Question 1

Bob is using public key encryption to send a message to Ted. Bob encrypts the message with Ted's _____ key, and Ted decrypts the message using his _____ key.

Accepted Answer

In public key encryption, the sender encrypts the message with the recipient's public key, and the recipient decrypts it with their private key. This ensures that only the intended recipient can decrypt the message.

Question 2

_____ controls are concerned with user identification, and they restrict unauthorized individuals from using information resources.

Accepted Answer

Access controls are specifically designed to limit unauthorized users from using information resources by requiring user identification and authentication. Physical controls are involved in securing the physical environment and premises of an organization. Data security controls are implemented to ensure the confidentiality, integrity, and availability of data. Administrative controls include policies and procedures governing appropriate behavior, roles and responsibilities, and compliance requirements. Input controls regulate the entry and processing of data into information systems.

Question 3

In _____, the organization takes concrete actions against risks.

Accepted Answer

Risk mitigation refers to taking practical actions to minimize or control the impact of risks. It involves implementing strategies to reduce the likelihood of an event occurring or the severity of its consequences. Other options such as risk analysis involve identifying and evaluating risks, risk management involves the overall process of identifying, assessing, and controlling risks, and risk acceptance refers to acknowledging the existence of a risk but choosing not to take any action. Risk transference involves shifting the risk to another party through insurance or contracts.

Question 4

Which of the following is(are) designed to use your computer as a launch pad for sending unsolicited e-mail to other computers?

Accepted Answer

Spamware is designed specifically to send unsolicited emails using your computer as a launching pad to other computers. While spyware, adware, viruses, and worms may have other malicious intents, spamware is focused solely on spamming.

Question 5

Which of the following is not a strategy for mitigating the risk of threats against information?

Accepted Answer

The answer of Which of the following is not a...

Question 6

Voice and signature recognition are examples of:

Accepted Answer

Voice and signature recognition are examples of "something the user does," as they involve actions or behaviors unique to the user.

Question 7

_____ is the process in which an organization assesses the value of each asset being protected, estimates the probability that it will be compromised, and compares the probable costs of an attack with the costs of protecting the asset.

Accepted Answer

The process described is risk analysis, which involves assessing the value of assets to determine the likelihood of compromise and comparing the costs of protection with the potential costs of an attack. Risk management involves the overall process of identifying, assessing, and mitigating risks, while risk mitigation involves taking steps to reduce the likelihood or impact of a potential risk. Risk acceptance and risk transference refer to accepting or transferring the risk to others.

Question 8

Which of the following is not a characteristic of strong passwords?

Accepted Answer

Strong passwords are not short and easy to remember, as these are easier for hackers to crack. Strong passwords should be long and complex, with a mix of upper and lowercase letters, numbers, and special characters, and not a recognizable word or string of numbers.

Question 9

The term _____ refers to clandestine software that is installed on your PC through duplicitous channels but is not particularly malicious.

Accepted Answer

The term "Alien software" specifically refers to software that is installed through deceptive means but does not have harmful intent, making it the best choice for this definition. The other options listed (virus, worm, back door, logic bomb) all suggest malicious intent or behavior.

Question 10

In _____, the organization purchases insurance as a means to compensate for any loss.

Accepted Answer

Risk transference involves transferring the risk to another party, usually through insurance. By purchasing insurance, the organization transfers the financial risk of a potential loss to the insurance company.

Question 11

Which of the following statements concerning the difficulties in protecting information resources is not correct?

Accepted Answer

Rapid technological changes ensure that controls become ineffective quickly, as threats and vulnerabilities evolve. Therefore, controls need to be continuously updated and improved to effectively protect information resources.

Question 12

_____ are segments of computer code embedded within an organization's existing computer programs that activate and perform a destructive action at a certain time or date.

Accepted Answer

The given description matches the definition of a logic bomb, which is a type of program that is designed to lie dormant within a system until a predetermined set of circumstances are met, such as a certain date or event, at which point it will activate and cause damage or disruption to the system. Viruses, worms, Trojan horses, and back doors are all types of malicious software as well, but their functions and methods of operation differ.

Question 13

Which of the following statements is false?

Accepted Answer

Assessing the value of a hypothetical attack is challenging due to the unpredictability and variability of potential threats and impacts.

Question 14

Passwords and passphrases are examples of:

Accepted Answer

The answer of Passwords and passphrases are examples of:
...

Question 15

Access controls involve _____ before _____.

Accepted Answer

Access controls involve two main steps: authentication, which verifies the identity of the user, and authorization, which determines what actions the user is allowed to perform. Biometrics, signature recognition, iris scanning, and voice recognition are all methods that can be used for authentication, but they are only one part of the access control process. Strong passwords are also an important factor in authentication, but they are not the only method that can be used. Therefore, the correct answer is B, as it includes both authentication and authorization.

Question 16

When companies attempt to counter _____ by requiring users to accurately select characters in turn from a series of boxes, attackers respond by using _____.

Accepted Answer

Companies use character selection from a series of boxes to counter keyloggers, which record keystrokes to steal information. Attackers then use screen scrapers, which capture the graphical screen output to bypass this security measure.

Question 17

Biometrics are an example of:

Accepted Answer

Biometrics refer to physical or behavioral characteristics unique to an individual, such as fingerprints or facial recognition. These are examples of "something the user is," making choice A the most accurate answer.

Question 18

Which of the following is not an example of a weak password?

Accepted Answer

EWeak passwords typically lack a mix of characters, are short, or are easily guessable. Option C, "9AmGt/*", includes a mix of uppercase and lowercase letters, numbers, and special characters, making it stronger. Option E, "InformationSecurity", is longer and not a common phrase or easily guessable combination, which also makes it stronger compared to the others listed.

Question 19

In a _____ attack, a coordinated stream of requests is launched against a target system from many compromised computers at the same time.

Accepted Answer

A distributed denial-of-service (DDoS) attack is a coordinated stream of requests from many compromised computers against a target system, causing a denial of service to legitimate users.

Question 20

A _____ attack uses deception to fraudulently acquire sensitive personal information by masquerading as an official e-mail.

Accepted Answer

A phishing attack attempts to trick the recipient into providing sensitive information, such as usernames, passwords, or credit card details, by posing as a trustworthy entity in an email or other communication.

Quiz 4: Information Security

Bob is using public key encryption to send a message to Ted. Bob encrypts the message with Ted's _ key, and Ted decrypts the message using his _ key.