Deck 12: Information Security Management

Question 1

Natural disasters present the largest risk for infrastructure loss.

Answer 1

True

Question 2

An intrusion detection system (IDS)is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

Answer 2

True

Question 3

Email spoofing is a synonym for phishing.

Answer 3

True

Question 4

Usurpation occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones.

Question 5

As per the study conducted by Verizon, organizations that have been phished have increased to 40 percent since 2007.

Question 6

Sniffing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 7

In a study conducted by Verizon, in a year only about a hundred thousand people become victims of computer crimes.

Question 8

In a study conducted by Verizon, data theft has been most successful at large scale enterprises.

Question 9

Most emails and IMs are protected by encryption.

Question 10

When a hacker floods a Web server with millions of bogus service requests so that it cannot service legitimate requests, it is called a denial-of-service attack.

Question 11

In a study conducted by Verizon, in 2011, the four most frequent computer crimes involved criminal activity against servers.

Question 12

Unauthorized data disclosures are possible due to human error.

Question 13

Cookies enable an individual to access Web sites without having to sign in every time.

Question 14

As problems caused by human errors are accidental and not malicious, they are not considered as security threats to the information system.

Question 15

A computer crime is committed if an employee who inadvertently installs an old database on top of the current one.

Question 16

Faulty service includes incorrectly billing customers or sending the wrong information to employees, but not incorrect data modification.

Question 17

Pretexting occurs when a person receives a confidential text message by mistake and pretends to be the intended recipient.

Question 18

Phishing is a technique for intercepting computer communications.

Question 19

Drive-by sniffers monitor and intercept wireless traffic at will.

Question 20

In context of information security, safeguards increase work efficiency by making common tasks easier.

Question 21

It is safer to use the same password for all the Web sites.

Question 22

Most spyware programs are benign in that they do not perform malicious acts or steal data.

Question 23

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 24

Viruses and worms are examples of malware.

Question 25

Unlike credit, debit, and ATM cards, which have a magnetic strip, smart cards have a microchip.

Question 26

Encryption is an example of a technical safeguard.

Question 27

A magnetic strip holds far more data than a microchip.

Question 28

A Trojan horse is a virus that masquerades as a useful program or file.

Question 29

Security policies must not depend on whether the organization is governmental or nongovernmental,
or whether it is publically held or private.

Question 30

Brute force requires only 2 days to crack a password having a mixture of upper and lowercase letters, numbers, and special characters.

Question 31

Even short passwords with no special characters can make strong passwords.

Question 32

Technical safeguards involve the hardware and software components of an information system.

Question 33

The senior management must establish a company-wide security policy that states the organization's posture regarding the data that it gathers.

Question 34

A new hire must seek out the employer's security policy if it is not discussed in new employee training.

Question 35

In symmetric encryption, two different keys are used to encode and decode a message.

Question 36

Secure Socket Layer (SSL)is a protocol that is restricted to asymmetric encryption.

Question 37

Biometric authentication uses characteristics such as retinal scans.

Question 38

SQL injection attack occurs when users enter an SQL statement into a form in which they are supposed to enter a name or other data.

Question 39

Data safeguards are measures used to protect computer hardware from external threat.

Question 40

Improper data disclosure and data damage and loss are possible consequences of an SQL injection attack.

Question 41

Hardening is actually a human safeguard.

Question 42

Which of the following is considered a threat caused by human error?

A)An employee inadvertently installs an old database on top of the current one.
B)An employee intentionally destroys data and system components.
C)A virus and worm writer infects computer systems.
D)A hacker breaks into a system to steal for financial gain.

Question 43

A ________ is a person or organization that seeks to obtain data or other assets illegally, without the owner's permission and often without the owner's knowledge.

A)target
B)vulnerability
C)threat
D)warning

Question 44

A ________ pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

A)hacker
B)phisher
C)safeguard
D)sniffer

Question 45

When referring to security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A)unauthorized data disclosure
B)incorrect data modification
C)faulty services
D)loss of infrastructure

Question 46

________ occurs when someone deceives by pretending to be someone else.

A)Hacking
B)Baiting
C)Sniffing
D)Pretexting

Question 47

Companies should require vendors and partners to perform appropriate screening and security training.

Question 48

Which of the following is an example of a sniffing technique?

A)IP spoofing
B)caches
C)ad blockers
D)adware

Question 49

The existence of accounts that are no longer in use are not a security threat to an organization.

Question 50

________ take computers with wireless connections through an area and search for unprotected wireless networks and then monitor and intercept wireless traffic at will.

A)Drive-by spoofers
B)Pretexters
C)Drive-by sniffers
D)Phishers

Question 51

If a backup of the database contents is made, the database is protected.

