Deck 2: The Need for Security

Question 1

Two watchdog organizations that investigate allegations of software abuse: SIIA and NSA.

Answer 1

False

Question 2

A worm can deposit copies of itself onto all Web servers that the infected system can reach,so that users who subsequently visit those sites become infected.

Answer 2

True

Question 3

A mail bomb is a form of DoS.

Answer 3

True

Question 4

Information security safeguards the technology assets in use at the organization.

Question 5

Compared to Web site defacement,vandalism within a network is less malicious in intent and more public.

Question 6

A number of technical mechanisms-digital watermarks and embedded code,copyright codes,and even the intentional placement of bad sectors on software media-have been used to enforce copyright laws.

Question 7

A firewall is a mechanism that keeps certain kinds of network traffic out of a private network.

Question 8

Forces of nature,force majeure,or acts of God can present some of the most dangerous threats,because they are usually occur with very little warning and are beyond the control of people.

Question 9

Organizations can use dictionaries to disallow passwords during the reset process and thus guard against easy-to-guess passwords.

Question 10

Information security's primary mission is to ensure that systems and their contents retain their confidentiality at all costs.

Question 11

DoS attacks cannot be launched against routers.

Question 12

Much human error or failure can be prevented with training and ongoing awareness activities.

Question 13

An act of theft performed by a hacker falls into the category of "theft," but is also often accompanied by defacement actions to delay discovery and thus may also be placed within the category of "forces of nature."

Question 14

A timing attack involves the interception of cryptographic elements to determine keys and encryption algorithms.

Question 15

A worm requires that another program is running before it can begin functioning.

Question 16

Attacks conducted by scripts are usually unpredictable.

Question 17

Expert hackers are extremely talented individuals who usually devote lots of time and energy to attempting to break into other people's information systems.

Question 18

With electronic information is stolen,the crime is readily apparent.

Question 19

With the removal of copyright protection,software can be easily distributed and installed.

Question 20

A sniffer program shows all the data going by on a network segment including passwords,the data inside files-such as word-processing documents-and screens full of sensitive data from applications.

Question 21

The shoulder looking technique is used in public or semipublic settings when individuals gather information they are not authorized to have by looking over another individual's shoulder or viewing the information from a distance._________________________

Question 22

A(n)cookie can allow an attacker to collect information on how to access password-protected sites._________________________

Question 23

Which of the following functions does information security perform for an organization?

A)Protecting the organization's ability to function.
B)Enabling the safe operation of applications implemented on the organization's IT systems.
C)Protecting the data the organization collects and uses.
D)All of the above.

Question 24

____ are software programs that hide their true nature,and reveal their designed behavior only when activated.

A)Viruses
B)Worms
C)Spam
D)Trojan horses

Question 25

Which of the following is an example of a Trojan horse program?

A)Netsky
B)MyDoom
C)Klez
D)Happy99.exe

Question 26

Hackers are "people who use and create computer software to gain access to information illegally." _________________________

Question 27

Sniffers often work on TCP/IP networks,where they're sometimes called packet sniffers._________________________

Question 28

The macro virus infects the key operating system files located in a computer's boot sector._________________________

Question 29

The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication._________________________

Question 30

Once a(n)back door has infected a computer,it can redistribute itself to all e-mail addresses found on the infected system._________________________

Question 31

The application of computing and network resources to try every possible combination of options of a password is called a brute crack attack._________________________

Question 32

When voltage levels surge (experience a momentary increase),the extra voltage can severely damage or destroy equipment._________________________

Question 33

One form of e-mail attack that is also a DoS is called a mail spoof,in which an attacker routes large quantities of e-mail to the target._________________________

Question 34

____ is an integrated system of software,encryption methodologies,and legal agreements that can be used to support the entire information infrastructure of an organization.

A)SSL
B)PKI
C)PKC
D)SIS

Question 35

Packet kiddies use automated exploits to engage in distributed denial-of-service attacks._________________________

Question 36

As frustrating as viruses and worms are,perhaps more time and money is spent on resolving virus ____.

A)false alarms
B)power faults
C)hoaxes
D)urban legends

Question 37

A(n)polymorphic threat is one that over time changes the way it appears to antivirus software programs,making it undetectable by techniques that look for preconfigured signatures._________________________

Question 38

The malicious code attack includes the execution of viruses,worms,Trojan horses,and active Web scripts with the intent to destroy or steal information._________________________

Question 39

Intellectual property is defined as "the ownership of ideas and control over the tangible or virtual representation of those ideas." _________________________

Question 40

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways._________________________

Question 41

One form of online vandalism is ____ operations,which interfere with or disrupt systems to protest the operations,policies,or actions of an organization or government agency.

