Deck 7: Information Security

Question 1

Dumpster diving is always illegal because it involves trespassing on private property.

Answer 1

False

Question 2

An information resource's vulnerability is the possibility that the system will be harmed by a threat.

Answer 2

True

Question 3

IT security is the responsibility of everyone in the organization.

Answer 3

True

Question 4

Risk analysis involves determining whether security programs are working.

Question 5

In most cases, cookies track your path through Web sites and are therefore invasions of your privacy.

Question 6

The exposure of an information resource is any danger to which a system may be exposed.

Question 7

Every device that connects to the internet is password protected.

Question 8

Human errors cause more than half of the security-related problems in many organizations.

Question 9

Software can be copyrighted.

Question 10

Supervisory control and data acquisition (SCADA)systems require human data input.

Question 11

The security of each computer on the Internet is independent of the security of all other computers on the Internet.

Question 12

You start a dog-walking service, and you store your client's records on your cell phone. You don't need to worry about information security.

Question 13

A password refers to "something the user is."

Question 14

Cyberterrorism is usually carried out by nations.

Question 15

Zero-day attacks use deceptive e-mails to acquire sensitive personal information.

Question 16

Trojan horses are software programs that hide in other computer programs and reveal their designed behavior only when they are activated.

Question 17

Cyberterrorism and cyberwarfare can attack supervisory control and data acquisition (SCADA)systems to cause widespread physical damage.

Question 18

The higher the level of an employee in organization, the greater the threat that he or she poses to the organization.

Question 19

The computing skills necessary to be a hacker are decreasing.

Question 20

Organizations utilize layers of controls because they face so many diverse threats to information security.

Question 21

An information system's _____ is the possibility that the system will be harmed by a threat.

A)vulnerability
B)risk
C)control
D)danger
E)compromise

Question 22

The computing skills necessary to be a hacker are decreasing for which of the following reasons?

A)More information systems and computer science departments are teaching courses on hacking so that their graduates can recognize attacks on information assets.
B)Computer attack programs, called scripts, are available for download from the Internet.
C)International organized crime is training hackers.
D)Cybercrime is much more lucrative than regular white-collar crime.
E)Almost anyone can buy or access a computer today.

Question 23

Employees in which functional areas of the organization pose particularly grave threats to information security?

A)human resources, finance
B)human resources, management information systems
C)finance, marketing
D)operations management, management information systems
E)finance, management information systems

Question 24

Public-key encryption uses two different keys, one public and one private.

Question 25

You start a new job, and the first thing your new company wants you to do is create a user ID and a password. To remember your password, you write it on a Post It note and put it on your laptop screen. This is an example of ________________.

A)social engineering.
B)tailgating.
C)poor security.
D)dumpster diving
E)phishing.

Question 26

Voice recognition is an example of "something a user does" authentication.

Question 27

Unintentional threats to information systems include all of the following except ______________.

A)malicious software
B)tailgating
C)power outage
D)lack of user experience
E)tornados

Question 28

The cost of a stolen laptop includes all of the following except ____________.

A)Loss of intellectual property
B)Loss of data
C)Backup costs
D)Loss of productivity
E)Replacement cost

Question 29

A _____ is any danger to which an information resource may be exposed.

A)vulnerability
B)risk
C)control
D)threat
E)compromise

Question 30

The area located between two firewalls within an organization is called the demilitarized zone.

Question 31

A VPN is a network within the organization.

Question 32

_____ involves building an inappropriate trust relationship with employees for the purpose of gaining sensitive information or unauthorized access privileges.

A)Tailgating
B)Hacking
C)Spoofing
D)Social engineering
E)Spamming

Question 33

You start a new job, and the first thing your new company wants you to do is create a user ID and a password. To remember your password, you write it on a PostIt note and throw the note out. Someone takes the note out of your garbage and gets your password. This is an example of ____________.

A)social engineering.
B)tailgating.
C)dumpster diving
D)phishing.

Question 34

A URL that begins with https rather than http indicates that the site transmits using an extra layer of security called transport layer security.

Question 35

Refer to Opening Case - Shodan: Good or Bad Tool?: Shodan is a _____________.

A)application that runs on webcams.
B)web tool used to search the Internet for devices that are programmed answer it.
C)brand of baby monitors.
D)application that blocks access to webcams.

Question 36

Rank the following in terms of dollar value of the crime, from highest to lowest.

A)robbery - white collar crime - cybercrime
B)white collar crime - extortion - robbery
C)cybercrime - white collar crime - robbery
D)cybercrime - robbery - white collar crime
E)white collar crime - burglary - robbery

Question 37

Which of the following factors is not increasing the threats to information security?

A)smaller computing devices
B)downstream liability
C)the Internet
D)limited storage capacity on portable devices
E)due diligence

Question 38

Which of the following is not one of the key factors that are contributing to the increasing vulnerability of organizational information resources.