Question 52

Which of the following is considered a computer crime?

A)internal software bug deleting customer records
B)poorly written programs resulting in data losses
C)loss of data as a result of flooding
D)hacking of information systems

Question 53

If the incident-response plan is not well prepared, there is substantial risk that the actions of well-meaning people will make the problem worse.

Question 54

Email spoofing is a synonym for ________.

A)hacking
B)phishing
C)usurping
D)sniffing

Question 55

Business requirements do not necessitate opening information systems to nonemployee personnel-temporary personnel, vendors or partner personnel.

Question 56

It is easy and economical to hold public users of Web sites accountable for security violations.

Question 57

Employee termination is a potential security threat for an organization.

Question 58

Hardening a site means to take extraordinary measures to reduce a system's vulnerability.

Question 59

Documenting position sensitivity enables security personnel to prioritize their activities in accordance with the possible risk and loss.

Question 60

________ is a technique for intercepting computer communications, either through a physical connection to a network or without physical connection in the case of wireless networks.

A)Spoofing
B)Phishing
C)Sniffing
D)Pretexting

Question 61

Which of the following is a critical security function of senior management in an organization?

A)safeguarding computer hardware and software
B)developing IS security software
C)establishing the security policy and managing risk
D)managing security programs on a real-time basis

Question 62

Which of the following was passed to give individuals the right to access their own health data created by doctors and other healthcare providers?

A)Privacy Act of 1974
B)Sarbanes-Oxley Act
C)HIPAA of 1996
D)Gramm-Leach-Bliley Act

Question 63

Nonword passwords are vulnerable to a(n)________ attack, in which the password cracker tries every possible combination of characters.

A)denial-of-service
B)side channel
C)brute force
D)obfuscation

Question 64

________ present the largest risk for an organization's infrastructure loss.

A)Employees
B)Natural disasters
C)Hackers
D)Competitors

Question 65

Which of the following usually happens in a malicious denial-of-service attack?

A)A hacker monitors and intercepts wireless traffic at will.
B)A hacker floods a Web server with millions of bogus service requests.
C)A hacker uses another site's IP address to masquerade as that other site.
D)A phisher pretends to be a legitimate company and requests confidential data.

Question 66

A(n)________ is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

A)IDS
B)botnet
C)antivirus
D)firewall

Question 67

Which of the following is most likely to be the result of hacking?

A)certain Web sites being blocked from viewing for security reasons
B)small amounts of spam in your inbox
C)an unexplained reduction in your account balance
D)pop-up ads appearing frequently

Question 68

________ are small files that your browser stores on your computer when you visit Web sites and enable you to access Web sites without having to sign in every time.

A)Cookies
B)Registers
C)Pop-ups
D)Public keys

Question 69

Which of the following is an example of a technical safeguard?

A)position definitions
B)firewalls
C)key escrow
D)locked down servers

Question 70

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A)Unauthorized data disclosure
B)Incorrect data modification
C)Denial of service
D)Loss of infrastructure

Question 71

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones that shut down legitimate applications and substitute their own processing to spy, steal and manipulate data, or other purposes.

A)Hacking
B)Spoofing
C)Phishing
D)Usurpation

Question 72

A ________ is a number used to encrypt the data.

A)key
B)WPA
C)pretext
D)WEP

Question 73

________ enable you to access Web sites without having to sign in every time.

A)Bookmarks
B)Pop-ups
C)Cookies
D)Public keys

Question 74

Users of smart cards are required to enter a ________ to be authenticated.

A)Social Security number
B)public key
C)personal identification number
D)private key

Question 75

A(n)________ has a microchip in it to hold data.

A)ATM card
B)smart card
C)cookie
D)escrow

Question 76

Which of the following is used for biometric authentication?

A)smart cards
B)facial features
C)passwords
D)personal identification numbers

Question 77

In asymmetric encryption, each site has a ________ for encoding messages.

A)wireless fidelity
B)private key
C)public key
D)pretext

Question 78

Which of the following statements is true of biometric identification?

A)It involves the use of a PIN for authentication.
B)It provides weak authentication.
C)It is a relatively inexpensive mode of authentication.
D)It often faces resistance from users for its invasive nature.

Question 79

The Privacy Act of 1974 provides protection to individuals regarding ________.

A)records held by private companies
B)records held by the U.S.government
C)records held by banks and other financial institutions
D)records held by non-government agencies

Question 80

________ occurs when a person breaks into a network to steal data such as customer lists, product inventory data, employee data, and other proprietary and confidential data.

A)Pretexting
B)Phishing
C)Hacking
D)Spoofing