Deck 12: Information Security Management

Question 1

The GLB Act protects__________ data stored by banks.

A) Internet customer orders
B) consumer financial
C) school records
D) book orders
E) health care

Answer 1

consumer financial

Question 2

When an employee is terminated, system administrators should receive advance notice so they can:

A) get the employees computer.
B) remove accounts and passwords.
C) plan a termination party.
D) plan for security changes.
E) fight over the person's office.

Answer 2

B

Question 3

__________, which are the patterns that exist in malware code, should be downloaded and updated frequently.

A) Software updates
B) Malware patterns
C) Network patches
D) Malware definitions

Answer 3

Malware definitions

Question 4

__________are the primary means of authentication.

A) Passwords
B) Single sign- on
C) Encrypted keys
D) Network administrators
E) Facial scans

Question 5

Which of the following is NOT a human error or mistake?

A) hacking
B) installing an old application on top of new one
C) entering a zero for an eight in a database
D) driving a forklift through the wall of a server room

Question 6

A(n) __________card has a microchip on it that is loaded with identifying data.

A) ATM
B) debit
C) smart
D) credit

Question 7

From one study by AOL, it was found that only five percent of those users who had malware on their computers:

A) said they updated their antivirus software in the past week.
B) thought they didn't have a virus.
C) gave permission for the adware to be installed.
D) knew what a virus was.

Question 8

Since most organizations are protected by a(n) __________, it is not surprising that most viruses spread via email.

A) white- hat hacker
B) firewall
C) data dictionary
D) biometric authentication device
E) antivirus program

Question 9

__________encryption uses the same key for both parties.

A) SSL
B) Asymmetric
C) Single- key
D) Symmetric
E) TLS

Question 10

Users often resist biometric identification because they feel it is:

A) invasive.
B) too technical.
C) ineffective.
D) expensive.
E) hard to use.

Question 11

A hacker can launch a denial of service attack against a Web server by__________ it with millions of bogus service requests.

A) hacking
B) denying
C) flooding
D) programming
E) probing

Question 12

A ____________ is someone who pretends to be a legitimate company and sends email requesting confidential data.

A) hawker
B) spoofer
C) phisher
D) employee
E) hacker

Question 13

One of the most important security tasks for management is ___________ management.

A) problem
B) vulnerability
C) risk
D) uncertainty
E) assessment

Question 14

Management should compose a security __________in order to communicate the goals and specifications of the organization's security program.

A) report
B) policy
C) manual
D) white paper
E) memo

Question 15

__________is a protocol that uses both symmetric and asymmetric encryption.

A) OSI
B) TCP
C) SSL
D) TSL
E) CA

Question 16

__________manipulates messages mathematically to create bit strings.

A) TLS
B) Hashing
C) Digests
D) Authentication programs
E) SSL

Question 17

__________is when someone deceives by pretending to be someone else.

A) Sniffing
B) Spoofing
C) Pretexting
D) Hacking
E) Phishing

Question 18

About ninety percent of all viruses are spread via__________ .

A) technology
B) spreadsheets
C) email
D) AOL.
E) network worms

Question 19

Passwords have weaknesses because users often choose simple passwords, which__________ systems can easily guess.

A) intrusion
B) biometric
C) security
D) antivirus
E) malware

Question 20

Loss of infrastructure can be caused by:

A) terrorism.
B) Trojan horses.
C) hacking.
D) worms.
E) viruses.

Question 21

Which of the following is a wireless security standard?

A) WPA
B) WEP
C) WPA2
D) all of the above
E) none of the above

Question 22

__________considerations should be part of the hiring process.

A) Gender
B) Age
C) Weight
D) Security

Question 23

Which of the following is a threat to security?

A) earthquakes
B) hackers
C) employees accidentally deleting records
D) terrorism
E) all of the above

Question 24

__________safeguards involve the people and procedure components of information systems.

A) Human
B) Firewall
C) Technical
D) Malware
E) Data

Question 25

Organizations should store at least some of the backups of the database contents ___________, possibly in a remote location.

A) on site
B) in situ
C) off site
D) on hard drives

Question 26

It is possible for some malware to install itself on your computer by doing nothing more than opening a(n):

A) Web page.
B) account.
C) computer.
D) file.

Question 27

Which of the following is not considered malicious human activity?

A) robbing a safe
B) poorly written application programs
C) terrorism
D) hacking

Question 28

Technology for protecting documents is called ___________.

A) SSL
B) DRM
C) E- DRM
D) TLS

Question 29

Users should scan their computers with anti- malware programs at least:

A) once a month.
B) daily.
C) biannually.
D) once a year.
E) once a week.

Question 30

A common protection for wireless access is:

A) single sign- on.
B) Kerberos.
C) Sniffer.
D) VPN.

Question 31

Some unauthorized programs are able to __________the legitimate system and substitute their own processing.

A) overwhelm
B) hack
C) usurp
D) deny
E) complement

Question 32

The purpose of a(n) ___________ is to protect databases and other organizational data.

A) data security group
B) steering committee
C) operations group
D) data safeguard
E) data warehouse

Question 33

Security programs have __________components.

A) five
B) eight
C) two
D) twelve
E) three

Question 34

When an employee notices a virus on his machine, the ___________ plan should specify what to do.

A) company
B) incident response
C) antivirus
D) technology
E) security

Question 35

In the United States, ___________ was passed to give individuals the right to access their own health data.

