[ { "id": "q1", "type": "single", "category": "Kepatuhan Hukum (Compliance & Law)", "question": { "id": "Menurut materi pelatihan, manakah yang BUKAN bagian dari kerangka utama 'Tiga Undang-Undang Keamanan Siber' di Cina?", "en": "According to the training material, which of the following is NOT part of China's core 'Three Cybersecurity Laws'?", "zh": "根据培训材料，中国网络安全“三法”核心体系不包括以下哪部法律？" }, "options": [ { "id": "A", "text": { "id": "Undang-Undang Keamanan Siber (Cybersecurity Law)", "en": "Cybersecurity Law", "zh": "《网络安全法》" } }, { "id": "B", "text": { "id": "Undang-Undang Keamanan Data (Data Security Law)", "en": "Data Security Law", "zh": "《数据安全法》" } }, { "id": "C", "text": { "id": "Hukum Pidana (Penal Code)", "en": "Penal Code", "zh": "《刑法》" } }, { "id": "D", "text": { "id": "Undang-Undang Perlindungan Informasi Pribadi (PIPL)", "en": "Personal Information Protection Law", "zh": "《个人信息保护法》" } } ], "answer": [ "C" ], "explanation": { "id": "Tiga Undang-Undang Keamanan Siber yang utama adalah Undang-Undang Keamanan Siber, Undang-Undang Keamanan Data, dan Undang-Undang Perlindungan Informasi Pribadi.", "en": "The core 'Three Cybersecurity Laws' consist of the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.", "zh": "中国网络安全“三法”核心体系为《网络安全法》、《数据安全法》和《个人信息保护法》。" } }, { "id": "q2", "type": "single", "category": "Kepatuhan Hukum (Compliance & Law)", "question": { "id": "Berdasarkan Undang-Undang Keamanan Siber, berapa denda maksimum untuk penggunaan kata sandi lemah dan tidak menyimpan log?", "en": "According to the Cybersecurity Law, what is the maximum fine for using weak passwords and failing to retain system logs?", "zh": "根据《网络安全法》，使用弱口令且未留存日志可能面临的最高罚款？" }, "options": [ { "id": "A", "text": { "id": "100 Juta Rupiah (100k RMB)", "en": "100k RMB", "zh": "10万元" } }, { "id": "B", "text": { "id": "500 Juta Rupiah (500k RMB)", "en": "500k RMB", "zh": "50万元" } }, { "id": "C", "text": { "id": "1 Miliar Rupiah (1M RMB)", "en": "1M RMB", "zh": "100万元" } }, { "id": "D", "text": { "id": "5 Miliar Rupiah (5M RMB)", "en": "5M RMB", "zh": "500万元" } } ], "answer": [ "C" ], "explanation": { "id": "Denda maksimum untuk pelanggaran berat keamanan sistem dan kegagalan penyimpanan log dapat mencapai 1.000.000 RMB (1 Miliar Rp).", "en": "The maximum fine for severe system security violations and log retention failure can reach 1,000,000 RMB.", "zh": "违反《网络安全法》使用弱口令且未留存日志，情节严重的最高处以100万元罚款。" } }, { "id": "q3", "type": "single", "category": "Kepatuhan Hukum (Compliance & Law)", "question": { "id": "Peraturan baru 2026 menetapkan denda maksimum bagi penanggung jawab langsung infrastruktur informasi kritis hingga:", "en": "The 2026 regulations stipulate that the maximum penalty for direct responsible persons of critical infrastructure can reach:", "zh": "2026年新法规定，针对关键信息基础设施运营者的直接责任人，最高处罚可以达到：" }, "options": [ { "id": "A", "text": { "id": "100 Juta Rupiah (100k RMB)", "en": "100k RMB", "zh": "10万元" } }, { "id": "B", "text": { "id": "500 Juta Rupiah (500k RMB)", "en": "500k RMB", "zh": "50万元" } }, { "id": "C", "text": { "id": "1 Miliar Rupiah (1M RMB)", "en": "1M RMB", "zh": "100万元" } }, { "id": "D", "text": { "id": "2 Miliar Rupiah (2M RMB)", "en": "2M RMB", "zh": "200万元" } } ], "answer": [ "D" ], "explanation": { "id": "Penanggung jawab langsung pada infrastruktur informasi kritis dapat dikenakan sanksi denda individu hingga 2,000,000 RMB.", "en": "Direct responsible individuals in critical information infrastructure can face personal fines up to 2,000,000 RMB.", "zh": "针对关键信息基础设施运营者的直接责任人，最高个人罚款可达200万元。" } }, { "id": "q4", "type": "single", "category": "Kepatuhan Hukum (Compliance & Law)", "question": { "id": "Apakah yang dimaksud dengan prinsip 'Denda Ganda' (Dual Penalty System) yang disebutkan dalam pelatihan?", "en": "What does the 'Dual Penalty System' mentioned in the training refer to?", "zh": "培训中提到的“双罚制”是指什么？" }, "options": [ { "id": "A", "text": { "id": "Menerapkan sanksi terhadap organisasi dan penanggung jawab langsung secara bersamaan", "en": "Penalizing both the organization and direct responsible individuals", "zh": "对违规单位和直接责任人同时处罚" } }, { "id": "B", "text": { "id": "Pelaksanaan teknis dan manajemen secara bersamaan", "en": "Simultaneous execution of technology and management", "zh": "技术与管理同时执行" } }, { "id": "C", "text": { "id": "Hukuman ganda domestik dan internasional", "en": "Dual domestic and international penalties", "zh": "国内外双重惩罚" } }, { "id": "D", "text": { "id": "Kepatuhan bisnis dan hukum dicapai bersamaan", "en": "Business and compliance achieved simultaneously", "zh": "业务与合规同时达标" } } ], "answer": [ "A" ], "explanation": { "id": "Prinsip Denda Ganda berarti saat terjadi insiden keamanan berat, baik insitusi/perusahaan maupun individu penanggung jawab akan dikenakan sanksi hukum.", "en": "Dual Penalty System means both the enterprise entity and the individual in charge face legal penalties for severe security breaches.", "zh": "双罚制指发生严重网络安全事件时，既对违法单位处以罚款，又对直接负责的主管人员和其他直接责任人员一并进行处罚。" } }, { "id": "q5", "type": "single", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Serangan siber umumnya melalui 5 tahapan. Pada 2 tahap manakah karyawan paling berkesempatan menghentikan serangan?", "en": "Cyber attacks typically go through 5 stages. In which 2 stages do employees have the best chance to disrupt the attack?", "zh": "网络攻击通常经历五个阶段，员工最有机会打断的是哪两个阶段？" }, "options": [ { "id": "A", "text": { "id": "Deteksi & Akses Awal (Reconnaissance & Initial Access)", "en": "Reconnaissance & Initial Access", "zh": "探测与进入" } }, { "id": "B", "text": { "id": "Kontrol & Pergerakan Lateral (Control & Lateral Movement)", "en": "Control & Lateral Movement", "zh": "控制与扩张" } }, { "id": "C", "text": { "id": "Akses Awal & Eksekusi Kontrol (Initial Access & Control)", "en": "Initial Access & Control", "zh": "进入与控制" } }, { "id": "D", "text": { "id": "Pencurian & Kerusakan Data (Exfiltration & Damage)", "en": "Exfiltration & Damage", "zh": "窃取与破坏" } } ], "answer": [ "C" ], "explanation": { "id": "Karyawan memiliki kewaspadaan tertinggi pada tahap Akses Awal (seperti email phishing) dan Eksekusi Kontrol awal.", "en": "Employees have the highest chance of interrupting attacks during the Initial Access (phishing) and initial Control execution stages.", "zh": "在攻击的前端“进入”（如识别钓鱼邮件）与“控制”初期，员工防范意识最能发挥关卡阻断作用。" } }, { "id": "q6", "type": "single", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Manakah dari berikut ini yang BUKAN merupakan pintu masuk umum serangan siber?", "en": "Which of the following is NOT a common entry point for cyber attacks?", "zh": "以下哪项不是网络攻击的常见入口？" }, "options": [ { "id": "A", "text": { "id": "Email Phishing", "en": "Phishing