Deck 9: Confidentiality and Privacy Controls

Question 1

Information rights management software can do all of the following except

A)limiting access to specific files.
B)limit action privileges to a specific time period.
C)authenticate individuals accessing information.
D)specify the actions individuals granted access to information can perform.

Answer 1

C

Question 2

Identify the first step in protecting the confidentiality of intellectual property below.

A)Identifying who has access to the intellectual property.
B)Identifying the means necessary to protect the intellectual property.
C)Identifying the weaknesses surrounding the creation of the intellectual property.
D)Identifying what controls should be placed around the intellectual property.

Answer 2

A

Question 3

Identify the type of information below that is least likely to be considered confidential by an organization.

A)Audited financial statements.
B)Legal documents.
C)Top executives' salaries.
D)New product development plans.

Answer 3

A

Question 4

Which type of software provides an additional layer of protection to sensitive information that is stored in digital format,offering the capability not only to limit access to specific files or documents but also to specify the actions that individuals who are granted access to that resource can perform?

A)Anti-virus software.
B)Data loss prevention software.
C)A digital watermark.
D)Information rights software.

Question 5

Describe the four basic actions that organizations must take to preserve the confidentiality of sensitive information.

Question 6

Encryption is not a panacea to protecting confidential information.

Question 7

Classification of confidential information is the responsibility of whom,according to COBIT5?

A)External auditor.
B)Information owner.
C)IT security professionals.
D)Management.

Question 8

What confidentiality and security risk does using VoIP present to organizations?

A)Internet e-mail communications can be intercepted.
B)Internet photographs can be intercepted.
C)Internet video can be intercepted.
D)Internet voice conversations can be intercepted.

Question 9

Identify the last step in protecting the confidentiality of intellectual property below.

A)Encrypt the information.
B)Control access to the information.
C)Train employees to properly handle the information.
D)Identify and classify the information to be protected.

Question 10

After the information that needs to be protected has been identified,what step should be completed next?

A)The information needs to be placed in a secure, central area.
B)The information needs to be encrypted.
C)The information needs to be classified in terms of its value to the organization.
D)The information needs to be depreciated.

Question 11

The Bear Corporation uses a tool that embeds a code into all of its digital documents.It then scours the internet,searching for codes that it has embedded into its files.When Bear finds an embedded code on the internet,it knows that confidential information has been leaked.Bear then begins identifying how the information was leaked and who was involved with the leak.Bear is using

A)an information rights management software.
B)a data loss prevention software.
C)a digital watermark.
D)a stop leak software.

Question 12

The first steps in protecting the privacy of personal information is to identify

A)what sensitive information is possessed by the organization.
B)where sensitive information is stored.
C)who has access to sensitive information.
D)All of the above are first steps in protecting privacy.

Question 13

Describe some steps you can take to minimize your risk of identity theft.

Question 14

Encryption is a necessary part of which information security approach?

A)Defense in depth.
B)Time based defense.
C)Continuous monitoring.
D)Synthetic based defense.

Question 15

Explain the controls that organizations can use to protect the privacy of personal information they collect from customers, suppliers, and employees, and discuss how the Generally Accepted Privacy Principles (GAPP) framework provides guidance in developing a comprehensive approach to protecting privacy.
Which of the following is not one of the 10 internationally recognized best practices for protecting the privacy of customers' personal information?

A)Provide free credit report monitoring for customers.
B)Inform customers of the option to opt-out of data collection and use of their personal information.
C)Allow customers' browsers to decline to accept cookies.
D)Utilize controls to prevent unauthorized access to, and disclosure of, customers' information.

Question 16

Explain the controls that organizations can use to protect the privacy of personal information they collect from customers, suppliers, and employees, and discuss how the Generally Accepted Privacy Principles (GAPP) framework provides guidance in developing a comprehensive approach to protecting privacy.
A client approached Paxton Uffe and said,"Paxton,I need for my customers to make payments online using credit cards,but I want to make sure that the credit card data isn't intercepted.What do you suggest?" Paxton responded,"The most effective solution is to implement

A)a data masking program."
B)a virtual private network."
C)a private cloud environment."
D)an encryption system with digital signatures."

Question 17

Which of the following is not one of the basic actions that an organization must take to preserve the confidentiality of sensitive information?

A)Identification of information to be protected.
B)Backing up the information.
C)Controlling access to the information.
D)Training.

Question 18

Discuss the most important control for protecting confidentiality.

Question 19

Which type of software blocks outgoing messages containing key words or phrases associated with an organization's sensitive data?

A)Anti-virus software.
B)Data loss prevention software.
C)A digital watermark.
D)Information rights software.

