Question 1

Which of the following would not be considered an example of an intentional security threat?
A) Theft of data
B) Inappropriate use of data
C) Malicious damage to computer resources
D) Human Error
E)g., manipulating inputs)

Accepted Answer

Human error, while it can result in security incidents, is not considered an intentional security threat as it is not done with malicious intent.

Question 2

Which of the following is not a characteristic of money laundering and terrorist financing?
A) Transnational organized crime groups use money laundering to fund their operations, which creates international and national security threats.
B) Cybercrime is safer and easier than selling drugs, dealing in black market diamonds, or robbing banks.
C) Funds used to finance terrorist operations are easy to track, which provides evidence to identify and locate leaders of terrorist organizations and cells.
D) Online gambling offers easy fronts for international money-laundering operations.

Accepted Answer

This statement is not true. In reality, funds used to finance terrorist operations are often difficult to track because they are often raised through informal channels, such as donations from sympathizers or illicit sources. Identifying and locating leaders of terrorist organizations and cells is also a complex and challenging task. The other choices are true characteristics of money laundering and terrorist financing.

Question 3

The supervision, monitoring, and control of the organization's IT assets is called __________________.
A) IT planning
B) Strategic planning for IT
C) IT governance
D) IT architecture management

Accepted Answer

IT governance refers to the overall management and control of IT resources within an organization. It includes the development of policies and procedures, risk management, compliance, and performance measurement. It is an essential function of IT management to ensure that IT assets are effectively utilized, aligned with business objectives, and meet regulatory requirements.

Question 4

Computers infected by software "robots" can be organized into networks called ______________.
A) Zombies
B) Spies
C) Botnets
D) Phishnets

Accepted Answer

The term used for networks of infected computers organized by software "robots" is botnets. Options A, B, and D are not commonly used to describe this phenomenon.

Question 5

Which of the following would not be considered an example of an intentional security threat?
A) Computer systems failure
B) Malicious damage to computer resources
C) Destruction from viruses and similar attacks
D) Internet fraud

Accepted Answer

Computer systems failure may be a result of unintentional causes such as hardware failure, natural disasters, or human error, and is not considered an intentional security threat. The other options (B, C, and D) involve deliberate actions taken to compromise security.

Question 6

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved, threats from __________________ have increased considerably in recent years.
A) Software errors
B) Malicious employees
C) Social networks and cloud computing
D) Vendor sabotage

Accepted Answer

Social networks and cloud computing have become popular avenues for cyber attackers to exploit in recent years. With the increasing use of these platforms, there has been a rise in social engineering attacks and data breaches as cyber criminals target individuals and organizations through fake social media accounts, phishing emails, and compromised cloud services. While software errors, malicious employees, and vendor sabotage are still potential threats, they do not have the same level of prevalence as social network and cloud computing attacks do.

Question 7

The ______________________ is an exercise that determines the impact of losing the support or availability of a resource.
A) Business impact analysis BIA)
B) Vulnerability audit
C) Asset valuation audit
D) Computing Cost/Benefit CCB) audit

Accepted Answer

The exercise described is a Business Impact Analysis (BIA). A BIA is used to identify the impact on business operations if a particular resource or asset (such as a system or a team member) becomes unavailable. It helps organizations prioritize their disaster recovery and business continuity plans, and allocate resources in a more efficient and effective way. The other choices, vulnerability audit, asset valuation audit, and computing cost/benefit audit, are all different types of audits that focus on different aspects of an organization's operations and infrastructure, but they do not specifically address the impact of losing resources.

Question 8

Organizations that use the _______________________ of network security develop strategic layers of protection against security breaches. The top layer is often, "senior management commitment and support" of security efforts.
A) Layered Security Model
B) Security module model
C) Segmented security model
D) Defense-in-depth model

Accepted Answer

The answer of Organizations that use the _______________________ of network...

Question 9

Facebook, YouTube, Twitter, LinkedIn, and other social networks are making IT security dangers worse. Why?
A) Users invite in and build relationships with others. Cybercriminals hack into these trusted relationships using stolen log-ins.
B) E-mail viruses and malware have been increasing for years even though e-mail security has improved.
C) Communication has shifted from social networks to smartphones.
D) Web filtering, user education, and strict policies cannot help prevent IT security dangers on Facebook and other social networks.

