Deck 13: Information Security Management

Question 1

Unauthorized data disclosures can occur from malicious human activity.

Answer 1

True

Question 2

Everyone in the department must adequately safeguard company assets.This statement is in accordance with the elements of company security outlined in the NIST Handbook.

Answer 2

False

Question 3

The IT department should set the security policy for an organization.

Answer 3

False

Question 4

Drive-by spoofers take computers with wireless connections through an area and search for unprotected wireless networks.

Question 5

When a hacker floods a Web server with millions of bogus service requests so that it cannot service legitimate requests,this is called a denial-of-service attack.

Question 6

People who intentionally gain unauthorized access to computer systems are called hackers.

Question 7

Spoofing is a technique for intercepting computer communications.

Question 8

According to the elements of company security outlined in the NIST Handbook,computer security should not be constrained by societal factors.

Question 9

Any action,device,procedure,technique,or other measure that reduces a system's vulnerability to a threat is a safeguard.

Question 10

Drive-by sniffers can be prevented from accessing wireless networks by protecting them.

Question 11

The Privacy Act of 1974 gives individuals the right to access health data.

Question 12

Phishing is when someone sends an email pretending to be a legitimate company and asking for confidential data,such as account numbers.

Question 13

An example of malicious human activity could include an employee who,in the course of backing up a database,inadvertently installs an old database on top of the current one.

Question 14

Denial of service always occurs because of malicious attacks on the system.

Question 15

Faulty service can be caused by usurpation.

Question 16

Pretexting occurs when you receive a confidential SMS by mistake.

Question 17

Risk management can only be approximated because of uncertainty.

Question 18

An example of a human mistake is an employee entering the wrong data into an account.

Question 19

Email spoofing is a synonym for phishing.

Question 20

Uncertainty is the likelihood of an adverse occurrence.

Question 21

With symmetric encryption,both parties use the same key.

Question 22

Technical safeguards involve the hardware and software components of an information system.

Question 23

Tangible consequences include such things as loss of customer goodwill due to an outage.

Question 24

Windows,Linux,Unix,and other operating systems employ Kerberos and thus can authenticate user requests across networks of computers using a mixture of these operating systems.

Question 25

WEP is considered to be state-of-the-art wireless security.

Question 26

Wireless networks are more secure than wired networks.

Question 27

Encryption is an example of a technical safeguard.

Question 28

Public keys are supplied by third parties called certificate authorities.

Question 29

Probable loss is the probability that a given asset will be compromised by a given threat,despite the safeguards.

Question 30

Smart cards are convenient and easy to use since they don't require any PIN numbers for authentication.

Question 31

Vulnerabilities in a security system are its weaknesses.

Question 32

The Gramm-Leach-Bliley Act set limits on how health care providers use your medical information.

Question 33

A retina scan would be considered a biometric authentication technique.

Question 34

Viruses and worms are examples of malware.

Question 35

The "bottom line" of risk assessment is termed probable loss.

Question 36

HIPAA sets limits on who can receive your health information.

Question 37

A CA verifies the legitimacy of the business sending the digital certificate.

Question 38

Digital signatures use public keys to encrypt the message digest.

Question 39

Secure Socket Layer (SSL)is a protocol that is restricted to asymmetric encryption.

Question 40

One should never send sensitive data over the Internet unless they see "https://" in the browser's address bar.

Question 41

Even if a potential new hire will not have access to sensitive data and systems,they should be extensively screened for security purposes.

Question 42

It makes business sense for every company to have backup facilities because they are inexpensive.

Question 43

Firewalls produce activity logs of their activities,including lists of all dropped packets,infiltration attempts,and unauthorized access attempts from within the firewall.

Question 44

To protect against lost or sabotaged encryption keys,a trusted party should keep a copy of the key.

Question 45

Following a disaster,hot sites provide office space,but customers themselves must come and provide and install the equipment needed to continue operations.

Question 46

Data safeguards are measures used to protect computer hardware from external threat.

Question 47

A botnet is a network of bots that is created and managed by the individual or organization that infected the network with the bot program.

Question 48

Organizations need a rehearsed incident-response plan in place.

Question 49

When an account is created,the new user should continue to use the safe password provided to him.

Question 50

A Trojan horse is a virus that masquerades as a useful program or file.

Question 51

Adware can change the user's default window or modify search results and switch the user's search engine.

