Deck 5: Security and Controls

Question 1

The concept of non-repudiation refers to:

A) the inability to deny who the sender of data was.
B) the inability to identify who the sender of data was.
C) the automatic destruction of data after it has been sent.
D) a virus which destroys a user's hard drive.
E) a network scenario where backup procedures are carried out.

Answer 1

the inability to deny who the sender of data was.

Question 2

The following are all examples of security controls except:

A) policies on putting test applications into production
B) monitoring employee emails for personal messages
C) requiring passwords to access important applications
D) requiring users to change passwords every thirty days
E) documenting backup policies and procedures

Answer 2

monitoring employee emails for personal messages

Question 3

Software development within a firm:

A) can result in very severe security risks.
B) has little to do with security since it is internal.
C) should generally be outsourced for security reasons.
D) should always be kept encrypted.
E) requires the same security procedures as purchased software.

Answer 3

can result in very severe security risks.

Question 4

A janitor brought her children to work in the evening and let them into the server room to use the network server to play games because her computer was already logged on. What control has been broken?

A) physical controls
B) logical access controls
C) general access controls
D) security management controls
E) all of the above

Question 5

A public key infrastructure relies on which of the following?

A) digital certificates, encryption, and certificate authorities
B) random key generators, and encryption
C) certificate authorities, government key authority, and encryption
D) digital certificates, digital keys, and digital encryption
E) all of the above

Question 6

An asymmetric approach to security management means that:

A) both the sender and receiver of data have the same key.
B) the sender and receiver of data each have their own key.
C) the sender and receiver of data share a public-private key pair.
D) trading partners agree to outsource their security to a specialist.
E) trading partners directly link their servers with a VPN.

Question 7

The following is an example of an applications control:

A) a password is required to log onto the network
B) the security manager has written an internet-use policy
C) email is backed up on a storage area network
D) an input mask ensures data is entered appropriately
E) none of the above

Question 8

Which of the following would be part of the disaster recovery plan of a company?

A) operations controls
B) physical controls
C) backup hardware locations
D) the number of check digits there should be in the application controls
E) none of the above

Question 9

A security policy for a firm should deal with:

A) the responsibility for security issues in the firm.
B) types of controls to be used.
C) computing policies for users to follow.
D) disaster recovery issues.
E) all of the above

Question 10

More than half the damage suffered in security breaches is caused by:

A) the inability to safely answer questionnaires.
B) carelessness, errors, or omissions.
C) having email read by unauthorized persons.
D) failure to lock the web browsers.
E) not having a firewall to protect the data .

Question 11

Digital certificates are used to:

A) identify who a user is and share their public key.
B) identify who a user is and share their private key.
C) let email recipients know what email program you use.
D) encrypt corporate data before it leaves the firewall.
E) encrypt outside data before it comes in through the firewall.

Question 12

Viruses can potentially result in:

A) destruction of data.
B) inappropriate access to data.
C) slowing of network traffic.
D) employee downtime.
E) all of the above

Question 13

The most accurate description of a firewall would be:

A) a security company hired to monitor your website.
B) a hardware device used to monitor traffic between a network and the internet.
C) a software application that determines how often backups should be made and ensures that they are stored offsite.
D) a protective barrier in the wall outside of the network room.
E) a high risk area of a network.

Question 14

When logging on to a network server, authentication would mean that:

A) the user is permitted to look at specific directories on the server.
B) the password has expired.
C) the server is using VPN technology.
D) the client computer is recognized by the server.
E) all of the above

Question 15

The term that describes the privileges that a user has within a system is ________.