Email", "zh": "邮件" } }, { "id": "B", "text": { "id": "Kredensial Tercuri", "en": "Stolen Credentials", "zh": "凭据" } }, { "id": "C", "text": { "id": "Kerentanan Sistem", "en": "System Vulnerability", "zh": "系统漏洞" } }, { "id": "D", "text": { "id": "Pernyataan Pribadi", "en": "Personal Statement", "zh": "个人声明" } } ], "answer": [ "D" ], "explanation": { "id": "Email phishing, kebocoran kata sandi, dan celah sistem adalah vektor serangan utama. Pernyataan pribadi bukan vektor teknis peretasan.", "en": "Email phishing, stolen credentials, and system vulnerabilities are primary attack vectors. Personal statements are not an exploit vector.", "zh": "邮件钓鱼、凭据被盗和漏洞利用是攻击者的三大核心入侵手段，个人声明并非网络攻击物理/技术入口。" } }, { "id": "q7", "type": "single", "category": "Keamanan Sandi & MFA (Password & MFA)", "question": { "id": "Apakah titik masuk awal (initial compromise) pada insiden peretasan British Library?", "en": "What was the initial entry point in the British Library cybersecurity incident?", "zh": "英国图书馆（British Library）安全事件的初始入侵点是什么？" }, "options": [ { "id": "A", "text": { "id": "Email Phishing", "en": "Phishing Email", "zh": "邮件钓鱼" } }, { "id": "B", "text": { "id": "Akses Remote Terminal tanpa Autentikasi Multi-Faktor (MFA)", "en": "Remote Terminal Access without MFA", "zh": "远程终端访问未启用MFA" } }, { "id": "C", "text": { "id": "Ancaman Pihak Internal (Insider Threat)", "en": "Insider Threat", "zh": "内部人员泄密" } }, { "id": "D", "text": { "id": "Intrusi Fisik", "en": "Physical Intrusion", "zh": "物理入侵" } } ], "answer": [ "B" ], "explanation": { "id": "Insiden British Library terjadi karena portal rintisan akses jarak jauh tidak dilindungi dengan autentikasi ganda (MFA).", "en": "The British Library breach occurred because a remote access gateway lacked Multi-Factor Authentication (MFA).", "zh": "英国图书馆安全事件初始入侵点为管理员远程入口未开启MFA多因素认证。" } }, { "id": "q8", "type": "single", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Pada insiden British Library, tindakan pertama apa yang dilakukan penyerang setelah berhasil masuk sistem?", "en": "In the British Library incident, what was the first action attackers took after gaining system access?", "zh": "（替换题）英国图书馆安全事件中，攻击者在进入系统后首先采取的行动是什么？" }, "options": [ { "id": "A", "text": { "id": "Langsung mengenkripsi server", "en": "Directly encrypting servers", "zh": "直接加密服务器" } }, { "id": "B", "text": { "id": "Mencuri file penting berisi data sensitif", "en": "Exfiltrating key files containing sensitive data", "zh": "窃取包含敏感数据的关键文件" } }, { "id": "C", "text": { "id": "Menghapus log sistem", "en": "Deleting system logs", "zh": "删除系统日志" } }, { "id": "D", "text": { "id": "Mencuri email karyawan", "en": "Stealing employee emails", "zh": "窃取员工邮件" } } ], "answer": [ "B" ], "explanation": { "id": "Peretas pertama kali mencuri dan mentransfer dokumen rahasia sebelum meluncurkan ransomware pemerasan ganda.", "en": "Attackers exfiltrated confidential documents first before launching double-extortion ransomware.", "zh": "攻击者进入系统后优先对敏感高价值数据进行横向复制与外传窃取。" } }, { "id": "q9", "type": "single", "category": "Keamanan Sandi & MFA (Password & MFA)", "question": { "id": "Apakah celah kerentanan utama pada insiden peretasan Change Healthcare?", "en": "What was the primary vulnerability in the Change Healthcare incident?", "zh": "Change Healthcare事件的主要漏洞是什么？" }, "options": [ { "id": "A", "text": { "id": "Kebocoran hak akses tinggi pihak internal", "en": "Internal high-privilege credential leakage", "zh": "内部人员高权限泄露" } }, { "id": "B", "text": { "id": "Akses Jarak Jauh (Remote Access) tanpa MFA", "en": "Remote Access without MFA", "zh": "远程访问未启用MFA" } }, { "id": "C", "text": { "id": "Jaringan Wi-Fi tidak aman", "en": "Unsecure Wi-Fi network", "zh": "Wi-Fi不安全" } }, { "id": "D", "text": { "id": "Penyimpanan data tanpa enkripsi", "en": "Unencrypted data storage", "zh": "未加密存储" } } ], "answer": [ "B" ], "explanation": { "id": "Celah utama peretasan Change Healthcare adalah pintu masuk portal Citrix jarak jauh yang tidak menerapkan kebijakan MFA wajib.", "en": "The critical flaw in Change Healthcare was a remote Citrix gateway that did not enforce Multi-Factor Authentication.", "zh": "Change Healthcare重大安全事件核心原因为远程办公入口未强制部署MFA。" } }, { "id": "q10", "type": "single", "category": "Keamanan Sandi & MFA (Password & MFA)", "question": { "id": "Pada insiden Snowflake, bagaimana cara utama penyerang memperoleh kredensial pengguna?", "en": "In the Snowflake incident, what was the primary way attackers obtained user credentials?", "zh": "Snowflake事件中，攻击者获取凭据的主要途径是什么？" }, "options": [ { "id": "A", "text": { "id": "Serangan Brute Force", "en": "Brute Force Attack", "zh": "暴力破解" } }, { "id": "B", "text": { "id": "Infeksi Malware Infostealer pada perangkat eksternal", "en": "Infostealer malware infecting external endpoints", "zh": "信息窃取木马感染外部终端" } }, { "id": "C", "text": { "id": "Diberikan oleh pihak internal", "en": "Provided by internal personnel", "zh": "内部人员提供" } }, { "id": "D", "text": { "id": "Eksploitasi Kerentanan Zero-Day Sistem", "en": "Zero-Day System Vulnerability", "zh": "系统0day漏洞" } } ], "answer": [ "B" ], "explanation": { "id": "Kredensial dicuri dari komputer pribadi/kontraktor yang terinfeksi malware pencuri kata sandi (Infostealer).", "en": "Credentials were harvested from contractor PCs infected with password-stealing malware (Infostealers).", "zh": "攻击者通过窃密木马（Infostealer）感染外包/个人终端，非法采集到云数据库登录凭据。" } }, { "id": "q11", "type": "single", "category": "Keamanan Sandi & MFA (Password & MFA)", "question": { "id": "Pada insiden Okta, apakah penyebab utama kebocoran kredensial akun layanan?", "en": "In the Okta security incident, what was the main cause of service account credential leakage?", "zh": "Okta安全事件中，服务账号凭据泄露的主要原因是？" }, "options": [ { "id": "A", "text": { "id": "Kata sandi lemah dan kadaluarsa", "en": "Weak and expired password", "zh": "弱口令且过期" } }, { "id": "B", "text": { "id": "Karyawan login akun Google pribadi di komputer kantor, menyinkronkan kata sandi kantor", "en": "Employee logged into personal Google account on work PC, syncing corporate credentials", "zh": "员工在公司电脑上登录个人Google账号，同步了凭据" } }, { "id": "C", "text": { "id": "Menggunakan kata sandi bersama", "en": "Sharing credentials", "zh": "共享密码" } }, { "id": "D", "text": { "id": "Kebocoran dari pihak vendor", "en": "Leakage from third-party vendor", "zh": "供应商泄露" } } ], "answer": [ "B" ], "explanation": { "id": "Karyawan mengaktifkan sinkronisasi Chrome di akun Google pribadi pada laptop kerja, sehingga kata sandi sistem perusahaan ikut terunggah ke cloud pribadi yang diretas.", "en": "An employee enabled personal Google account sync on a work PC, pushing work system credentials to a compromised