Question 1

A form of sabotage in which very large numbers of requests flood a Web server within a short time interval is known as a
A) denial of service attack.
B) logic bomb.
C) macro virus.
D) grid overload.

Accepted Answer

This type of attack, commonly referred to as a DDoS (Distributed Denial of Service), overwhelms a website or server with too much traffic to handle, causing it to crash or become unavailable.

Question 2

________ involves running multiple operating systems or multiple copies of the same operating system on the same machine.

Accepted Answer

The answer of ________ involves running multiple operating systems or...

Question 3

Most financial institutions use ________ ________ layer encryption to communicate with their clients through Web browsers.

Accepted Answer

The answer of Most financial institutions use ________ ________ layer...

Question 4

A defrauder substitutes his own version of a company's master file for the real one.This method of computer fraud is known as
A) direct file alteration.
B) data theft.
C) misappropriation of information resources.
D) Answers B and C above are both correct.

Accepted Answer

Direct file alteration refers to the act of a fraudster changing or substituting a company's master file with their own version. Data theft and misappropriation of information resources are different methods of computer fraud, but they do not specifically refer to this type of activity.

Question 5

GASB statement number ________ requires utility companies to maintain business continuity plans.

Accepted Answer

The answer of GASB statement number ________ requires utility companies...

Question 6

In virtualization,the individual operating system instances run under the control of a "master program" called a(n)________.

Accepted Answer

The answer of In virtualization,the individual operating system instances run...

Question 7

Information security is an international problem.Which countries below have set criminal penalties of up to 10 years for fraudulent use of computer services or the intentional changing of a data processing record with the intent of enrichment?
A) Canada and Finland
B) Switzerland and Canada
C) Denmark and Finland
D) France and Germany

Accepted Answer

Switzerland and Canada have established criminal penalties of up to 10 years for such offenses, reflecting their stringent approach to combating cybercrime.

Question 8

A weakness in an information security system is
A) a threat.
B) computer sabotage.
C) a vulnerability.
D) a system fault.

Accepted Answer

A weakness in an information security system is known as a vulnerability, which can be exploited by potential threats such as computer sabotage or system faults.

Question 9

An intruder who intercepts legitimate information and replaces it with fraudulent information is known as a
A) hacker.
B) wiretapper.
C) piggybacker.
D) spy.

Accepted Answer

This type of intrusion is known as "piggybacking," where the intruder rides along on legitimate communication and injects fraudulent information. A hacker generally refers to someone who gains unauthorized access to a computer system, while a wiretapper intercepts and listens to communication without permission. A spy may refer to someone who gathers information for another party but may not necessarily change the information being transmitted.

Question 10

In an information security system,security measures focus on
A) correcting the effects of threats.
B) preventing and detecting threats.
C) management philosophy and operating style.
D) the internal audit function.

Accepted Answer

Security measures in an information security system are put in place to prevent and detect potential threats before they cause harm. This includes implementing firewalls, antivirus software, access controls, and encryption. Correcting the effects of threats, such as restoring data after a breach, is just one component of incident response and not the primary focus of security measures. Management philosophy and the internal audit function are important in establishing an overall information security strategy and ensuring compliance, but not specific security measures.

Question 11

When the qualitative approach to risk assessment is used,costs might be estimated using
A) replacement costs.
B) service denial costs.
C) business interruption costs.
D) All of these answers are correct.

Accepted Answer

When using a qualitative approach to risk assessment, costs can be estimated using various methods such as replacement costs (for assets that need to be replaced), service denial costs (resulting from the inability to provide goods or services due to risk), and business interruption costs (resulting from a disruption to normal business operations). Therefore, all of the given choices are correct.

Question 12

Which group of people listed below would not pose a high degree of threat to an organization's information system?
A) Systems personnel
B) Users
C) Intruders
D) External auditors

Accepted Answer

External auditors are hired to review the organization's information system and ensure compliance with regulations and standards. They are not a threat to the system as their main goal is to analyze and verify the system's effectiveness rather than to cause harm.

Question 13

Sometimes computer programs are used to commit acts of sabotage.A destructive program masquerading as a legitimate one is called a
A) logic bomb.
B) worm.
C) virus.
D) Trojan horse.

Accepted Answer

A Trojan horse is a type of malware that infiltrates a computer system by disguising itself as a harmless or legitimate program, but once inside, it can carry out destructive actions such as deleting files or stealing information.

Question 14

The most important personnel policy and practice regarding information systems security is that
A) there should be adequate supervision of personnel at all times.
B) employees should be required to rotate jobs.
C) the duties of computer users and computer systems personnel should be segregated.
D) employees should be required to take vacations.

