Question 1

Storm worm,which is spread via spam,is a ________ agent embedded inside over 25 million computers.Storm's combined power has been compared to the processing power of ________.
A)botnet;a supercomputer
B)spyware;a DDoS attack
C)vector;zombies
D)spear phishing;a server

Accepted Answer

The passage states that Storm worm is spread via spam and is a botnet agent embedded inside over 25 million computers. It also mentions that Storm's combined power has been compared to the processing power of a supercomputer. Therefore, the best choice is A, as it correctly identifies Storm as a botnet (a network of infected computers controlled by a central command) and compares its power to that of a supercomputer.

Question 2

The purpose of the ________ is to improve customers' trust in e-commerce,especially when it comes to online payments,and to increase the Web security of online merchants.
A)IT governance
B)Internal control
C)PCI DSS
D)FISMA

Accepted Answer

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. It was created to increase the security of online payments and to give customers more confidence in e-commerce. Compliance with PCI DSS is required by all major credit card companies.

Question 3

The IT security defense-in-depth model ends with ________.
A)Senior management commitment and support
B)IT security procedures and enforcement
C)Hardware and software selection
D)Acceptable use policies and IT security training

Accepted Answer

The answer of The IT security defense-in-depth model ends with...

Question 4

________ is the supervision,monitoring,and control of an organization's IT assets.
A)IT governance
B)Internal control
C)PCI DSS
D)FISMA

Accepted Answer

IT governance is the overall process of managing and controlling an organization's IT assets, including hardware, software, data, and networks. This includes setting priorities, making decisions, and implementing policies and procedures to ensure that IT resources are used effectively and efficiently. Internal control is a broader concept that encompasses all aspects of an organization's management and includes financial, operational, and compliance controls. PCI DSS and FISMA are specific regulations or standards related to data security and IT management.

Question 5

The principle of ________ acknowledges that the cost of information security needs to be balanced with its benefits.It is the basic cost-benefit principle with which you are familiar.
A)accounting
B)economic use of resources
C)legality
D)COBIT

Accepted Answer

The principle of economic use of resources acknowledges that the cost of information security needs to be balanced with its benefits. This principle is rooted in understanding that limited resources must be allocated efficiently in order to maximize benefits.

Question 6

Samuel received an email that looked like it came from his bank.The email told him to click a link that opened an official looking Webpage where he was asked to enter his account information.But when Samuel examined the URL,he noticed it was a strange address he did not recognize.Most likely,someone was attempting to steal Samuel's confidential information using a technique called __________.
A)Botnets
B)Phishing
C)Spoofing
D)Click hijacking

Accepted Answer

The scenario described is an example of phishing, which is a technique used by cybercriminals to trick victims into divulging their sensitive information through fake emails, websites or messages. The goal of phishing attacks is to steal credentials or money from unsuspecting users. In this case, the attacker sent an email that appeared to be from the victim's bank, but the URL was a strange address that Samuel did not recognize. This is a red flag that the website was not legitimate because banks usually have their own URLs.

Question 7

Intrusion Detection Systems (IDS)are designed to monitor network traffic and identify threats that have breached the networks' initial defenses.IDS identify all of the following except:
A)An attacker who is trying to break into the credentials of a legitimate user in order to gain access to an IS,device,or network.
B)A legitimate user who performs actions he is not authorized to do.
C)A user who tries to disguise or cover up his actions by deleting audit files or system logs.
D)Employees who use computing or network resources inefficiently.

Accepted Answer

IDS are not designed to detect inefficient use of computing or network resources by employees. IDS are focused on detecting security threats and suspicious activity within the network.

Question 8

Facebook,YouTube,Twitter,LinkedIn,and other social networks are making IT security dangers worse.Why?
A)Users invite in and build relationships with others.Cybercriminals hack into these trusted relationships using stolen log-in credentials.
B)E-mail viruses and malware have been increasing for years even though e-mail security has improved.
C)Communication has shifted from social networks to smartphones.
D)Web filtering,user education,and strict policies cannot help prevent IT security dangers on Facebook and other social networks.

