Question 1

The estimated cost,loss,or damage that can result if a threat exploits a vulnerability best describes

Accepted Answer

Exposure refers to the estimated cost, loss, or damage that can result if a threat exploits a vulnerability. It quantifies the potential impact on an organization, asset, or individual, highlighting the extent of harm or loss that could occur.

Question 2

A malicious hacker who may represent a serious problem for a corporation best describes a

Accepted Answer

A cracker is a malicious hacker who gains unauthorized access to computer systems or networks with the intention of causing harm, stealing information, or disrupting operations. This type of hacker can pose a serious problem for a corporation by compromising sensitive data, disrupting business operations, and damaging the company's reputation. Cyberspies may also be a problem, but their motivation is usually to gather sensitive information rather than causing harm. Web surfers and Internet commandos do not necessarily have malicious intent.

Question 3

Creating a rogue copy of a popular website that shows contents similar to the original to a Web crawler.Once there,an unsuspecting user is redirected to malicious websites.This description is indicative of

Accepted Answer

This scenario describes page hijacking, wherein a rogue copy of a legitimate website is created to mislead users and redirect them to malicious websites.

The other options are not completely relevant to the given scenario. Electronic splogging refers to automatically generated spam content, cyberworming involves the use of worms or viruses to spread through networks, and spamming refers to unsolicited bulk messages.

Question 4

An attack on a website in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources best describes

Accepted Answer

A denial-of-service (DoS) attack is precisely an attack in which an attacker uses specialized software to flood the target computer with a flood of data packets, aiming to overload its resources and ultimately bringing it down.

Question 5

The protection of information systems against unauthorized access to or modification of information that is stored,processed,or being sent over a network is referred to as

Accepted Answer

Protection of information systems against unauthorized access and modification is known as information assurance. Data integrity refers to the accuracy and completeness of data, not necessarily its protection from unauthorized access. Information integrity refers to ensuring the consistency and accuracy of information, but not necessarily its protection from unauthorized access. Human firewall refers to the training and education of employees to become a line of defense against cyber threats, but it is not the same as protecting against unauthorized access or modification of information.

Question 6

A generic term for malicious software is

Accepted Answer

Malware is the best choice as it is a broad term encompassing all forms of malicious software that can harm computer systems, disrupt their operations, or steal confidential information. NOS (Network Operating System) refers to software that manages network resources, while ad-aware and spynet are products developed by Lavasoft and Microsoft respectively to detect and remove malware.

Question 7

A program that appears to have a useful function but that contains a hidden function that presents a security risk best defines

Accepted Answer

A Trojan horse is a type of malware that appears to be a legitimate program but has a malicious purpose hidden inside, such as stealing data or giving an attacker remote access to a computer. Trojan horses often appear to have a useful function or disguise themselves as a harmless file, tricking users into downloading and running them.

Question 8

The probability that a vulnerability will be known and used best describes

Accepted Answer

The probability of a vulnerability being known and exploited is a key factor in determining the level of risk associated with that vulnerability. Higher probabilities indicate higher risk.

Question 9

According to Sullivan (2011),the vulnerabilities in Business IT and EC systems include each of the following organizational weaknesses except

Accepted Answer

The statement mentions all the possible vulnerabilities except for closed systems not reacting quickly enough to security breaches.

Question 10

The assurance that an online customer or trading partner cannot falsely deny their purchase or transaction is referred to as

Accepted Answer

Nonrepudiation refers to the ability to prove that a user participated in a transaction, such as a purchase or agreement, and cannot deny it later. This is important for online transactions where there may not be physical evidence, and helps prevent disputes and fraud. Integrity refers to the accuracy and completeness of data, while availability refers to system uptime and accessibility. Authentication refers to the process of confirming a user's identity.

