Deck 10: Information Systems Security

Question 1

Spoofing occurs when a person receives a confidential text message by mistake.

Answer 1

False

Question 2

Email spoofing is a synonym for phishing.

Answer 2

True

Question 3

One of the personal security safeguards is to use https at trusted, reputable vendors.

Answer 3

True

Question 4

A denial-of-service attack is launched when a hacker floods a Web server with millions of bogus service requests.

Question 5

Faulty service excludes problems that result due to incorrect data modification.

Question 6

The best personal security safeguard is to remove browsing history, temporary files, and cookies from the computer and to set the browser to disable history and cookies.

Question 7

Natural disasters present the largest risk for infrastructure loss.

Question 8

The single most important computer security safeguard that can be implemented is the creation and use of passwords that are comprised of names.

Question 9

Phishing is a technique for intercepting computer communications.

Question 10

Sniffing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 11

Most emails and IMs are protected by encryption.

Question 12

In the context of information security, safeguards increase work efficiency by making common tasks easier.

Question 13

An Advanced Persistent Threat (APT) is a sophisticated computer hack that is perpetrated by large, well-funded organizations such as governments.

Question 14

A computer crime is committed if an employee inadvertently installs an old database on top of the current one.

Question 15

Usurpation occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones.

Question 16

As problems caused by human errors are accidental and not malicious, they are not considered as security threats to the information system.

Question 17

Drive-by sniffers monitor and intercept wireless traffic on secured wireless networks.

Question 18

Cookies enable an individual to access Web sites without having to sign in every time.

Question 19

The losses due to human error are minimal, and hence, organizations tend to ignore these losses.

Question 20

Unauthorized data disclosure is possible due to human error.

Question 21

Nonword passwords are vulnerable to brute force attacks.

Question 22

In symmetric encryption, two different keys are used to encode and decode a message.

Question 23

A Trojan horse is a virus that masquerades as a useful program or file.

Question 24

Unlike credit, debit, and ATM cards, which have a magnetic strip, smart cards have a microchip.

Question 25

Secure Sockets Layer (SSL) is a protocol that is restricted to asymmetric encryption.

Question 26

Technical safeguards involve the hardware and software components of an information system.

Question 27

SQL injection attack occurs when users enter an SQL statement into a form in which they are supposed to enter a name or other data.

Question 28

Malware is a broad category of software that includes viruses, spyware and adware.

Question 29

A new hire must seek out the employer's security policy if it is not discussed in new-employee training.

Question 30

Improper data disclosure and data damage and loss are possible consequences of an SQL injection attack.

Question 31

Short passwords with no special characters can make strong passwords.

Question 32

Encryption is an example of a technical safeguard.

Question 33

The senior management of an organization must establish company-wide security policies.

Question 34

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 35

It is safe to use the same password for all Web sites.

Question 36

The specifics of a security policy should not depend on whether the organization is governmental or nongovernmental, or whether it is publicly held or private.

Question 37

Data safeguards protect computer hardware from external threat.

Question 38

Most spyware programs are benign in that they do not perform malicious acts or steal data.

Question 39

Biometric authentication uses physical characteristics such as retinal scans to authenticate users.

Question 40

A magnetic strip holds far more data than a microchip.

Question 41

A ________ pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

A) hacker
B) phisher
C) safeguard
D) sniffer

Question 42

Companies should require vendors and partners to perform appropriate screening and security training.

Question 43

If the incident-response plan is not well-prepared, there is substantial risk that the actions of well-meaning people will make the problem worse.

Question 44

Companies must establish security policies and procedures for the termination of employees.

Question 45

Which of the following is considered a threat caused by human error?

A) an employee inadvertently installing an old database on top of the current one
B) an employee intentionally destroying data and system components
C) a virus and worm writer infecting computer systems
D) a hacker breaking into a system to steal for financial gain

Question 46

In the context of security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A) unauthorized data disclosure
B) incorrect data modification
C) faulty services
D) loss of infrastructure

Question 47

________ occurs when someone deceives by pretending to be someone else.

A) Hacking
B) Usurping
C) Sniffing
D) Pretexting

Question 48

If a backup of the database contents is created, the database is completely protected.

Question 49

Hardening a site means to take extraordinary measures to reduce a system's vulnerability.

Question 50

Business requirements do not necessitate opening information systems to nonemployee personnel, such as temporary personnel, vendors, or partner personnel.

Question 51

Documenting position sensitivity enables security personnel to prioritize their activities in accordance with the possible risk and loss.

Question 52

Which of the following is considered a computer crime?

A) deletion of records by an employee who is unaware of operating procedures
B) poorly written programs resulting in data losses
C) loss of data as a result of flooding
D) hacking of information systems

Question 53

A ________ is a person or an organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge.

