Deck 12: Information Systems Development

Question 1

Drive-by sniffers monitor and intercept wireless traffic at will.

Answer 1

True

Question 2

Usurpation occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones.

Answer 2

True

Question 3

Email spoofing is a synonym for phishing.

Answer 3

True

Question 4

The single most important computer security safeguard that can be implemented is to create and use passwords that comprise of names.

Question 5

Pretexting occurs when a person receives a confidential text message by mistake.

Question 6

Natural disasters present the largest risk for infrastructure loss.

Question 7

Cookies enable an individual to access Web sites without having to sign in every time.

Question 8

An intrusion detection system (IDS) is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

Question 9

In the context of information security, safeguards increase work efficiency by making common tasks easier.

Question 10

Unauthorized data disclosures are possible due to human error.

Question 11

When a hacker floods a Web server with millions of bogus service requests so that it cannot service legitimate requests, it is called a denial-of-service attack.

Question 12

The losses due to human error are minimal; hence, organizations tend to ignore these losses.

Question 13

An Advanced Persistent Threat (APT) is a sophisticated computer hack that is perpetrated by large, well-funded organizations such as governments.

Question 14

The security of online transactions has increased with the use of https.

Question 15

Most emails and IMs are protected by encryption.

Question 16

As problems caused by human errors are accidental and not malicious, they are not considered as security threats to the information system.

Question 17

Sniffing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 18

A computer crime is committed if an employee inadvertently installs an old database on top of the current one.

Question 19

Faulty service excludes problems that result due to incorrect data modification.

Question 20

Phishing is a technique for intercepting computer communications.

Question 21

A magnetic strip holds far more data than a microchip.

Question 22

Specific security policies should not depend on whether the organization is governmental or nongovernmental or whether it is publicly held or private.

Question 23

Viruses and worms are examples of malware.

Question 24

The senior management must establish a company-wide security policy that states the organization's posture regarding the data that it gathers.

Question 25

A new hire must seek out the employer's security policy if it is not discussed in new-employee training.

Question 26

Data safeguards are measures used to protect computer hardware from external threat.

Question 27

It is safer to use the same password for all the Web sites.

Question 28

Most spyware programs are benign in that they do not perform malicious acts or steal data.

Question 29

Secure Socket Layer (SSL) is a protocol that is restricted to asymmetric encryption.

Question 30

In symmetric encryption, two different keys are used to encode and decode a message.

Question 31

Encryption is an example of a technical safeguard.

Question 32

Improper data disclosure and data damage and loss are possible consequences of an SQL injection attack.

Question 33

Nonword passwords are also vulnerable to brute force attacks.

Question 34

Even short passwords with no special characters can make strong passwords.

Question 35

SQL injection attack occurs when users enter an SQL statement into a form in which they are supposed to enter a name or other data.

Question 36

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 37

A Trojan horse is a virus that masquerades as a useful program or file.

Question 38

Unlike credit, debit, and ATM cards, which have a magnetic strip, smart cards have a microchip.

Question 39

Technical safeguards involve the hardware and software components of an information system.

Question 40

Biometric authentication uses physical characteristics such as retinal scans to authenticate users.

Question 41

A ________ is a person or an organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge.

A) target
B) vulnerability
C) threat
D) key escrow

Question 42

Which of the following is considered a threat caused by human error?

A) an employee inadvertently installs an old database on top of the current one
B) an employee intentionally destroys data and system components
C) a virus and worm writer infects computer systems
D) a hacker breaks into a system to steal for financial gain

Question 43

Documenting position sensitivity enables security personnel to prioritize their activities in accordance with the possible risk and loss.

Question 44

Hardening a site means to take extraordinary measures to reduce a system's vulnerability.

Question 45

A ________ pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

A) hacker
B) phisher
C) safeguard
D) sniffer

Question 46

If a backup of the database contents is made, the database is completely protected.

Question 47

Business requirements do not necessitate opening information systems to nonemployee personnel, such as temporary personnel, vendors, or partner personnel.

Question 48

Companies should require vendors and partners to perform appropriate screening and security training.

Question 49

Which of the following is considered a computer crime?

A) deletion of records by an employee who is unaware of operating procedures
B) poorly written programs resulting in data losses
C) loss of data as a result of flooding
D) hacking of information systems

Question 50

Which of the following is an example of a sniffing technique?

A) IP spoofing
B) caches
C) denial of service
D) adware

Question 51

When referring to security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A) unauthorized data disclosure
B) incorrect data modification
C) faulty services
D) loss of infrastructure

Question 52

________ take computers with wireless connections through an area and search for unprotected wireless networks and then monitor and intercept wireless traffic at will.

A) Keyloggers
B) Pretexters
C) Drive-by sniffers
D) Phishers

Question 53

The existence of accounts that are no longer in use are not a security threat to an organization.

