Question 1

What is the most important aspect of internal control?

Accepted Answer

D

Question 2

What is usually the primary goal in traditional fraud?

Accepted Answer

The primary goal in traditional fraud is usually the theft of money, whether it be through embezzlement, check forging, or other types of schemes. Financial statement fraud, identity theft, and information theft can all be part of a traditional fraud scheme, but the end goal is typically to obtain money illegally.

Question 3

Passwords,biometrics,and digital signatures are examples of _____.

Accepted Answer

Passwords, biometrics, and digital signatures are all examples of authorization controls, which ensure that only authorized individuals or systems have access to specific resources or data. Physical controls involve physical barriers or safeguards to protect physical assets, segregation of duties involves separating sensitive functions amongst multiple individuals to prevent fraud or errors, and checks on performance involve evaluating the effectiveness of internal controls and improving processes.

Question 4

Which of the following is NOT a general type of control activity?

Accepted Answer

Use of internal auditors is not a general type of control activity, but rather a specific control activity that falls under the broader category of monitoring activities. The other options listed (adequate separation of duties, independent checks on performance, and proper authorization of transactions and activities) are all general types of control activities.

Question 5

One of the greatest fallacies of e-commerce security is a prevention measure known as _________.

Accepted Answer

Security through obscurity is the belief that a system is secure because attackers do not know enough about the system to attack it. This belief is a fallacy because it is not a reliable form of protection and can lead to a false sense of security. It is important to have strong, well-known security measures in place, rather than relying on the hope that attackers will not discover weaknesses in the system.

Question 6

________ is the use of unique features of the human body to create secure access controls.

Accepted Answer

Biometrics use unique physical or behavioral characteristics like fingerprints, iris/retina patterns, or facial features to grant access control.

Question 7

____ are self-contained programs that represent today's biggest threat and spread via direct transfer,email,or another mechanism.

Accepted Answer

Internet worms are self-contained programs that can spread through direct transfer, email, or other mechanisms. P2P programs are not necessarily a threat, as they can be used for legitimate purposes. Trojan horses and spyware are also threats but do not necessarily spread in the same way as internet worms.

Question 8

A (n)_____,similar to a trojan horse,installs monitoring software in addition to the regular software that a user downloads or buys.

Accepted Answer

The definition provided matches the characteristics of spyware, which is a type of malicious software that sneaks into a computer and secretly gathers information on the user without their knowledge or consent.

Question 9

Generally,the best way to prevent fraud in e-business settings is to focus on:

Accepted Answer

The best way to prevent fraud in e-business settings is to reduce fraud opportunities by implementing security measures like encrypting sensitive data, using secure payment gateways, implementing two-factor authentication, and regularly monitoring transactions for suspicious activities. While anti-virus software and hiring security experts can be beneficial, they are not as effective in preventing fraud as reducing the opportunities for it to occur in the first place. Similarly, while reducing pressures can make employees less likely to commit fraud, it is not always within a business's control to do so.

Question 10

The threat of falsified identity is less of a concern in the case of:

Accepted Answer

Traditional EDI settings typically involve established, known partners who have verified identities before engaging in electronic transactions, making the threat of falsified identity less of a concern. Virtual private networks can also be secure if properly implemented, while e-business and unsecured online transactions pose higher risks of identity fraud.

Question 11

_____ is the viewing of information that passes along a network line,and it is a common method of gathering information from unencrypted communications.

Accepted Answer

Sniffing is the practice of intercepting and inspecting network traffic. It can be used to gather sensitive information such as passwords, usernames, email content, and credit card numbers from unencrypted communications. Spoofing involves impersonating or masquerading as another user or device, hijacking involves taking over control of a network connection or device, and impersonation involves pretending to be someone else online.

Question 12

What is normally the primary concern in an electronic environment?

Accepted Answer

In an electronic environment, data theft is the primary concern. As companies increasingly rely on electronic data storage and communication, the risk of data breaches and thefts has also increased. This can lead to financial losses, reputational damage, and legal consequences for the affected organization. Therefore, protecting electronic data from unauthorized access, theft, or manipulation is crucial in today's business environment.

Question 13

Why are passwords often considered the "Achilles' heel" of electronic systems?

Accepted Answer

Passwords are often considered weak points in electronic systems because their selection is left to the end user and cannot be fully controlled. End users tend to choose weak or easily guessable passwords, making it easier for unauthorized individuals to gain access to systems and sensitive information.

Question 14

Which element of the fraud triangle can easily be reduced in preventing fraud in e-business?

Accepted Answer

Opportunity is the element that can easily be reduced in preventing fraud in e-business. This can be achieved by implementing strong internal controls, regular monitoring, background checks, and segregation of duties. By reducing the opportunity, the likelihood of fraud occurring in e-business is minimized. Pressure and rationalization are internal to the fraudster and are difficult to control. Interaction is not part of the fraud triangle.

Question 15

A hacker calls a targeted user and pose as technical support.The hacker asks the victim to divulge the account information so that immediate steps can be taken to prevent data loss from the account.What is this an example of?

Accepted Answer

This is an example of social engineering, where the hacker uses manipulation tactics to trick the victim into divulging sensitive information.

Question 16

What is spoofing?

Accepted Answer

Spoofing is the act of changing information in e-mail headers or IP addresses to make it look like the message came from someone or somewhere else. The goal of spoofing is often to trick recipients into disclosing sensitive information or taking some action they shouldn't.

Question 17

E-mail messages and Web visits can be hijacked because:

Accepted Answer

Subtle differences in Internet host names often go unnoticed by Internet users, making it easier for attackers to hijack email messages and web visits through techniques like phishing or spoofing.

Question 18

What is biometrics?

Accepted Answer

Biometrics involves using unique physical or behavioral characteristics, such as fingerprints or facial recognition, as a means of secure authentication or access control. It is often used as a more secure alternative to traditional passwords or PINs.

Question 19

In an electronic environment,no other control can better prevent fraud than the wise use of _________.

Accepted Answer

The answer of In an electronic environment,no other control can...

Question 20

Which of the following refers to the tactic of keeping security holes,encryption algorithms,and processes secret in an effort to confuse attackers?

Accepted Answer

"Security through obscurity" refers to the practice of keeping security measures a secret in order to confuse attackers. This approach is generally not considered reliable as it does not address the root cause of vulnerabilities and can potentially give a false sense of security.

Quiz 17: Fraud in E-Commerce