A) target
B) vulnerability
C) threat
D) key escrow

Question 54

The existence of accounts that are no longer in use is not a security threat to an organization.

Question 55

________ is a technique for intercepting computer communications through a physical connection to a network or without a physical connection in the case of wireless networks.

A) Spoofing
B) Phishing
C) Sniffing
D) Pretexting

Question 56

It is easy and economical to hold public users of Web sites accountable for security violations.

Question 57

Which of the following is a sniffing technique?

A) IP spoofing
B) caches
C) denial of service
D) adware

Question 58

Email spoofing is a synonym for ________.

A) hacking
B) phishing
C) usurping
D) sniffing

Question 59

________ take computers with wireless connections through an area and search for unprotected wireless networks, and then monitor and intercept wireless traffic on unsecured wireless networks.

A) Keyloggers
B) Pretexters
C) Drive-by sniffers
D) Phishers

Question 60

Hardening is actually a human safeguard.

Question 61

Removing and disabling ________ that may contain sensitive security data presents an excellent example of the trade-off between improved security and cost.

A) bookmarks
B) pop-ups
C) cookies
D) toolbars

Question 62

Which of the following statements is True about biometric identification?

A) It involves the use of a personal identification number (PIN) for authentication.
B) It provides weak authentication.
C) It is a relatively inexpensive mode of authentication.
D) It often faces resistance from users for its invasive nature.

Question 63

Which of the following usually happens in a malicious denial-of-service attack?

A) a hacker monitoring and intercepts wireless traffic at will
B) a hacker floods a Web server with millions of bogus service requests
C) an intruder using another site's IP address to masquerade as that other site
D) a phisher pretending to be a legitimate company and requesting confidential data

Question 64

________ are small files that enables a browser to access Web sites without having to sign in every time.

A) Cookies
B) Botnets
C) Payloads
D) Public keys

Question 65

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own, unauthorized ones that shut down legitimate applications.

A) Encryption
B) Spoofing
C) Phishing
D) Usurpation

Question 66

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A) Unauthorized data disclosure
B) Incorrect data modification
C) Denial of service
D) Loss of infrastructure

Question 67

Which of the following statements is True about losses due to computer security threats?

A) Surveys on computer crimes provide accurate results since they use standard parameters to measure and tally computer crime costs.
B) Surveys suggest that some organizations do not report all their computer crime losses, and some will not report such losses at all.
C) Losses due to natural disasters can be measured accurately.
D) Losses due to human error are insignificant.

Question 68

________ involves breaking into a network to steal data such as customer lists, product inventory data, employee data, and other proprietary and confidential data.

A) Pretexting
B) Phishing
C) Hacking
D) Spoofing

Question 69

In information security, which of the following is True about managing risk?

A) All organizations except financial institutions should invest heavily in security safeguards.
B) Organizations should implement safeguards that balance the trade-off between risk and cost.
C) Passwords are classified as technical safeguards.
D) Physical security is classified as human safeguards.

Question 70

Which of the following is a personal security safeguard?

A) sending valuable data only via email or IM
B) using single password for all the sites
C) removing high-value assets from computers
D) storing browsing history, temporary files, and cookies

Question 71

Which of the following was passed to give individuals the right to access their own health data created by doctors and other healthcare providers?

A) the Privacy Act of 1974
B) the Sarbanes-Oxley Act
C) the HIPAA of 1996
D) the Gramm-Leach-Bliley Act

Question 72

Which of the following is a critical security function that should be addressed by the senior management of an organization?

A) sharing the private key with all systems connected to the network
B) creating IS security software programs
C) establishing the security policy
D) avoiding the use of perimeter firewalls

Question 73

A(n) ________ has a microchip in it to hold data.

A) ATM card
B) smart card
C) cookie
D) key escrow

Question 74

Which of the following is classified as a technical safeguard?

A) cookies
B) firewalls
C) key escrow
D) passwords

Question 75

A ________ is a number used to encrypt data.

A) key
B) honeypot
C) cookie
D) cache

Question 76

________ present(s) the largest risk for an organization's infrastructure loss.

A) Employees' dissatisfaction
B) Natural disasters
C) Hackers
D) Competitors

Question 77

Nonword passwords are vulnerable to a ________ attack in which the password cracker tries every possible combination of characters.

A) denial-of-service
B) sniffing
C) brute force
D) phishing

Question 78

Users of smart cards are required to enter a ________ to be authenticated.

A) Social Security number
B) public key
C) personal identification number
D) private key

Question 79

Which of the following is most likely to be a result of hacking?

A) certain Web sites being censored for hurting sentiments
B) small amounts of spam in a user's inbox
C) an unauthorized transaction from a user's credit card
D) pop-up ads appearing frequently

Question 80

Which of the following is used for biometric authentication?

A) smart cards
B) facial features
C) passwords
D) personal identification numbers