Deck 12: Managing Information Security and Privacy

Question 1

A retinal scan would be considered a biometric authentication technique.

Answer 1

True

Question 2

Drive-by sniffers take computers with wireless connections through an area and search for unprotected wireless networks.

Answer 2

True

Question 3

Technical safeguards involve the hardware and software components of an information system.

Answer 3

True

Question 4

Data safeguards are designed to protect computer networks.

Question 5

Care must be taken when terminating employees because they may take harmful and malicious actions.

Question 6

Phishing is when someone sends an email pretending to be a legitimate company and asking for confidential data, such as account numbers.

Question 7

Despite warnings, users have a tendency to write their passwords on sticky notes next to the computer.

Question 8

Smart cards are convenient and easy to use since they don't require any PIN numbers for authentication.

Question 9

Spoofing is a technique for intercepting computer communications.

Question 10

People who intentionally gain unauthorized access to computer systems are called hackers.

Question 11

Even if a potential new hire will not have access to sensitive data and systems, they should be extensively screened for security purposes.

Question 12

To protect against lost or sabotaged encryption keys, a trusted party should keep a copy of the key.

Question 13

Encryption is one of several technical safeguards.

Question 14

Biometric authentication has been around for some time, and because of weaknesses is not likely to see much usage in the future.

Question 15

Malware is used in denial-of-service attacks.

Question 16

Most anti-malware programs check email attachments for malware code.

Question 17

Malware protection is an example of a technical safeguard.

Question 18

Any action, device, procedure, technique, or other measure that reduces a system's vulnerability to a threat is a safeguard.

Question 19

Denial of service always occurs because of malicious attacks on the system.

Question 20

When a hacker floods a web server with millions of bogus service requests so that it cannot service legitimate requests, this is called a denial-of-service attack.

Question 21

Organizations should store at least some of the ________ of the database contents off the premises, possibly in a remote location.

A) backups
B) company information
C) malware definitions
D) smaller parts

Question 22

The purpose of a(n) ________ is to protect databases and other organizational data.

A) data warehouse
B) data security group
C) operations group
D) data safeguard
E) steering committee

Question 23

________, which are the patterns that exist in malware code, should be downloaded and updated frequently.

A) Software updates
B) Service packs
C) Malware patterns
D) Network patches
E) Malware definitions

Question 24

Be sure to purchase your antispyware program from a(n) ________ vendor because some free programs in the past were actually malware programs in disguise.

A) reasonable
B) reputable
C) entrepreneurial
D) inexpensive
E) illegitimate

Question 25

About 90 percent of all viruses are spread via

A) spreadsheets.
B) AOL.
C) technology.
D) network worms.
E) email.

Question 26

Viruses and worms don't spread very quickly so it is not essential to move cautiously when one is discovered by someone in your organization.

Question 27

________ to (for) the physical computers that run the DBMS and all devices that store database data should be carefully controlled.

A) References
B) Access
C) Design plans
D) Connections
E) Documentation

Question 28

Bloggers have not yet had much of an impact on the mainstream media.

Question 29

Hardened websites use special versions of the operating systems and functions that are not required by the application.

Question 30

Help desks have not been the source of many security problems in the past.

Question 31

Since most organizations are protected by a(n) ________, it is not surprising that most viruses spread via email.

A) data dictionary
B) antivirus program
C) biometric authentication device
D) firewall
E) white-hat hacker

Question 32

Following a disaster, hot sites provide office space, but customers themselves must come and provide and install the equipment needed to continue operations.

Question 33

It is possible for some malware to install itself on your computer by you doing nothing more than opening a(n)

A) webpage.
B) file.
C) email
D) computer.
E) account.

Question 34

The best safeguard against a natural disaster is to have a safe location.

Question 35

If you ever receive notification that your password has been reset when you did not request a reset, immediately contact your IS department.

Question 36

Because encryption keys can be lost or destroyed, a copy of the key should be stored with a trusted third party called a(n)

A) key account.
B) white-hat hacker.
C) key escrow.
D) authentication certifier.
E) control account.

Question 37

Organizations should protect sensitive data by storing it in ________ form.

A) compressed
B) secure
C) digital
D) encrypted
E) standardized

Question 38

Users should scan their computers with anti-malware programs at least

A) once a year.
B) biannually.
C) once a week.
D) daily.
E) once a month.

Question 39

________ safeguards involve the people and procedure components of information systems.

A) Human
B) Data
C) Technical
D) Malware
E) Firewall

Question 40

Backup and recovery, passwords, and encryption are human safeguards.

Question 41

The existence of ________ user accounts is a serious security threat.

A) unused
B) network
C) meta
D) employee
E) modified

Question 42

In order to prioritize their activities and protect an organization from possible risk and loss, security personnel must document the position ________ of all employees.

A) riskiness
B) data access
C) controls
D) level
E) sensitivity

Question 43

Computing infrastructure should be located in ________ buildings designed to house expensive and critical equipment.

A) central
B) air-conditioned
C) high-tech
D) fire-resistant
E) easily accessible

Question 44

________ is a technique for intercepting computer communications.

A) Spoofing
B) Hacking
C) Pretexting
D) Phishing
E) Sniffing

Question 45

Some of the biggest security threats are from ________ employees.

A) disinterested
B) disgruntled
C) self-motivated
D) happy
E) contrarian

Question 46

A(n) ________ is someone who pretends to be a legitimate company and sends email requesting confidential data.

A) hacker
B) phisher
C) spoofer
D) hawker
E) employee

Question 47

The best way to safeguard a website from public users is to ________ the website against an attack.