A) HIPAA
B) Gramm- Leach- Biley Act
C) Gramm- Rudman Bill
D) Privacy Act of 1974
E) Sarbanes- Oxley Bill

Question 36

Firewalls produce__________ of their activities, which include lists of all dropped packets, and attempts to gain unauthorized access.

A) lists
B) logs
C) accounts
D) programs
E) calls

Question 37

Be sure and purchase your antispyware program from a__________ vendor, because some of the free programs in the past were actually malware programs in disguise.

A) inexpensive
B) reasonable
C) illegitimate
D) reputable
E) entrepreneurial

Question 38

Because they kept giving out passwords to users who claimed to have forgotten them, the ___________ were a serious security risk in the organization.

A) interns
B) developers
C) data administrators
D) executives
E) help- desks

Question 39

Organizations should protect sensitive data by storing it in__________ form.

A) standardized
B) compressed
C) digital
D) secure
E) encrypted

Question 40

In order to prioritize their activities as far as possible risk and loss to the organization, security personnel have to document the position__________ of all employees.

A) data access
B) level
C) sensitivity
D) riskiness
E) controls

Question 41

A weakness in a security system is known as a system:

A) safeguard.
B) condition.
C) vulnerability.
D) weakness.
E) problem.

Question 42

A ____________ has three elements: the security program, the issue specific policy and the system specific policy.

Question 43

__________is when messages are encoded by the sender and then decoded on the other end by the receiver.

Question 44

__________resides in the background and observes the user's behavior, but is usually benign.

Question 45

A ___________ is a remote processing center run by a commercial disaster- recovery service that provides all the equipment needed to continue operations after a disaster.

A) disaster site
B) hot site
C) cold site
D) development site
E) Web farm

Question 46

__________refers to things we do not know that we do not know.

A) Uncertainty
B) Problem
C) Assessment
D) Vulnerability
E) Risk

Question 47

__________use private keys to "sign" a message digest.

Question 48

__________could be viruses, adware, or spyware.

Question 49

__________is a technique for intercepting computer communications.

A) Pretexting
B) Sniffing
C) Phishing
D) Spoofing
E) Hacking

Question 50

A computer ___________ is a program that infiltrates networks and generates so much artificial traffic that it virtually shuts down the network for legitimate traffic.

Question 51

Drive- by sniffers simply take computers with__________ connections through an area and search for unprotected networks.

Question 52

Because encryption slows processing, most messages are sent over the Internet as:

A) queries.
B) compressed data.
C) zip files.
D) plaintext.
E) code.

Question 53

In order to intercept communications on__________ networks, drive- by sniffers simply drive or walk around with computers with wireless connections.

A) ISP
B) wireless
C) LAN
D) commercial
E) WAN

Question 54

Computing infrastructure should be located in__________ buildings designed to house expensive and critical equipment.

A) fire- resistant
B) hot- site
C) remote
D) easily accessible
E) high- tech

Question 55

A company should clearly define the security __________for each position.

A) safeguards
B) responsibilities
C) backups
D) levels
E) accounts

Question 56

Even with security safeguards in place, there is always going to be some __________risk.

Question 57

__________consequences of security attacks are those whose financial impacts can be measured.

A) Operational
B) Intangible
C) Legal
D) Tangible
E) Financial

Question 58

Fingerprints and facial features are used to provide authentication for ___________ security devices.

Question 59

In addition to capturing credit card numbers, phishing schemes sometimes install__________on your computer.

Question 60

Because encryption keys can be lost or destroyed, a copy of the key should stored with a trusted third party called a(n):

A) key escrow.
B) control account.
C) authentication certifier.
D) key account.
E) white- hat hacker.

Question 61

Australia has ___________ individual privacy laws than most other countries.

Question 62

The first step in practicing risk management is to assess what the _ ___________ are.

Question 63

___________ occurs when unauthorized programs invade a computer system and replace legitimate programs.

Question 64

A __________ is an operation that spoofs legitimate companies in an attempt to illegally capture credit card or bank account numbers.

Question 65

The __________publishes a handbook that suggests what management should do to address security issues.

Question 66

Computer security should have the appropriate__________analysis.

Question 67

Unauthorized data disclosure can occur by simple human __________when someone inadvertently releases data in violation of a policy.

Question 68

Firewalls use__________ to establish rules for which packets will be allowed through the firewall.

Question 69

To protect their wireless networks, large businesses with sophisticated equipment commonly use special security servers and__________ for secure data transmission.

Question 70

Pop- up ads are an example of ___________.

Question 71

A ___________ number must be entered when using a smart card in order to provide authentication.

Question 72

When someone calls and pretends to be from a credit card company in order to check the validity of your credit card number, they are most likely engaging in __________.

Question 73

A__________ is an opening or a weakness in the security system.

Question 74

A __________firewall examines each packet and determines whether to let the packet pass.

Question 75

__________is a technique for intercepting computer communications.

Question 76

Some new operating systems offer a feature called__________, which remembers your data once you enter it the first time and authenticates you to other machines in the network.

Question 77

Operating systems today have the capability to__________ you to multiple networks and servers.

Question 78

An organization's security __________has three components: senior management involvement, safeguards, and a planned incident response.

Question 79

By starting a computationally intense application at the wrong time, users can inadvertently shut down a network or Web server resulting in a __________.

Question 80

With __________encryption, sender and receiver transmit a message using the same key.