Accepted Answer

Social networks rely on users building relationships and sharing information with others, which can lead to cybercriminals gaining access through stolen log-ins. E-mail security may have improved, but social networks create new opportunities for cyber attacks. Communication shifting to smartphones may also be a security concern, but this is not directly related to the question of why social networks are making IT security dangers worse. The last option, stating that web filtering, user education, and strict policies cannot help prevent IT security dangers on social networks, is incorrect as these security measures can still be effective in mitigating risks.

Question 10

Most information security incidents will occur because of _______________________.
A) Increases in hacker skills and capabilities
B) Poorly designed network protection software
C) Increasing sophistication of computer viruses and worms
D) Users who do not follow secure computing practices and procedures

Accepted Answer

While all of the options listed can contribute to information security incidents, the most common cause is the human factor. Users who do not follow secure computing practices and procedures, such as using weak passwords or clicking on suspicious links, can inadvertently give hackers access to sensitive information. Therefore, it is important for organizations to prioritize user education and training in their overall cybersecurity strategy.

Question 11

Effective organizations develop an) _____________________ that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance.
A) Terms of service TOS)
B) Acceptable use policy AUP)
C) Safe security plan SSP)
D) Computing practices policy CPP)

Accepted Answer

An acceptable use policy (AUP) is a document that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance. AUPs are essential for promoting responsible use of information technology and preventing abuse or misuse of organization resources. Terms of service (TOS) refer to a legal agreement outlining the rules for using a website or service. Safe security plan (SSP) and computing practices policy (CPP) are not directly related to user responsibilities for information technology use.

Question 12

Samuel received an email that looked like it came from his bank. The email asked him to click on a link that opened an official looking Webpage that asked him to enter information about his account. But when he looked at the URL address, he noticed it was a strange address he did not recognize. As a result, he closed his browser and deleted the email rather than enter anything on the fraudulent page. Most likely, someone was attempting to steal Samuel's information using a technique called __________________.
A) Malware
B) Phishing
C) Impostering
D) Click hijacking

Accepted Answer

The email Samuel received is an example of a phishing attack, which is a type of social engineering attack in which an attacker disguises themselves as a trustworthy entity to obtain sensitive information from the victim, such as login credentials or credit card information. In this case, the attacker disguised themselves as Samuel's bank and sent him an email with a link to a fake website designed to steal his information. By noticing the strange URL address and not entering any information, Samuel was able to avoid falling victim to the phishing attack.

Question 13

In the United States, the Sarbanes-Oxley Act SOX), Gramm-Leach-Bliley Act GLB), Federal Information Security Management Act FISMA), and USA Patriot Act all require businesses to __________________________.
A) Report security breaches
B) Backup sensitive data
C) Protect personally identifiable information
D) Inform the public about network failures in a timely manner

Accepted Answer

The Sarbanes-Oxley Act (SOX), Gramm-Leach-Bliley Act (GLB), Federal Information Security Management Act (FISMA), and USA Patriot Act all include provisions that require businesses to protect personally identifiable information (PII) to ensure the privacy and security of individuals' data.

Question 14

__________ is the elapsed time between when vulnerability is discovered and when it's exploited and has shrunk from months to __________.
A) Time-to-exploitation; weeks
B) Time-to-exploitation; minutes
C) Denial of service; days
D) Denial of service; seconds

Accepted Answer

Time-to-exploitation is the elapsed time between when vulnerability is discovered and when it's exploited. This time duration has drastically reduced from months to minutes due to the advancement in technology and the increasing sophistication of attackers. Therefore, option B is the best choice among the given options.

Question 15

The "Payment Card Industry Data Security Standard PCI DSS)" created by Visa, MasterCard, American Express, and Discover is a ___________________________________.
A) Set of standards required by U.S. and international law for protecting credit card transaction data.
B) Set of industry standards required for all members, merchants, or service providers that store, process, or transmit cardholder data.
C) Set of voluntary security guidelines for retailers who accept Visa, MasterCard, American Express, and Discover credit cards.
D) Set of regulations that vary from state to state, and country to country) that apply to credit card companies, but not necessarily to retailers or merchants who accept them.