Question 11

A type of nontechnical attack that uses some ruse to trick users into revealing information or performing an action that compromises a computer or network best describes

Accepted Answer

Social engineering is a type of attack that exploits human psychology to gain access to sensitive information or computer systems. Attackers use various tactics such as phishing, pretexting, baiting, or quid pro quo to trick users into revealing passwords or other sensitive information, installing malware, or performing an action that compromises security. The other options are not associated with social engineering.

Question 12

Computers infected with malware that are under the control of a spammer,hacker,or other criminal best describes

Accepted Answer

Computers infected with malware and under the control of a criminal are commonly known as zombies. Criminals use these compromised computers to carry out illegal activities such as spamming, launching DDoS attacks, or stealing sensitive information. The term zombie is used because these computers are effectively "dead" to their rightful owners, as they no longer function as intended and are under the control of the criminal.

Question 13

A plan that keeps the business running after a disaster occurs best defines

Accepted Answer

A business continuity plan is designed to keep the business running after a disaster occurs, minimizing downtime and loss of revenue. A security audit specification is a document that outlines the procedures and criteria for conducting a security audit. A vulnerability assessment plan identifies weaknesses in the organization's network or systems. A project initiation plan outlines the objectives, scope, and deliverables of a particular project.

Question 14

The process of verifying the real identity of an individual,computer,computer program,or EC website best defines

Accepted Answer

The process of verifying the real identity of an individual, computer, computer program or EC website is known as authentication. Vulnerability assessment involves finding and evaluating vulnerabilities in a system, security audit involves reviewing security measures for adequacy and effectiveness, and authorization involves granting access to users based on their roles and responsibilities.

Question 15

A strategy that views EC security as the process of preventing and detecting unauthorized use of the organization's brand,identity,website,e-mail,information,or other asset and attempts to defraud the organization,its customers,and employees best describes

Accepted Answer

The description best fits the EC security strategy, which focuses on safeguarding the organization's e-commerce assets from unauthorized access, fraudulent activities, and security breaches. Feasibility assessment refers to the evaluation of the viability of a project, while information systems security plan and disaster recovery plan are more comprehensive approaches to securing an organization's IT infrastructure and operations, respectively.

Question 16

The process of determining what the authenticated entity is allowed to access and what operations it is allowed to perform is known as

Accepted Answer

The process of determining what the authenticated entity is allowed to access and what operations it is allowed to perform is known as authorization. This involves defining specific access levels and permissions for different users or user roles.

Question 17

A software program that runs independently,consuming the resources of its host in order to maintain itself,that is capable of propagating a complete working version of itself onto another machine best describes

Accepted Answer

The description given best matches a worm, which is a type of malware that is capable of self-replicating and spreading onto other machines. It operates independently, consuming the resources of the host machine to propagate itself. Splog refers to spam blogs, tidal wave is not a term used to describe malware, and Trojan horse is a type of malware that disguises itself as legitimate software to trick users into downloading and installing it, but it does not have the ability to self-replicate.

Question 18

Unintentional threats include each of the following except

Accepted Answer

Identity theft is considered an intentional threat rather than an unintentional one as it involves a deliberate attempt to steal someone's personal information or data. Human errors, environmental hazards and computer system malfunctions, on the other hand, are considered unintentional threats as they are not premeditated but rather occur due to mistakes, natural events or technical issues.

Question 19

According to Sullivan (2011),vulnerabilities in IT and EC systems include each of the following except

Accepted Answer

Sullivan (2011) lists poor application security, weak boundary security, and unencrypted communications as vulnerabilities in IT and EC systems. However, lack of environmental support is not mentioned as a vulnerability in the text. Therefore, C is the correct choice.

Question 20

Someone who gains unauthorized access to a computer system best describes a

Accepted Answer

A hacker is someone who gains unauthorized access to a computer system or network with the intention of causing harm or obtaining sensitive information. A network technician is someone who is authorized to access a computer system for maintenance or repair purposes. Cyberwarriors are individuals who engage in cyber warfare typically under the authority of a government or military while cyberseekers is not a commonly used term in this context.

Quiz 9: E-Commerce Security and Fraud Protection