {"key": "B", "text": "把它接入更多网络共享文件"}, {"key": "C", "text": "把它当文件服务器继续用"}, {"key": "D", "text": "用它登录更多系统"}], "correct_key": "A", "explanation": "隔离受感染主机可阻断横向传播，是遏制内网蔓延的首要动作。", "category": "malware", "qtype": "single"}, {"prompt": "关于杀毒软件的「实时防护/实时监控」功能，正确态度是？", "options": [{"key": "A", "text": "平时关掉，需要时再开"}, {"key": "B", "text": "始终保持开启，实时拦截恶意文件的执行"}, {"key": "C", "text": "会拖慢电脑，应彻底关闭"}, {"key": "D", "text": "只在周末开启"}], "correct_key": "B", "explanation": "实时防护能在恶意文件落地或执行的第一时间拦截，应始终保持开启。", "category": "malware", "qtype": "single"}, {"prompt": "从网上下载的免费软件安装过程中，默认勾选了多个「附带安装」的工具栏和软件，应？", "options": [{"key": "A", "text": "全部保留默认勾选，一路下一步"}, {"key": "B", "text": "多装一些没坏处"}, {"key": "C", "text": "取消这些捆绑勾选，只安装所需主程序，谨防捆绑广告/流氓软件"}, {"key": "D", "text": "捆绑软件都是有用的"}], "correct_key": "C", "explanation": "安装包捆绑（bundleware）常夹带广告软件或 PUP，应取消勾选只装必要主程序。", "category": "malware", "qtype": "single"}, {"prompt": "杀毒软件报告发现一个威胁并提供「隔离（quarantine）」选项，隔离的作用是？", "options": [{"key": "A", "text": "把文件公开分享"}, {"key": "B", "text": "把病毒发给厂商炫耀"}, {"key": "C", "text": "让病毒继续运行"}, {"key": "D", "text": "把可疑文件移入安全区使其无法运行，同时暂不彻底删除以便误报时恢复"}], "correct_key": "D", "explanation": "隔离会封存可疑文件使其失去危害能力，又保留恢复余地以应对误报。", "category": "malware", "qtype": "single"}, {"prompt": "收到一封邮件带 .zip 附件，解压后是一个 .scr 或 .exe 文件，你并未预期收到程序，应？", "options": [{"key": "A", "text": "不要运行，压缩包内的可执行文件常是恶意载荷，应删除并上报"}, {"key": "B", "text": "双击运行看看是什么"}, {"key": "C", "text": "改名成 .txt 再运行"}, {"key": "D", "text": "在同事电脑上运行试试"}], "correct_key": "A", "explanation": "用压缩包夹带 .exe/.scr 可执行文件是常见的恶意软件投递方式，不应运行。", "category": "malware", "qtype": "single"}, {"prompt": "关于给手机安装 App，防恶意软件的正确做法是？", "options": [{"key": "A", "text": "从任意第三方链接直接下载 APK 安装"}, {"key": "B", "text": "从官方应用商店安装，并留意其申请的权限是否合理"}, {"key": "C", "text": "谁发的安装包都装"}, {"key": "D", "text": "越权限多的 App 越好"}], "correct_key": "B", "explanation": "官方商店有审核，从侧载来源安装易中招；同时应审视权限，防范恶意 App 越权窃密。", "category": "malware", "qtype": "single"}, {"prompt": "一个手电筒 App 却申请读取通讯录、短信、通话记录等权限，说明？", "options": [{"key": "A", "text": "功能强大，值得安装"}, {"key": "B", "text": "所有 App 都这样，无所谓"}, {"key": "C", "text": "权限与功能明显不符，可能是间谍/恶意软件，应拒绝授权并卸载"}, {"key": "D", "text": "多给权限用起来更顺"}], "correct_key": "C", "explanation": "权限远超功能所需是恶意 App 