Deck 12: Managing Information Security and Privacy

Question 1

When a hacker floods a web server with millions of bogus service requests so that it cannot service legitimate requests,this is called a denial of service attack.

Answer 1

True

Question 2

Despite warnings,users have a tendency to write their passwords on sticky notes next to the computer.

Answer 2

True

Question 3

Denial of service always occurs because of malicious attacks on the system.

Answer 3

False

Question 4

Smart cards are convenient and easy to use since they don't require any PIN numbers for authentication.

Question 5

Drive-by sniffers take computers with wireless connections through an area and search for unprotected wireless networks.

Question 6

Malware protection is an example of a technical safeguard.

Question 7

Phishing is when someone sends an e-mail pretending to be a legitimate company and asking for confidential data,such as account numbers.

Question 8

Care must be taken when terminating employees because they may take harmful and malicious actions.

Question 9

Malware is used in denial of service attacks.

Question 10

Biometric authentication has been around for some time,and because of weaknesses is not likely to see much usage in the future.

Question 11

Spoofing is a technique for intercepting computer communications.

Question 12

Data safeguards are designed to protect computer networks.

Question 13

A retinal scan would be considered a biometric authentication technique.

Question 14

Technical safeguards involve the hardware and software components of an information system.

Question 15

People who intentionally gain unauthorized access to computer systems are called hackers.

Question 16

Any action,device,procedure,technique,or other measure that reduces a system's vulnerability to a threat is a safeguard.

Question 17

To protect against lost or sabotaged encryption keys,a trusted party should keep a copy of the key.

Question 18

Even if a potential new hire will not have access to sensitive data and systems,they should be extensively screened for security purposes.

Question 19

Encryption is one of several technical safeguards.

Question 20

Most anti-malware programs check e-mail attachments for malware code.

Question 21

Organizations should protect sensitive data by storing it in ________ form.

A) compressed
B) secure
C) digital
D) encrypted
E) standardized

Question 22

Bloggers have not yet had much of an impact on the main stream media.

Question 23

Users should scan their computers with anti-malware programs at least

A) once a year.
B) biannually.
C) once a week.
D) daily.
E) once a month.

Question 24

Backup and recovery,passwords,and encryption are human safeguards.

Question 25

Following a disaster,hot sites provide office space,but customers themselves must come and provide and install the equipment needed to continue operations.

Question 26

Be sure and purchase your antispyware program from a(n)________ vendor,because some free programs in the past were actually malware programs in disguise.

A) reasonable
B) reputable
C) entrepreneurial
D) inexpensive
E) illegitimate

Question 27

About ninety percent of all viruses are spread via

A) spreadsheets.
B) AOL.
C) technology.
D) network worms.
E) email.

Question 28

It is possible for some malware to install itself on your computer by you doing nothing more than opening a(n)

A) web page.
B) file.
C) e-mail
D) computer.
E) account.

Question 29

Because encryption keys can be lost or destroyed,a copy of the key should be stored with a trusted third party called a(n)

A) key account.
B) white-hat hacker.
C) key escrow.
D) authentication certifier.
E) control account.

Question 30

________ safeguards involve the people and procedure components of information systems.

A) Human
B) Data
C) Technical
D) Malware
E) Firewall

Question 31

Organizations should store at least some of the _______________ of the database contents off the premises,possibly in a remote location.

A) backups
B) company information
C) malware definitions
D) smaller parts

Question 32

________,which are the patterns that exist in malware code,should be downloaded and updated frequently.

A) Software updates
B) Service packs
C) Malware patterns
D) Network patches
E) Malware definitions

Question 33

Hardened web sites use special versions of the operating systems and functions that are not required by the application.

Question 34

Viruses and worms don't spread very quickly so it is not essential to move cautiously when one is discovered by someone in your organization.

Question 35

The purpose of a(n)________ is to protect databases and other organizational data.

A) data warehouse
B) data security group
C) operations group
D) data safeguard
E) steering committee

Question 36

The best safeguard against a natural disaster is to have a safe location.

Question 37

Help desks have not been the source of many security problems in the past.

Question 38

Since most organizations are protected by a(n)________,it is not surprising that most viruses spread via e-mail.

A) data dictionary
B) antivirus program
C) biometric authentication device
D) firewall
E) white-hat hacker

Question 39

________ to (for)the physical computers that run the DBMS and all devices that store database data should be carefully controlled.

A) References
B) Access
C) Design plans
D) Connections
E) Documentation

Question 40

If you ever receive notification that your password has been reset when you did not request a reset,immediately contact your IS department.

Question 41

A(n)________ card has a microchip on it that is loaded with identifying data.

A) smart
B) debit
C) credit
D) ATM
E) identity

Question 42

________ considerations should be part of the hiring process.

A) Weight
B) Position
C) Gender
D) Age
E) Security

Question 43

A ________ is a remote processing centre run by a commercial disaster-recovery service that provides all the equipment needed to continue operations after a disaster.

A) web farm
B) development site
C) cold site
D) hot site
E) server farm

Question 44

In order to prioritize their activities and protect an organization from possible risk and loss,security personnel must document the position ________ of all employees.

A) riskiness
B) data access
C) controls
D) level
E) sensitivity

Question 45

In order to intercept communications on ________ networks,drive-by sniffers simply drive or walk around with computers with wireless connections.

A) commercial
B) LAN
C) wireless
D) ISP
E) WAN

Question 46

________________ is one of the fastest-growing crimes in Canada because it is relatively easy to do.

A) phishing
B) Hacking
C) Spoofing
D) PIPEDA
E) Identity theft

Question 47

Because they kept giving out passwords to users who claimed to have forgotten them,________ were a serious security risk in the organization.