personal cloud.", "zh": "员工在工作电脑登录个人Google账号开启自动同步，导致公司工作凭据随个人账号被窃。" } }, { "id": "q12", "type": "single", "category": "Rekayasa Sosial (Social Engineering)", "question": { "id": "Manakah langkah paling efektif untuk mencegah penipuan video konferensi berbantuan AI (Deepfake Video Fraud)?", "en": "What is the most effective measure to prevent AI Deepfake video conference fraud?", "zh": "（替换题）面对深伪视频会议诈骗，以下哪项是最有效的防范措施？" }, "options": [ { "id": "A", "text": { "id": "Tanya jawab ketat saat panggilan video", "en": "Strict Q&A during video call", "zh": "严格视频问答" } }, { "id": "B", "text": { "id": "Meminta lawan bicara menunjukkan KTP", "en": "Requesting ID card verification", "zh": "要求对方提供身份证" } }, { "id": "C", "text": { "id": "Menggunakan kode rahasia luring (offline passphrase) & verifikasi dua orang", "en": "Using an offline secret passphrase & performing dual-person verification", "zh": "使用已知密码/离线暗号并执行双人核验" } }, { "id": "D", "text": { "id": "Menolak panggilan video", "en": "Refusing video calls", "zh": "拒绝视频通话" } } ], "answer": [ "C" ], "explanation": { "id": "Gunakan frasa sandi offline yang telah disepakati sebelumnya dan verifikasi transaksi via jalur telepon terpisah.", "en": "Use pre-arranged offline passphrases and verify transactions via separate phone channels.", "zh": "对于涉及资金与敏感权限的视频要求，必须通过事先约定的离线暗号及双人交叉核验。" } }, { "id": "q13", "type": "single", "category": "Rekayasa Sosial (Social Engineering)", "question": { "id": "Bagaimana cara masuk awal (initial access) pada insiden peretasan M&S (Marks & Spencer)?", "en": "What did the initial access vector involve in the M&S (Marks & Spencer) incident?", "zh": "M&S（玛莎百货）事件的初始进入方式涉及什么？" }, "options": [ { "id": "A", "text": { "id": "Email Phishing", "en": "Phishing Email", "zh": "邮件钓鱼" } }, { "id": "B", "text": { "id": "Penyamaran kompleks & Social Engineering yang melibatkan pihak ketiga/vendor", "en": "Complex impersonation & Social Engineering involving third-party vendors", "zh": "复杂的冒充与社会工程，涉及第三方" } }, { "id": "C", "text": { "id": "Eksploitasi Kerentanan Sistem", "en": "System Vulnerability Exploitation", "zh": "系统漏洞利用" } }, { "id": "D", "text": { "id": "Intrusi Fisik", "en": "Physical Intrusion", "zh": "物理入侵" } } ], "answer": [ "B" ], "explanation": { "id": "Peretas melakukan penyamaran identitas bantuan IT (vishing) untuk mengelabui helpdesk dan mereset kata sandi akses vendor.", "en": "Attackers spoofed IT helpdesk communications to trick personnel into resetting vendor access credentials.", "zh": "攻击者通过冒充第三方服务商结合社会工程学电话（Vishing）突破了身份重置防线。" } }, { "id": "q14", "type": "single", "category": "Rekayasa Sosial (Social Engineering)", "question": { "id": "Apakah pelajaran penting dari insiden keamanan M&S?", "en": "What is the key lesson learned from the M&S security incident?", "zh": "（替换题）M&S安全事件给我们的重要教训是？" }, "options": [ { "id": "A", "text": { "id": "Akses pihak ketiga harus dikontrol ketat & verifikasi kuat saat reset identitas", "en": "Third-party access must be strictly controlled & identity resets strongly verified", "zh": "第三方权限必须可控，且重置身份时需强核验" } }, { "id": "B", "text": { "id": "Semua sistem harus diperbarui ke versi terbaru", "en": "All systems must be updated to the latest version", "zh": "所有系统必须升级到最新版本" } }, { "id": "C", "text": { "id": "Hanya divisi IT yang perlu peduli keamanan", "en": "Only the IT department needs to care about security", "zh": "只有IT部门需要关注安全" } }, { "id": "D", "text": { "id": "Serangan Social Engineering tidak bisa dicegah", "en": "Social Engineering attacks cannot be prevented", "zh": "社会工程攻击无法防范" } } ], "answer": [ "A" ], "explanation": { "id": "Hak akses pihak luar harus menerapkan prinsip hak terendah (Least Privilege) serta verifikasi berlapis saat penanganan akun.", "en": "Third-party access must enforce least privilege and require strict identity verification during password resets.", "zh": "第三方受信任通道与身份重置环节必须建立强制双人核验机制。" } }, { "id": "q15", "type": "single", "category": "Kesadaran Keamanan (Security Awareness)", "question": { "id": "Manakah pernyataan yang BENAR mengenai kondisi keamanan siber di Indonesia?", "en": "Which of the following statements is TRUE regarding Indonesia's cybersecurity posture?", "zh": "（替换题）关于印尼网络安全状况，以下哪项说法是正确的？" }, "options": [ { "id": "A", "text": { "id": "Peringkat GCI Tier 1 Indonesia berarti kemampuan pertahanan siber nomor satu dunia", "en": "Indonesia's GCI Tier 1 ranking means world-leading cyber defense", "zh": "印尼GCI Tier1意味着网络攻防实力世界领先" } }, { "id": "B", "text": { "id": "Keamanan digital pribadi telah sepenuhnya teratasi", "en": "Individual digital security issues are completely resolved", "zh": "国家投入提升后，个人数字安全问题已完全解决" } }, { "id": "C", "text": { "id": "Peringkat GCI tidak sama dengan kemampuan pertahanan nyata; keamanan perangkat tergantung kontrol organisasi & tindakan individu", "en": "GCI ranking does not equal actual defense capability; endpoint security depends on organizational controls & individual actions", "zh": "GCI评级不等于实际攻防实力，每台终端的安全仍取决于组织控制和个人动作" } }, { "id": "D", "text": { "id": "Jumlah insiden siber di Indonesia sangat sedikit", "en": "Cyber security incidents in Indonesia are extremely rare", "zh": "印尼境内网络安全事件数量极少" } } ], "answer": [ "C" ], "explanation": { "id": "Indeks Kebijakan Nasional (GCI) tidak menjamin setiap PC kantor aman dari ancaman; kebiasaan tindakan karyawan adalah garis pertahanan akhir.", "en": "National policy indexes do not guarantee endpoint security; individual employee behavior remains the critical last line of defense.", "zh": "国家宏观指数评级不等于微观终端落地安全，个人防范意识是防线的核心。" } }, { "id": "q16", "type": "single", "category": "Keamanan Jaringan & Mobile (Network & Mobile)", "question": { "id": "Jika menerima file APK via aplikasi pesan (misal: menyamar sebagai Bonus THR), apa tindakan yang BENAR?", "en": "If you receive an APK installer via messaging app (e.g. disguised as THR bonus), what is the CORRECT action?", "zh": "遇到通过聊天发送的APK安装包要求（如伪装成THR福利），正确的做法是？" }, "options": [ { "id": "A", "text": { "id": "Langsung pasang & buka file", "en": "Immediately install and open", "zh": "立即安装查看" } }, { "id": "B", "text": { "id": "Teruskan ke rekan kerja untuk dipastikan sebelum pasang", "en": "Forward to colleague for confirmation before installing", "zh": "转发给同事确认后再安装" } }, { "id": "C", "text": { "id": "Jangan unduh & pasang; verifikasi ke tim HR via kontak resmi kantor", "en": "Do not download or install; verify with HR via official company directory", "zh": "不下载不安装，通过公司通讯录联系HR核验" } }, { "id": "D", "text": { "id": "Pasang dulu baru lapor jika ada virus", "en": "Install first, report later if infected", "zh": "先安装，如果是病毒再报告" } } ], "answer": [ "C" ], "explanation": { "id": "Dilarang mengunduh