Question 20

Encryption is one of the many ways to protect information in transit over the internet.

Question 21

Abbie Johnson is a programmer at Healtheast network.Abbie has recently developed a new computer program for Healtheast.As part of the testing process,Abbie needs to use realistic patients data to ensure that the system is working properly.To protect privacy,management at Healtheast uses a program that replaces private patient information with fake values before sending the data to Abbie for testing.The program that replaces patient information with fake values is called

A)data encryptioning.
B)data masking.
C)data wiping.
D)data redacting.

Question 22

All of the following are associated with asymmetric encryption except

A)speed.
B)private keys.
C)public keys.
D)no need for key exchange.

Question 23

If an organization asks you to disclose your social security number,yet fails to permit you to opt-out before you provide the information,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Management.
B)Notice.
C)Choice and consent.
D)Use and retention.

Question 24

It is impossible to encrypt information transmitted over the Internet.

Question 25

Discuss to the key CAN-SPAM's guidelines on commercial e-mail that has the primary purpose of advertising.

Question 26

CAN-SPAM provides both criminal and civil penalties for violations of the law.

Question 27

If an organization asks you to disclose your social security number,but fails to establish a set of procedures and policies for protecting your privacy,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Management.
B)Notice.
C)Choice and consent.
D)Use and retention.

Question 28

Identify the item below that is not a step you could take to prevent yourself from becoming a victim of identity theft.

A)Shred all documents that contain your personal information.
B)Only print your initial and last name on your personal checks.
C)Monitor your credit reports regularly.
D)Refuse to disclose your social security number to anyone or any organization.

Question 29

If an organization asks you to disclose your social security number,but decides to use it for a different purpose than the one stated in the organization's privacy policies,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Collection.
B)Access.
C)Security.
D)Quality.

Question 30

Data masking is also referred to as

A)encryption.
B)tokenization.
C)captcha.
D)cookies.

Question 31

If an organization asks you to disclose your date of birth and your address,but refuses to let you review or correct the information you provided,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Collection.
B)Access.
C)Security.
D)Choice and consent.

Question 32

CAN-SPAM applies to both commercial and personal e-mail.

Question 33

Cindy Vindoolo logged on to her e-mail account to find that she had received 50 e-mails from a company called LifeCo that promised her extreme weight loss if she bought their diet pills.Cindy angrily deleted all 50 e-mails,realizing she was a victim of

A)telemarketing.
B)spam.
C)direct mail.
D)MLM.

Question 34

If an organization asks you to disclose your social security number,yet fails to properly dispose of your private information once it has fulfilled its purpose,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Management.
B)Notice.
C)Choice and consent.
D)Use and retention.

Question 35

If an organization asks you to disclose your social security number,but fails to tell you about its privacy policies and practices,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Management.
B)Notice.
C)Choice and consent.
D)Use and retention.

Question 36

Identify the item below which is not a piece of legislation passed to protect individuals against identity theft or to secure individuals' privacy.

A)The Health Insurance Portability and Accountability Act (HIPAA).
B)The Health Information Technology for Economic and Clinical Health Act (HITECH).
C)The Gramm--Leach--Bliley Act.
D)The Dodd-Frank Act.

Question 37

Under CAN-SPAM legislation,an organization that receives an opt-out request from an individual has ________ days to implement steps to ensure they do not send out any additional unsolicited e-mail to the individual again.

A)2
B)5
C)7
D)10

Question 38

If an organization asks you to disclose your date of birth and your address,but fails to take any steps to protect your private information,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Collection.
B)Access.
C)Security.
D)Quality.

Question 39

If an organization asks you to disclose your date of birth and your address,but fails to establish any procedures for responding to customer complaints,the organization has likely violated which of the Generally Accepted Privacy Principles?

A)Collection.
B)Access.
C)Security.
D)Monitoring and enforcement.

Question 40

Which of the following is not true regarding virtual private networks (VPN)?

A)VPNs provide the functionality of a privately owned network using the Internet.
B)Using VPN software to encrypt information while it is in transit over the Internet in effect creates private communication channels, often referred to as tunnels, which are accessible only to those parties possessing the appropriate encryption and decryption keys.
C)It is more expensive to reconfigure VPNs to include new sites than it is to add or remove the corresponding physical connections in a privately owned network.
D)The cost of the VPN software is much less than the cost of leasing or buying the infrastructure (telephone lines, satellite links, communications equipment, etc.)needed to create a privately owned secure communications network.

Question 41

Identify one weakness of encryption below.

A)Encrypted packets cannot be examined by a firewall.
B)Encryption provides for both authentication and non-repudiation.
C)Encryption protects the privacy of information during transmission.
D)Encryption protects the confidentiality of information while in storage.