的危险信号，应拒绝授权并卸载。", "category": "malware", "qtype": "single"}, {"prompt": "「后门（Backdoor）」在恶意软件语境中指？", "options": [{"key": "A", "text": "软件的一个正常菜单"}, {"key": "B", "text": "杀毒软件的功能"}, {"key": "C", "text": "一种备份方式"}, {"key": "D", "text": "绕过正常认证、让攻击者可远程秘密访问和控制系统的隐蔽通道"}], "correct_key": "D", "explanation": "后门为攻击者提供绕过认证的隐蔽远程访问通道，是持续控制受害系统的手段。", "category": "malware", "qtype": "single"}, {"prompt": "关于使用来路不明的公共充电桩/借来的充电数据线给设备充电，可能存在的风险是？", "options": [{"key": "A", "text": "「充电劫持（juice jacking）」可能通过数据接口植入恶意软件或窃取数据，应使用自己的充电头/纯充电线"}, {"key": "B", "text": "完全没有风险"}, {"key": "C", "text": "充电越快越安全"}, {"key": "D", "text": "公共充电桩都经过安全认证"}], "correct_key": "A", "explanation": "恶意改装的充电接口可能借数据通道投毒或窃密，应使用自带电源适配器或纯充电线。", "category": "malware", "qtype": "single"}, {"prompt": "公司要求终端安装 EDR/杀毒代理，员工把它卸载了以「让电脑更快」，这样做？", "options": [{"key": "A", "text": "很合理，性能优先"}, {"key": "B", "text": "会使终端失去恶意软件检测与响应能力、违反安全策略，绝不应擅自卸载"}, {"key": "C", "text": "只要自己小心就行"}, {"key": "D", "text": "反正有防火墙就够了"}], "correct_key": "B", "explanation": "擅自卸载终端防护会造成检测盲区并违反策略，性能问题应通过 IT 解决而非关闭防护。", "category": "malware", "qtype": "single"}, {"prompt": "「零日（zero-day）漏洞」利用型恶意软件之所以危险，是因为？", "options": [{"key": "A", "text": "它没有任何危害"}, {"key": "B", "text": "它只在零点发作"}, {"key": "C", "text": "它利用尚无官方补丁的未知漏洞，传统特征库可能一时无法识别"}, {"key": "D", "text": "它一定会被杀毒软件拦截"}], "correct_key": "C", "explanation": "零日利用针对尚未修补的未知漏洞，故需纵深防御与及时打补丁降低风险。", "category": "malware", "qtype": "single"}, {"prompt": "浏览器不断弹出广告、主页被莫名篡改、搜索被重定向，最可能是？", "options": [{"key": "A", "text": "网络太快了"}, {"key": "B", "text": "这是正常功能"}, {"key": "C", "text": "浏览器升级了"}, {"key": "D", "text": "感染了广告软件/浏览器劫持类恶意程序，应扫描清除并检查扩展"}], "correct_key": "D", "explanation": "强制广告、主页篡改与搜索重定向是广告软件/浏览器劫持特征，应清除并排查恶意扩展。", "category": "malware", "qtype": "single"}, {"prompt": "安装浏览器扩展时，防恶意软件的正确做法是？", "options": [{"key": "A", "text": "只从官方扩展商店安装口碑良好的扩展，审视其权限，定期清理不用的"}, {"key": "B", "text": "看到有用就装，越多越好"}, {"key": "C", "text": "任何网站弹出的扩展都装"}, {"key": "D", "text": "给扩展所有权限最省事"}], "correct_key": "A", "explanation": "恶意扩展可窃取数据或注入广告，应择优安装、控制权限并定期清理。", "category": "malware", "qtype": "single"}, {"prompt": "关于给恶意软件感染的机器「彻底清除」，以下哪种情况下最稳妥？", "options": [{"key": "A", "text": "删掉一个可疑文件就算清除完成"}, {"key": "B", "text": "对严重或不确定的感染，按 IT 指引进行彻底查杀，必要时重装系统并从可信备份恢复"}, {"key": "C", "text": "关机放一晚自然就好了"}, {"key": "D", "text": "改个密码即可"}], "correct_key": "B", "explanation": "深度或不确定的感染可能残留后门，按 IT 指引彻底处置甚至重装并用可信备份恢复最稳妥。", "category": "malware", "qtype": "single"}, {"prompt": "「僵尸网络（Botnet）」中，被恶意软件控制的电脑通常被用来？", "options": [{"key": "A", "text": "帮你提速上网"}, {"key": "B", "text": "自动备份数据"}, {"key": "C", "text": "在机主不知情下被远程操控，发起 