Deck 12: Information Security Management

Question 1

Faulty service includes incorrectly billing customers or sending the wrong information to employees, but not incorrect data modification.

Answer 1

False

Question 2

As problems caused by human errors are accidental and not malicious, they are not security threats.

Answer 2

False

Question 3

Usurpation occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones.

Answer 3

True

Question 4

Uncertainty is the likelihood of an adverse occurrence.

Question 5

Sniffing occurs when an intruder uses another site's IP address as if it were that other site.

Question 6

Unauthorized data disclosures are possible due to human error.

Question 7

When a hacker floods a Web server with millions of bogus service requests so that it cannot service legitimate requests, it is called a denial-of-service attack.

Question 8

Email spoofing is a synonym for phishing.

Question 9

Cookies enables one to access Web sites without having to sign in every time.

Question 10

According to the elements of company security outlined in the NIST Handbook, computer security is not constrained by societal factors.

Question 11

Phishing is a technique for intercepting computer communications.

Question 12

Uncertainty is different from risk.

Question 13

Drive-by sniffers monitor and intercept wireless traffic at will.

Question 14

Pretexting occurs when a person receives a confidential text message by mistake and pretends to be the intended recipient.

Question 15

An example of a computer crime includes an employee who inadvertently installs an old database on top of the current one.

Question 16

Safeguards increase work efficiency by making common tasks easier.

Question 17

According to the NIST Handbook, computer security responsibilities and accountability should not be made explicit.

Question 18

Natural disasters present the largest risk for infrastructure loss.

Question 19

Most email and IM are protected by encryption.

Question 20

Because of uncertainty, risk management is always approximate.

Question 21

A Trojan horse is a virus that masquerades as a useful program or file.

Question 22

Secure Socket Layer (SSL)is a protocol that is restricted to asymmetric encryption.

Question 23

Data safeguards are measures used to protect computer hardware from external threat.

Question 24

Probable loss is the probability that a given asset will be compromised by a given threat, despite the safeguards.

Question 25

Probable loss is concerned only with tangible consequences.

Question 26

To gain access to a wired network, a potential intruder must obtain physical access to the network.

Question 27

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 28

A botnet is a network of bots that is created and managed by the individual or organization that infected the network with the bot program.

Question 29

Windows, Linux, Unix, and other operating systems employ Kerberos and authenticate user requests across networks of computers using a mixture of these operating systems.

Question 30

Unlike credit, debit, and ATM cards, which have a magnetic strip, smart cards have a microchip.

Question 31

A magnetic strip holds far more data than a microchip.

Question 32

Encryption is an example of a technical safeguard.

Question 33

Wireless networks are more secure than wired networks.

Question 34

Technical safeguards involve the hardware and software components of an information system.

Question 35

Most spyware is benign in that it does not perform malicious acts or steal data.

Question 36

A retina scan is a biometric authentication technique.

Question 37

Beacons are tiny files that gather demographic information and use different codes to identify users by age, gender, location, likely income, and online activity.

Question 38

Viruses and worms are examples of malware.

Question 39

Intangible consequences are those whose financial impact can be measured.

Question 40

In symmetric encryption, two different keys are used to encode and decode a message.

Question 41

A ________ is a person or organization that seeks to obtain data or other assets illegally, without the owner's permission and often without the owner's knowledge.

A) target
B) vulnerability
C) threat
D) warning

Question 42

Documenting position sensitivity enables security personnel to prioritize their activities in accordance with the possible risk and loss.

Question 43

________ is a technique for intercepting computer communications, either through a physical connection to a network or, in the case of wireless networks, with no physical connection.

A) Spoofing
B) Phishing
C) Sniffing
D) Pretexting

Question 44

The total cost of a cold site, including all customer labor and other expenses, is always less than the cost of a hot site.

Question 45

Incident response procedures should provide decentralized reporting of all security incidents.

Question 46

Due to increased security in operating systems and other software, and improved security procedures and employee training, it will be impossible for hackers to find vulnerabilities to exploit in the future.

Question 47

Email spoofing is a synonym for ________.

A) hacking
B) phishing
C) usurping
D) sniffing

Question 48

A ________ pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

A) hacker
B) phisher
C) safeguard
D) sniffer

Question 49

________ occurs when someone deceives by pretending to be someone else.

A) Hacking
B) Baiting
C) Sniffing
D) Pretexting

Question 50

Employee termination is a potential security threat for an organization.

Question 51

When referring to security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A) unauthorized data disclosure
B) incorrect data modification
C) faulty services
D) loss of infrastructure

Question 52

The existence of accounts that are no longer in use are not a security threat to an organization.

Question 53

If a backup is made, the database is secure.

Question 54

________ take computers with wireless connections through an area and search for unprotected wireless networks and then monitor and intercept wireless traffic at will.

A) Drive-by spoofers
B) Pretexters
C) Drive-by sniffers
D) Phishers

Question 55

Which of the following is considered a threat caused by human error?