A)International organized crime taking over cybercrime
B)Lack of management support
C)Increasing skills necessary to be a computer hacker.
D)Today's interconnected, interdependent, wirelessly networked business environment

Question 39

The most overlooked people in information security are:

A)consultants and temporary hires.
B)secretaries and consultants.
C)contract laborers and executive assistants.
D)janitors and guards.
E)executives and executive secretaries.

Question 40

Organizations use authentication to establish privileges to systems operations.

Question 41

A pharmaceutical company's research and development plan for a new class of drugs would be best described as which of the following?

A)Copyrighted material
B)Patented material
C)A trade secret
D)A knowledge base
E)Public property

Question 42

A _____ is intellectual work that is known only to a company and is not based on public information.

A)copyright
B)patent
C)trade secret
D)knowledge base
E)private property

Question 43

________ occurs when an unauthorized individual attempts to gain illegal access to organizational information.

A)Theft
B)Espionage
C)Extortion
D)Vandalism

Question 44

Information ________ occurs when an attacker either threatens to steal, or actually steals, information from a company.

A)Theft
B)Espionage
C)Extortion
D)Vandalism

Question 45

An organization's e-mail policy has the least impact on which of the following software attacks?

A)virus
B)worm
C)phishing
D)zero-day
E)spear phishing

Question 46

A _____ is a document that grants the holder exclusive rights on an invention for 20 years.

A)copyright
B)patent
C)trade secret
D)knowledge base
E)private property notice

Question 47

Refer to IT's About Business 7.1 - Stealing Cash from ATMs with Text Messages: To prevent an attack using Ploutus, which of the following is not something banks are doing?

A)Encrypt the hard drive located in the ATM.
B)Monitor the ATM via closed-circuit TV.
C)Providing better physical protection to the ATM.
D)Switching to Apple's OSx

Question 48

________ is a deliberate act that involves defacing an organization's web site.

A)Theft
B)Espionage
C)Sabotage
D)Extortion

Question 49

Cybercriminals can obtain the information they need in order to assume another person's identity by ____________.

A)Infiltrating an organization that stores large amounts of personal information.
B)Phishing.
C)Hacking into a corporate database.
D)Stealing mail.
E)All of the choices are strategies to obtain information to assume another person's identity.

Question 50

When companies attempt to counter _____ by requiring users to accurately select characters in turn from a series of boxes, attackers respond by using _____.

A)keyloggers, screen scrapers
B)screen scrapers, uninstallers
C)keyloggers, spam
D)screen scrapers, keyloggers
E)spam, keyloggers

Question 51

Dumpster diving is ______________.

A)always illegal because it is considered trespassing.
B)never illegal because it is not considered trespassing.
C)typically committed for the purpose of identity theft.
D)always illegal because individuals own the material in the dumpster.
E)always legal because the dumpster is not owned by private citizens.

Question 52

In a _____ attack, a coordinated stream of requests is launched against a target system from many compromised computers at the same time.

A)phishing
B)zero-day
C)worm
D)back door
E)distributed denial-of-service

Question 53

Which of the following is (are)designed to use your computer as a launch pad for sending unsolicited e-mail to other computers?

A)Spyware
B)Spamware
C)Adware
D)Viruses
E)Worms

Question 54

The term _____ refers to clandestine software that is installed on your PC through duplicitous channels but is not particularly malicious.

A)Alien software
B)Virus
C)Worm
D)Back door
E)Logic bomb

Question 55

_____ are segments of computer code embedded within an organization's existing computer programs that activate and perform a destructive action at a certain time or date.

A)Viruses
B)Worms
C)Trojan horses
D)Back doors
E)Logic bombs

Question 56

Refer to IT's About Business 7.1 - Stealing Cash from ATMs with Text Messages: Ploutus is ____________.

A)the operating system that runs on most ATM machines.
B)malware that runs on the computers banks use to connect to their ATMs.
C)a malware that is engineered to compromise certain types of ATMs.
D)can easily uploaded to all ATMs.

Question 57

A _____ attack uses deception to fraudulently acquire sensitive personal information by masquerading as an official e-mail.

A)Zero-day
B)Denial-of-service
C)Distributed denial-of-service
D)Phishing
E)Brute force dictionary

Question 58

Refer to IT's About Business 7.2 - The Mask: The malware application Careto appears to be designed to ____________.

A)target information from government institutions.
B)target information from home personal computers.
C)target information from personal computers used by college students.
D)target information from mom-and-pop type businesses..

Question 59

_____ are segments of computer code that attach to existing computer programs and perform malicious acts.

A)Viruses
B)Worms
C)Trojan horses
D)Back doors
E)Logic bombs

Question 60

_____ are software programs that hide in other computer programs and reveal their designed behavior only when they are activated.

A)Viruses
B)Worms
C)Trojan horses
D)Back doors
E)Logic bombs

Question 61

Your company's headquarters was just hit head on by a hurricane, and the building has lost power. The company sends you to their hot site to minimize downtime from the disaster. Which of the following statements is true?

