Question 1

A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage is called a(n) _____.
A) activist
B) cyber agitator
C) hacktivist
D) ethical hacker
E) cybersquatter

Accepted Answer

The term "hacktivist" refers to a person or group who uses hacking techniques to protest against perceived injustice, often for political purposes. This can include acts such as defacing websites, disrupting online services, or stealing and publishing sensitive information.

Question 2

Hordes of surreptitiously infiltrated computers, linked and controlled remotely, are known as zombie networks or:
A) honeypots.
B) zombots.
C) botnets.
D) blacklists.
E) megabots.

Accepted Answer

The term for surreptitiously infiltrated computers linked and controlled remotely is botnets. Honeypots are decoy systems designed to lure and detect hackers. Zombots and megabots are not widely recognized industry terms. Blacklists are lists of IP addresses or domains known for malicious activity, but do not refer to networks of controlled computers.

Question 3

Describe some of the factors at work that enabled the Target security breach to occur.

Accepted Answer

Security software notification went off shortly after unauthorized software began collecting data inside Target's network, but Target ignored the warning. While the area where credit card transactions are processed is supposed to be walled off from other areas of the Target network, hackers found holes and eventually nestled their code in a sweet spot for grabbing customer data, disguising the code with the label "BladeLogic" the name of a legitimate data center management product. The firm's security software has an option to automatically delete malware as it's detected but Target's security team had turned that function off.

Question 4

Many U.S. technology firms believe that U.S. government surveillance techniques put them at a disadvantage relative to foreign firms because:
A) some customers have begun seeking alternative products and services untarnished by the perception of having (complicity or unwittingly) provided private information to authorities.
B) the cost to include government surveillance technology inside their products is expensive and lowers profits compared to rivals.
C) the government-required installations of software, such as Stuxnet, that U.S. tech firms must comply with inevitably take up valuable storage space, adding cost to industrial and commercial products.
D) the cost to house government workers on-site is a burden private corporations should not have to shoulder.
E) firms in foreign governments are directly contracted to perform surveillance, and are compensated for their efforts with perks and tax breaks, while U.S. firms receive no such compensation.

Accepted Answer

The perception that U.S. tech firms have been complicit in providing private information to authorities has led some customers to seek alternative products and services, putting these firms at a disadvantage relative to their foreign counterparts.

Question 5

A research scientist with a major pharmaceutical firm in New Jersey is caught passing on sensitive information, worth millions of dollars, regarding the composition and test results of his firm's latest drug to a rival company. What crime is he being held responsible for?
A) Cyber-fraud
B) Corporate espionage
C) Carrying out technology disruptions
D) Extortion
E) Illegal funds transfer

Accepted Answer

The scientist is being held responsible for corporate espionage, which involves the theft or unauthorized disclosure of confidential information for the benefit of a competitor.

Question 6

The term _____ originally referred to a particularly skilled programmer.
A) data harvester
B) cracke
C) hacker
D) black hat
E) hacktivist

Accepted Answer

The term "hacker" originally referred to a skilled programmer who was able to solve problems and manipulate computer software effectively. The negative connotations associated with the term came later, when some hackers began using their skills for malicious purposes.

Question 7

Almost all security breaches can be traced back to technology lapses; personnel or procedural factors rarely factor in.

Accepted Answer

While technology lapses play a significant role in security breaches, personnel or procedural factors also often contribute, such as weak passwords or lack of employee training.

Question 8

Which of the following is a valid statement on information security?
A) Security breaches cannot be prevented despite the adoption of the best security policies.
B) Technology lapses are solely responsible for almost all security breaches.
C) Information security is everybody's responsibility.
D) Greater expenditure on security products is the only way to contain security breaches.
E) A reactive, rather than proactive, approach is better suited for dealing with security breaches.

Accepted Answer

Information security is not just the responsibility of the IT department or security professionals, but of everyone within an organization, from top management down to the lowest-level employees. It requires a comprehensive and collaborative effort to ensure that all aspects of data and information handling are secured. The other statements are false or do not represent a holistic approach to information security.

Question 9

A black hat hacker looks for weaknesses in security mechanisms, with a view to help plug the holes that might be exploited by cyber-criminals.

Accepted Answer

A black hat hacker exploits weaknesses in security mechanisms for personal gain or malicious intent, and does not have the intention to help plug the holes in the system. A hacker who helps to identify vulnerabilities and fix them is known as a white hat hacker or ethical hacker.

Question 10

An attack on the US power grid by terrorists or a foreign power is indicative of:
A) DDoS attacks.
B) espionage.
C) cyberwarfare.
D) extortion.
E) phishing.

Accepted Answer

A cyber attack on the power grid by terrorists or a foreign power is considered an act of cyber warfare, which involves using computer technology to cause harm or disruption to a nation's infrastructure or economy. DDoS attacks, espionage, extortion, and phishing may be tactics used in cyber warfare, but they do not encompass the entirety of the concept.

Question 11

A vast majority of security breaches are not preventable and happen despite the best security practices.

Accepted Answer

While no security solution is 100% foolproof, many security breaches can be prevented by implementing best security practices such as using strong passwords, regularly updating software and systems, and providing security awareness training to employees.

Question 12

Hackers might infiltrate computer systems to enlist hardware for subsequent illegal acts.

Accepted Answer

This statement is true. Hackers often use a technique known as "botnets" to infiltrate and control multiple computer systems, which can then be used for various illegal activities such as launching distributed denial of service attacks, sending spam emails, or conducting cyber espionage.

Question 13

What are some of the key managerial takeaways from the Target security breach?

Accepted Answer

The answer of What are some of the key managerial...