A) An employee inadvertently installs an old database on top of the current one.
B) An employee intentionally destroys data and system components.
C) A virus and worm writer infects computer systems.
D) A hacker breaks into a system to steal for financial gain.

Question 56

A hot site is a utility company that can take over another company's processing with no forewarning.

Question 57

Security, like BPM, is a process that requires process management.

Question 58

Which of the following is an example of a sniffing technique?

A) IP spoofing
B) caches
C) ad blockers
D) adware

Question 59

Many companies create honeypots, which are false targets for computer criminals to attack.

Question 60

Which of the following is considered a computer crime?

A) accidentally deleting customer records
B) poorly written programs resulting in data losses
C) loss of data as a result of flooding
D) hacking of information systems

Question 61

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones that shut down legitimate applications and substitute their own processing to spy, steal and manipulate data, or other purposes.

A) Hacking
B) Spoofing
C) Phishing
D) Usurpation

Question 62

Which of the following is a critical security function of senior management?

A) safeguarding computer hardware and software
B) delegating responsibility for managing IS security
C) establishing the security policy and managing risk
D) managing security programs on a real-time basis

Question 63

________ refers to things we do not know, while ________ is the likelihood of an adverse occurrence.

A) Risk; indemnity
B) Uncertainty; risk
C) Assessment; uncertainty
D) Vulnerability; risk

Question 64

Employees resent physical searches when arriving at and departing from work.Which aspect of computer security described in the NIST Handbook is reflected here?

A) Computer security is an integral element of sound management.
B) Computer security should be cost-effective.
C) Computer security is constrained by societal factors.
D) Computer security should be periodically reassessed.

Question 65

Which of the following usually happens in a malicious denial-of-service attack?

A) A hacker monitors and intercepts wireless traffic at will.
B) A hacker floods a Web server with millions of bogus service requests.
C) A hacker uses another site's IP address to masquerade as that other site.
D) A phisher pretends to be a legitimate company and requests confidential data.

Question 66

Which of the following is the first step in risk management?

A) create backup procedures
B) reduce the likelihood of a threat
C) evaluate the results of the risk management process
D) assess the threats and vulnerabilities

Question 67

Nonword passwords are vulnerable to a ________ attack, in which the password cracker tries every possible combination of characters.

A) denial-of-service
B) side channel
C) brute force
D) obfuscation

Question 68

________ are small files that your browser stores on your computer when you visit Web sites and enable you to access Web sites without having to sign in every time.

A) Cookies
B) Registers
C) Pop-ups
D) Public keys

Question 69

Which of the following is an example of a system-specific security policy?

A) limiting the personal use of an organization's computer systems
B) deciding what customer data from the order-entry system will be shared with other organizations
C) designating a department for managing an organization's IS security
D) inspecting an employee's personal email for compliance with company policy

Question 70

A security policy covering the matters related to the personal use of computers at work would be an example of a(n)________.

A) data policy
B) issue-specific policy
C) system-specific policy
D) network security policy

Question 71

Which of the following is an example of an intangible consequence?

A) a dip in sales because supplies were not replenished
B) a loss of customer goodwill due to an outage
C) a drop in production due to plant maintenance
D) a financial loss due to high input costs

Question 72

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A) Unauthorized data disclosure
B) Incorrect data modification
C) Denial of service
D) Loss of infrastructure

Question 73

Which factor of risk assessment refers to the probability that a given asset will be compromised by a given threat, despite the safeguards?

A) likelihood
B) uncertainty
C) consequence
D) vulnerability

Question 74

________ present the largest risk for an organization's infrastructure loss.

A) Employees
B) Natural disasters
C) Hackers
D) Competitors

Question 75

Which of the following is most likely to be the result of hacking?

A) certain Web sites being blocked from viewing for security reasons
B) small amounts of spam in your inbox
C) an unexplained reduction in your account balance
D) pop-up ads appearing frequently

Question 76

To obtain a measure of probable loss, companies ________.

A) multiply likelihood by the probability of occurrence
B) multiply the vulnerability by the probability of occurrence
C) multiply likelihood by the cost of the consequences
D) multiply residual risk by the cost of the consequences

Question 77

________ occurs when a person breaks into a network to steal data such as customer lists, product inventory data, employee data, and other proprietary and confidential data.

A) Pretexting
B) Phishing
C) Hacking
D) Spoofing

Question 78

Which of the following is covered by the Gramm-Leach-Bliley Act of 1999?

A) information related to national security
B) records maintained by the U.S.government
C) consumer financial data stored by financial institutions
D) health data collected by doctors and other health-care providers

Question 79

Which element of a security policy specifies how an organization will ensure the enforcement of security programs and policies?

A) the general statement of the security policy
B) the issue-specific policy
C) the network policy
D) the system-specific policy

Question 80

A(n)________ is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

A) IDS
B) botnet
C) antivirus
D) firewall