Deck 5: Cybersecurity, Compliance, and Business Continuity

Question 1

An) _______________________ is a special kind of hacker who attempts to breach secure networks looking for trade secrets or proprietary information.

A) Hacktivist
B) Political criminal
C) Industrial spy
D) Attention seeker

Answer 1

C

Question 2

For many organizations, ____________ technologies have worsened their exposure to security risks because they cannot enforce or verify their ____________ providers' cybersecurity policies.

A) Database
B) Cloud
C) Anti-virus
D) Local Area Network LAN)

Answer 2

B

Question 3

Which of the following was not cited in your text as a reason why cyberattacks are getting worse?

A) Because networks are used by hacktivists looking for media attention
B) Because of hackers stealing credentials such as banking PINS and passwords
C) Because of industrial spies looking for trade secrets
D) Because of decreased awareness about the problem on the part of top management and IT professionals in organizations.

Answer 3

D

Question 4

A stealth network attack in which an unauthorized person gains access to a network and remains undetected for a long time is referred to as an) ___________________________.

A) Background Intruder attack
B) Advanced Persistent Threat APT) attack
C) Silent Sabotage attack
D) Unauthorized Security Breach USB) attack

Question 5

Which of the following represents the chief concern about employees using their own smartphones for work purposes?

A) Employees will spend too much time playing games or using entertainment and recreation apps, thus reducing productivity.
B) Managers will be unable to monitor phone calls or police the volume of personal calls made during work hours.
C) Many personal smartphones do not have anti-malware or data encryption apps, creating a security problem with respect to any confidential business data stored on the device.
D) Consumer quality equipment is more likely to break or malfunction than enterprise quality devices.

Question 6

Organizations in the ________________________ industries are more heavily regulated than most when it comes to being required take special measures to protect the business and data.

A) Banking and finance, entertainment and technology
B) Technology, banking and finance, and education
C) Energy utility, health care, and banking and finance
D) Healthcare, technology and defense

Question 7

Most data breaches go unreported, according to cybersecurity experts, because corporate victims fear that disclosure would ______________________.

A) Result in the firing of the top IT management or top officials in the organization.
B) Damage their stock price, or because they never knew they were hacked in the first place.
C) Encourage other hackers to target the organization.
D) Require them to spend more money on increasing security in the future.

Question 8

The Data Breach Investigations Report revealed that 97 percent of data breaches evaluated in the study _____________________________________.

A) Resulted from sophisticated software attacks that effectively defeated the IT security defenses in place at the time of the attack.
B) Were avoidable and did not require hackers to possess special skills, resources, or customization.
C) Resulted from hackers using high tech hardware to breach the IT security defenses in place at the time of the attack.
D) Resulted from a combination of sophisticated hacking software and hardware tools designed to defeat IT security defenses.

Question 9

Which of the following most accurately describes the steps that organizations should take to secure confidential data?

A) There are no laws that specifically address unauthorized access of confidential data.
B) Current laws prohibit unauthorized access of confidential data, but few laws require organizations to take steps to protect data.
C) Only a few specific industries
D) International, federal, and state laws and industry regulations mandate that organizations invest in cybersecurity defenses, audits, and internal controls to secure confidential data.
E)g. banking, health care) are affected by laws requiring organizations to take steps to protect data.

Question 10

______________________ is/are defined as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters."

A) The National Security architecture
B) Strategically connected networks
C) Critical infrastructure
D) Secure network architecture

Question 11

LulzSec and Anonymous are examples of hacker groups that have claimed responsibility for high profile attacks designed to make a political statement, embarrass an organization or government, or to gain publicity. According to your text, organizations like these are considered _______________.

A) Hacktivists
B) Political criminals
C) Industrial spies
D) Information Systems Terrorists

Question 12

____________________is a type of attack where a web site or network is bombarded with traffic to make them crash.

A) Advanced Persistent Threat APT)
B) Malware intrusion
C) Denial of service DoS)
D) System Overload Attack SOA)

Question 13

One way that hackers and corporate spies trick people into revealing login information or access codes is __________________; use of an incentive to get a user to perform an insecure action. A common application of this practice involves offering a free app or video for clicking a link in a text message and voting for best video game. Clicking the link downloads malware.

A) Pretexting
B) Identity Fraud
C) Baiting
D) Thrashing

Question 14

People wanting to use their mobile devices at work is part of a trend called _____________.