A) interns
B) help desks
C) data administrators
D) executives
E) developers

Question 48

Firewalls produce ________ of their activities,which include lists of all dropped packets,and attempts to gain unauthorized access.

A) programs
B) logs
C) graphics
D) calls
E) accounts

Question 49

Some of the biggest security threats are from ________ employees.

A) disinterested
B) disgruntled
C) self-motivated
D) happy
E) contrarian

Question 50

A company should clearly define the security ________ for each position.

A) accounts
B) levels
C) responsibilities
D) backups
E) safeguards

Question 51

The existence of ________ user accounts is a serious security threat.

A) unused
B) network
C) meta
D) employee
E) modified

Question 52

A(n)________ is someone who pretends to be a legitimate company and sends e-mail requesting confidential data.

A) hacker
B) phisher
C) spoofer
D) hawker
E) employee

Question 53

When an employee is terminated,system administrators should receive advance notice so they can

A) plan for security changes.
B) get the employees computer.
C) remove accounts and passwords.
D) fight over the person's office.
E) plan a termination party.

Question 54

When an employee notices a virus on his machine,the ________ plan should specify what to do.

A) antivirus
B) security
C) technology
D) company
E) incident response

Question 55

The best way to safeguard a web site from public users is to ________ the web site against an attack.

A) secure
B) prepare
C) defend
D) harden
E) update

Question 56

________ are the primary means of authentication.

A) Encrypted keys
B) Network administrators
C) Passwords
D) Single sign-on
E) Facial scans

Question 57

________ is a technique for intercepting computer communications.

A) Spoofing
B) Hacking
C) Pretexting
D) Phishing
E) Sniffing

Question 58

Computing infrastructure should be located in ________ buildings designed to house expensive and critical equipment.

A) central
B) air-conditioned
C) high-tech
D) fire-resistant
E) easily accessible

Question 59

Passwords have weaknesses because users often choose simple passwords,which ________ systems can easily guess.

A) security
B) intrusion
C) antivirus
D) malware
E) biometric

Question 60

A hacker can launch a denial of service attack against a web server by ________ it with millions of bogus service requests.

A) programming
B) flooding
C) denying
D) hacking
E) probing

Question 61

User accounts should be given (the)________ to perform their jobs

A) least possible privileges needed
B) most possible privileges needed
C) administrator privileges
D) user privileges
E) company standard privileges

Question 62

According to PIPEDA every organization needs to identify anyone in the organization who is responsible for ___________ personal information.

A) using
B) safeguarding
C) disclosing
D) collecting
E) maintaining

Question 63

What is pretexting?

Question 64

Enforcement consists of ________ interdependent factors.

A) 4
B) 2
C) 5
D) 3
E) 6

Question 65

The web site _______________________ lists simple things to do to lower your risk of identity theft.

A) HYPERLINK "http://www.wordpress.com" www.wordpress.com
B) HYPERLINK "http://www.google.ca" www.google.ca
C) HYPERLINK "http://www.safecanada.com" www.safecanada.com
D) HYPERLINK "http://www.priv.gc.da" www.priv.gc.da
E) HYPERLINK "http://www.equifax.com" www.equifax.com

Question 66

If you suspect an organization has inappropriately disclosed your personal information to a 3ʳᵈ party,you can lodge a complaint with

A) Industry Canada
B) RCMP
C) the local police.
D) Revenue Canada.
E) Office of the Privacy Commissioner of Canada.

Question 67

________ is an organization-wide function that is in charge of developing data policies and enforcing data standards.

A) Data contents protection
B) Data safeguarding
C) Data integrity
D) Data administration
E) Data rights administration

Question 68

Users often resist biometric identification because they feel it is

A) expensive.
B) ineffective.
C) too technical.
D) invasive.
E) hard to use.

Question 69

What is phishing?

Question 70

After installing anti-virus and antispyware,what is the best way to avoid malware?

A) Encrypt your work
B) Give your friend your passwords.
C) Shut the computer down at the end of the day.
D) Open all email by double clicking.
E) Don't open email attachments from unknown sources.

Question 71

When an incident is reported,________ is (are)of the essence.

A) the response
B) preparation
C) speed
D) a systematic approach
E) actions

Question 72

PIPEDA stands for

A) Personal Information Protection and Electronic Disclosure Act.
B) Personal Information Protection and Effective Disclosures Act.
C) Personal Information Protection and Electronic Disclosures Act.
D) Personal Information Protection and Electronic Documents Act.
E) Personal Information Protection and Electronic Disclosure Actions.

Question 73

A security incident reporting plan should ________ all incident reports.

A) centralize
B) generalize
C) standardize
D) decentralize
E) prioritize

Question 74

PIPEDA gives individuals the right to know why an organization is ________ their personal information.

A) collecting and disclosing
B) collecting and changing
C) collecting, using or disclosing
D) changing
E) using and disclosing

Question 75

Adware is ________ than spyware.

A) more serious
B) less annoying
C) more malicious
D) more benign
E) harder to get rid of

Question 76

Hardening is actually a(n)________ safeguard.

A) technical
B) security
C) data
D) human
E) accountability

Question 77

The popularity and efficacy of search engines like Google have created a source of

A) entertainment.
B) inadvertent information disclosure.
C) phishing.
D) pretexting.
E) sniffing.

Question 78

Security policy establishment is the responsibility of

A) middle managers.
B) the CEO.
C) corporate lawyers.
D) senior management.
E) the IT department.

Question 79

What is an unauthorized data disclosure?

Question 80

A company establishes data rights and responsibilities and educates employees on how to backup and recover the database.But,The company still needs to address the ___________ safeguards.

A) inadvertent
B) security
C) human
D) data
E) technical