Accepted Answer

The PCI DSS is a set of industry standards required for all members, merchants, or service providers that store, process, or transmit cardholder data. It is not mandated by law, but failure to comply can result in fines and other penalties imposed by the payment card brands.

Question 16

Intrusion Detection Systems IDS) are designed to detect and protect a network primarily from _____________ threats.
A) Social media
B) Internal
C) Cloud based
D) Foreign

Accepted Answer

Intrusion Detection Systems (IDS) are primarily designed to detect and protect a network from internal threats, such as those posed by users within the organization who may have malicious intent or inadvertently compromise security.

Question 17

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security. Which of the following is not an example of an unintentional threat described in your textbook?
A) Political/civic unrest
B) Human errors
C) Environmental hazards
D) Computer systems failures

Accepted Answer

Political/civic unrest is not an unintentional threat, it is a deliberate action taken by individuals or groups to disrupt systems and operations. All the other options (human errors, environmental hazards, and computer system failures) can lead to unintentional threats or security breaches.

Question 18

Which of the following is not one of the COBIT Control Objectives for Information and Related Technology) principles listed in your textbook?
A) Principle of economic use of resources
B) Principle of legality
C) Principle of secure assets
D) Accounting principles

Accepted Answer

The answer of Which of the following is not one...

Question 19

When new vulnerabilities are found in operating systems, applications, or wired and wireless networks, vendors of those products release __________ or __________ to fix the vulnerabilities.
A) Patches; service packs
B) Patches; downloads
C) Firewalls; spyware
D) Service packs; firewalls

Accepted Answer

Vendors release patches or service packs to fix vulnerabilities in their products.

Question 20

The director of the Federal Trade Commission FTC) bureau of consumer protection warned that the agency would bring enforcement action against small businesses
A) That failed to inform the public about network failures in a timely manner
B) That failed to transmit sensitive data
C) That did not report security breaches to law enforcement
D) Lacked adequate policies and procedures to protect consumer data.

Accepted Answer

The director of the FTC bureau of consumer protection warned that the agency would bring enforcement action against small businesses that lacked adequate policies and procedures to protect consumer data. The other options may also result in enforcement action, but lack of policies and procedures is a broad issue that encompasses all aspects of data protection.

Quiz 5: Cybersecurity, Compliance, and Business Continuity

Which of the following would not be considered an example of an intentional security threat?

Which of the following is not a characteristic of money laundering and terrorist financing?

The supervision, monitoring, and control of the organization's IT assets is called __________________.

Computers infected by software "robots" can be organized into networks called ______________.

Which of the following would not be considered an example of an intentional security threat?

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved, threats from __________________ have increased considerably in recent years.

The ______________________ is an exercise that determines the impact of losing the support or availability of a resource.

Organizations that use the _______________________ of network security develop strategic layers of protection against security breaches. The top layer is often, "senior management commitment and support" of security efforts.

Facebook, YouTube, Twitter, LinkedIn, and other social networks are making IT security dangers worse. Why?

Most information security incidents will occur because of _______________________.

Effective organizations develop an) _____________________ that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance.

In the United States, the Sarbanes-Oxley Act SOX) , Gramm-Leach-Bliley Act GLB) , Federal Information Security Management Act FISMA) , and USA Patriot Act all require businesses to __________________________.

is the elapsed time between when vulnerability is discovered and when it's exploited and has shrunk from months to .

The "Payment Card Industry Data Security Standard PCI DSS) " created by Visa, MasterCard, American Express, and Discover is a ___________________________________.

Intrusion Detection Systems IDS) are designed to detect and protect a network primarily from _____________ threats.

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security. Which of the following is not an example of an unintentional threat described in your textbook?

Which of the following is not one of the COBIT Control Objectives for Information and Related Technology) principles listed in your textbook?

When new vulnerabilities are found in operating systems, applications, or wired and wireless networks, vendors of those products release or to fix the vulnerabilities.

The director of the Federal Trade Commission FTC) bureau of consumer protection warned that the agency would bring enforcement action against small businesses