Question 52

Most spyware is benign in that it does not perform malicious acts or steal data.

Question 53

Hardened sites use special versions of the operating system,and they lock down or eliminate operating systems features and functions that are not required by the application.

Question 54

A bot is a computer program that is surreptitiously installed and that takes actions unknown and uncontrolled by the computer's owner or administrator.

Question 55

The different systems procedure types are: normal operations,review,control,and recovery.

Question 56

Care must be taken when terminating employees because they may take harmful and malicious actions.

Question 57

Most antimalware programs check email attachments for malware code.

Question 58

The best safeguard against a natural disaster is to have a safe location.

Question 59

A worm propagates by attaching itself to normal programs.

Question 60

Key escrow refers to the safety procedure of using a private key for encryption.

Question 61

A survey conducted by the Computer Security Institute revealed that the number of virus attacks has steadily increased during the last ten years.

Question 62

A security policy covering personal use of computers at work would be an example of a ________.

A)data policy
B)issue-specific policy
C)system-specific policy
D)personnel policy

Question 63

________ occurs when a person gains unauthorized access to a computer system.

A)Pretexting
B)Phishing
C)Hacking
D)Spoofing

Question 64

Which of the following usually happens in a malicious denial-of-service attack?

A)A hacker monitors and intercepts wireless traffic at will.
B)A hacker floods a Web server with millions of bogus service requests.
C)A hacker uses unauthorized programs to invade a computer system and replace legitimate programs.
D)A phisher pretends to be a legitimate company and sends an email requesting confidential data.

Question 65

Which of the following presents the largest risk for infrastructure loss?

A)thefts
B)terror attacks
C)natural disasters
D)human mistakes

Question 66

Which of the following is a critical security function of senior-management involvement?

A)implementing disaster-recovery safeguards
B)protecting the organizational network from sneak attacks
C)training junior employees about the security policy
D)managing risk by balancing the costs and benefits of the security program

Question 67

________ is a technique for intercepting computer communications.

A)Spoofing
B)Phishing
C)Sniffing
D)Pretexting

Question 68

Which of the following is an example of a data safeguard?

A)administration
B)assessment
C)compliance
D)physical security

Question 69

Customers do not want to have their retinas scanned before they can place an order.Which element of computer security described in the NIST Handbook is discussed here?

A)System owners have computer security responsibilities outside their own organizations.
B)Computer security is an integral element of sound management.
C)Computer security should be periodically reassessed.
D)Computer security is constrained by societal factors.

Question 70

The ________ pretends to be a legitimate company and sends an email requesting confidential data,such as account numbers,Social Security numbers,account passwords,and so forth.

A)hawker
B)phisher
C)spoofer
D)sniffer

Question 71

Email spoofing is a synonym for ________.

A)spoofing
B)phishing
C)pretexting
D)sniffing

Question 72

Which of the following could most likely be the result of hacking?

A)unexplained reduction in account balance
B)certain Web sites being blocked from viewing due to security reasons
C)mysterious increase in the amount spam received in your inbox
D)pop-up ads appearing frequently

Question 73

Which of the following is a critical security function of senior-management involvement?

A)safeguarding computer hardware and software
B)planning response to security incidents
C)establishing the security policy
D)managing the security program on a real-time basis

Question 74

________ is when someone deceives by pretending to be someone else.

A)Hacking
B)Baiting
C)Sniffing
D)Pretexting

Question 75

Which of the following is an example of a human safeguard?

A)procedure design
B)firewalls
C)malware protection
D)application design

Question 76

Which of the following is an example of a sniffing technique?

A)IP spoofing
B)Adblocker
C)Cache
D)Adware

Question 77

An example of a system-specific security policy would be ________.

A)limiting personal use of its computer systems
B)deciding what customer data from the order-entry system will be shared with other organizations
C)a general statement of the organization's security program
D)inspection of personal email for compliance

Question 78

Which of the following is an example of a technical safeguard?

A)backup and recovery
B)encryption
C)procedure design
D)compliance

Question 79

Which of the following is not considered malicious human activity?

A)hacking
B)intentional destruction of data
C)terrorism
D)poorly written programs

Question 80

________ take computers with wireless connections through an area and search for unprotected wireless networks and then monitor and intercept wireless traffic at will.

A)Drive-by sniffers
B)Drive-by spoofers
C)Pretexters
D)Drive-by phishers