DDoS、发垃圾邮件或挖矿等"}, {"key": "D", "text": "免费杀毒"}], "correct_key": "C", "explanation": "被控主机（肉鸡）会被用于攻击、发垃圾邮件或挖矿，因此发现异常外联应及时处置。", "category": "malware", "qtype": "single"}, {"prompt": "关于「无文件恶意软件（fileless malware）」，正确认识是？", "options": [{"key": "A", "text": "重启也一定清不掉"}, {"key": "B", "text": "它没有危害"}, {"key": "C", "text": "它一定会留下明显的 exe 文件"}, {"key": "D", "text": "它不写落磁盘文件、常驻内存并滥用系统合法工具，仅靠扫描文件难以发现"}], "correct_key": "D", "explanation": "无文件恶意软件驻留内存、滥用合法工具，需行为检测（如 EDR）而非仅靠文件特征扫描。", "category": "malware", "qtype": "single"}, {"prompt": "公司下发的系统/软件更新推送，员工的正确做法是？", "options": [{"key": "A", "text": "在合适时间尽快按 IT 要求完成更新，及时修补安全漏洞"}, {"key": "B", "text": "无限期推迟"}, {"key": "C", "text": "只更新自己喜欢的功能"}, {"key": "D", "text": "把更新提示永久关闭"}], "correct_key": "A", "explanation": "及时应用公司下发的补丁能封堵被恶意软件利用的漏洞，不应长期拖延。", "category": "malware", "qtype": "single"}, {"prompt": "关于「宏病毒」，下列说法正确的是？", "options": [{"key": "A", "text": "它只感染图片文件"}, {"key": "B", "text": "它藏在文档的宏代码里，在启用宏时执行恶意操作"}, {"key": "C", "text": "只要不联网就一定不会中"}, {"key": "D", "text": "它是一种硬件故障"}], "correct_key": "B", "explanation": "宏病毒依赖文档宏在启用时运行，因此对来源不明文档应保持宏禁用。", "category": "malware", "qtype": "single"}, {"prompt": "在办公电脑上，员工是否应擅自安装个人来源的各类小工具软件？", "options": [{"key": "A", "text": "随便装，反正是自己在用"}, {"key": "B", "text": "只要免费就能装"}, {"key": "C", "text": "应仅安装公司批准/软件中心提供的软件，未知来源软件可能携带恶意代码"}, {"key": "D", "text": "装完记得关掉杀毒即可"}], "correct_key": "C", "explanation": "在企业终端应遵守软件白名单，未授权来源软件是恶意软件常见入口。", "category": "malware", "qtype": "single"}, {"prompt": "以下哪种备份策略对抵御勒索软件最有效？", "options": [{"key": "A", "text": "只把文件留在本机同一磁盘"}, {"key": "B", "text": "把备份和源文件放同一台一直联网的机器"}, {"key": "C", "text": "只截图保存"}, {"key": "D", "text": "多副本、异地/离线保存、并定期演练恢复（如 3-2-1 原则）"}], "correct_key": "D", "explanation": "多副本加离线/异地备份并验证可恢复性，能在勒索软件加密在线数据后仍成功恢复。", "category": "malware", "qtype": "single"}, {"prompt": "邮件里的链接指向一个网站，声称「需先安装一个插件/播放器才能观看视频」，应？", "options": [{"key": "A", "text": "「需装插件才能看」常是诱导安装恶意软件的套路，不要安装，离开该站点"}, {"key": "B", "text": "按提示下载安装该插件"}, {"key": "C", "text": "安装后立即关杀毒软件"}, {"key": "D", "text": "把插件分享给同事"}], "correct_key": "A", "explanation": "以「缺少插件/播放器」为由诱导下载安装，是投递木马的经典手法，不应安装。", "category": "malware", "qtype": "single"}, {"prompt": "杀毒软件多次报告同一威胁但你觉得可能是误报，稳妥做法是？", "options": [{"key": "A", "text": "直接把该文件加入白名单并关闭扫描"}, {"key": "B", "text": "先保持隔离，联系 