file installer APK dari luar Toko Aplikasi Resmi (Play Store). Selalu verifikasi info promosi via HR resmi.", "en": "Never install APK files from unofficial messaging apps. Always verify HR announcements via official channels.", "zh": "绝不通过非官方渠道下载安装未知APK安装包，遇到福利宣传须独立联系HR核对。" } }, { "id": "q17", "type": "single", "category": "Keamanan Jaringan & Mobile (Network & Mobile)", "question": { "id": "Jika terlanjur mengunduh/menginstal file APK mencurigakan, langkah darurat apa yang HARUS segera diambil?", "en": "If you accidentally installed a suspicious APK, what immediate emergency action SHOULD be taken?", "zh": "已安装可疑APK后，应立即采取什么措施？" }, "options": [ { "id": "A", "text": { "id": "Tetap gunakan HP sambil mengamati keadaan", "en": "Continue using while observing", "zh": "继续使用观察情况" } }, { "id": "B", "text": { "id": "Hapus instalan (uninstall) APK saja", "en": "Uninstall APK and delete installer package", "zh": "卸载APK并删除安装包" } }, { "id": "C", "text": { "id": "Putuskan koneksi internet (Wi-Fi/Data) dan segera laporkan ke tim IT", "en": "Disconnect network (Wi-Fi/Cellular) and report to IT immediately", "zh": "断网并立即报告" } }, { "id": "D", "text": { "id": "Restart HP", "en": "Reboot phone", "zh": "重启手机" } } ], "answer": [ "C" ], "explanation": { "id": "Segera matikan Wi-Fi dan Data Seluler untuk memotong jalur kontrol trojan/remote malware, lalu hubungi tim IT Security.", "en": "Immediately disable Wi-Fi and Cellular Data to sever C2 trojan communication, then report to IT Security.", "zh": "第一时间切断网络连接（拔网线/关Wi-Fi/开飞行模式），阻断木马与远端C2服务器通信并呈报。" } }, { "id": "q18", "type": "single", "category": "Keamanan Jaringan & Mobile (Network & Mobile)", "question": { "id": "Di tempat umum terdapat dua Wi-Fi dengan nama sama (satu tanpa kata sandi), apa tindakan yang BENAR?", "en": "In a public area, you see two Wi-Fi hotspots with the same name (one without password). What is the CORRECT action?", "zh": "在公共区域发现两个同名Wi-Fi热点，其中一个无需密码，正确的做法是？" }, "options": [ { "id": "A", "text": { "id": "Pilih yang sinyalnya paling kuat", "en": "Choose the one with stronger signal", "zh": "选择信号更强的连接" } }, { "id": "B", "text": { "id": "Pilih yang tanpa kata sandi karena lebih praktis", "en": "Choose the open one for convenience", "zh": "选择无需密码的更方便" } }, { "id": "C", "text": { "id": "Tanyakan kepada petugas/IT untuk SSID resmi atau gunakan Hotspot HP pribadi", "en": "Confirm official SSID with staff/IT or use personal mobile hotspot", "zh": "向前台或IT确认正确的SSID" } }, { "id": "D", "text": { "id": "Keduanya tidak disambungkan, pakai hotspot seluler pribadi", "en": "Do not connect to either; use personal cellular hotspot", "zh": "两个都不连，使用手机热点" } } ], "answer": [ "C" ], "explanation": { "id": "Wi-Fi publik gratis tanpa sandi sering kali merupakan jebakan Evil Twin Wi-Fi yang disiapkan peretas untuk mengintip data.", "en": "Open public Wi-Fi hotspots are often Evil Twin traps designed to intercept confidential data.", "zh": "开放式公共Wi-Fi极易为黑客设立的伪造热点（Evil Twin Attack），必须核对SSID或开启公司VPN/个人热点。" } }, { "id": "q19", "type": "single", "category": "Perlindungan Data (Data Protection)", "question": { "id": "Mengenai tindakan mengirim tangkapan layar (screenshot) data kerja ke WhatsApp pribadi, manakah pernyataan yang BENAR?", "en": "Regarding sending screenshots of work data to personal WhatsApp, which statement is TRUE?", "zh": "关于工作数据截图发送到个人WhatsApp，以下说法正确的是？" }, "options": [ { "id": "A", "text": { "id": "Langsung hapus setelah kirim tidak akan bermasalah", "en": "Deleting immediately after sending eliminates any risk", "zh": "发完立即删除就不会有问题" } }, { "id": "B", "text": { "id": "Hanya kirim ke rekan terpercaya diperbolehkan", "en": "Sending only to trusted colleagues is allowed", "zh": "只发给信任的同事是可以的" } }, { "id": "C", "text": { "id": "Tangkapan layar masuk ke cadangan cloud; menghapus di HP tidak menghilangkan salinan di cloud", "en": "Screenshots enter cloud backups; deleting from chat does not remove cloud copies", "zh": "截图会进入聊天备份、云同步，删除不代表副本消失" } }, { "id": "D", "text": { "id": "Aman selama tidak diteruskan ke pihak ketiga", "en": "Safe as long as it's not forwarded to third parties", "zh": "只要不转发给第三方就安全" } } ], "answer": [ "C" ], "explanation": { "id": "Gambar yang terkirim di WhatsApp otomatis tersimpan di galeri lokal & ter-backup ke Google Drive/iCloud pribadi yang berisiko bocor.", "en": "WhatsApp photos automatically sync to local galleries and personal cloud backups, creating persistent unmanaged copies.", "zh": "截图发送到个人通讯软件会自动触发云端备份与本地相册存储，删掉聊天记录不等于清理干净敏感副本。" } }, { "id": "q20", "type": "single", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Jika antivirus mati sendiri dan muncul pop-up aneh pada komputer kerja, apa tindakan yang BENAR?", "en": "If antivirus is disabled automatically and strange pop-ups appear on your PC, what is the CORRECT action?", "zh": "发现防病毒软件被关闭且出现异常弹窗，正确的处置是？" }, "options": [ { "id": "A", "text": { "id": "Restart beberapa kali sampai normal kembali", "en": "Reboot multiple times to see if it recovers", "zh": "重启几次看是否能恢复" } }, { "id": "B", "text": { "id": "Tetap bekerja menunggu tim IT menangani", "en": "Continue working until IT handles it", "zh": "继续工作，等IT统一处理" } }, { "id": "C", "text": { "id": "Hentikan aktivitas, cabut kabel jaringan/Wi-Fi, catat gejala, dan laporkan ke IT", "en": "Stop operating, disconnect network, log symptoms, and contact IT", "zh": "停止操作，断开网络，记录现象并联系IT" } }, { "id": "D", "text": { "id": "Pasang ulang antivirus sendiri", "en": "Reinstall antivirus software yourself", "zh": "自行重新安装防病毒软件" } } ], "answer": [ "C" ], "explanation": { "id": "Hentikan penggunaan, putuskan jaringan (kabel/Wi-Fi), dan segera hubungi tim IT Security untuk isolasi ancaman.", "en": "Stop work immediately, disconnect network cables/Wi-Fi, and contact IT Security to contain potential malware.", "zh": "防病毒软件异常关闭是木马或勒索病毒植入的前兆，必须立即断网并上报IT。" } }, { "id": "q21", "type": "single", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Menerima email 'Email akan dinonaktifkan dalam 30 menit, klik tautan untuk verifikasi', apa tindakan yang BENAR?", "en": "Receiving an email stating 'Email suspended in 30 mins, click link to verify', what is the CORRECT action?", "zh": "收到“邮箱30分钟后停用，请点击链接重新登录并输入验证码”的邮件，正确的做法是？" }, "options": [ { "id": "A", "text": { "id": "Langsung klik tautan & ikuti petunjuk", "en": "Immediately click link and follow prompt", "zh": "立即点击链接操作" } }, { "id": "B", "text": { "id": "Klik tautan dulu untuk melihat tampilan web", "en": "Click link first to inspect page legitimacy", "zh": "先点击链接看看页面是否正规" } }, { "id": "C", "text": { "id": "Jangan klik tautan; masuk mandiri lewat Portal Resmi Kantor dan laporkan email phishing", "en": "Do not click link; access via official corporate portal independently and report", "zh": "不点链接，从公司门户进入独立核验，并报告" } }, { "id": "D", "text": { "id": "Teruskan email ke divisi IT", "en": "Forward email to IT department", "zh": "转发给IT部门处理" } } ], "answer": [ "C" ], "explanation": { "id": "Email yang menebar rasa panik dan tenggat waktu sempit adalah modus khas phishing pencurian kata sandi/OTP.", "en": "Urgent deadlines and panic-inducing emails are classic credential-harvesting phishing tactics.", "zh": "制造紧迫感要求点击链接输入验证码的为典型钓鱼邮件，切勿点击，须从正式入口独立核验。" } }, { "id": "q22", "type": "single", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Manakah aturan yang BENAR saat menggunakan komputer bersama (Shared PC / Public Workstation)?", "en": "Which rule is CORRECT when using a shared computer / public workstation?", "zh": "关于共享电脑的使用，以下哪项是正确的？" }, "options": [ { "id": "A", "text": { "id": "Boleh mewakili rekan kerja untuk login", "en": "Allowed to log in on behalf of colleagues", "zh": "可以帮同事代登录" } }, { "id": "B", "text": { "id": "Boleh centang 'Ingat Kata Sandi' agar praktis", "en": "Allowed to check 'Remember Password' for convenience", "zh": "可以勾选“记住密码”方便下次使用" } }, { "id": "C", "text": { "id": "Selalu Logout/Keluar akun dan hapus file sementara setelah selesai", "en": "Always logout of accounts and clear temporary files after use", "zh": "使用后退出账号并清理临时文件" } }, { "id": "D", "text": { "id": "Simpan file kerja di Desktop komputer publik", "en": "Save work files on desktop for easy access", "zh": "可以把工作文件保存在桌面便于查找" } } ], "answer": [ "C" ], "explanation": { "id": "Pada komputer publik/bersama, selalu logout akun, bersihkan riwayat peramban, dan jangan pernah simpan kata sandi.", "en": "On shared computers, always log out, clear browser history, and never store saved passwords.", "zh": "在公共/共享电脑上使用后必须主动退出所有系统并清理浏览器缓存与临时下载文件。" } }, { "id": "q23", "type": "single", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Manakah yang BUKAN merupakan bagian dari prinsip '5 Cek' dalam mengidentifikasi Email Phishing?", "en": "Which of the following is NOT part of the '5 Checks' for identifying Phishing Emails?", "zh": "钓鱼邮件“五看”中不包括以下哪项？" }, "options": [ { "id": "A", "text": { "id": "Cek Pengirim (Sender Domain)", "en": "Check Sender Domain", "zh": "看发件人" } }, { "id": "B", "text": { "id": "Cek Nada & Subjek (Urgency & Subject)", "en": "Check Tone & Subject", "zh": "看语气与主题" } }, { "id": "C", "text": { "id": "Melihat ukuran file lampiran (Attachment File Size)", "en": "Checking attachment file size", "zh": "看附件大小" } }, { "id": "D", "text": { "id": "Cek Permintaan Kata Sandi/OTP", "en": "Check if password/OTP is requested", "zh": "看请求内容是否索要密码/OTP" } } ], "answer": [ "C" ], "explanation": { "id": "Prinsip 5 Cek meliput: Pengirim, Subjek/Urgenitas, Tautan URL, Isi Permintaan Kredensial, dan Ekstensi Lampiran (bukan ukuran file).", "en": "The 5 Checks focus on Sender, Subject/Urgency, Links, Credential requests, and File Extensions (not file size).", "zh": "钓鱼邮件“五看”关注发件人、主题语气、链接真实性、是否索要凭据/OTP及附件类型，非单纯看字节大小。" } }, { "id": "q24", "type": "single", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Dalam prosedur penanganan Phishing '4 Langkah Mutlak', apakah langkah PERTAMA yang harus dilakukan?", "en": "In the '4 Absolute Steps' for handling phishing, what is the FIRST step?", "zh": "钓鱼邮件处置“四要”中，第一步是？" }, "options": [ { "id": "A", "text": { "id": "Verifikasi lewat saluran resmi", "en": "Verify via official channel", "zh": "要换渠道核验" } }, { "id": "B", "text": { "id": "Berhenti sejenak (Jangan asal klik)", "en": "Pause first (Stop and don't click blindly)", "zh": "要停一下" } }, { "id": "C", "text": { "id": "Masuk dari portal resmi", "en": "Access via official portal", "zh": "要从正式入口进入" } }, { "id": "D", "text": { "id": "Segera laporkan ke IT", "en": "Report immediately to IT", "zh": "要立即报告" } } ], "answer": [ "B" ], "explanation": { "id": "Langkah pertama yang paling penting saat menerima email mencurigakan adalah 'Berhenti Sejenak' untuk tidak mengklik tautan asal.", "en": "The single most crucial first step is to 'Pause' before clicking any link impulsively.", "zh": "处置钓鱼邮件首要动作是“要停一下”，压制冲动按键，避免第一秒被钓。" } }, { "id": "q25", "type": "single", "category": "Rekayasa Sosial (Social Engineering)", "question": { "id": "Apakah yang terutama dimanfaatkan oleh serangan Social Engineering (Rekayasa Sosial)?", "en": "What do Social Engineering attacks primarily exploit?", "zh": "社会工程攻击主要利用的是什么？" }, "options": [ { "id": "A", "text": { "id": "Celah Keamanan Teknis Sistem", "en": "Technical System Vulnerabilities", "zh": "系统技术漏洞" } }, { "id": "B", "text": { "id": "Rasa percaya manusia & kelemahan alur kerja (Trust & Workflow)", "en": "Human trust & workflow vulnerabilities", "zh": "人的信任与工作流程" } }, { "id": "C", "text": { "id": "Celah Protokol Jaringan", "en": "Network Protocol Defects", "zh": "网络协议缺陷" } }, { "id": "D", "text": { "id": "Kelemahan Keamanan Fisik", "en": "Physical Security Vulnerabilities", "zh": "物理安全漏洞" } } ], "answer": [ "B" ], "explanation": { "id": "Social Engineering tidak memanipulasi kode program, melainkan memanipulasi psikologis manusia seperti kebiasaan rasa percaya dan simpati.", "en": "Social Engineering exploits human psychology, trust, and habits rather than code vulnerabilities.", "zh": "社交工程利用的是人性弱点（信任、从众、恐惧）以及日常业务流程疏漏。" } }, { "id": "q26", "type": "single", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Dalam 5 menit pertama setelah perangkat terinfeksi malware, manakah tindakan yang SALAH?", "en": "In the first 5 minutes after a device is infected with malware, which action is WRONG?", "zh": "发现设备被感染后的前五分钟，以下哪个操作是错误的？" }, "options": [ { "id": "A", "text": { "id": "Hentikan aktivitas (Stop Operating)", "en": "Stop Operating", "zh": "停止操作" } }, { "id": "B", "text": { "id": "Isolasi Jaringan (Disconnect Network)", "en": "Disconnect Network", "zh": "隔离网络" } }, { "id": "C", "text": { "id": "Segera Laporkan (Report Immediately)", "en": "Report Immediately", "zh": "立即报告" } }, { "id": "D", "text": { "id": "Mencoba merestart perangkat sendiri atau menghapus file secara asal", "en": "Attempting to reboot the device or delete files manually", "zh": "自行重启或删除文件尝试修复" } } ], "answer": [ "D" ], "explanation": { "id": "Merestart komputer dapat memicu enkripsi otomatis ransomware atau menghapus bukti log forensik memori.", "en": "Rebooting infected PCs can trigger ransomware encryption routines or destroy volatile memory forensic evidence.", "zh": "切勿擅自重启设备，重启可能触发勒索软件加快加密或破坏内存取证数据。" } }, { "id": "q27", "type": "single", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Apakah yang dimaksud dengan 'Manajemen Aset Perangkat' (Endpoint Asset Governance)?", "en": "What is meant by 'Endpoint