A) secure
B) prepare
C) defend
D) harden
E) update

Question 48

A ________ is a remote processing centre run by a commercial disaster-recovery service that provides all the equipment needed to continue operations after a disaster.

A) web farm
B) development site
C) cold site
D) hot site
E) server farm

Question 49

In order to intercept communications on ________ networks, drive-by sniffers simply drive or walk around with computers with wireless connections.

A) commercial
B) LAN
C) wireless
D) ISP
E) WAN

Question 50

When an employee notices a virus on his machine, the ________ plan should specify what to do.

A) antivirus
B) security
C) technology
D) company
E) incident response

Question 51

Firewalls produce ________ of their activities, which include lists of all dropped packets, and attempts to gain unauthorized access.

A) programs
B) logs
C) graphics
D) calls
E) accounts

Question 52

________ considerations should be part of the hiring process.

A) Weight
B) Position
C) Gender
D) Age
E) Security

Question 53

________ is one of the fastest-growing crimes in Canada because it is relatively easy to do.

A) Phishing
B) Hacking
C) Spoofing
D) PIPEDA
E) Identity theft

Question 54

A(n) ________ card has a microchip on it that is loaded with identifying data.

A) smart
B) debit
C) credit
D) ATM
E) identity

Question 55

When an employee is terminated, system administrators should receive advance notice so they can

A) plan for security changes.
B) get the employees computer.
C) remove accounts and passwords.
D) fight over the person's office.
E) plan a termination party.

Question 56

A hacker can launch a denial-of-service attack against a web server by ________ it with millions of bogus service requests.

A) programming
B) flooding
C) denying
D) hacking
E) probing

Question 57

Because they kept giving out passwords to users who claimed to have forgotten them, ________ were a serious security risk in the organization.

A) interns
B) help desks
C) data administrators
D) executives
E) developers

Question 58

________ are the primary means of authentication.

A) Encrypted keys
B) Network administrators
C) Passwords
D) Single sign-on
E) Facial scans

Question 59

A company should clearly define the security ________ for each position.

A) accounts
B) levels
C) responsibilities
D) backups
E) safeguards

Question 60

Passwords have weaknesses because users often choose simple passwords, which ________ systems can easily guess.

A) security
B) intrusion
C) antivirus
D) malware
E) biometric

Question 61

Security policy establishment is the responsibility of

A) middle managers.
B) the CEO.
C) corporate lawyers.
D) senior management.
E) the IT department.

Question 62

A security incident reporting plan should ________ all incident reports.

A) centralize
B) generalize
C) standardize
D) decentralize
E) prioritize

Question 63

The website ________ lists simple things to do to lower your risk of identity theft.

A) www.wordpress.com
B) www.google.ca
C) www.safecanada.com
D) www.priv.gc.da
E) www.equifax.com

Question 64

When an incident is reported, ________ is (are) of the essence.

A) the response
B) preparation
C) speed
D) a systematic approach
E) actions

Question 65

Hardening is actually a(n) ________ safeguard.

A) technical
B) security
C) data
D) human
E) accountability

Question 66

If you suspect an organization has inappropriately disclosed your personal information to a 3rd party, you can lodge a complaint with

A) Industry Canada.
B) RCMP.
C) the local police.
D) Revenue Canada.
E) Office of the Privacy Commissioner of Canada.

Question 67

Users often resist biometric identification because they feel it is

A) expensive.
B) ineffective.
C) too technical.
D) invasive.
E) hard to use.

Question 68

According to PIPEDA, every organization needs to identify anyone in the organization who is responsible for ________ personal information.

A) using
B) safeguarding
C) disclosing
D) collecting
E) maintaining

Question 69

A company establishes data rights and responsibilities and educates employees on how to backup and recover the database, but the company still needs to address the ________ safeguards.

A) inadvertent
B) security
C) human
D) data
E) technical

Question 70

PIPEDA gives individuals the right to know why an organization is ________ their personal information.

A) collecting and disclosing
B) collecting and changing
C) collecting, using or disclosing
D) changing
E) using and disclosing

Question 71

Pretexting is the same as ________ in the world of malicious computer activities.

Question 72

User accounts should be given (the) ________ to perform their jobs.

A) least possible privileges needed
B) most possible privileges needed
C) administrator privileges
D) user privileges
E) company standard privileges

Question 73

The popularity and efficacy of search engines like Google have created a source of

A) entertainment.
B) inadvertent information disclosure.
C) phishing.
D) pretexting.
E) sniffing.

Question 74

PIPEDA stands for

A) Personal Information Protection and Electronic Disclosure Act.
B) Personal Information Protection and Effective Disclosures Act.
C) Personal Information Protection and Electronic Disclosures Act.
D) Personal Information Protection and Electronic Documents Act.
E) Personal Information Protection and Electronic Disclosure Actions.

Question 75

Adware is ________ than spyware.

A) more serious
B) less annoying
C) more malicious
D) more benign
E) harder to get rid of

Question 76

________ is an organization-wide function that is in charge of developing data policies and enforcing data standards.

A) Data contents protection
B) Data safeguarding
C) Data integrity
D) Data administration
E) Data rights administration

Question 77

Enforcement consists of ________ interdependent factors.

A) 4
B) 2
C) 5
D) 3
E) 6

Question 78

After installing anti-virus and antispyware, what is the best way to avoid malware?

A) Encrypt your work.
B) Give your friend your passwords.
C) Shut the computer down at the end of the day.
D) Open all email by double clicking.
E) Don't open email attachments from unknown sources.

Question 79

Email spoofing, where a hacker uses email to pretend to be someone else, is another name for ________.

Question 80

The sources of security problems are human error, malicious activity, and ________.