A)hacktivist
B)phvist
C)hackcyber
D)cyberhack

Question 42

Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL)which is longer than ____ characters in Internet Explorer 4.0,the browser will crash.

A)64
B)128
C)256
D)512

Question 43

A ____ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

A)denial-of-service
B)distributed denial-of-service
C)virus
D)spam

Question 44

A virus or worm can have a payload that installs a(n)____________________ door or trap door component in a system,which allows the attacker to access the system at will with special privileges.

Question 45

There are generally two skill levels among hackers: expert and ____.

A)novice
B)journeyman
C)packet monkey
D)professional

Question 46

A(n)____________________ is an object,person,or other entity that represents an ongoing danger to an asset.

Question 47

Web hosting services are usually arranged with an agreement providing minimum service levels known as a(n)____.

A)SSL
B)SLA
C)MSL
D)MIN

Question 48

In a ____ attack,the attacker sends a large number of connection or information requests to a target.

A)denial-of-service
B)distributed denial-of-service
C)virus
D)spam

Question 49

The ____ hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network.

A)WWW
B)TCP
C)FTP
D)HTTP

Question 50

The ____ data file contains the hashed representation of the user's password.

A)SLA
B)SNMP
C)FBI
D)SAM

Question 51

According to Mark Pollitt,____ is the premeditated,politically motivated attacks against information,computer systems,computer programs,and data which result in violence against noncombatant targets by subnational groups or clandestine agents.

A)infoterrorism
B)cyberterrorism
C)hacking
D)cracking

Question 52

Complete loss of power for a moment is known as a ____.

A)sag
B)fault
C)brownout
D)blackout

Question 53

A computer virus consists of segments of code that perform ____________________ actions.

Question 54

Duplication of software-based intellectual property is more commonly known as software ____________________.

Question 55

A(n)____________________ is a malicious program that replicates itself constantly,without requiring another program environment.

Question 56

Acts of ____ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter.

A)bypass
B)nature
C)trespass
D)security

Question 57

____ is any technology that aids in gathering information about a person or organization without their knowledge.

A)A bot
B)Spyware
C)Trojan
D)Worm

Question 58

In the well-known ____ attack,an attacker monitors (or sniffs)packets from the network,modifies them,and inserts them back into the network.

A)zombie-in-the-middle
B)sniff-in-the-middle
C)server-in-the-middle
D)man-in-the-middle

Question 59

"4-1-9" fraud is an example of a ____ attack.

A)social engineering
B)virus
C)worm
D)spam

Question 60

____ are machines that are directed remotely (usually by a transmitted command)by the attacker to participate in an attack.

A)Drones
B)Helpers
C)Zombies
D)Servants

Question 61

A(n)____________________ is an application error that occurs when more data is sent to a program buffer than it is designed to handle.

Question 62

A(n)____________________ hacks the public telephone network to make free calls or disrupt services.

Question 63

A momentary low voltage is called a(n)____________________.

Question 64

Describe the capabilities of a sniffer.

Question 65

When information gatherers employ techniques that cross the threshold of what is legal or ethical,they are conducting industrial ____________________.

Question 66

Some information gathering techniques are quite legal,for example,using a Web browser to perform market research.These legal techniques are called,collectively,competitive ____________________.

Question 67

The timing attack explores the contents of a Web browser's ____________________.

Question 68

The expert hacker sometimes is called ____________________ hacker.

Question 69

Attempting to reverse-calculate a password is called ____________________.

Question 70

Script ____________________ are hackers of limited skill who use expertly written software to attack a system.

Question 71

In the context of information security,____________________ is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker.

Question 72

Describe viruses and worms.

Question 73

____________________ is a technique used to gain unauthorized access to computers,wherein the intruder sends messages with a source IP address that has been forged to indicate that the messages are coming from a trusted host.

Question 74

____________________ is unsolicited commercial e-mail.

Question 75

ESD means electrostatic ____________________.

Question 76

A(n)____________________ is an identified weakness in a controlled system,where controls are not present or are no longer effective.

Question 77

A(n)____________________ is an act that takes advantage of a vulnerability to compromise a controlled system.

Question 78

List at least six general categories of threat.