Deck 2: The Need for Security

Question 1

A number of technical mechanisms-digital watermarks and embedded code, copyright codes, and even the intentional placement of bad sectors on software media-have been used to deter or prevent the theft of software intellectual property.

Answer 1

True

Question 2

With the removal of copyright protection mechanisms, software can be easily distributed and installed.

Answer 2

True

Question 3

The information security function in an organization safeguards its technology assets.

Answer 3

True

Question 4

Forces of nature, sometimes called acts of God, can present some of the most dangerous threats because they usually occur with very little warning and are beyond the control of people.

Question 5

DoS attacks cannot be launched against routers.

Question 6

A worm requires that another program is running before it can begin functioning.

Question 7

Compared to Web site defacement, vandalism within a network is less malicious in intent and more public.

Question 8

Much human error or failure can be prevented with effective training and ongoing awareness activities.

Question 9

Suppose an act of theft performed by a hacker was accompanied by defacement actions to delay discovery. The first act is obviously in the category of  "theft" but the second act is another category-in this case it is a "force of nature." 

Question 10

An advance-fee fraud attack involves the interception of cryptographic elements to determine keys and encryption algorithms.

Question 11

When electronic information is stolen, the crime is readily apparent.

Question 12

Organizations can use dictionaries to regulate password selection during the reset process and thus guard against easy-to-guess passwords.

Question 13

A sniffer program can reveal data transmitted on a network segment, including passwords, the embedded and attached files-such as word-processing documents-and sensitive data transmitted to or from applications.

Question 14

Expert hackers are extremely talented individuals who usually devote lots of time and energy to attempting to break into other people's information systems.

Question 15

Attacks conducted by scripts are usually unpredictable.

Question 16

A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected.

Question 17

Information security's primary mission is to ensure that systems and their contents retain their confidentiality at any cost.

Question 18

As an organization grows, it must often use more robust technology to replace the security technologies it may have outgrown.

Question 19

A mail bomb is a form of DoS attack.

Question 20

Two watchdog organizations that investigate allegations of software abuse are the Software & Information Industry Association (SIIA) and National Security Agency (NSA).

Question 21

Computer assets are the focus of information security and are the information that has value to theorganization, as well as the systems that store, process, and transmit the information. ____________

Question 22

"Shoulder spying" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual's shoulder or viewing the information from a distance. _________________________

Question 23

Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n) ____.

A) SSL
B) SLA 
C) MSL
D) MIN

Question 24

Once a(n) back door has infected a computer, it can redistribute itself to all e-mail addresses found on the infected system. _________________________

Question 25

The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. _________________________

Question 26

Media as a subset of information assets are the systems and networks that store, process, and transmit information.

Question 27

A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. _________________________

Question 28

Hackers are "persons who access systems and information without authorization and often illegally." _________________________

Question 29

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. _________________________

Question 30

Which of the following functions does information security perform for an organization  

A) Protecting the organization's ability to function. 
B) Enabling the safe operation of applications implemented on the organization's IT systems. 
C) Protecting the data the organization collects and uses. 
D) All of the above.

Question 31

When voltage levels lag (experience a momentary increase), the extra voltage can severely damage or destroy equipment. _________________________

Question 32

Packet munchkins use automated exploits to engage in distributed denial-of-service attacks. _________________________

Question 33

Software code known as a(n) cookie can allow an attacker to track a victim's activity on Web sites. _________________________

Question 34

The macro virus infects the key operating system files located in a computer's start-up sector. _________________________

Question 35

Intellectual property is defined as "the creation, ownership, and control of ideas as well as the representation of those ideas." _________________________

Question 36

The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. _________________________

Question 37

The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack. _________________________

Question 38

A device (or a software program on a computer) that can monitor data traveling on a network is known as a socket sniffer. _________________________

Question 39

One form of e-mail attack that is also a DoS attack is called a mail spoof, in which an attacker overwhelms the receiver with excessive quantities of e-mail. _________________________

Question 40

Media are items of fact collected by an organization and include raw numbers, facts, and words.

Question 41

____________________ are malware programs that hide their true nature and reveal their designed behavior only when activated.

A) Viruses
B) Worms 
C) Spam
D) Trojan horses

Question 42

In a ____________________ attack, the attacker sends a large number of connection or information requests to disrupt a target from a small number of sources.

A) denial-of-service
B) distributed denial-of-service 
C) virus
D) spam

Question 43

A ____________________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

A) denial-of-service
B) distributed denial-of-service 
C) virus
D) spam

Question 44

____  is any technology that aids in gathering information about a person or organization without their knowledge.

A) A bot
B) Spyware 
C) A Trojan
D) A worm

Question 45

Human error or failure often can be prevented with training, ongoing awareness activities, and ____________________.