Question 14

Several surprising findings were revealed in the wake of the Target breach, providing a cautionary tale for all executives and security professionals. Which of the following was not thought to have occurred during the Target security breach?
A) Target had security software, but the notification alerts from the software were ignored.
B) Target had properly installed and configured its security software, but hackers got in, anyway.
C) Credit card databases were on entirely separate systems, not connected to other parts of the firm's information system, but wireless networking allowed hackers to access anything reachable from a cell phone connection.
D) Target regularly monitored file names and matched them to file sizes and archival copies to ensure that software was not installed on their systems using the names of legitimate products, but hackers saved files with blank file names so they wouldn't be detected.
E) All of the above

Accepted Answer

The answer of Several surprising findings were revealed in the...

Question 15

Organized crime networks now have their own R&D labs and are engaged in sophisticated development efforts to piece together methods to thwart current security measures.

Accepted Answer

This statement is true. Organized crime networks have been known to invest in research and development to improve their criminal activities and evade security measures.

Question 16

Which of the following statements is consistent with ground realities regarding information security?
A) Cyber-crime is not yet considered a serious enough threat to warrant the attention of law-enforcement agencies.
B) Law-enforcement agencies are well-resourced to fight cyber-crimes effectively.
C) Governments usually outmatch private industry in terms of retaining top talent with incentives and generous pay.
D) Law-enforcement agencies struggle to hire, train, and retain staff capable of keeping pace with today's cyber-criminals.
E) Cyber-crime is not rewarding in terms of financial gain.

Accepted Answer

Cyber-crime is a serious threat and law-enforcement agencies struggle to keep up with the pace of cyber-criminals. The shortage of staff with the necessary skills and expertise is a significant challenge that law-enforcement agencies face.

Question 17

Cyber criminals who infiltrate systems and collect data for illegal resale are called _____.
A) cash-out fraudsters
B) data harvesters
C) corporate spies
D) ethical hackers
E) information hoarders

Accepted Answer

Data harvesters infiltrate systems and collect data with the intent to sell it on the black market for illegal profit.

Question 18

Which of these would be an example of a DDoS attack?
A) An extortion attempt where hackers threaten to reveal names and social security information stolen from medical records databases
B) Overloading a popular social networking site with inbound messages in order to shut down access to the site
C) Launching a targeted phishing campaign on a department of defense or other surveilance network.
D) Stealing proprietary data directly from mobile phones using a distributed network of difficult-to-trace online services.
E) Launching tough-to-track click-fraud efforts

Accepted Answer

DDoS stands for Distributed Denial of Service, which means overwhelming a system or website with traffic from multiple sources to make it unavailable to users. Overloading a popular social networking site with inbound messages in order to shut down access to the site is an example of a DDoS attack.

Question 19

Which of the followings aspects of international law would enable a cyber-criminal operating across borders to evade prosecution?
A) Lack of technology to identify the origin of a security attack
B) Non-recognition of commission of a security-related crime
C) Unwillingness of developed countries to share technical know-how with lesser-developed countries
D) Non-existent extradition agreements between two countries
E) Technological incompatibility between the two countries

Accepted Answer

Non-existent extradition agreements between two countries would allow a cyber-criminal to evade prosecution. If there is no agreement between two countries to transfer individuals who have committed a crime in one country to the other for trial or punishment, then the cyber-criminal can simply flee to the country where they cannot be extradited.

Question 20

A(n) _____ is someone who uncovers computer weaknesses and reveals them to manufacturers or system owners, without exploiting these vulnerabilities.
A) hacktivist
B) data harvester
C) corporate spy
D) white hat hacker
E) ethical cyber criminal

Accepted Answer

A white hat hacker is someone who finds vulnerabilities in computer systems, networks, or software and reports them to the appropriate parties so that they can be fixed. White hat hackers are often employed by companies to test the security of their systems, but they can also work independently as ethical hackers.

Quiz 17: Information Security: Barbarians at the Gateway and Just About Everywhere Else

A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage is called a(n) _____.

Hordes of surreptitiously infiltrated computers, linked and controlled remotely, are known as zombie networks or:

Describe some of the factors at work that enabled the Target security breach to occur.

Many U.S. technology firms believe that U.S. government surveillance techniques put them at a disadvantage relative to foreign firms because:

A research scientist with a major pharmaceutical firm in New Jersey is caught passing on sensitive information, worth millions of dollars, regarding the composition and test results of his firm's latest drug to a rival company. What crime is he being held responsible for?

The term _____ originally referred to a particularly skilled programmer.

Almost all security breaches can be traced back to technology lapses; personnel or procedural factors rarely factor in.

Which of the following is a valid statement on information security?

A black hat hacker looks for weaknesses in security mechanisms, with a view to help plug the holes that might be exploited by cyber-criminals.

An attack on the US power grid by terrorists or a foreign power is indicative of:

A vast majority of security breaches are not preventable and happen despite the best security practices.

Hackers might infiltrate computer systems to enlist hardware for subsequent illegal acts.

What are some of the key managerial takeaways from the Target security breach?

Several surprising findings were revealed in the wake of the Target breach, providing a cautionary tale for all executives and security professionals. Which of the following was not thought to have occurred during the Target security breach?

Organized crime networks now have their own R&D labs and are engaged in sophisticated development efforts to piece together methods to thwart current security measures.

Which of the following statements is consistent with ground realities regarding information security?

Cyber criminals who infiltrate systems and collect data for illegal resale are called _____.

Which of these would be an example of a DDoS attack?

Which of the followings aspects of international law would enable a cyber-criminal operating across borders to evade prosecution?

A(n) _____ is someone who uncovers computer weaknesses and reveals them to manufacturers or system owners, without exploiting these vulnerabilities.