A) physical controls
B) authentication
C) non-repudiation
D) authorization
E) data management

Question 16

The primary purpose of a firewall is to:

A) ensure that employees don't shop online while at work.
B) encrypt data sent over the internet.
C) monitor website traffic for ecommerce purposes.
D) make the internal network of a company more secure.
E) none of the above

Question 17

Secure socket layer (SSL) is:

A) a section of a website requiring a username and password.
B) email being sent through the underground internet.
C) a component of internet security protocol used to securely connect clients and servers.
D) a component of the internet used to connect desktops to wireless applications.
E) none of the above

Question 18

The following statement best describes encryption on the internet:

A) Encryption completely protects your data.
B) Encryption assists in an overall security program.
C) Encryption only works on an intranet.
D) Encryption only works for email.
E) none of the above

Question 19

An employee created a new database system to track promotional materials and linked it into the ERP system. Soon after, the ERP system's inventory module suffered a crash. This crash is likely the result of ________.

A) physical controls
B) non-repudiation
C) developmental controls
D) digital signatures
E) firewall errors

Question 20

Computer viruses are a major security threat because:

A) they can break through any protective measure.
B) they can be embarrassing to companies.
C) they cause a risk of loss of data.
D) they can infect home computers.
E) firewalls cannot protect against viruses.

Question 21

There are two broad categories of controls. These are:

A) general and applications controls.
B) security and access controls.
C) firewall and biometric controls.
D) logical and operations controls.
E) management and business process

Question 22

The annual report of Canadian Tire's financial activities contains a tag containing the time that it was created, modified and moved. This is an example of ________.

A) auto tagging
B) digital tagging
C) time stamping
D) authentication
E) auto stamping

Question 23

A potential problem with some Intrusion Detection Systems is the generation of a large volume of ________.

A) false-positives
B) false-negatives
C) true-positives
D) true-negatives
E) all of the above

Question 24

Malicious acts include:

A) hacker attacks and viruses.
B) floods and storms.
C) unintentional errors.
D) power failure.
E) all of the above

Question 25

An International Development System (IDS) monitors devices and processes for security threats and can alert security personnel of the occurrence of unusual activity as it occurs.

Question 26

With current technology, security risks are becoming much less of a concern.

Question 27

Logical access controls include locking the door to the server room.

Question 28

Firewalls are only one component of an overall security program.

Question 29

An access control technique used on the web to prevent unauthorized software from masquerading as a person, presenting a set of distorted squiggly letters and numbers that people can decipher but computers cannot is called ________.

A) GOTCHA
B) a digitial signature
C) CAPTCHA
D) a public key
E) encryption

Question 30

A company can build its security platform on public key infrastructure.

Question 31

The use of electronic devices attached to transmission lines that can detect and capture data transmissions on those lines is called:

A) Certificate Authorities (CAS).
B) check digits.
C) sniffing.
D) a digital certificate.
E) a disaster recovery plan.

Question 32

The most basic privilege in a computerized business system is ________.

A) operation
B) output
C) storage
D) access
E) processing

Question 33

S-HTTP is an extension of HTTP that enables individual messages to be encrypted.

Question 34

Lack of standards, regulations and rules, and support systems are examples of internal risks associated with new business models.

Question 35

The encryption of information is all that is needed to ensure that a network is safe from attacks.

Question 36

An entity's security program must address all but the following:

A) its users' security awareness
B) procedural guidance and training
C) compliance incentives
D) business process improvement
E) compliance monitoring.

Question 37

Biometrics include all of the following except:

A) signatures.
B) fingerprints.
C) passwords
D) voice recognition.
E) retina scans

Question 38

All applications that a business uses require controls for input, processing, output, storage, and:

A) communications.
B) access
C) authorization
D) performance
E) privacy

Question 39

The process of encryption converts data into a form called cipher.

Question 40

Studies on stock prices of ebusiness entities have shown that security breaches involving access to confidential data and website outages are associated with significant stock price declines.

Question 41

Define the meaning of the term "hash".

Question 42

List the major components of a security policy.

Question 43

What pair of "keys" is used to encrypt and decrypt messages and other data transmissions?

Question 44

How does drive-by hacking work?

Question 45

All risks can be prevented.

Question 46

Explain the "principle of least privilege".

Question 47

List six categories included in general controls.

Question 48

Describe what should be included in end-user computing policy.

Question 49

Determining the right level of security is a difficult balance. Explain.

Question 50

Outsourcing IT activities can lead to a loss of control over the entity's business activities.