Accepted Answer

Social networks like Facebook, YouTube, Twitter, LinkedIn, and others rely on users building relationships with others. Cybercriminals take advantage of this trust and hack into these relationships using stolen log-in credentials. This makes IT security dangers worse on social networks.

Question 9

Cybersecurity is ___________.
A)an ongoing unending process
B)a problem that is solved with hardware or software
C)defined in the AUP that is enforced periodically
D)primarily the responsibility of the IT and legal departments

Accepted Answer

Cybersecurity is an ongoing process, as new threats and vulnerabilities are constantly emerging and evolving, requiring continuous assessment and mitigation. It is not a one-time problem that can be solved with hardware or software, nor is it solely defined in the Acceptable Use Policy (AUP), or the responsibility of just the IT and legal departments.

Question 10

In cybersecurity terms,the function of a password together with a username is to __________ a user's identity to verify that the person has the right to access a computer or network.
A)Record
B)Authenticate
C)Substantiate
D)Validate

Accepted Answer

The function of a password together with a username is to authenticate a user's identity to verify that the person has the right to access a computer or network. Authentication is the process of verifying the identity of a user, device, or system. Therefore, option B is the best choice.

Question 11

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security.Unintentional threats are all of the following except ___________.
A)Political/civic unrest
B)Human errors
C)Environmental hazards
D)Computer systems failures

Accepted Answer

Political/civic unrest is not an example of unintentional threats as it is a deliberate action taken by a group or organization to cause harm or disrupt operations.

Question 12

In the United States,the Sarbanes-Oxley Act (SOX)requires businesses to __________________________.
A)Report security breaches via media sources to inform the public
B)Backup sensitive data to offsite locations
C)Set up comprehensive internal controls
D)Inform the public about network failures in a timely manner

Accepted Answer

The Sarbanes-Oxley Act (SOX) requires businesses to establish and maintain comprehensive internal controls to ensure accurate financial reporting and prevent fraudulent activities. SOX was enacted in response to corporate scandals, such as the Enron and WorldCom scandals, and aims to increase transparency and accountability in business practices. While security breaches and network failures may fall under the purview of SOX, the primary focus is on financial reporting and internal controls. Therefore, options A, B, and D are not the best choices.

Question 13

Most APT attacks are launched through ________.
A)Data tampering
B)Worms
C)Phishing
D)Vectors

Accepted Answer

APT attacks are commonly launched through phishing emails, where the attacker sends an email that appears to be from a trusted source and tricks the victim into providing sensitive information or downloading a malicious attachment.

Question 14

The IT security defense-in-depth model starts with ________.
A)Senior management commitment and support
B)IT security procedures and enforcement
C)Hardware and software selection
D)Acceptable use policies and IT security training

Accepted Answer

The IT security defense-in-depth model starts with senior management commitment and support, as this sets the tone for prioritizing and investing in IT security measures. This commitment and support ensure that IT security procedures and enforcement, hardware and software selection, and acceptable use policies and IT security training are all implemented effectively.

Question 15

__________ is the elapsed time between when vulnerability is discovered and when it is exploited and has shrunk from months to __________.
A)Time-to-exploitation;days
B)Time-to-exploitation;minutes
C)Denial of service;days
D)Denial of service;seconds

Accepted Answer

Time-to-exploitation is the elapsed time between when vulnerability is discovered and when it is exploited. It has significantly reduced from months to minutes due to the advancements in technology and the rise of cybercrime.

Question 16

According to Cisco in 2015,the most common form of malware distributed was _________.
A)Facebook scams
B)Ransomware
C)Rogue mobile apps
D)Spyware

Accepted Answer

The answer of According to Cisco in 2015,the most common...

