Question 1

Statements ranking information risks and identifying security goals are included in a(n)

Accepted Answer

Statements ranking information risks and identifying security goals are typically included in a security policy which outlines an organization's overall approach to securing its digital assets. An Acceptable Use Policy (AUP) focuses more narrowly on the acceptable use of an organization's IT resources rather than security risks specifically. A risk assessment evaluates the likelihood and potential impact of security incidents occurring. A business impact analysis identifies how various disruptions could affect an organization's operations. A business continuity plan outlines procedures for maintaining critical business functions in the event of disruptions or disasters.

Question 2

The most common type of electronic evidence is

Accepted Answer

E-mails are the most commonly used electronic communication method in both personal and professional settings, making them the most common type of electronic evidence.

Question 3

Which of the following specifications replaces WEP with a stronger security standard that features changing encryption keys?

Accepted Answer

WPA2 (Wi-Fi Protected Access 2) replaces WEP (Wired Equivalent Privacy) with a stronger security standard that features changing encryption keys. TLS (Transport Layer Security) is a cryptographic protocol used for secure communication over networks. AUP (Acceptable Use Policy) is a set of rules and guidelines that users must comply with when using a network or system. VPN (Virtual Private Network) is a network technology used to create a secure connection between two devices over an insecure network. UTM (Unified Threat Management) is a security solution that integrates various security functions into one device. None of these specifications directly replace WEP with a stronger security standard that features changing encryption keys except for WPA2.

Question 4

The HIPAA Act of 1996

Accepted Answer

The HIPAA Act of 1996 (Health Insurance Portability and Accountability Act) specifically outlines medical security and privacy rules for protected health information. It applies to healthcare providers, insurance companies, and other entities that handle personal health information.

Question 5

The Gramm-Leach-Bliley Act

Accepted Answer

The Gramm-Leach-Bliley Act requires financial institutions to ensure the security of customer data, specifically by implementing safeguards to protect against unauthorized access, use, and disclosure of customer information.

Question 6

What are the security challenges faced by wireless networks?

Accepted Answer

The answer of What are the security challenges faced by...

Question 7

Your company, an online discount stationers, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure?

Accepted Answer

The expected loss from this exposure can be calculated as: 
Expected loss = Probability of occurrence * Potential loss 
Expected loss = 0.5 * ($2,000 - $3,000) 
Expected loss = $1,000 * 0.5 
Expected loss = $500

Therefore, the annual expected loss from this exposure is $500. Choice (C) is the only answer option that matches this calculation.

Question 8

Computer forensics tasks include all of the following except

Accepted Answer

Computer forensics primarily deals with collecting and analyzing electronic data. Collecting physical evidence on the computer is not a task typically performed in computer forensics.

Question 9

How can a firm's security policies contribute and relate to the six main business objectives?
 Give examples.

Accepted Answer

The answer of How can a firm's security policies contribute...

Question 10

The Sarbanes-Oxley Act

Accepted Answer

The Sarbanes-Oxley Act was passed in response to accounting scandals and requires companies and management to safeguard the accuracy of financial information.

Question 11

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

Accepted Answer

Data security controls are specifically designed to protect valuable business data files from unauthorized access, change or destruction. These controls include various measures such as encryption, access controls, backup and recovery procedures, and physical security measures. While software and implementation controls can help ensure the effectiveness of data security measures, administrative and input controls are not directly related to protecting data files from unauthorized access, change or destruction.

Question 12

Three major concerns of system builders and users are disaster, security, and human error. Of the three, which do you think is most difficult to deal with?
 Why?

Accepted Answer

The answer of Three major concerns of system builders and...

Question 13

Explain how an SQL injection attack works and what types of systems are vulnerable to this type of attack.

Accepted Answer

The answer of Explain how an SQL injection attack works...

Question 14

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)

Accepted Answer

The analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a risk assessment. A security policy outlines an organization's security goals, while an Acceptable Use Policy (AUP) defines acceptable use of an organization's resources. A business impact analysis determines the impact of an incident on business operations, and a business continuity plan outlines the steps an organization should take to continue operations in the event of a disruption.

Question 15

Which of the following is a type of ambient data?

Accepted Answer

The answer of Which of the following is a type...

Question 16

Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses.

Accepted Answer

Spyware is a distinct category of malicious software programs that are designed to gather information from a computer system without the user's knowledge or consent. While spyware can be spread through viruses, worms, and Trojan horses, it is not the same thing as these types of threats.

Question 17

Application controls

Accepted Answer

Application controls can be classified as input controls, processing controls, and output controls. Each type of control focuses on a different stage in the application process to ensure accuracy, completeness, and validity of the data being processed.

Question 18

How is the security of a firm's information system and data affected by its people, organization, and technology?
 Is the contribution of one of these dimensions any more important than the other?
 Why?

Accepted Answer

The answer of How is the security of a firm's...

Question 19

Hackers and their companion viruses are an increasing problem, especially on the Internet. What are the most important measurers for a firm to take to protect itself from this?
 Is full protection feasible?
 Why or why not?

Accepted Answer

The answer of Hackers and their companion viruses are an...

Question 20

An acceptable use policy defines the acceptable level of access to information assets for different users.

Accepted Answer

The answer of An acceptable use policy defines the acceptable...

Quiz 8: Securing Information Systems