Accepted Answer

Segregation of duties is the most important personnel policy and practice regarding information systems security. It helps to prevent and detect fraud, errors, and unauthorized access or modification of data by ensuring that no single employee has complete control over a transaction or system. Adequate supervision, job rotations, and vacations are also important but are not as crucial as segregation of duties.

Question 15

The method used in most cases of computer fraud is
A) program alteration.
B) input manipulation.
C) data theft.
D) sabotage.

Accepted Answer

Input manipulation is the most common method used in computer fraud. This involves an attacker modifying or manipulating data that will be entered into a system to achieve a specific outcome, such as stealing confidential data or gaining access to sensitive network resources. Program alteration and data theft are also common methods used in computer fraud, but input manipulation is the most prevalent. Sabotage is not typically associated with computer fraud, as the focus is more on exploiting vulnerabilities rather than intentionally damaging a system or network.

Question 16

Within the health-care sector the ________ ________ Portability and Accountability Act requires that health-care providers,insurance companies,and payment clearinghouses adopt standardized processes for electronic payments and claims.

Accepted Answer

The answer of Within the health-care sector the ________ ________...

Question 17

A significant benefit of the quantitative approach to risk assessment is that
A) often the most likely threat to occur is not the one with the largest exposure.
B) the relevant cost of the loss's occurrence is an estimate.
C) the likelihood of a given failure requires predicting the future.
D) the approach estimates the costs and benefits to the perpetrators of attacks.

Accepted Answer

Quantitative risk assessment focuses on numerical values and calculations to determine the impact and likelihood of risks, allowing for the identification of risks that, while not the most likely to occur, may have the largest financial or operational impact. This approach helps in prioritizing risks based on their potential exposure rather than their probability of occurrence.

Question 18

Which individual listed below is placed in a position of great trust,normally having access to security secrets,files and programs?
A) Systems supervisor
B) Programmer
C) Computer maintenance person
D) Data control clerk

Accepted Answer

A systems supervisor is typically responsible for managing and overseeing computer systems, including access to security secrets, files, and programs. This role requires a great deal of trust and accountability, as the supervisor may have access to sensitive information and controls. Programmers, computer maintenance persons, and data control clerks may have access to some confidential information, but not to the extent that a systems supervisor would.

Question 19

An extremely risk-seeking perpetrator
A) will offer his or her services to the "highest bidder."
B) will take very large risks for a small reward.
C) is almost always a terminated employee of the organization he or she attacks.
D) will take small risks for small rewards.

Accepted Answer

An extremely risk-seeking perpetrator is characterized by a willingness to take very large risks even for the potential of only a small reward. This behavior contrasts with risk-averse individuals who prefer to minimize risks, often seeking larger rewards for any risks taken.

Question 20

Sometimes computer programs are used to commit acts of sabotage.A computer program that actually grows in size as it infects more and more computers in a network is known as a
A) Trojan horse.
B) logic bomb.
C) virus.
D) worm.

Accepted Answer

A worm is a type of computer program that spreads through a computer network and replicates itself. As it infects more computers, the program grows in size, consuming more and more resources, and causing damage to the network. Unlike viruses, worms do not need to attach themselves to a host file or program, and can operate independently. Trojans and logic bombs are also types of malicious software, but they do not exhibit the same self-replicating behavior as worms.

Quiz 6: Information Systems Security

A form of sabotage in which very large numbers of requests flood a Web server within a short time interval is known as a

________ involves running multiple operating systems or multiple copies of the same operating system on the same machine.

Most financial institutions use layer encryption to communicate with their clients through Web browsers.

A defrauder substitutes his own version of a company's master file for the real one.This method of computer fraud is known as

GASB statement number ________ requires utility companies to maintain business continuity plans.

In virtualization,the individual operating system instances run under the control of a "master program" called a(n)________.

Information security is an international problem.Which countries below have set criminal penalties of up to 10 years for fraudulent use of computer services or the intentional changing of a data processing record with the intent of enrichment?

A weakness in an information security system is

An intruder who intercepts legitimate information and replaces it with fraudulent information is known as a

In an information security system,security measures focus on

When the qualitative approach to risk assessment is used,costs might be estimated using

Which group of people listed below would not pose a high degree of threat to an organization's information system?

Sometimes computer programs are used to commit acts of sabotage.A destructive program masquerading as a legitimate one is called a

The most important personnel policy and practice regarding information systems security is that

The method used in most cases of computer fraud is

Within the health-care sector the Portability and Accountability Act requires that health-care providers,insurance companies,and payment clearinghouses adopt standardized processes for electronic payments and claims.

A significant benefit of the quantitative approach to risk assessment is that

Which individual listed below is placed in a position of great trust,normally having access to security secrets,files and programs?

An extremely risk-seeking perpetrator

Sometimes computer programs are used to commit acts of sabotage.A computer program that actually grows in size as it infects more and more computers in a network is known as a