Question 1

Powerful IT security systems are needed to defend against what appears to be authorized access to a network or application.

Accepted Answer

The answer of Powerful IT security systems are needed to...

Question 2

All of the following describe The Sarbanes-Oxley Act except:

Accepted Answer

The statement "Has been adopted by all countries in North American and the European Union" is not accurate. While some countries have implemented similar laws, the Sarbanes-Oxley Act is a US law and has not been adopted by all countries in North America or the European Union.

Question 3

Hacking is an industry with its own way of operating,a workforce,and support services,such as contract hackers.

Accepted Answer

Hacking has become an industry with professionals working as contract hackers, support services, and other associated workers.

Question 4

The smart strategy is to invest more to protect the company's most valuable assets rather than try to protect all assets equally.

Accepted Answer

It is smart to prioritize and invest more in protecting the most valuable assets of a company, rather than spreading resources thin and trying to protect all assets equally, which may not be cost-effective or practical.

Question 5

Exploits are gaps,holes,weaknesses,or flaws in corporate networks,IT security defenses,user training,policy enforcement,data storage,software,operating systems,apps,or mobile devices that expose an organization to intrusions or other attacks.

Accepted Answer

The answer of Exploits are gaps,holes,weaknesses,or flaws in corporate networks,IT...

Question 6

The internal control environment is the work atmosphere that a company sets for its employees and is designed to achieve all of the following except _________.

Accepted Answer

The internal control environment is designed to achieve reliability of financial reporting, compliance with laws, regulations, and policies, and secure decision making. Therefore, all options except for B are objectives of the internal control environment.

Question 7

It is often easy to get users to infect their corporate network or mobiles by tricking them into downloading and installing malicious apps or backdoors.

Accepted Answer

This statement is true. Social engineering techniques such as phishing emails or fake software updates can lure users into downloading and installing malicious apps or backdoors, which can then provide attackers with access to the corporate network or the user's mobile device.

Question 8

Vulnerabilities exist in networks,OSs,apps,databases,mobile devices,and cloud environments.These vulnerabilities are attack vectors for malware,hackers,hactivists,and organized crime.

Accepted Answer

Vulnerabilities in various systems and environments can definitely be exploited by malicious actors, making them attractive targets for various types of attacks. It is important to identify and address these vulnerabilities in order to enhance the security of these systems and protect against potential exploits.

Question 9

When an employee's device is lost,the company can suffer a data breach if the device is not encrypted.

Accepted Answer

If an employee's device is lost and it is not encrypted, there is a risk that the sensitive data stored on the device can be accessed by unauthorized individuals, leading to a data breach. Encryption is a security measure that protects data by converting it into a code that cannot be easily read or understood without a decryption key. By encrypting employee devices, companies can mitigate the risk of data breaches in case of lost or stolen devices.

Question 10

The main cause of a data breach is malware,but the reason hacking is so successful is negligence-management not doing enough to defend against cyberthreats.

Accepted Answer

The main cause of data breaches can vary widely, including but not limited to malware, hacking, insider threats, and human error. Negligence or inadequate cybersecurity measures can indeed contribute to the success of hacking, but it is not the sole reason; factors such as sophisticated attack methods, social engineering, and software vulnerabilities also play significant roles.

Question 11

Most data breaches go unreported,according to cybersecurity experts,because corporate victims fear that disclosure would damage their stock price,or because they never knew they were hacked in the first place

Accepted Answer

Cybersecurity experts believe that most data breaches go unreported due to the fear of damage to stock prices or because companies never detect the breach in the first place.

Question 12

Countering cyber-threats demands diligence,determination,and investment.

Accepted Answer

Countering cyber-threats is a continuous process that requires constant monitoring, proactive measures, and investment in cybersecurity infrastructure and personnel. It cannot be achieved overnight or with a one-time effort, hence demands diligence, determination, and investment.

Question 13

Risk is the probability of a threat successfully exploiting a vulnerability and the estimated cost of the loss or damage.

Accepted Answer

This statement accurately describes the definition of risk in the context of information security. It involves both the likelihood of a threat exploiting a vulnerability as well as the potential impact or cost of the resulting loss or damage.

Question 14

The consequences of lax cybersecurity include damaged reputations,financial penalties,government fines,lost market share,falling share prices,and consumer backlash.

Accepted Answer

Lax cybersecurity can lead to a variety of negative outcomes for organizations, including those listed.

Question 15

An audit is an important part of any control system.Which of the following is not a question that would typically be asked as part of an information systems audit?

Accepted Answer

While the effectiveness of controls and the presence of reporting and corrective action procedures are important aspects of an information systems audit, ROI (return on investment) is not typically a question that would be asked. The focus is on the security, accuracy, and reliability of the system, rather than on financial gain or loss.

Question 16

Cyber-security experts warn that battling distributed denial-of-service and malware attacks has become part of everyday business for all organizations.

Accepted Answer

Cyber-security experts have indeed warned that DDoS and malware attacks are now a regular occurrence for all types of organizations.

Question 17

Since protecting all data at an equally high level is not practical,cybersecurity strategies need to classify and prioritize defenses.

Accepted Answer

This statement is true. Not all data requires the same level of protection, so cybersecurity strategies should prioritize protections based on the level of importance and potential impact if the data were compromised.

Question 18

Managers should expect less tolerant regulators and greater fines and negative consequences for data breaches,according to KPMG.

Accepted Answer

KPMG predicts that regulators will become less tolerant towards data breaches, which means companies can expect harsher consequences such as higher fines and negative publicity.

Question 19

Robust data security is the responsibility of IT and data managers.

Accepted Answer

Robust data security is a shared responsibility across all members of an organization, including employees at all levels, not just IT and data managers.

Question 20

Botnets are stealth network attacks in which an unauthorized person gains access to a network and remains undetected for a long time to steal data continuously.

Accepted Answer

Botnets are networks of infected computers that are controlled by an attacker to perform malicious activities, such as sending spam or launching DDoS attacks, rather than stealthy, long-term data theft operations.

Quiz 5: Cybersecurity and Risk Management Technology