Question 1

If you receive an email that says it is from Sam Johnson, your boss, with an odd EXE file as an attachment, it could be dangerous for all of the following reasons except:
A) It could be dangerous because the email might not really be from Sam.
B) It could be dangerous because the email might be from Sam's computer without his or her knowledge.
C) It could be dangerous even if it was sent knowingly because Sam didn't know a virus might be attached.
D) It could be dangerous because Sam gave someone his password once a long time ago
E) None of the above (indicating that all are true).

Accepted Answer

All the options provided are valid reasons why the email could be dangerous, indicating that none of them are exceptions.

Question 2

An "evil twin" in the context of computer security is:
A) A virus-laden attachment that looks just like a sincere attachment
B) A duplicate badge that allows a nasty person entry into a data center
C) Someone who looks just like the Chief Information Officer, but steals data
D) An operating system that is not genuine
E) A counterfeit wifi connection in a hotel or coffee shop that appears to be genuine

Accepted Answer

An "evil twin" in computer security refers to a type of attack in which a rogue wifi access point is set up to mimic a legitimate one, in order to lure users into connecting to it and potentially exposing sensitive information. This is typically done in public places such as hotels or coffee shops, where users might be more likely to connect to a free wifi network without verifying its authenticity. The rogue access point is referred to as an "evil twin" because it appears to be the same as the legitimate network, but is actually controlled by a malicious actor.

Question 3

On the black market, stolen data in a "kit" that contains credit card information plus social security number and medical information is worth:
A) between $13 and $18 per record
B) between $43 and 65 per record
C) between $145 and $154 per record
D) between $100 and $1,000 per record
E) between $4,520 and $4,580 per record

Accepted Answer

According to various reports and studies, stolen data in a "kit" containing credit card information, social security numbers, and medical information can be sold on the black market for anywhere between $100 and $1,000 per record. The exact price may vary depending on the type and amount of information included in the kit, as well as the demand for it. Therefore, option D is the best choice.

Question 4

___ of breaches are caused by stealing a password
A) A very low percentage (somewhere around 1%)
B) A low percentage (around 10%)
C) A moderate percentage (around 25%)
D) A high percentage (around 50%)
E) A very high percentage (around 80%)

Accepted Answer

The answer of ___ of breaches are caused by stealing...

Question 5

Thanks to tightened security in operating systems, it is more difficult than ever before for hackers to break into systems, compared to the early 1990s, when people were much less often protected, less aware of risks, and more easily fooled.

Accepted Answer

The answer of Thanks to tightened security in operating systems,...

Question 6

Examples of multi-factor authentication are:
A) passwords and text messages
B) passwords with longer than one character
C) a human will chat with you to see who you are
D) using two badges to allow you into a building
E) none of the above

Accepted Answer

Multi-factor authentication involves using two or more different types of factors to verify identity, such as something you know (password) and something you have (text message).

Question 7

In the Office of Personnel Management's case, the security breach made many people vulnerable to this.
A) Loss of personal property
B) Inaccurate personal data
C) Identity theft
D) Loss of access to personal data
E) Credit card fees

Accepted Answer

The security breach at the Office of Personnel Management resulted in the theft of personal information, including Social Security numbers, which could be used for identity theft. It did not result in loss of personal property, inaccurate personal data, loss of access to personal data, or credit card fees.

Question 8

It usually takes ____ for someone in a firm to discover a security compromise in a system, after the evidence shows up in logs or alerts
A) Several seconds
B) Several minutes
C) Several hours
D) Several days
E) Several months

Accepted Answer

The answer of It usually takes ____ for someone in...

Question 9

Over time, attackers have had to increase their skills to be able to attack systems or create viruses.

Accepted Answer

The answer of Over time, attackers have had to increase...

Question 10

The cost of a data breach in 2015 is estimated to be:
A) between $13 and $18 per record
B) between $43 and 65 per record
C) between $145 and $154 per record
D) between $100 and $1,000 per record
E) between $4,520 and $4,580 per record

Accepted Answer

According to the 2015 Cost of Data Breach Study by the Ponemon Institute, the cost per record in a data breach is estimated to be between $145 and $154. This cost includes expenses related to detection, notification, and response, as well as lost business and legal fees.

Question 11

Many organizations and even consumers use this to control access to a network like the Internet, allowing only authorized traffic to pass.
A) Encryption
B) VPN
C) Firewall
D) Anonymizing tools
E) Filtering

Accepted Answer

Firewalls are commonly used to control access to a network or part of a network, allowing only authorized traffic to pass through while blocking other unauthorized traffic. Firewalls can be implemented in hardware or software and are an important component of network security. Encryption, VPN, anonymizing tools, and filtering are also useful for network security but do not necessarily control access to the network.

Question 12

Included in the five critical elements that are used to raise security in a firm are all of the following except:
A) Infrastructure
B) Law enforcement
C) Policies
D) Training
E) Investments

Accepted Answer

While law enforcement may be involved in investigating security breaches, it is not an element that a firm can control or implement internally. Therefore, it is not typically included in the five critical elements for raising security in a firm. The other options - infrastructure, policies, training, and investments - all refer to areas where a firm can take action to improve its security measures.