Asset Governance'?", "zh": "终端安全“资产纳管”指的是什么？" }, "options": [ { "id": "A", "text": { "id": "Membelikan asuransi untuk semua perangkat", "en": "Purchasing insurance for all devices", "zh": "给所有设备购买保险" } }, { "id": "B", "text": { "id": "Komputer, server, HP kerja & remote terminal memiliki inventaris resmi & penanggung jawab", "en": "Corporate PCs, servers, mobile devices & remote terminals have official inventory & owners", "zh": "公司电脑、服务器、手机与远程终端有清单、有负责人" } }, { "id": "C", "text": { "id": "Memasang sistem operasi seragam pada semua HP/PC", "en": "Installing uniform operating system on all devices", "zh": "所有设备安装统一操作系统" } }, { "id": "D", "text": { "id": "Melarang penuh perangkat pribadi", "en": "Restricting employees from personal devices", "zh": "限制员工使用个人设备" } } ], "answer": [ "B" ], "explanation": { "id": "Aset terkelola berarti seluruh terminal kerja tercatat dalam inventaris perusahaan dan memiliki penanggung jawab pemilik akses yang jelas.", "en": "Asset governance ensures all endpoints are inventoried, monitored, and assigned responsible owners.", "zh": "资产纳管要求所有联网终端设备做到底数清、情况明、有清单、责任到人。" } }, { "id": "q28", "type": "single", "category": "Perlindungan Data (Data Protection)", "question": { "id": "Manakah yang BUKAN merupakan tahap resmi dalam Siklus Hidup Data (Data Security Lifecycle)?", "en": "Which of the following is NOT an official stage in the Data Security Lifecycle?", "zh": "数据安全生命周期覆盖的环节不包括以下哪项？" }, "options": [ { "id": "A", "text": { "id": "Pembuatan / Pengumpulan Data (Creation/Collection)", "en": "Data Creation/Collection", "zh": "产生" } }, { "id": "B", "text": { "id": "Penggunaan Data (Use)", "en": "Data Use", "zh": "使用" } }, { "id": "C", "text": { "id": "Enkripsi (Enkripsi adalah metode teknis, bukan siklus hidup)", "en": "Encryption (Encryption is a technical control, not a lifecycle stage)", "zh": "加密" } }, { "id": "D", "text": { "id": "Penghancuran / Pemusnahan Data (Destruction)", "en": "Data Destruction", "zh": "销毁" } } ], "answer": [ "C" ], "explanation": { "id": "Tahap standar siklus data adalah: Pengumpulan, Penyimpanan, Penggunaan, Berbagi, dan Pemusnahan. Enkripsi adalah teknik perlindungan.", "en": "The standard lifecycle stages are Collection, Storage, Use, Share, and Destruction. Encryption is a protective measure.", "zh": "数据生命周期标准环节为产生、存储、使用、共享、销毁。加密是安全保障技术手段。" } }, { "id": "q29", "type": "single", "category": "Kesadaran Keamanan (Security Awareness)", "question": { "id": "Bagaimana pemahaman yang BENAR tentang prinsip 'Ketidaktahuan Bukan Alasan Bebas Tanggung Jawab'?", "en": "What is the CORRECT understanding of 'Ignorance is No Excuse for Security Breaches'?", "zh": "以下关于“不知情绝非免责理由”的理解，正确的是？" }, "options": [ { "id": "A", "text": { "id": "Hanya manajemen puncak yang bertangung jawab", "en": "Only executive management is responsible", "zh": "只有管理层需要对安全事件负责" } }, { "id": "B", "text": { "id": "Setiap karyawan adalah subjek penanggung jawab keamanan siber & wajib mematuhi aturan", "en": "Every employee is personally accountable for cybersecurity & must follow policies", "zh": "每位员工都是网络安全的责任主体，必须主动履行安全义务" } }, { "id": "C", "text": { "id": "Divisi IT menanggung seluruh risiko keamanan", "en": "IT department bears all security liability", "zh": "IT部门承担所有安全责任" } }, { "id": "D", "text": { "id": "Vendor pihak ketiga tidak perlu bertanggung jawab", "en": "Third-party vendors bear no responsibility", "zh": "第三方供应商不需要对安全问题负责" } } ], "answer": [ "B" ], "explanation": { "id": "Setiap individu di dalam perusahaan bertanggung jawab atas keamanan data yang diaksesnya, ketidaktahuan atas kebijakan tidak membebaskan sanksi.", "en": "Every employee is accountable for data security; lack of policy awareness does not exempt one from consequences.", "zh": "每位员工均为自身账号与操作安全的直接责任主体，不能以“不知情”免除责任。" } }, { "id": "q30", "type": "single", "category": "Kesadaran Keamanan (Security Awareness)", "question": { "id": "Apakah tujuan UTAMA dari prinsip 'Stop, Verifikasi, Laporkan' yang diajarkan dalam pelatihan?", "en": "What is the MAIN objective of the 'Stop, Verify, Report' principle taught in the training?", "zh": "培训中“停一下、核一下、报一下”的核心目的是？" }, "options": [ { "id": "A", "text": { "id": "Mengurangi kecepatan kerja rutin", "en": "Slowing down work speed", "zh": "放慢工作速度" } }, { "id": "B", "text": { "id": "Memberikan kesempatan untuk menghentikan serangan di titik paling awal rantai serang", "en": "Providing an opportunity to halt the attack at the earliest stage of the attack chain", "zh": "在攻击链最前端争取一次停止与核验的机会" } }, { "id": "C", "text": { "id": "Menambah beban kerja divisi IT", "en": "Increasing IT department workload", "zh": "增加IT部门工作量" } }, { "id": "D", "text": { "id": "Menghindari penggunaan teknologi baru", "en": "Avoiding new technologies", "zh": "避免使用新技术" } } ], "answer": [ "B" ], "explanation": { "id": "Tujuan utamanya adalah mencegat serangan siber pada tahap paling awal sebelum malware berhasil menginfeksi jaringan.", "en": "The primary goal is to intercept cyber attacks at the very beginning before malware infects the network.", "zh": "目的在于在攻击链的最前端（Initial Access）为自己和组织争取一次阻断与核实的机会。" } }, { "id": "q31", "type": "multiple", "category": "Kepatuhan Hukum (Compliance & Law)", "question": { "id": "Menurut materi pelatihan, manakah yang termasuk dalam kerangka utama 'Tiga Undang-Undang Keamanan Siber'? (Pilih semua yang benar)", "en": "According to the training material, which of the following are included in the core 'Three Cybersecurity Laws'? (Select all that apply)", "zh": "根据培训材料，中国“三法”核心法律体系包含以下哪些？（多选）" }, "options": [ { "id": "A", "text": { "id": "Undang-Undang Keamanan Siber (Cybersecurity Law)", "en": "Cybersecurity Law", "zh": "《网络安全法》" } }, { "id": "B", "text": { "id": "Undang-Undang Keamanan Data (Data Security Law)", "en": "Data Security Law", "zh": "《数据安全法》" } }, { "id": "C", "text": { "id": "Undang-Undang Perlindungan Informasi Pribadi (PIPL)", "en": "Personal Information Protection Law", "zh": "《个人信息保护法》" } }, { "id": "D", "text": { "id": "Undang-Undang E-Commerce", "en": "E-Commerce Law", "zh": "《电子商务法》" } }, { "id": "E", "text": { "id": "Undang-Undang Tanda Tangan Elektronik", "en": "Electronic Signature Law", "zh": "《电子签名法》" } } ], "answer": [ "A", "B", "C" ], "explanation": { "id": "Tiga Undang-Undang Keamanan Siber meliputi UU Keamanan Siber, UU Keamanan Data, dan UU Perlindungan Informasi Pribadi.", "en": "The Three Cybersecurity Laws encompass the Cybersecurity Law, Data Security Law, and PIPL.", "zh": "中国网络安全“三法”核心法律体系为《网络安全法》、《数据安全法》和《个人信息保护法》。" } }, { "id": "q32", "type": "multiple", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Manakah di antara berikut ini yang termasuk dalam 5 tahapan Serangan Siber? (Pilih semua yang benar)", "en": "Which of the following belong to the 5 stages of a Cyber Attack? (Select all that apply)", "zh": "以下哪些属于网络攻击五个阶段的内容？（多选）" }, "options": [ { "id": "A", "text": { "id": "Akses Awal / Masuk (Phishing, Kredensial Tercuri)", "en": "Initial Access (Phishing, Stolen Credentials)", "zh": "进入（钓鱼、被盗凭据等）" } }, { "id": "B", "text": { "id": "Eksekusi & Kontrol (Sesi Remote, Malware)", "en": "Control & Execution (Sessions, Malware)", "zh": "控制（建立会话、植入程序）" } }, { "id": "C", "text": { "id": "Pergerakan Lateral / Ekspansi Hak Akses", "en": "Lateral Movement / Expansion", "zh": "扩张（寻找高权限与关键系统）" } }, { "id": "D", "text": { "id": "Pencurian / Exfiltrasi Data", "en": "Exfiltration of Data", "zh": "窃取（复制客户、员工和业务数据）" } }, { "id": "E", "text": { "id": "Menghapus Log Sistem secara penuh", "en": "Complete Log Wiping", "zh": "删除（清空所有日志）" } } ], "answer": [ "A", "B", "C", "D" ], "explanation": { "id": "Tahapan standar serangan meliputi Deteksi, Akses Awal/Masuk, Kontrol, Pergerakan Lateral/Ekspansi, dan Pencurian Data.", "en": "Standard attack stages include Recon, Initial Access, Control, Lateral Expansion, and Data Exfiltration.", "zh": "网络攻击典型的五个阶段为：探测、进入、控制、扩张和窃取。" } }, { "id": "q33", "type": "multiple", "category": "Keamanan Sandi & MFA (Password & MFA)", "question": { "id": "Pelajaran dan peringatan apakah yang kita dapatkan dari insiden peretasan British Library? (Pilih semua yang benar)", "en": "What warnings and lessons did we learn from the British Library security incident? (Select all that apply)", "zh": "英国图书馆安全事件给我们的提醒包括以下哪些？（多选）" }, "options": [ { "id": "A", "text": { "id": "Pintu masuk remote wajib dikelola terpusat & gunakan MFA", "en": "Centralize remote access points & enforce MFA", "zh": "远程入口统一纳管并启用MFA" } }, { "id": "B", "text": { "id": "Akun hak akses tinggi boleh dipakai harian untuk kemudahan", "en": "High-privilege accounts can be used for daily work", "zh": "高权限账号可做日常使用以方便管理" } }, { "id": "C", "text": { "id": "Server wajib memiliki kemampuan deteksi ancaman (EDR)", "en": "Servers also require endpoint detection capabilities (EDR)", "zh": "服务器同样需要终端检测能力" } }, { "id": "D", "text": { "id": "Kurangi salinan data tersebar & batasi akses massal", "en": "Reduce scattered data copies & restrict bulk access", "zh": "减少数据散落副本，限制批量访问" } }, { "id": "E", "text": { "id": "Akun administrator boleh dipakai bersama-sama", "en": "Administrator accounts can be shared", "zh": "管理员账号可多人共用" } } ], "answer": [ "A", "C", "D" ], "explanation": { "id": "Pelajaran utama: Aktifkan MFA pada rintisan remote, pasang EDR pada server, dan batasi duplikasi data sensitif.", "en": "Key lessons: Enforce MFA on remote entry points, install EDR on servers, and limit scattered data copies.", "zh": "教训总结：远程入口强MFA、服务器装终端检测(EDR)、限制敏感数据分散副本与批量访问。" } }, { "id": "q34", "type": "multiple", "category": "Kesadaran Keamanan (Security Awareness)", "question": { "id": "Manakah dari masalah berikut yang merupakan kerentanan umum pada berbagai insiden siber dunia nyata? (Pilih semua yang benar)", "en": "Which of the following are common vulnerabilities exposed in real-world cybersecurity incidents? (Select all that apply)", "zh": "以下哪些是真实的网络安全事件案例中暴露的共性问题？（多选）" }, "options": [ { "id": "A", "text": { "id": "Akses remote tidak menggunakan MFA", "en": "Remote entry points lacking MFA", "zh": "远程入口未启用MFA" } }, { "id": "B", "text": { "id": "Sistem lama (legacy) tidak masuk dalam standar keamanan", "en": "Legacy systems omitted from unified security baselines", "zh": "遗留系统未纳入统一安全基线" } }, { "id": "C", "text": { "id": "Hak akses pihak ketiga/vendor tidak terkontrol", "en": "Uncontrolled third-party vendor access", "zh": "第三方权限失控" } }, { "id": "D", "text": { "id": "Pencampuran perangkat pribadi & kerja menyebabkan kebocoran kata sandi", "en": "Mixing personal & work devices leading to credential leakage", "zh": "员工个人设备与工作设备混用导致凭据泄露" } }, { "id": "E", "text": { "id": "Semua kasus terjadi karena tidak pasang firewall", "en": "All cases were due to missing firewalls", "zh": "所有案例都是因为防火墙未安装" } } ], "answer": [ "A", "B", "C", "D" ], "explanation": { "id": "Empat masalah utama yang sering berulang: Tanpa MFA, Sistem lama terabaikan, Akses vendor tak terkontrol, dan Perangkat pribadi bercampur dengan akun kerja.", "en": "Four major recurring flaws: Missing MFA, Legacy systems omitted, Uncontrolled vendor access, and Personal/work device mixing.", "zh": "真实案例暴露的共性问题包括：缺乏MFA、遗留系统监管盲区、第三方访问无管控以及个人设备混用导致的凭据泄漏。" } }, { "id": "q35", "type": "multiple", "category": "Kesadaran Keamanan (Security Awareness)", "question": { "id": "Manakah yang termasuk dalam '5 Kategori Risiko Keamanan Harian' yang dibahas dalam pelatihan? (Pilih semua yang benar)", "en": "Which of the following belong to the '5 Daily Security Risk Categories' discussed in training? (Select all that apply)", "zh": "培训中提到的“五类日常风险”包括以下哪些？（多选）" }, "options": [ { "id": "A", "text": { "id": "Media Portabel / Flashdisk (Removable Media)", "en": "Removable Media", "zh": "移动介质" } }, { "id": "B", "text": { "id": "Perangkat Pribadi (Personal Devices / BYOD)", "en": "Personal Devices / BYOD", "zh": "个人设备" } }, { "id": "C", "text": { "id": "Koneksi Jaringan & Wi-Fi (Network Connections)", "en": "Network Connections", "zh": "网络连接" } }, { "id": "D", "text": { "id": "Penanganan Data (Data Handling)", "en": "Data Handling", "zh": "数据处理" } }, { "id": "E", "text": { "id": "Rekayasa Sosial / Penipuan (Social Engineering)", "en": "Social Engineering", "zh": "社会工程" } } ], "answer": [ "A", "B", "C", "D", "E" ], "explanation": { "id": "Lima risiko harian meliputi: Media portabel, Perangkat pribadi, Koneksi jaringan, Penanganan data, dan Rekayasa sosial.", "en": "The 5 daily risk areas encompass: Removable Media, Personal Devices, Network Connections, Data Handling, and Social Engineering.", "zh": "日常五类典型风险涵盖：移动介质、个人设备、网络连接、数据处理与社会工程。" } }, { "id": "q36", "type": "multiple", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Mengenai keamanan media portabel (U盘/Flashdisk), manakah praktik yang BENAR? (Pilih semua yang benar)", "en": "Regarding removable media security (USB drives), which practices are CORRECT? (Select all that apply)", "zh": "关于移动介质安全，以下正确的做法包括？