Question 54

________ occurs when someone deceives by pretending to be someone else.

A) Hacking
B) Usurping
C) Sniffing
D) Pretexting

Question 55

Employee termination is a potential security threat for an organization.

Question 56

________ is a technique for intercepting computer communications, either through a physical connection to a network or without a physical connection in the case of wireless networks.

A) Spoofing
B) Phishing
C) Sniffing
D) Pretexting

Question 57

If the incident-response plan is not well-prepared, there is substantial risk that the actions of well-meaning people will make the problem worse.

Question 58

It is easy and economical to hold public users of Web sites accountable for security violations.

Question 59

Email spoofing is a synonym for ________.

A) hacking
B) phishing
C) usurping
D) sniffing

Question 60

Hardening is actually a human safeguard.

Question 61

________ occurs when a person breaks into a network to steal data such as customer lists, product inventory data, employee data, and other proprietary and confidential data.

A) Pretexting
B) Phishing
C) Hacking
D) Spoofing

Question 62

A(n) ________ has a microchip in it to hold data.

A) ATM card
B) smart card
C) cookie
D) key escrow

Question 63

Which of the following statements is true of biometric identification?

A) It involves the use of a PIN for authentication.
B) It provides weak authentication.
C) It is a relatively inexpensive mode of authentication.
D) It often faces resistance from users for its invasive nature.

Question 64

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A) Unauthorized data disclosure
B) Incorrect data modification
C) Denial of service
D) Loss of infrastructure

Question 65

________ are small files that the browser stores on the user's computer when he/she visits Web sites and enables him/her to access Web sites without having to sign in every time.

A) Cookies
B) Botnets
C) Payloads
D) Public keys

Question 66

A(n) ________ is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

A) intrusion detection system
B) keylogger
C) botnet
D) access control system

Question 67

In information security, which of the following is true of managing risk?

A) All organizations except financial institutions should invest heavily in security safeguards.
B) Organizations should implement safeguards that balance the trade-off between risk and cost.
C) Passwords are classified under the technical safeguards category.
D) Physical security is classified under the human safeguards category.

Question 68

Users of smart cards are required to enter a ________ to be authenticated.

A) Social Security number
B) public key
C) personal identification number
D) private key

Question 69

Which of the following is a critical security function that the senior management should address in an organization?

A) sharing the private key with all systems connected to the network
B) creating IS security software programs
C) establishing the security policy
D) avoiding the use of perimeter firewalls

Question 70

Which of the following was passed to give individuals the right to access their own health data created by doctors and other healthcare providers?

A) the Privacy Act of 1974
B) the Sarbanes-Oxley Act
C) the HIPAA of 1996
D) the Gramm-Leach-Bliley Act

Question 71

________ is the type of security loss that involves computer criminals invading a computer system and replacing legitimate programs with their own unauthorized ones that shut down legitimate applications and substitute their own processing to spy, steal, and manipulate data.

A) Encryption
B) Spoofing
C) Phishing
D) Usurpation

Question 72

Which of the following is most likely to be a result of hacking?

A) certain Web sites being censored for hurting sentiments
B) small amounts of spam in a user's inbox
C) an unauthorized transaction from a user's credit card
D) pop-up ads appearing frequently

Question 73

Nonword passwords are vulnerable to a ________ attack, in which the password cracker tries every possible combination of characters.

A) denial-of-service
B) sniffing
C) brute force
D) phishing

Question 74

Which of the following statements is true about losses due to computer security threats?

A) Surveys on computer crimes provide accurate results since they use standard parameters to measure and tally computer crime costs.
B) Some organizations don't report all their computer crime losses, and some won't report such losses at all.
C) Losses due to natural disasters can be measured accurately.
D) Losses due to human error are insignificant.

Question 75

Which of the following is classified as a technical safeguard?

A) cookies
B) firewalls
C) key escrow
D) passwords

Question 76

________ present the largest risk for an organization's infrastructure loss.

A) Employees
B) Natural disasters
C) Hackers
D) Competitors

Question 77

Which of the following is used for biometric authentication?

A) smart cards
B) facial features
C) passwords
D) personal identification numbers

Question 78

Which of the following usually happens in a malicious denial-of-service attack?

A) a hacker monitors and intercepts wireless traffic at will
B) a hacker floods a Web server with millions of bogus service requests
C) an intruder uses another site's IP address to masquerade as that other site
D) a phisher pretends to be a legitimate company and requests confidential data

Question 79

A ________ is a number used to encrypt data.

A) key
B) honeypot
C) cookie
D) cache

Question 80

Removing and disabling ________, which may contain sensitive security data, presents an excellent example of the trade-off between improved security and cost.

A) bookmarks
B) pop-ups
C) cookies
D) toolbars