Question 17

When new vulnerabilities are found in operating systems,applications,or wired and wireless networks,vendors of those products release __________ or __________ to fix the vulnerabilities.
A)Patches;service packs
B)Patches;downloads
C)Firewalls;spyware
D)Service packs;firewalls

Accepted Answer

Vendors release patches, which are small updates to fix specific vulnerabilities, or service packs, which are larger updates that include multiple patches and other improvements, to address vulnerabilities in their products. The other choices, firewalls and spyware, are not related to fixing vulnerabilities but are security measures to prevent or detect unauthorized access or malicious software.

Question 18

Which of the following statements about malware is false?
A)Technically,malware is a computer program or code that can infect anything attached to the Internet and is able to process the code.
B)Setting an e-mail client,such as Microsoft Outlook or Gmail,to allow scripting blocks malware.
C)RATS create an unprotected backdoor into a system through which a hacker can remotely control that system.
D)The payload carries out the purpose of the malware.

Accepted Answer

Allowing scripting in an email client can actually make it easier for malware to execute. The other statements are true - malware can infect anything attached to the internet, RATS can create a backdoor for remote control, and the payload is the purpose of the malware.

Question 19

The director of the Federal Trade Commission (FTC)bureau of consumer protection warned that the agency would bring enforcement action against small businesses that ________
A)failed to inform the public about network failures in a timely manner
B)failed to transmit sensitive data
C)did not report security breaches to law enforcement
D)lacked adequate policies and procedures to protect consumer data.

Accepted Answer

The key phrase in the question is "protect consumer data". The only answer choice that directly relates to protecting consumer data is D, which refers to businesses lacking adequate policies and procedures to protect consumer data. Choices A, B, and C relate more to specific incidents or actions, rather than overall policies for protecting consumer data.

Question 20

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved,threats from __________ have increased considerably in recent years.
A)Software errors
B)Malicious employees
C)Social networks and cloud computing
D)Vendor sabotage

Accepted Answer

Social networks and cloud computing have become increasingly popular and are now widely used by individuals and businesses alike. This popularity has resulted in a corresponding increase in security threats from these sources, as hackers and cybercriminals leverage this technology to launch attacks on unsuspecting users. As a result, it is critical that individuals and organizations take steps to protect themselves from these threats, such as using strong passwords and two-factor authentication, monitoring their accounts for suspicious activity, and ensuring that all software and systems are up-to-date with the latest security patches and updates.

Quiz 5: Cybersecurity and Risk Management Technology

Storm worm,which is spread via spam,is a agent embedded inside over 25 million computers.Storm's combined power has been compared to the processing power of .

The purpose of the ________ is to improve customers' trust in e-commerce,especially when it comes to online payments,and to increase the Web security of online merchants.

The IT security defense-in-depth model ends with ________.

________ is the supervision,monitoring,and control of an organization's IT assets.

The principle of ________ acknowledges that the cost of information security needs to be balanced with its benefits.It is the basic cost-benefit principle with which you are familiar.

Intrusion Detection Systems (IDS) are designed to monitor network traffic and identify threats that have breached the networks' initial defenses.IDS identify all of the following except:

Facebook,YouTube,Twitter,LinkedIn,and other social networks are making IT security dangers worse.Why?

Cybersecurity is ___________.

In cybersecurity terms,the function of a password together with a username is to __________ a user's identity to verify that the person has the right to access a computer or network.

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security.Unintentional threats are all of the following except ___________.

In the United States,the Sarbanes-Oxley Act (SOX) requires businesses to __________________________.

Most APT attacks are launched through ________.

The IT security defense-in-depth model starts with ________.

is the elapsed time between when vulnerability is discovered and when it is exploited and has shrunk from months to .

According to Cisco in 2015,the most common form of malware distributed was _________.

When new vulnerabilities are found in operating systems,applications,or wired and wireless networks,vendors of those products release or to fix the vulnerabilities.

Which of the following statements about malware is false?

The director of the Federal Trade Commission (FTC) bureau of consumer protection warned that the agency would bring enforcement action against small businesses that ________

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved,threats from __________ have increased considerably in recent years.