（多选）" }, "options": [ { "id": "A", "text": { "id": "U-Disk dari sumber tak dikenal dilarang colok ke PC kantor", "en": "Never plug unknown USB drives into work PCs", "zh": "来历不明的U盘不插入公司终端" } }, { "id": "B", "text": { "id": "U-Disk temuan boleh dicolok untuk tes isi", "en": "Found USB drives can be plugged in to test", "zh": "捡到的U盘可以先插入测试" } }, { "id": "C", "text": { "id": "Utamakan saluran berbagi file resmi kantor", "en": "Prioritize officially approved corporate file sharing channels", "zh": "优先使用公司批准的文件交换渠道" } }, { "id": "D", "text": { "id": "Boleh mewakili rekan kerja untuk login PC publik", "en": "Allowed to log in for colleagues on public PCs", "zh": "在共享电脑上帮同事代登录" } }, { "id": "E", "text": { "id": "Keluar akun & bersihkan file sementara setelah pakai", "en": "Logout and clean temporary files after use", "zh": "使用后退出账号并清理临时文件" } } ], "answer": [ "A", "C", "E" ], "explanation": { "id": "Dilarang colok U-disk tak dikenal, utamakan saluran resmi kantor, dan selalu bersihkan akun/file di PC bersama.", "en": "Never plug unknown USBs, use approved channels, and clean accounts on shared PCs.", "zh": "正确做法：拒绝使用不明U盘、优先采用公司文件通道、在共享终端使用后清空账户痕迹。" } }, { "id": "q37", "type": "multiple", "category": "Keamanan Perangkat (Device Security)", "question": { "id": "Apakah 3 pilar utama dalam menjaga keamanan perangkat pribadi (HP/Laptop)? (Pilih semua yang benar)", "en": "What are the 3 core pillars for securing personal devices (smartphones/laptops)? (Select all that apply)", "zh": "个人设备安全的三件核心事项包括？（多选）" }, "options": [ { "id": "A", "text": { "id": "Kunci Layar Kuat (Strong Screen Lock)", "en": "Strong Screen Lock", "zh": "强锁屏" } }, { "id": "B", "text": { "id": "Sering mengganti HP baru", "en": "Frequently replacing hardware", "zh": "经常更换设备" } }, { "id": "C", "text": { "id": "Pembaruan Sistem Rutin (OS & App Updates)", "en": "System & App Updates", "zh": "系统更新" } }, { "id": "D", "text": { "id": "Antivirus Aktif (Active Antivirus Protection)", "en": "Active Antivirus Protection", "zh": "防病毒" } }, { "id": "E", "text": { "id": "Memasang aplikasi sebanyak mungkin", "en": "Installing as many apps as possible", "zh": "安装尽可能多的应用" } } ], "answer": [ "A", "C", "D" ], "explanation": { "id": "Tiga pilar dasar keamanan perangkat pribadi: Pasang kata sandi kunci layar kuat, rutin perbarui OS/Aplikasi, dan aktifkan perlindungan Antivirus.", "en": "The three pillars for personal device security: Strong screen lock, regular updates, and active antivirus.", "zh": "个人设备安全三大支柱为：开启强密码锁屏、保持系统与应用更新、安装并启用防病毒防护。" } }, { "id": "q38", "type": "multiple", "category": "Rekayasa Sosial (Social Engineering)", "question": { "id": "Jika menerima instruksi transfer uang mendadak dari 'Atasan/Boss' via WhatsApp, manakah tindakan yang BENAR? (Pilih semua yang benar)", "en": "If you receive an urgent wire transfer request from 'the Boss' via WhatsApp, which actions are CORRECT? (Select all that apply)", "zh": "接到“老板”通过WhatsApp发来的紧急转账要求，以下做法正确的有？（多选）" }, "options": [ { "id": "A", "text": { "id": "Langsung transfer karena mendesak", "en": "Transfer immediately because it's urgent", "zh": "立即执行，因为老板很急" } }, { "id": "B", "text": { "id": "Telepon kembali via nomor telepon resmi kantor untuk verifikasi suara", "en": "Call back via official corporate phone directory for voice verification", "zh": "用已知的公司通讯录号码回拨核验" } }, { "id": "C", "text": { "id": "Hanya bertanya detail lewat chat WhatsApp", "en": "Ask for details via WhatsApp chat only", "zh": "在聊天中追问细节" } }, { "id": "D", "text": { "id": "Konfirmasi lewat saluran resmi kedua sebelum mengeksekusi", "en": "Confirm via second official channel before executing", "zh": "换渠道确认后再执行" } }, { "id": "E", "text": { "id": "Teruskan ke rekan kerja tanpa verifikasi", "en": "Forward to colleagues without verifying", "zh": "转发给同事讨论但不核验" } } ], "answer": [ "B", "D" ], "explanation": { "id": "Instruksi keuangan via pesan singkat wajib diverifikasi ulang melalui saluran komunikasi resmi terpisah (seperti telepon kantor).", "en": "Financial transfer requests over messaging apps must be cross-verified via an independent official channel.", "zh": "凡涉及资金转移要求，必须通过已知官方通讯录号码回拨或第二独立渠道交叉核查。" } }, { "id": "q39", "type": "multiple", "category": "Kesadaran Phishing (Phishing Awareness)", "question": { "id": "Manakah tindakan penanganan yang BENAR saat menerima email Phishing? (Pilih semua yang benar)", "en": "Which actions are CORRECT when receiving a Phishing email? (Select all that apply)", "zh": "收到钓鱼邮件后正确的处置动作包括？（多选）" }, "options": [ { "id": "A", "text": { "id": "Klik tautan untuk cek isi", "en": "Click link to inspect content", "zh": "点击链接查看内容" } }, { "id": "B", "text": { "id": "Berhenti sejenak: Jangan klik tautan & jangan balas email", "en": "Pause: Do not click links or reply", "zh": "停一下，不点不回" } }, { "id": "C", "text": { "id": "Verifikasi via saluran komunikasi resmi terpisah", "en": "Verify via separate official communication channel", "zh": "换渠道核验" } }, { "id": "D", "text": { "id": "Masuk mandiri melalui Portal Resmi Kantor", "en": "Access independently via official corporate portal", "zh": "从正式入口（公司门户）进入查看" } }, { "id": "E", "text": { "id": "Segera laporkan ke tim IT Security", "en": "Report immediately to IT Security team", "zh": "立即报告" } } ], "answer": [ "B", "C", "D", "E" ], "explanation": { "id": "Empat langkah penanganan email phishing: Berhenti sejenak (jangan klik), Verifikasi saluran lain, Masuk dari portal resmi mandiri, dan Laporkan ke IT.", "en": "The 4 proper handling steps: Pause (don't click), Verify via secondary channel, Access via official portal, and Report to IT.", "zh": "处置钓鱼邮件“四要”要领：要停一下、要换渠道核验、要从正式入口进入、要立即报告。" } }, { "id": "q40", "type": "multiple", "category": "Perlindungan Data (Data Protection)", "question": { "id": "Manakah di antara berikut ini yang merupakan 5 Pilar Utama dalam Solusi Keamanan Data? (Pilih semua yang benar)", "en": "Which of the following belong to the 5 Core Pillars of a Data Security Solution? (Select all that apply)", "zh": "数据安全整体方案的核心环节包括以下哪些？（多选）" }, "options": [ { "id": "A", "text": { "id": "Klasifikasi & Identifikasi Data (Data Discovery & Classification)", "en": "Data Discovery & Classification", "zh": "识别分类" } }, { "id": "B", "text": { "id": "Kontrol Akses & Otorisasi (Access Control & Authorization)", "en": "Access Control & Authorization", "zh": "授权访问" } }, { "id": "C", "text": { "id": "Alur Data Aman (Secure Data Transfer)", "en": "Secure Data Transfer", "zh": "安全流转" } }, { "id": "D", "text": { "id": "Pemantauan & Pencegahan Kebocoran (DLP & Monitoring)", "en": "Monitoring & DLP Prevention", "zh": "监测阻断" } }, { "id": "E", "text": { "id": "Pemusnahan Data Aman (Secure Disposal/Destruction)", "en": "Secure Data Disposal", "zh": "处置销毁" } } ], "answer": [ "A", "B", "C", "D", "E" ], "explanation": { "id": "Solusi keamanan data mencakup 5 pilar utama: Klasifikasi/Identifikasi, Akses Terotorisasi, Transmisi Aman, Pemantauan DLP, dan Pemusnahan Aman.", "en": "Data security solution encompasses 5 core pillars: Discovery/Classification, Access Authorization, Secure Flow, DLP Monitoring, and Destruction.", "zh": "数据安全闭环防线核心5大环节为：识别分类、授权访问、安全流转、监测阻断与处置销毁。" } } ]