Deck 8: Securing Information Systems

Question 1

Web 2.0 applications,such as blogs,wikis,and social networking sites such as Facebook and MySpace,have are not conduits for malware or spyware.

Answer 1

False

Question 2

Social Bookmarking is tricking people into revealing their passwords or other information by pretending to be legitimate users or members of a company in need of information.

Answer 2

False

Question 3

Keyloggers record every keystroke made on a computer to steal serial numbers for software,to launch Internet attacks,to gain access to e-mail accounts,to obtain passwords to protected computer systems,or to pick up personal information such as credit card numbers.

Answer 3

True

Question 4

General controls govern the design,security,and use of computer programs and the security of data files throughout the organization's IT infrastructure.

Question 5

Software errors are no threat to information systems,that could cause untold losses in productivity.

Question 6

A computer bacteria is a rogue software program that attaches itself to other software programs or data files in order to be executed,usually without user knowledge or permission.

Question 7

Many firms spend heavily on security because it is directly related to sales revenue.

Question 8

The term "cybervandalism" is the intentional disruption,defacement,or even destruction of a Web site or corporate information system.

Question 9

Computer crime is defined as "any criminal activity involving the copy of,use of,removal of,interference with,access to,manipulation of computer systems,and/or their related functions,data or programs."

Question 10

Malicious software programs are referred to as badware and include a variety of threats,such as computer viruses,worms,and Trojan horses.

Question 11

One increasingly popular tactic is a form of spoofing called phishing.

Question 12

Large public networks,such as the Internet,are less vulnerable than internal networks because they are virtually open to anyone.

Question 13

The term "cracker" is typically used to denote a hacker with criminal intent.

Question 14

A hacker is an individual who intends to gain unauthorized access to a computer system.

Question 15

Application controls are specific controls unique to each computerized application,such as payroll or order processing.

Question 16

A Trojan horse is a software program that appears threatening but is really benign.

Question 17

Pharming redirects users to a bogus Web page,even when the individual types the correct Web page address into his or her browser.

Question 18

The potential for unauthorized access is usually limited to the communications lines of a network.

Question 19

Computer forensics is the scientific collection,examination,authentication,preservation,and analysis of data held on or retrieved from computer storage media in such a way that the information can be used as evidence in a court of law.

Question 20

Identity theft is a crime in which an imposter obtains key pieces of personal information,such as social insurance numbers,driver's licence numbers,or credit card numbers,to impersonate someone else.

Question 21

Disaster recovery planning devises plans for the restoration of computing and communications services before they have been disrupted.

Question 22

Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.

Question 23

Authentication refers to the ability to know that a person is who he or she claims to be.

Question 24

An acceptable use policy defines the acceptable level of access to information assets for different users.

Question 25

Computer worms spread much more rapidly than computer viruses.

Question 26

The WEP specification calls for an access point and its users to share the same 40-bit encrypted password.

Question 27

DoS attacks are used to destroy information and access restricted areas of a company's information system.

Question 28

Output controls check data for accuracy and completeness when they enter the system.

Question 29

Sniffers enable hackers to steal proprietary information from anywhere on a network,including e-mail messages,company files,and confidential reports.

Question 30

An MIS audit examines the firm's overall security environment as well as controls governing individual information systems.

Question 31

The range of Wi-Fi networks can be extended up to two miles by using external antennae.

Question 32

An MIS audit examines the firm's overall security environment as well as controls governing individual information systems.

Question 33

Wireless networks are vulnerable to penetration because radio frequency bands are easy to scan.

Question 34

Computers using cable modems to connect to the Internet are more open to penetration than those connecting via dial-up.

Question 35

A firewall is a combination of hardware and software that controls the flow of incoming and outgoing network traffic.

Question 36

One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender.

Question 37

A risk audit includes statements ranking information risks,identifying acceptable security goals,and identifying the mechanisms for achieving these goals.

Question 38

Viruses can be spread through e-mail.

Question 39

Biometric authentication is the use of physical characteristics such as retinal images to provide identification.

Question 40

Packet filtering catches most types of network attacks.