A) Personal devices at work PDAW)
B) Bring your own device BYOD)
C) Consumer /Enterprise Equipment CEE)
D) Non-Approved Devices NAD)

Question 15

Which of the following factors was not listed in your text as a challenge related to managing employee owned mobile devices used for work related purposes?

A) Increase costs of managing new and existing mobile devices
B) Security threats - employee owned devices may not be properly protected with strong passwords or encryption software.
C) Compliance - employee owned devices may not meet regulatory standards for how data must be collected, stored, or made available in the event of audit or legal action.
D) Impact on productivity - managers must trade-off gains related to employees having 24/7 access to work related data against losses related to employees using non-work related apps
E)g. personal social media, texting, personal phone calls) while on the job.

Question 16

One source of cybersecurity threats today are ____________, hacker-activists or hacking for a cause) who breach networks in an attempt to gain media attention.

A) Hacktivists
B) Political criminals
C) Industrial spies
D) Attention seekers

Question 17

________________ tactics are used by hackers and corporate spies to trick people into revealing login information or access codes.

A) Social engineering
B) URL fabricating
C) Security crashing
D) Password crashing

Question 18

Which of the following is not a true statement regarding the use of employee owned mobile devices in the workplace?

A) With the number of mobile apps hitting 1.3 million-compared to only 75,000 apps for PCs--managing employee-owned devices is more complex and expensive.
B) Companies are increasingly prohibiting employees from using their personal mobile devices for work related purposes because of security and compliance challenges.
C) Companies need to insure and be able to prove that enterprise data stored on personal devices are in compliance,
D) Controls placed on employee-owned devices can infringe on personal privacy; organizations could learn what sites were visited or movies were watched, what was done on sick days, and all social media activities during work hours and off-hours.
E)g., encrypted, password protected, unaltered, etc.

Question 19

One way that hackers and corporate spies trick people into revealing login information or access codes is __________________; using a story that convinces someone that it is okay to reveal secret information.

A) Pretexting
B) Identity Fraud
C) Baiting
D) Thrashing

Question 20

According to your text, the preferred method of hackers who wish to steal trade secrets and other confidential information from business organizations is _______________________.

A) To bribe employees to get access codes and passwords.
B) To bombard websites or networks with so much traffic that they "crash", exposing sensitive data.
C) To break into employees' mobile devices and leapfrog into employers' networks-stealing secrets without a trace.
D) Use a combination of sophisticated hardware tools designed to defeat IT security defenses.

Question 21

IT professionals work hard to protect key characteristics of an asset from security breaches. One of these characteristics is _________________, or the property that data is accessible and modifiable when needed by those authorized to do so.

A) Integrity
B) Confidentiality
C) Availability
D) Reliability

Question 22

In Cybersecurity terminology, a threat is defined as:

A) A weakness that threatens the confidentiality, integrity, or availability CIA) of an asset
B) Something or someone that may result in harm to an asset
C) Estimated cost, loss, or damage that can result from an exploited vulnerability
D) Tool or technique that takes advantage of a vulnerability

Question 23

IT professionals work hard to protect key characteristics of an asset from security breaches. One of these characteristics is _________________, or the property that data or files have not been altered in an unauthorized way.

A) Integrity
B) Confidentiality
C) Availability
D) Reliability

Question 24

IT professionals work hard to protect key characteristics of an asset from security breaches. One of these characteristics is _________________, or the avoidance of unauthorized disclosure of information or data.

A) Integrity
B) Confidentiality
C) Availability
D) Reliability

Question 25

In Cybersecurity terminology, an exploit is defined as:

A) A weakness that threatens the confidentiality, integrity, or availability CIA) of an asset
B) The estimated cost, loss, or damage that can result from an exploited vulnerability
C) A tool or technique that takes advantage of a vulnerability
D) The probability of a threat exploiting a vulnerability

Question 26

The three key principles of cybersecurity are:

A) Data protection, equipment protection, reputation protection
B) Confidentiality, integrity, availability
C) Anticipate, defend, counter-attack
D) Identify, assess risk, take action

Question 27

Viruses, worms, Trojan horses, spyware, and any other type of disruptive, destructive, or unwanted programs are examples of ___________________.

A) Spam
B) Adware
C) Malware
D) Spyware

Question 28

In Cybersecurity terminology, a risk is defined as:

A) A weakness that threatens the confidentiality, integrity, or availability CIA) of an asset
B) The estimated cost, loss, or damage that can result from an exploited vulnerability
C) A tool or technique that takes advantage of a vulnerability
D) The probability of a threat exploiting a vulnerability

Question 29

The ability of an IS to continue to operate when a failure occurs, but usually for a limited time or at a reduced level is referred to as _______________.

A) Fault tolerance
B) Minimal Operating Level MOL)
C) Stand-by Mode
D) System Fail Mode

Question 30

Some government and corporate officials concerned about security threats from abroad do not bring their own cell phone or laptop when traveling overseas. Instead, they bring loaner devices and follow a strict regimen of security procedures including not connecting to their US network while out of the country. These procedures are referred to as ____________________.

A) Top Secret Security Procedures
B) Do-Not-Carry-Rules
C) Foreign Threat Prevention Procedures FTPP)
D) Strict Security Standards SSS)

Question 31

Chris Morrisey is a network manager for a large company. She receives daily updates about various worms, viruses and other malicious software found on the Internet including an assessment of how dangerous each of these are so that she can figure out how best to protect her organization's network. The information in her report is about __________________.

A) Threats and risks
B) Vulnerabilities
C) Exposure
D) Network Integrity

Question 32

Chris Morrisey is a network manager for a large company. She receives daily updates about various worms, viruses and other malicious software found on the Internet and then assesses how to best protect her organization's network from possible attack. In cybersecurity terminology, she is involved in ________________________.

A) Identifying exposure
B) Risk management
C) An audit
D) Encryption

Question 33

Access to top secret or highly secure networks associated with Homeland Security or national defense often use authentication methods based on a biological feature, such as a fingerprint or retina to identify a person. These methods are called ____________________.

A) Advanced security methods
B) Physical security
C) Biometrics
D) Unique Identification methods

Question 34

In Cybersecurity terminology, a vulnerability is defined as:

A) A weakness that threatens the confidentiality, integrity, or availability CIA) of an asset
B) Something or someone that may result in harm to an asset
C) Estimated cost, loss, or damage that can result from a cybersecurity breach
D) Tool or technique that threatens the confidentiality, integrity, or availability CIA) of an asset

Question 35

Intrusion Detection Systems IDS) are designed to monitor network traffic and identify threats that may have breached the networks initial defenses. These include all of the following except:

A) An attacker who is using the identity or credentials of a legitimate user to gain access to an IS, device, or network
B) A legitimate user who performs actions he is not authorized to do
C) A user who tries to disguise or cover up his actions by deleting audit files or system logs.
D) Employees who use computing or network resources inefficiently.

Question 36

U.S. cybersecurity experts and government officials are increasingly concerned about breaches from ______________________ into corporate networks, either through mobile devices or by other means.

A) Domestic terrorists
B) Amateur hackers
C) Organized crime syndicates based in the United States
D) Other countries

Question 37

When sending sensitive email, James uses a program that transforms data into scrambled code to protect it from being understood by unauthorized users. James is using ______________ to protect his email communications.

A) Authentication
B) Coding
C) Encryption
D) Text Mashing

Question 38

Most organizations use a software or hardware device that controls access to their private network from the Internet by analyzing data packets entering or exiting it. These devices are called ________________.

A) Secure channels
B) Botnets
C) Virus Blockers
D) Firewalls

Question 39

In cybersecurity terms, the function of a password together with a username is to __________ a user's identity to verify that the person has the right to access a computer or network.

A) Record
B) Authenticate
C) Substantiate
D) Validate

Question 40

__________________ contain a combination of upper- and lower-case letters, numbers, and punctuation marks, and at least eight characters long although ten characters is better.

A) Secret codes
B) Digital keys
C) Strong passwords
D) Unbreakable passcodes

Question 41

Which of the following would not be considered an example of an intentional security threat?

A) Theft of data
B) Inappropriate use of data
C) Malicious damage to computer resources
D) Human Error
E)g., manipulating inputs)

Question 42

Which of the following is not a characteristic of money laundering and terrorist financing?

A) Transnational organized crime groups use money laundering to fund their operations, which creates international and national security threats.
B) Cybercrime is safer and easier than selling drugs, dealing in black market diamonds, or robbing banks.
C) Funds used to finance terrorist operations are easy to track, which provides evidence to identify and locate leaders of terrorist organizations and cells.
D) Online gambling offers easy fronts for international money-laundering operations.

Question 43

The supervision, monitoring, and control of the organization's IT assets is called __________________.

A) IT planning
B) Strategic planning for IT
C) IT governance
D) IT architecture management

Question 44

Computers infected by software "robots" can be organized into networks called ______________.

A) Zombies
B) Spies
C) Botnets
D) Phishnets

Question 45

Which of the following would not be considered an example of an intentional security threat?

A) Computer systems failure
B) Malicious damage to computer resources
C) Destruction from viruses and similar attacks
D) Internet fraud

Question 46

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved, threats from __________________ have increased considerably in recent years.

A) Software errors
B) Malicious employees
C) Social networks and cloud computing
D) Vendor sabotage

Question 47

The ______________________ is an exercise that determines the impact of losing the support or availability of a resource.

A) Business impact analysis BIA)
B) Vulnerability audit
C) Asset valuation audit
D) Computing Cost/Benefit CCB) audit

Question 48

Organizations that use the _______________________ of network security develop strategic layers of protection against security breaches. The top layer is often, "senior management commitment and support" of security efforts.

A) Layered Security Model
B) Security module model
C) Segmented security model
D) Defense-in-depth model

Question 49

Facebook, YouTube, Twitter, LinkedIn, and other social networks are making IT security dangers worse. Why?

A) Users invite in and build relationships with others. Cybercriminals hack into these trusted relationships using stolen log-ins.
B) E-mail viruses and malware have been increasing for years even though e-mail security has improved.
C) Communication has shifted from social networks to smartphones.
D) Web filtering, user education, and strict policies cannot help prevent IT security dangers on Facebook and other social networks.

Question 50

Most information security incidents will occur because of _______________________.

A) Increases in hacker skills and capabilities
B) Poorly designed network protection software
C) Increasing sophistication of computer viruses and worms
D) Users who do not follow secure computing practices and procedures

Question 51

Effective organizations develop an) _____________________ that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance.

A) Terms of service TOS)
B) Acceptable use policy AUP)
C) Safe security plan SSP)
D) Computing practices policy CPP)

Question 52

Samuel received an email that looked like it came from his bank. The email asked him to click on a link that opened an official looking Webpage that asked him to enter information about his account. But when he looked at the URL address, he noticed it was a strange address he did not recognize. As a result, he closed his browser and deleted the email rather than enter anything on the fraudulent page. Most likely, someone was attempting to steal Samuel's information using a technique called __________________.

A) Malware
B) Phishing
C) Impostering
D) Click hijacking

Question 53

In the United States, the Sarbanes-Oxley Act SOX), Gramm-Leach-Bliley Act GLB), Federal Information Security Management Act FISMA), and USA Patriot Act all require businesses to __________________________.

A) Report security breaches
B) Backup sensitive data
C) Protect personally identifiable information
D) Inform the public about network failures in a timely manner

Question 54

__________ is the elapsed time between when vulnerability is discovered and when it's exploited and has shrunk from months to __________.

A) Time-to-exploitation; weeks
B) Time-to-exploitation; minutes
C) Denial of service; days
D) Denial of service; seconds

Question 55

The "Payment Card Industry Data Security Standard PCI DSS)" created by Visa, MasterCard, American Express, and Discover is a ___________________________________.

A) Set of standards required by U.S. and international law for protecting credit card transaction data.
B) Set of industry standards required for all members, merchants, or service providers that store, process, or transmit cardholder data.
C) Set of voluntary security guidelines for retailers who accept Visa, MasterCard, American Express, and Discover credit cards.
D) Set of regulations that vary from state to state, and country to country) that apply to credit card companies, but not necessarily to retailers or merchants who accept them.

Question 56

Intrusion Detection Systems IDS) are designed to detect and protect a network primarily from _____________ threats.

A) Social media
B) Internal
C) Cloud based
D) Foreign

Question 57

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security. Which of the following is not an example of an unintentional threat described in your textbook?

A) Political/civic unrest
B) Human errors
C) Environmental hazards
D) Computer systems failures

Question 58

Which of the following is not one of the COBIT Control Objectives for Information and Related Technology) principles listed in your textbook?

A) Principle of economic use of resources
B) Principle of legality
C) Principle of secure assets
D) Accounting principles

Question 59

When new vulnerabilities are found in operating systems, applications, or wired and wireless networks, vendors of those products release __________ or __________ to fix the vulnerabilities.

A) Patches; service packs
B) Patches; downloads
C) Firewalls; spyware
D) Service packs; firewalls

Question 60

The director of the Federal Trade Commission FTC) bureau of consumer protection warned that the agency would bring enforcement action against small businesses

A) That failed to inform the public about network failures in a timely manner
B) That failed to transmit sensitive data
C) That did not report security breaches to law enforcement
D) Lacked adequate policies and procedures to protect consumer data.

Question 61

A defense strategy requires several controls. ________________ are safeguards that are intended to protect specific applications.