Question 42

Encryption has a remarkably long and varied history.Spies have been using it to convey secret messages ever since there were secret messages to convey.One powerful method of encryption uses random digits.Two documents are prepared with the same random sequence of numbers.The spy is sent out with one and the spy master retains the other.The digits are used as follows.Suppose that the word to be encrypted is SPY and the random digits are 352.Then S becomes V (three letters after S),P becomes U (five letters after P),and Y becomes A (two letters after Y,restarting at A after Z).The spy would encrypt a message and then destroy the document used to encrypt it.This is an early example of

A)a hashing algorithm.
B)asymmetric key encryption.
C)symmetric key encryption.
D)public key encryption.

Question 43

Text that was transformed into unreadable gibberish using encryption is called

A)plaintext.
B)ciphertext.
C)encryption text.
D)private text.

Question 44

One way to circumvent the counterfeiting of public keys is by using

A)a digital certificate.
B)digital authority.
C)encryption.
D)cryptography.

Question 45

A laptop computer belonging to the Novak group was stolen from the trunk of a sales manager's car while she was attending a conference.After reporting the theft,the manager considered the implications for the company's network security and concluded there was little to worry about because

A)the computer was insured against theft.
B)the computer was protected by a password.
C)the data stored on the computer was encrypted.
D)it was unlikely that the thief would know how to access the company data stored on the computer.

Question 46

Using a combination of symmetric and asymmetric key encryption,Sofia sent a report to her home office in Indiana.She received an e-mail acknowledgement that her report had been received,but a few minutes later she received a second e-mail that contained a different hash total than the one associated with her report.This most likely explanation for this result is that

A)the public key had been compromised.
B)the private key had been compromised.
C)the symmetric encryption key had been compromised.
D)the asymmetric encryption key had been compromised.

Question 47

A process that takes plaintext of any length and transforms it into a short code is called

A)asymmetric encryption.
B)encryption.
C)hashing.
D)symmetric encryption.

Question 48

Which systems use the same key to encrypt communications and to decrypt communications?

A)Asymmetric encryption.
B)Symmetric encryption.
C)Hashing encryption.
D)Public key encryption

Question 49

An electronic document that certifies the identity of the owner of a particular public key.

A)Asymmetric encryption.
B)Digital certificate.
C)Digital signature.
D)Public key.

Question 50

Which of the following is not one of the three important factors determining the strength of any encryption system?

A)Key length.
B)Policies for managing cryptographic keys.
C)Encryption algorithm.
D)Storage of digital signatures.

Question 51

Asymmetric key encryption combined with the information provided by a certificate authority allows unique identification of

A)the user of encrypted data.
B)the provider of encrypted data.
C)both the user and the provider of encrypted data.
D)either the user or the provider of encrypted data.

Question 52

Which of the following descriptions is not associated with symmetric encryption?

A)A shared secret key.
B)Faster encryption.
C)Lack of authentication.
D)Separate keys for each communication party.

Question 53

Describe symmetric encryption and identify three limitations.

Question 54

Information encrypted with the creator's private key that is used to authenticate the sender is called

A)asymmetric encryption.
B)digital certificate.
C)digital signature.
D)public key.

Question 55

________ are used to create digital signatures.

A)Asymmetric encryption and hashing
B)Hashing and packet filtering
C)Packet filtering and encryption
D)Symmetric encryption and hashing

Question 56

In a private key system the sender and the receiver have ________,and in the public key system they have ________.

A)different keys; the same key
B)a decrypting algorithm; an encrypting algorithm
C)the same key; two separate keys
D)an encrypting algorithm; a decrypting algorithm

Question 57

Encryption has a remarkably long and varied history.The invention of writing was apparently soon followed by a desire to conceal messages.One of the methods,was the simple substitution of numbers for letters,for example A = 1,B = 2,etc.This is an example of

A)a hashing algorithm.
B)symmetric key encryption.
C)asymmetric key encryption.
D)a public key.

Question 58

The system and processes used to issue and manage asymmetric keys and digital certificates are known as

A)asymmetric encryption.
B)certificate authority.
C)digital signature.
D)public key infrastructure.

Question 59

The creation of a digital signature is a two-step process.

Question 60

You are assisting a manager from your company's headquarters in New York.The manager needs to interact online in real time with one of your company's affiliate overseas.The manager wants to make sure that her communications with the overseas affiliate won't be intercepted.What should you suggest to the manager?

A)A virtual private network connection.
B)A multifactor authentication network connection.
C)A private cloud network connection.
D)An asymmetric encryption system with digital signatures connection.

Question 61

Compare the advantages and disadvantage of symmetric and asymmetric encryption.