Question 13

All of the following are classic signs of a phishing message except:
A) Your email in-box is full and you must click on a link to increase storage
B) You just won a lottery or contest, and you need to click on a link to claim your prize
C) Poor grammar or spelling in a note that purports to be from a large company
D) Goods or services are offered at an impossibly low price
E) An emailed ad oddly does not provide any active links

Accepted Answer

The other options (A, B, C, and D) are classic signs of phishing messages, while option E is not necessarily a sign of phishing. An emailed ad without any active links may simply be a marketing email, as some companies prefer to provide their website URL instead of clickable links in emails.

Question 14

Who is responsible for developing security education, awareness, and training programs?
A) IT people
B) Shared: IT leaders and business leaders
C) Business leaders
D) Consultants
E) Team of consultants and IT people

Accepted Answer

Developing security education, awareness, and training programs should be a shared responsibility between IT leaders and business leaders. IT leaders bring their technical expertise, while business leaders understand their organization's culture, goals, and employees' needs. Collaboration between the two groups will ensure that the programs are effective and relevant to the organization. IT people, consultants, and a team of consultants and IT people can all contribute to the development of the programs, but the ultimate responsibility lies with the IT and business leaders.

Question 15

Spoofing is:
A) When someone makes fun of you for falling for a phishing scam
B) When the "from" address says the name/email address of a person different from who really sent it
C) When hackers snoop around in a system
D) When a person from IT unlocks your email account
E) When you receive a notice of an inheritance

Accepted Answer

Spoofing is when the "from" address in an email appears to be from a person or entity different from who actually sent it. This is often used in phishing scams to trick people into clicking on malicious links or providing personal information.

Question 16

The most common password of all in 2014 is:
A) Something complex that is hard to remember
B) None at all-they most commonly skip passwords and just press ENTER to continue
C) "password"
D) "123456"
E) "Rihanna"

Accepted Answer

According to a study conducted by SplashData, "123456" was the most common password of 2014, followed by "password." Both of these passwords are very weak and easily guessable, making them a security risk.

Question 17

When the Office of Personnel Management was hacked, all of the following are true except:
A) The hackers gained access to the building to steal the records
B) It took the Office of Personnel Management many months to detect the break-in
C) The hackers likely exploited a stolen password
D) The hackers did not need to escape in the blue turbocharged vehicle
E) None of the above (indicating that all are true)

Accepted Answer

There is no evidence that the hackers gained physical access to the building. It is believed that they used a spear-phishing attack to gain access to the network.

Question 18

Who is responsible for decisions about security strategy?
A) IT people
B) Shared: IT leaders and business leaders
C) Business leaders
D) Consultants
E) Team of consultants and IT people

Accepted Answer

The answer of Who is responsible for decisions about security...

Question 19

In the Anthem Blue Cross breach, where 80 million names, birthdays, social security numbers, etc., were stolen, the hackers got in by:
A) Breaking into the building where they were stored
B) Obtaining passwords of five or more high-level employees
C) Making phone calls to insiders posing as IT people needing to log into their accounts
D) Emailing each of the 80 million patients asking for their private information
E) Recovering patient records from a large recycling bin

Accepted Answer

According to reports, the hackers obtained the passwords of at least five high-level employees, which gave them access to the sensitive data.

Question 20

It is estimated that ___ % of all firms have been breached:
A) 5% or less
B) 10% to 20%
C) 40% to 60%
D) 70% to 90%
E) Over 95%

Accepted Answer

The answer of It is estimated that ___ % of...

Quiz 8: Security

If you receive an email that says it is from Sam Johnson, your boss, with an odd EXE file as an attachment, it could be dangerous for all of the following reasons except:

An "evil twin" in the context of computer security is:

On the black market, stolen data in a "kit" that contains credit card information plus social security number and medical information is worth:

___ of breaches are caused by stealing a password

Thanks to tightened security in operating systems, it is more difficult than ever before for hackers to break into systems, compared to the early 1990s, when people were much less often protected, less aware of risks, and more easily fooled.

Examples of multi-factor authentication are:

In the Office of Personnel Management's case, the security breach made many people vulnerable to this.

It usually takes ____ for someone in a firm to discover a security compromise in a system, after the evidence shows up in logs or alerts

Over time, attackers have had to increase their skills to be able to attack systems or create viruses.

The cost of a data breach in 2015 is estimated to be:

Many organizations and even consumers use this to control access to a network like the Internet, allowing only authorized traffic to pass.

Included in the five critical elements that are used to raise security in a firm are all of the following except:

All of the following are classic signs of a phishing message except:

Who is responsible for developing security education, awareness, and training programs?

Spoofing is:

The most common password of all in 2014 is:

When the Office of Personnel Management was hacked, all of the following are true except:

Who is responsible for decisions about security strategy?

In the Anthem Blue Cross breach, where 80 million names, birthdays, social security numbers, etc., were stolen, the hackers got in by:

It is estimated that ___ % of all firms have been breached: