Deck 4: Information Security

Question 1

The main purpose for the attack on Sony Picture Entertainment on November 24, 2014 was to __________.

A)sell social security numbers
B)steal credit card numbers
C)stop the release of the move The Interview
D)threaten the US government

Answer 1

C

Question 2

Weak passwords are a(n)___________ threat.

A)outside
B)employee
C)hardware
D)software

Answer 2

B

Question 3

_________ is the possibility that the system will be harmed by a threat.

A)Exposure
B)Threat
C)Security
D)Vulnerability

Answer 3

D

Question 4

The Heartbleed bug is an encryption security flaw in the ___________ software package that was an _____________ mistake by the software developer.

A)Microsoft; intended
B)Microsoft; unintended
C)OpenSSL; intended
D)OpenSSL; unintended

Question 5

The airport's self check-in computers are a(n)__________ threat.

A)outside
B)employee
C)hardware
D)software

Question 6

Which of the following is NOT an unintentional threat to information systems?

A)Careless monitoring of environmental hazards
B)Choosing a weak password
C)Having an unlocked desk or filing cabinet after going home
D)Viruses

Question 7

Social engineering is a(n)___________ threat on the part of the employee and a(n)_________ threat on the part of the social engineer.

A)deliberate; unintentional
B)deliberate; deliberate
C)unintentional; deliberate
D)unintentional; unintentional

Question 8

_________________ was originally accused of the Sony Picture Entertainment hack on November 24, 2014; their involvement ____________ been proved.

A)China; has
B)China; has not
C)North Korea; has
D)North Korea; has not

Question 9

_________ is any danger to which a system may be exposed.

A)Exposure
B)Information security
C)Threat
D)Security

Question 10

Which hacker group successfully attacked Sony Picture Entertainment on November 24, 2014?

A)Anonymous
B)Guardians of Peace
C)Hackweiser
D)Legion of Doom

Question 11

Which country is currently in a dispute with the US over bilateral hacking?

A)Australia
B)China
C)India
D)United Kingdom

Question 12

Wireless is a(n)inherently _________ network.

A)trusted
B)neutral
C)untrusted
D)useful

Question 13

Which of the following is NOT one of the most dangerous employees to information security?

A)Accountants
B)HR employees
C)Janitors
D)MIS employees

Question 14

Cybercriminals _________

A)are violent criminals.
B)can be easily arrested, once they are found.
C)don't make that much money; they do it for fun.
D)target known software security weaknesses.

Question 15

_____________________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords.

A)Dumpster diving
B)Shoulder surfing
C)Social engineering
D)Tailgating

Question 16

Google created a code fix for the Heartbleed bug. Which of the following is a TRUE statement?

A)Home internet routers should be largely safe from this bug since they don't exchange enough sensitive data to be a target.
B)Industrial control systems are highly vulnerable since they are updated infrequently.
C)Organizations simply have to install the fix.
D)Organizations need to install the fix and just create new private key-public key pairs.

Question 17

_________________ manages the internet connections for North Korea and could stop hacking attempts on the US.

A)Australia
B)China
C)India
D)Russia

Question 18

Which of the following is NOT a lesson learned from the Sony Picture Entertainment hack on November 24, 2014?

A)China is the leading hacking group that encourages similar behavior from other countries.
B)It appears that it is impossible to secure the Internet.
C)It is difficult, if not impossible, for organization to provide perfect security for their data.
D)There is a growing danger that countries are engaging in economic cyberwarfare among themselves.

Question 19

OpenSSL is __________ software.

A)Banking
B)Encryption
C)Hacking
D)Free

Question 20

Which of the following is FALSE?

A)It is easier to be a hacker nowadays.
B)Mainframes make it easy to communicate freely and seamlessly with everyone.
C)Management doesn't always support security efforts.
D)Thumb drives make it easy to steal huge amounts of sensitive information.

Question 21

Phishing is an example of __________.

A)Copyright infringement
B)Espionage
C)Sabotage
D)Software attack

Question 22

You decide to use the password "1234" on your computer because you figure nobody cares enough about your information to steal it. This is a risk __________ strategy.

A)acceptance
B)analysis
C)limitation
D)transference

Question 23

A ___________ is a remote attack requiring user action.

A)back door
B)denial-of-service attack
C)logic bomb
D)phishing attack

Question 24

If you hire a cybersecurity company like FireEye to identify security weaknesses in your information systems, you are using a risk _________ strategy.

A)acceptance
B)analysis
C)limitation
D)transference

Question 25

Risk _______________ means absorbing any damages that occur.

A)acceptance
B)analysis
C)limitation
D)transference

Question 26

A ___________ is an attack by a programmer developing a system.

A)back door
B)denial-of-service attack
C)phishing attack
D)virus

Question 27

You have a small business that has had problems with malware on your employees' computers. You decide to hire a third-party company such as GFI Software to implement security controls and then monitor your company's systems. You are adopting a risk ________ strategy.

A)acceptance
B)analysis
C)limitation
D)transference

Question 28

___________ is threatening to steal or actually stealing information from a company and then demanding payment to not use or release that information.

A)Competitive intelligence
B)Espionage
C)Information extortion
D)Intellectual property

Question 29

Coca-Cola's formula is an example of a ___________.

A)Copyright
B)Patent
C)Trade secret
D)All of the above

Question 30

_______________ is a process whereby the organization takes concrete actions against risks, such as implementing controls and developing a disaster recovery plan.

A)Risk
B)Risk analysis
C)Risk management
D)Risk mitigation

Question 31

Shodan is used for _________.

A)creating a backdoor
B)SCADA attacks
C)spreading viruses
D)phishing

Question 32

A ___________ is an attack by a programmer developing a system.

A)denial-of-service attack
B)logic bomb
C)phishing attack
D)worm

Question 33

__________ is an identity theft technique.

A)Dumpster diving
B)Espionage
C)Sabotage
D)Vandalism

Question 34

Which of the following is NOT an example of alien software?

A)Adware
B)Blockware
C)Spamware
D)Spyware

Question 35

You start browsing your favorite home improvement company's website and notice someone has changed all the logos to their main competitor's logos. This is an example of ___________.

A)Espionage
B)Identity theft
C)Information extortion
D)Sabotage

Question 36

Shodan's primary purpose is ___________.

A)a hacker website
B)a service that searches the internet for devices connected to the internet
C)a website that shows which devices are vulnerable to hackers
D)to help users search for other people who use similar devices

Question 37

The Shodan case illustrates ___________.

A)how vulnerable all devices are, even if they aren't connected to the internet
B)strong passwords aren't necessary on home devices since most hackers don't care about such a small target
C)that hackers and security researchers use the same sites to identify vulnerabilities
D)the government is doing nothing to protect our privacy

Question 38

The goal of CAPTCHA is to ___________.

A)ensure you aren't alien software
B)hack into secure networks
C)protect networks against hackers
D)remove alien software from your computer

Question 39

SCADA attacks typically occur on ___________.

A)Hacker networks
B)Industrial control systems
C)Personal computers
D)Government networks

Question 40

A ___________ is a remote attack needing no user action.

A)back door
B)denial-of-service attack
C)logic bomb
D)phishing attack

Question 41

_________ is one common example of SSL.

A)http
B)https
C)www
D)wwws

Question 42

The purpose of SpyEye is to _____________.

A)catch hackers in the act of hacking
B)collect personal and financial information
C)facilitate SCADA attacks by seeing which systems are vulnerable
D)watch what you do on your computer

Question 43

___ percent of organizational breaches exploit weak or stolen user credentials.

A)26
B)51
C)76
D)99

Question 44

A patent lasts for the life of the creator plus 70 years.

Question 45

By hiring FireEye to improve their security, Target adopted a risk _________ strategy; this strategy was ___________.

A)limitation; a failure
B)limitation; successful
C)transference; a failure
D)transference; successful

Question 46

Competitive intelligence is industrial espionage.

Question 47

The Target data breach started with a ____________.

A)back door
B)denial-of-service attack
C)logic bomb
D)phishing attack

Question 48

The main problem with multifactor authentication is _____________.

A)it's a single point of failure
B)it's too hard to do
C)it will invade our privacy
D)there are no problems with multifactor authentication

Question 49

__________ is a computer security firm that sells malware detection tools to companies like Target.

A)Heartbleed
B)FireEye
C)Shodan
D)SpyEye

Question 50

A copyright lasts 20 years.

Question 51

Wireless is an untrusted network.

Question 52

Security must be balanced with _________ for people to use systems.

A)Convenience
B)Cost
C)Time
D)Trust

Question 53

According to the "Catching a Hacker" case, ____________ is one of the most sophisticated and destructive malicious software programs ever developed.

A)the Heartbleed bug
B)FireEye
C)Shodan
D)SpyEye

Question 54

Auditing __________ the computer means inputs, outputs, and processing are checked.

A)Around
B)Into
C)Through
D)With

Question 55

If you have an empty building you can move into if your primary location is destroyed, you've implemented a _________ site.

A)Cold
B)Hot
C)Neutral
D)Warm

Question 56

Janitors are no threat to information security since they have no access to company systems.

Question 57

A firewall is a _______ control.

A)access
B)communication
C)physical
D)virtual

Question 58

Biometrics is something the user _______.

A)Does
B)Has
C)Is
D)Knows

Question 59

The goal of risk management is to reduce risk to acceptable levels.

Question 60

A smart ID card is something the user _______.

A)Does
B)Has
C)Is
D)Knows

Question 61

________________ controls restrict unauthorized individuals from using information resources.

Question 62

Identity theft is a deliberate threat to information systems and is one of the largest concerns of consumers and businesses today. What are the four techniques the book mentions for illegally obtaining information? How can you protect yourself or your future business from these threats?

Question 63

What are the five factors that contribute to the increasing vulnerability of organizational information resources? Using the Target case as an example, how did each of these five factors contribute to that situation?

Question 64

____________________ is the loss of business from increased customer turnover.

Question 65

Whitelisting is when nothing can run unless it is on the list.

Question 66

_____________ is the probability that a threat will impact an information resource.

Question 67

_____________________________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords.

Question 68

Blacklisting is when everything can run except what is on the list.

Question 69

_________________________ refers to all the processes and policies designed to protect an organization's information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Question 70

Biometrics is an authentication tool.

Question 71

Why are IT people, consultants, janitors, and guards such dangerous employees? How can you protect a company's assets against these people?

Question 72

Why is it so difficult to stop cybercriminals?

Question 73

What are the six basic guidelines for creating strong passwords? Without divulging your passwords, how do your passwords "add up" and why? HINT: You should specifically address each of the six guidelines for your passwords.

Question 74

Tracking down cybercriminals is the most difficult and only real challenge authorities face.

Question 75

________________ is software that causes pop-up advertisements to appear on your screen.