A) Application controls
B) Physical controls
C) General controls
D) Authentication controls

Question 62

People who have their social security or credit card numbers stolen and used by thieves are frequently victims of ___________________.

A) Insider fraud
B) Identity theft
C) Occupational corruption
D) Document sabotage

Question 63

Before the people who are responsible for security make any decisions about information security defenses, they must understand __________.

A) The requirements and operations of the business
B) How firewalls, anti-virus software, and other technology function
C) Tactics of hackers, fraudsters, botnets, and identity thieves
D) How much to invest in risk management

Question 64

A defense strategy requires several controls. ______________are established to protect the system regardless of the specific application.

A) Application controls
B) Physical controls
C) General controls
D) Authentication controls

Question 65

Network security involves three types of defenses, which are referred to as layers. Those layers consist of each of the following except:

A) Perimeter security layer to control access to the network.
B) Authentication layer to verify the identity of the person requesting access to the network.
C) Biometrics layer to monitor network usage.
D) Authorization layer to control what authenticated users can do once they are given access to the network.

Question 66

Crime can be divided into two categories depending on the tactics used to carry out the crime. What are those two categories?

A) Personal and non-personal
B) Felonies and misdemeanors
C) Insider and outsider
D) Violent and nonviolent

Question 67

Which of the following is not a type of administrative control for information assurance and risk management?

A) Fostering company loyalty
B) Immediately revoking access privileges of dismissed, resigned, or transferred employees
C) Instituting separation of duties by dividing sensitive computer duties among as many employees as economically feasible
D) Performing authorization and authentication

Question 68

To keep unauthorized users out of the network, companies need to implement ___________ controls.

A) Administrative
B) Network access
C) Input
D) Communication

Question 69

When it comes to fraud committed by an organization's employees, the single most effective fraud prevention technique is _______________________.

A) Holding managers responsible for the actions of their employees
B) Peer monitoring employees monitor each other)
C) Creating the perception that fraud will be detected and punished
D) A clearly written employee policy manual that explains unacceptable behaviors

Question 70

_____________________ is a term referring to a variety of criminal behaviors perpetrated by an organization's own employees or contractors.

A) Managerial corruption
B) Insider or internal fraud
C) Corporate fraud
D) Intentional fraud

Question 71

Detecting internal fraud has become sophisticated. Audit trails from key systems and personnel records are stored in data warehouses and subjected to ________________ where things like excessive hours worked, unusual transactions, copying of huge amounts of data and other unusual patterns of behavior are identified.

A) Security audits
B) Pattern analysis
C) Behavior recognition scans
D) Anomaly detection analysis

Question 72

When it comes to reducing employee fraud, regulators look favorably on companies that can demonstrate good _________________ and best practice operational risk management.

A) Corporate governance
B) Access to legal counsel
C) Relationships with security vendors
D) Awareness of industry standards

Question 73

The major objective of __________ is to identify a legitimate user and determine the actions) he or she is allowed to perform.

A) Authorization
B) Authentication
C) Endpoint security
D) Information assurance

Question 74

A defense strategy requires several controls. ______________ protect computer facilities and resources such as computers, data centers, software, manuals, and networks.

A) Application controls
B) Physical controls
C) General controls
D) Authentication controls

Question 75

The cybersecurity defense strategy and controls that should be used depend on _________________.

A) The source of the threat
B) Industry regulations regarding protection of sensitive data
C) What needs to be protected and the cost-benefit analysis
D) The available IT budget

Question 76

A __________ is a system, or group of systems, that enforces an access-control policy between two networks.

A) Firewall
B) Switch
C) Router
D) Gateway

Question 77

The objective of IT security management practices is to defend __________.

A) Data and data processing capabilities
B) Hardware and software applications and wireless devices
C) Data and networks
D) Data, hardware, software applications, and networks

Question 78

Individual computers infected by software "robots" are sometimes referred to as _____________.

A) Zombies
B) Spies
C) Botnets
D) Phishnets

Question 79

Internal fraud prevention and detection measures are based on __________ and __________.

A) A detailed recovery plan; containment, including a fault-tolerant system
B) Perimeter defense technologies, such as e-mail scanners; human resource procedures, such as recruitment screening
C) General controls; application controls
D) Physical controls, including authorization; authentication systems

Question 80

Physical security includes several controls. Which of the following is not a type of physical control?

A) Security bonds or malfeasance insurance for key employees
B) Emergency power shutoff and backup batteries
C) Shielding against electromagnetic fields
D) Properly designed and maintained air-conditioning systems