A)The site will not have any servers.
B)The site will not have any workstations, so you need to bring your laptop.
C)The site is probably in the next town.
D)The site should be an almost exact replica of the IT configuration at headquarters.
E)The site will not have up-to-date data.

Question 62

The forecast for your company's headquarters predicts the area hit head on by a hurricane,. The company sends you to their warm site to minimize downtime should such a disaster hit. Which of the following statements is true?

A)The site will not have any servers.
B)The site will not have any workstations, so you need to bring your laptop.
C)The site is probably in the next town.
D)The site will not have any of the company's applications.
E)The site will not have up-to-date data.

Question 63

Biometrics are an example of _______________.

A)something the user is.
B)something the user wants.
C)something the user has.
D)something the user knows.
E)something the user does.

Question 64

Bob is using public key encryption to send a message to Ted. Bob encrypts the message with Ted's _____ key, and Ted decrypts the message using his _____ key.

A)public, public
B)public, private
C)private, private
D)private, public
E)none of these

Question 65

Passwords and passphrases are examples of _____________.

A)something the user is.
B)something the user wants.
C)something the user has.
D)something the user knows.
E)something the user does.

Question 66

Organizations use hot sites, warm sites, and cold sites to insure business continuity. Which of the following statements is false?

A)A cold site has no equipment.
B)A warm site has no user workstations.
C)A hot site needs to be located close to the organization's offices.
D)A hot site duplicates all of the organization's resources.
E)A warm site does not include actual applications.

Question 67

_____ controls are concerned with user identification, and they restrict unauthorized individuals from using information resources.

A)Access
B)Physical
C)Data security
D)Administrative
E)Input

Question 68

Which of the following is not a strong password?

A)IloveIT
B)08141990
C)9AmGt/*
D)Rainer
E)Information Security

Question 69

In a process called _____, a company allows nothing to run unless it is approved, whereas in a process called _____, the company allows everything to run unless it is not approved.

A)whitelisting, blacklisting
B)whitelisting, encryption
C)encryption, whitelisting
D)encryption, blacklisting
E)blacklisting, whitelisting

Question 70

Which of the following is not a characteristic of strong passwords?

A)They are difficult to guess.
B)They contain special characters.
C)They are not a recognizable word.
D)They are not a recognizable string of numbers
E)They tend to be short so they are easy to remember.

Question 71

In _____, the organization takes concrete actions against risks.

A)risk management
B)risk analysis
C)risk mitigation
D)risk acceptance
E)risk transference

Question 72

Which of the following statements is false?

A)Credit card companies usually block stolen credit cards rather than prosecute.
B)People tend to shortcut security procedures because the procedures are inconvenient.
C)It is easy to assess the value of a hypothetical attack.
D)The online commerce industry isn't willing to install safeguards on credit card transactions.
E)The cost of preventing computer crimes can be very high.

Question 73

_____ is the process in which an organization assesses the value of each asset being protected, estimates the probability that it will be compromised, and compares the probable costs of an attack with the costs of protecting the asset.

A)Risk management
B)Risk analysis
C)Risk mitigation
D)Risk acceptance
E)Risk transference

Question 74

In _____, the organization purchases insurance as a means to compensate for any loss.

A)risk management
B)risk analysis
C)risk mitigation
D)risk acceptance
E)risk transference

Question 75

Voice and signature recognition are examples of _____________.

A)something the user is.
B)something the user wants.
C)something the user has.
D)something the user knows.
E)something the user does.

Question 76

Which of the following statements concerning the difficulties in protecting information resources is not correct?

A)Computing resources are typically decentralized.
B)Computer crimes often remain undetected for a long period of time.
C)Rapid technological changes ensure that controls are effective for years.
D)Employees typically do not follow security procedures when the procedures are inconvenient.
E)Computer networks can be located outside the organization.

Question 77

Which of the following is not a strategy for mitigating the risk of threats against information?

A)Continue operating with no controls and absorb any damages that occur
B)Transfer the risk by purchasing insurance.
C)Implement controls that minimize the impact of the threat
D)Install controls that block the risk.
E)Installing an updated operating system.

Question 78

Which of the following statements concerning firewalls is false?

A)Firewalls prevent unauthorized Internet users from accessing private networks.
B)Firewalls examine every message that enters or leaves an organization's network.
C)Firewalls filter network traffic according to categories of activities that are likely to cause problems.
D)Firewalls filter messages the same way as anti-malware systems do.
E)Firewalls are sometimes located inside an organization's private network.

Question 79

Refer to IT's About Business 7.2 - The Mask: The malware application Careto appears to be developed by ____________.

A)a small-time hacker working from home.
B)a national intelligence agency.
C)a Spanish speaking national intelligence agency.
D)the National Security Agency.

Question 80

Access controls involve _____ before _____.

A)biometrics, signature recognition
B)authentication, authorization
C)iris scanning, voice recognition
D)strong passwords, biometrics
E)authorization, authentication