A) threats
B) education 
C) hugs
D) paperwork

Question 46

____________________ is the premeditated, politically motivated attacks against information, computer systems, computer programs, and data that result in violence against noncombatant targets by subnational groups or clandestine agents.

A) infoterrorism
B) cyberterrorism 
C) hacking
D) cracking

Question 47

Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) longer than ____________________ characters in Internet Explorer 4.0, the browser will crash.

A) 64 
B) 128 
C) 256 
D) 512

Question 48

Hackers can be generalized into two skill groups: expert and ____________________.

A) novice
B) journeyman 
C) packet monkey
D) professional

Question 49

In the ____________________ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network.

A) zombie-in-the-middle
B) sniff-in-the-middle 
C) server-in-the-middle
D) man-in-the-middle

Question 50

As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus ____________________.

A) false alarms
B) polymorphisms 
C) hoaxes
D) urban legends

Question 51

Acts of ____________________ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter.

A) bypass
B) theft 
C) trespass
D) security

Question 52

____________________ are compromised systems that are directed remotely (usually by a transmitted command) by the attacker to participate in an attack.

A) Drones
B) Helpers 
C) Zombies
D) Servants

Question 53

When information gatherers employ techniques that cross a legal or ethical threshold, they are conducting __________.

A) industrial espionage 
B) competitive intelligence 
C) opposition research 
D) hostile investigation

Question 54

"4-1-9" fraud is an example of a ____________________ attack.

A) social engineering
B) virus 
C) worm
D) spam

Question 55

One form of online vandalism is ____________________ operations, which interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency.

A) hacktivist
B) phreak 
C) hackcyber
D) cyberhack

Question 56

The ____________________ hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network.

A) WWW
B) TCP 
C) FTP
D) HTTP

Question 57

The process of maintaining the confidentiality, integrity, and availability of data managed by a DBMS is known as __________ security.

A) database 
B) data 
C) information 
D) residual

Question 58

A short-term interruption in electrical power availability is known as a ____.

A) ​fault
B) ​brownout 
C) ​blackout
D) ​lag

Question 59

Which of the following is an example of a Trojan horse program  

A) Netsky
B) MyDoom 
C) Klez
D) Happy99.exe

Question 60

The ____________________ data file contains the hashed representation of the user's password.

A) SLA
B) SNMP 
C) FBI
D) SAM

Question 61

​A long-term interruption (outage) in electrical power availability is known as a(n) ___________.

A) ​blackout 
B) ​sag 
C) ​brownout 
D) ​fault

Question 62

The ____________________ fraud is a social engineering attack that involves convincing the victim to participate in a seeming money-making venture while getting the victim to pay fees or bribes or to refund uncleared international payments.

Question 63

Script ____________________ are hackers of limited skill who use expertly written software to attack a system.

Question 64

Some information gathering techniques are quite legal-for example, using a Web browser to perform market research. These legal techniques are called, collectively, competitive ____________________.

Question 65

A(n) ____________________ hacks the public telephone network to make free calls or disrupt services.

Question 66

ESD is the acronym for ____________________ discharge.

Question 67

In the context of information security, ____________________ is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker.

Question 68

Duplication of software-based intellectual property is more commonly known as software ____________________.

Question 69

A momentary low voltage is called a(n) ____________________.

Question 70

The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information is known as __________.

A) pharming 
B) phishing 
C) sniffing 
D) pharming

Question 71

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system's encrypted password file is known as a(n) __________.

A) rainbow table  
B) dictionary 
C) crib 
D) crack file

Question 72

​A short-term decrease in electrical power availability is known as a(n) ___________.

A) ​blackout 
B) ​sag 
C) ​brownout 
D) ​fault

Question 73

The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures, is known as __________.

A) mean time between failure (MTBF)  
B) mean time to diagnose (MTTD) 
C) mean time to failure (MTTF) 
D) mean time to repair (MTTR)

Question 74

A(n) ____________________ is a potential risk to an information asset.

Question 75

Attempting to reverse-calculate a password is called ____________________.

Question 76

The expert hacker sometimes is called a(n) ____________________ hacker.

Question 77

When information gatherers employ techniques in a commercial setting that cross the threshold of what is legal or ethical, they are conducting industrial ____________________.

Question 78

A(n) ____________________ is an act against an asset that could result in a loss.

Question 79

The average amount of time until the next hardware failure is known as __________.

A) ​​mean time between failure (MTBF)  
B) ​mean time to diagnose (MTTD) 
C) ​mean time to failure (MTTF) 
D) ​mean time to repair (MTTR)

Question 80

A(n) ____________________ is a potential weakness in an asset or its defensive control(s).