Question 41

Robert knows that he got an independent program off of his network on his computer.It deleted all of his spreadsheet files on his hard drive.Robert feels that this problem may have resulted from him opening up an attachment file on his e-mail.Robert is the victim of ________.

A)spoofing
B)keyloggers
C)a Trojan horse
D)worms

Question 42

Smartphones share the same security weaknesses as other Internet devices and are vulnerable to malicious software and penetration from outsiders.

Question 43

FLQ injection attacks are the largest malware threat,their attacks take advantage of vulnerabilities in poorly coded Web application software to introduce malicious program code into a company's systems and networks.

Question 44

SSL is a protocol used to establish a secure connection between two computers.

Question 45

High-availability computing is also referred to as fault tolerance.

Question 46

Fault-tolerant computers contain redundant hardware,software,and power supply components.

Question 47

The Cornflicker worm was first identified in January 2007.It spreads via e-mail spam with a fake attachment.Infected up to 10 million computers,causing them to join its zombie network of computers engaged in criminal activity.

Question 48

Businesses must protect only their own information assets but not those of customers,employees,and business partners.

Question 49

Betty downloaded a peer to peer file sharing program.She is worried that it might have come with spyware attached to it.She had a friend who had a spyware problem where all of her keystrokes were stolen which included her bank passwords.Betty's friend was a victim of ________.

A)spoofing
B)keyloggers
C)a Trojan horse
D)worms

Question 50

Helen downloaded a greeting card program from the internet.She was surprised that it really didn't do what it was supposed to do.What the program did was send nasty,profane e-mails to all the people in her contact list.Helen is the victim of ________.

A)spoofing
B)keyloggers
C)a Trojan horse
D)worms

Question 51

________ is/are methods,policies,and organizational procedures ensuring the safety of the organization's assets,the accuracy and reliability of its records,and operational adherence to management standards.

A)"Security"
B)"Controls"
C)"Benchmarking"
D)"Algorithms"

Question 52

Public key encryption uses two keys.

Question 53

The Conficker worm uses flaws in Windows software to take over machines and link them into a virtual computer that can be commanded remotely.

Question 54

NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs.

Question 55

The Sasser.ftp worm Word macro script mailed an infected Word file to the first 50 entries in a user's Microsoft Outlook address book.Infected 15 to 29 percent of all business PCs,causing $300 million to $600 million in damage.

Question 56

Domestic or offshore partnering with another company adds to system vulnerability if valuable information resides on networks and computers outside the organization's control.

Question 57

Many Wi-Fi networks can be penetrated easily by intruders using sniffer programs to obtain an address to access the resources of a network without authorization.

Question 58

Popular IM applications for consumers do not use a secure layer for text messages,so they can be intercepted and read by outsiders during transmission over the public Internet.

Question 59

John clicks into his online banking Web site.He is already to type in his password when he notices that something is just not right.Upon further examination he notices that it is not the actual bank site but one that looks almost identical.John was almost a victim of ________.

A)spoofing
B)keyloggers
C)a Trojan horse
D)worms

Question 60

The Melissa worm affected millions of computers worldwide,disrupting British Airways flight check-ins,operations of British Coast Guard stations,Hong Kong hospitals,Taiwan post office branches,and Australia's Westpac Bank.

Question 61

Jimmy Clark is sitting home one night and is very bored.He gets on his computer and starts to surf the net.He comes to a military site.He thinks he might be able to get around the security of the site and into the military computer system.He spends the next two hours trying to find his way into their system.Jimmy is ________.

A)a hacker
B)a cracker
C)a dumpster diver
D)a social engineer

Question 62

Daniel is sitting home one night and is very bored.He gets on his computer and starts to surf the net.He comes to a bank site.He thinks he might be able to get around the security of the site and into the bank computer system.He spends the next two hours trying to find his way into their system.Daniel gets into the system and puts $200 into his account from just some random name he found in the banking system.Daniel is a ________.

A)hacker
B)cracker
C)dumpster diver
D)social engineer

Question 63

________ consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders.

A)Output control
B)Input control
C)Access control
D)General control

Question 64

________ defects cannot be achieved in larger programs.

A)Two
B)One hundred
C)Thirty
D)Zero

Question 65

________ refers to all of the methods,policies,and organizational procedures that ensure the safety of the organization's assets,the accuracy and reliability of its accounting records,and operational adherence to management standards.

A)"Legacy systems"
B)"SSID standards"
C)"Vulnerabilities"
D)"Controls"

Question 66

________ are specific controls unique to each computerized application,such as payroll or order processing.

A)Output controls
B)Input controls
C)Application controls
D)General controls

Question 67

________ involves setting up fake Web sites or sending e-mail messages that look like those of legitimate businesses to ask users for confidential personal data.

A)Farming
B)Fishing
C)Pharming
D)Phishing

Question 68

Sobig.F and MyDoom.A are

A)viruses that use Microsoft Outlook to spread to other systems.
B)worms attached to e-mail that spread from computer to computer.
C)multipartite viruses that can infect files as well as the boot sector of the hard drive.
D)Trojan horses used to create bot nets.

Question 69

Bart Black walks into a local bank.He does not work there but he has a tag on his shirt that reads "IT Department." He goes up to a loans officer and tells him he needs to check the security on the loan officer's computer.Bart sits in front of the keyboard and asks the officer for his username and password.The loan officer gives him the information.Bart then thanks him and leaves the bank.Outside in his car Bart Black gets into the bank system using the information.This loan officer is a victim of ________.

A)a hacker
B)a cracker
C)dumpster diving
D)social engineering

Question 70

Many firms are reluctant to spend heavily on security because it is not directly related to ________.

A)sales expense
B)sales forecasting
C)sales tax
D)sales revenue

Question 71

Electronic data are more susceptible to destruction,fraud,error,and misuse because information systems concentrate data in computer files that

A)are usually bound up in legacy systems that are difficult to access and difficult to correct in case of error.
B)are not secure because the technology to secure them did not exist at the time the files were created.
C)have the potential to be accessed by large numbers of people and by groups outside of the organization.
D)are frequently available on the Internet.

Question 72

Specific security challenges that threaten corporate servers in a client/server environment include

A)tapping;sniffing;message alteration;radiation.
B)hacking;vandalism;denial of service attacks.
C)theft,copying,alteration of data;hardware or software failure.
D)unauthorized access;errors;spyware.

Question 73

Specific security challenges that threaten clients in a client/server environment include

A)tapping;sniffing;message alteration;radiation.
B)hacking;vandalism;denial of service attacks.
C)theft,copying,alteration of data;hardware or software failure.
D)unauthorized access;errors;spyware.

Question 74

An independent computer program that copies itself from one computer to another over a network is called a

A)worm.
B)Trojan horse.
C)bug.
D)pest.

Question 75

________ govern the design,security,and use of computer programs and the security of data files throughout the organization's IT infrastructure.

A)Output controls
B)Input controls
C)Application controls
D)General controls

Question 76

Large amounts of data stored in electronic form are ________ than the same data in manual form.

A)less vulnerable to damage
B)more secure
C)vulnerable to many more kinds of threats
D)more critical to most businesses

Question 77

Specific security challenges that threaten the communications lines in a client/server environment include

A)tapping;sniffing;message alteration;radiation.
B)hacking;vandalism;denial of service attacks.
C)theft,copying,alteration of data;hardware or software failure.
D)unauthorized access;errors;spyware.

Question 78

________ refers to policies,procedures,and technical measures used to prevent unauthorized access,alternation,theft,or physical damage to information systems.

A)"Security"
B)"Controls"
C)"Benchmarking"
D)"Algorithms"

Question 79

A ________ is a type of eavesdropping program that monitors information travelling over a network.

A)sniffer
B)keyloggers
C)a Trojan horse
D)worms

Question 80

________ is the process of transforming plain text or data into cipher text that cannot be read by anyone other than the sender and the intended receiver.

A)Risk audit
B)Spoofing
C)Encryption
D)Application control