IT/安全团队确认是否误报，再决定处理"}, {"key": "C", "text": "卸载杀毒软件"}, {"key": "D", "text": "把报警关掉眼不见为净"}], "correct_key": "B", "explanation": "在未确认前不应自行放行，应保持隔离并交由安全团队判定，避免放过真实威胁。", "category": "malware", "qtype": "single"}, {"prompt": "为降低恶意软件通过浏览器入侵的风险，下列哪项做法最好？", "options": [{"key": "A", "text": "长期使用不再更新的老旧浏览器"}, {"key": "B", "text": "关闭浏览器所有安全提示"}, {"key": "C", "text": "保持浏览器及其插件为最新版本，及时安装安全更新"}, {"key": "D", "text": "随意允许网站的所有弹窗和下载"}], "correct_key": "C", "explanation": "浏览器及插件的漏洞是常见入侵点，保持最新可修补被利用的安全缺陷。", "category": "malware", "qtype": "single"}, {"prompt": "同事传给你一个「绿色免安装版」的常用软件压缩包，让你直接解压运行，你应？", "options": [{"key": "A", "text": "直接解压运行"}, {"key": "B", "text": "再转发给更多同事"}, {"key": "C", "text": "运行前先把杀毒关掉"}, {"key": "D", "text": "来源无法保证完整性的可执行文件可能被植入后门，应从官方渠道获取或请 IT 核验"}], "correct_key": "D", "explanation": "非官方渠道的可执行文件可能被篡改植入恶意代码，应从官方获取或经 IT 核验。", "category": "malware", "qtype": "single"}, {"prompt": "开启操作系统的「防火墙」对防范恶意软件的作用是？", "options": [{"key": "A", "text": "可限制未经授权的网络连接，阻断恶意软件的外联与远程入侵"}, {"key": "B", "text": "毫无作用，应关闭"}, {"key": "C", "text": "只会拖慢网速没有别的用"}, {"key": "D", "text": "能替代杀毒软件"}], "correct_key": "A", "explanation": "防火墙管控网络连接，可阻断恶意软件的命令控制外联与外部入侵，应保持开启。", "category": "malware", "qtype": "single"}, {"prompt": "使用管理员（root/administrator）权限日常办公，从防恶意软件角度看？", "options": [{"key": "A", "text": "更方便，应始终用管理员账号"}, {"key": "B", "text": "会放大恶意软件的破坏范围，日常应使用低权限账号，仅在必要时提权"}, {"key": "C", "text": "权限越高越安全"}, {"key": "D", "text": "与安全无关"}], "correct_key": "B", "explanation": "遵循最小权限原则，用普通账号日常办公可限制恶意软件一旦运行造成的破坏。", "category": "malware", "qtype": "single"}, {"prompt": "怀疑手机中了恶意软件（异常耗电、乱跳广告、莫名扣费），较稳妥的处理是？", "options": [{"key": "A", "text": "无视继续用"}, {"key": "B", "text": "给更多 App 授权解决"}, {"key": "C", "text": "断网、卸载可疑近期安装的 App、用安全软件扫描，必要时备份数据后恢复出厂设置并联系 IT"}, {"key": "D", "text": "把手机借给别人用掉流量"}], "correct_key": "C", "explanation": "断网、清除可疑 App、扫描直至必要时恢复出厂，是清除移动端恶意软件的稳妥路径。", "category": "malware", "qtype": "single"}, {"prompt": "关于「定期全盘杀毒扫描」与「实时防护」的关系，正确认识是？", "options": [{"key": "A", "text": "有实时防护就完全不必再全盘扫描"}, {"key": "B", "text": "两者只能二选一"}, {"key": "C", "text": "全盘扫描没有意义"}, {"key": "D", "text": "两者互补：实时防护拦截即时威胁，定期全盘扫描可发现潜伏或漏网的恶意文件"}], "correct_key": "D", "explanation": "实时防护与定期全盘扫描互为补充，后者能查出潜伏已久或此前漏检的恶意文件。", "category": "malware", "qtype": "single"}, {"prompt": "收到系统或杀毒软件关于「检测到恶意软件已被清除」的通知后，稳妥的后续动作是？", "options": [{"key": "A", "text": "上报 IT 记录事件、修改可能泄露的相关密码，并留意是否有残留异常"}, {"key": "B", "text": "当作没事，不用管"}, {"key": "C", "text": "立即关闭杀毒软件庆祝"}, {"key": "D", "text": "把清除记录删掉隐瞒"}], "correct_key": "A", "explanation": "感染事件后应上报存档、更换可能泄露的凭据并观察残留，防止后门或凭据被继续滥用。", "category": "malware", "qtype": "single"}, ]