知识检核题生成

1. Statement: High-bias models tend to make similar systematic errors across different training sets, whereas high-variance models’ predictions vary substantially with different training sets. Answer: True Rationale: Bias reflects systematic error; variance reflects sensitivity to data sampling.

2. Statement: Increasing model complexity (e.g., moving from a linear model to a high-degree polynomial) generally decreases variance and increases bias. Answer: False Rationale: Greater complexity typically decreases bias and increases variance. Conversely, regularization usually increases bias and reduces variance.

3. Statement: Achieving near-zero training error implies the model has low bias on the underlying data distribution. Answer: False Rationale: Near-zero training error can result from overfitting (high variance). Bias is defined with respect to expected predictions over data samples and need not be low simply because training error is low.

以下为围绕密码管理（长度、复杂度、周期）与多因素认证（MFA）应用场景的三个判断题（含答案与简要解析）：

1. 题干：现代合规的密码策略应更强调足够的长度（最小长度不少于8个字符，并允许更长的输入上限，如≥64个字符）与已泄露密码库比对，而不是强制每个密码必须同时包含大写、小写、数字和特殊字符各至少一个。
   答案：对
   解析：主流标准（如NIST SP 800-63B）建议提高最小长度、支持更长密码与空格，并对常见/泄露密码进行拦截；不鼓励一刀切的字符种类组合强制要求。组织可基于风险附加复杂度规则，但这不是合规的硬性前提。

2. 题干：在未发现账户泄露或可疑活动的情况下，统一要求所有用户每90天强制更换密码是符合现代合规要求的做法。
   答案：错
   解析：现代实践不再推崇固定周期的强制轮换，因为易导致弱密码与重复模式；应在疑似泄露、用户遗忘、岗位变更/离职或高风险事件时触发变更。若受特定法规或合同要求约束，应按适用要求执行。

3. 题干：对远程访问（如VPN/零信任网关）、云或本地管理控制台登录、特权账户操作和敏感配置变更等高风险场景，应强制启用MFA，而非只在首次登录时启用。
   答案：对
   解析：MFA显著降低凭据被盗带来的入侵风险，是远程访问与高权限操作场景的通行合规与最佳实践；可结合基于风险的策略在异常地点、设备或行为时提升MFA验证频次。