Question 1

A self-replicating piece of program code that can attach itself to other programs and data and perform malicious actions is referred to as a(n):

Accepted Answer

A virus is a self-replicating piece of program code that can attach itself to other programs and data and perform malicious actions. Worms are also self-replicating, but they do not need to attach to other programs or data to execute their malicious actions. Encryption is a method used to protect data by altering it so that it can only be read by someone who has the key to decipher the code. Infection is a general term that can refer to any type of harmful invasion of a computer system, but it does not specifically refer to a self-replicating piece of program code.

Question 2

The process of proactively examining the IT system for weaknesses that can be exploited by hackers, viruses, or malicious employees is called:

Accepted Answer

Vulnerability assessment is the process of identifying and assessing vulnerabilities in an IT system. It helps in finding weaknesses that could be exploited by hackers, viruses or malicious employees. Intrusion detection and virus management are reactive measures whereas vulnerability assessment is a proactive measure. Penetration testing is a type of vulnerability assessment that involves simulating an attack on the IT system to identify vulnerabilities.

Question 3

This encryption method, used with wireless network equipment, is symmetric in that both the sending and receiving network nodes must use the same encryption key.It has been proven to be susceptible to hacking.

Accepted Answer

The description matches the Wired Equivalency Privacy (WEP) encryption method, which is known to have vulnerabilities and is no longer considered secure.

Question 4

The IT Governance Committee has several important responsibilities.Which of the following is not normally one of those responsibilities?

Accepted Answer

Investing excess IT funds in long-term investments is not normally one of the responsibilities of the IT Governance Committee. Their primary responsibilities include aligning IT investments to business strategies, overseeing and prioritizing changes to IT systems, and developing, monitoring, and reviewing security procedures.

Question 5

This form of encryption uses a public key, which is known by everyone, to encrypt data, and a private key, to decode the data.

Accepted Answer

Public key encryption uses a public key to encrypt data, which can be known by everyone, and a private key to decrypt the data, which is only known by the recipient. This makes it a secure and widely-used form of encryption.

Question 6

This encryption method requests connection to the network via an access point and that point then requests the use identity and transmits that identity to an authentication server, substantially authenticating the computer and the user.

Accepted Answer

WPA (Wireless Protection Access) is an encryption method that requests connection to the network via an access point, which then requests the use identity and transmits that identity to an authentication server, substantially authenticating the computer and the user.

Question 7

This communication protocol is built into web server and browser software that encrypts data transferred on that website.You can determine if a website uses this technology by looking at the URL.

Accepted Answer

The communication protocol described is Secure Sockets Layer (SSL), which is a technology that encrypts data transferred between a web server and a browser. One way to identify if a website uses SSL is by looking at the URL, which will typically start with "https" instead of "http".

Question 8

The type of network uses tunnels, authentication, and encryption within the Internet network to isolate Internet communications so that unauthorized users cannot access or use certain data.

Accepted Answer

The description given in the question matches with the definition of a Virtual Private Network (VPN), which uses tunnels, authentication, and encryption within the Internet network to isolate and secure communications. Therefore, the correct choice is C, Virtual Private Network.

Question 9

This form of encryption uses a single encryption key that must be used to encrypt data and also to decode the encrypted data.

Accepted Answer

The description given is of symmetric encryption, which uses the same key to both encrypt and decrypt data.

Question 10

This security feature, used on wireless networks, is a password that is passed between the sending and receiving nodes of a wireless network.

Accepted Answer

The security feature described is the Service Set Identifier (SSID), which is essentially the name of the wireless network. The password that is passed between sending and receiving nodes is called the Pre-Shared Key (PSK) or the network passphrase, which is used to authenticate and encrypt data transmitted over the network. Secure Sockets Layer (SSL), Wired Provided Access (WPA), and Virtual Private Network (VPN) are all other security measures used for protecting data, but they are not directly related to the SSID and PSK of a wireless network.

Question 11

Which of the following URL's would indicate that the site is using browser software that encrypts data transferred to the website?

Accepted Answer

The "s" in "https" stands for "secure" and indicates that the website uses browser software that encrypts data transferred to the website.

Question 12

A small piece of program code that attaches to the computer's unused memory space and replicates itself until the system becomes overloaded and shuts down is called:

Accepted Answer

A worm is a type of malware that replicates itself to spread to other computers, often consuming system resources and causing the system to become overloaded and potentially shut down.

Question 13

The process of legitimately attempting to hack into an IT system to find whether weaknesses can be exploited by unauthorized hackers is referred to as:

Accepted Answer

Penetration testing, also known as ethical hacking, involves a controlled attempt to detect and exploit vulnerabilities in an IT system in order to identify weaknesses that could be exploited by unauthorized hackers. The goal is to identify vulnerabilities before they can be exploited by real attackers and to provide recommendations for improving the security of the system. Vulnerability assessment involves identifying potential vulnerabilities in an IT system, while intrusion detection involves detecting and responding to unauthorized access attempts. Worm detection involves detecting and mitigating the spread of computer worms.

Question 14

This method of monitoring exposure can involve either manual testing or automated software tools.The method can identify weaknesses before they become network break-ins and attempt to fix these weaknesses before they are exploited.

Accepted Answer

Vulnerability assessment is the method of identifying weaknesses or vulnerabilities in a system, network or application that can be exploited by attackers. This can be done manually or with automated software tools to scan for known vulnerabilities. The purpose of vulnerability assessment is to identify these weaknesses before they can be exploited by malicious actors and to attempt to fix them to reduce the risk of a successful attack. Intrusion detection is a different method of monitoring that focuses on identifying unauthorized access or activity on a network, while encryption examination is not a standard method of monitoring exposure, and penetration testing is a more proactive method of testing security defenses by simulating a real attack.

Question 15

Authorized employees may need to access the company IT system from locations outside the organization.These employees should connect to the IT system using this type of network.

Accepted Answer

Virtual private network (VPN) is the best choice because it allows authorized employees to securely access the company IT system from remote locations. VPNs use encryption to ensure that data transmitted over the network is secure and only accessible to authorized users. It also ensures that the network is private and information transmitted over the network cannot be intercepted by unauthorized parties.

Question 16

The function of this committee is to govern the overall development and operation of IT systems.

Accepted Answer

The IT Governance Committee is responsible for governing the overall development and operation of IT systems. The IT Budget Committee is responsible for the financial aspects of IT, the IT Audit Committee is responsible for reviewing and ensuring compliance with IT policies and procedures, and the IT Oversight Committee oversees IT projects and initiatives.

Question 17

This type of software should be used to avoid destruction of data programs and to maintain operation of the IT system.It continually scans the system for viruses and worms and either deletes or quarantines them.

Accepted Answer

Antivirus software is specifically designed to scan for and prevent viruses and other malicious software from damaging or disrupting computer systems. Penicillin software, infection software, and internet software do not have this function.

Question 18

Specific software tools that monitor data flow within a network and alert the IT staff to hacking attempts or other unauthorized access attempts is called:

Accepted Answer

Intrusion detection is the specific software tools that monitor data flow within a network and alert the IT staff to hacking attempts or other unauthorized access attempts. Security detection is too broad and may refer to a wide range of security tools and techniques. Vulnerability assessment and penetration testing are more proactive approaches to detecting vulnerabilities in a network rather than monitoring for actual intrusions.

Question 19

The functional responsibilities within an IT system must include the proper segregation of duties.Which of the following positions is not one of the duties that is to be segregated from the others?

Accepted Answer

The Chief Information Officer is a senior executive responsible for the overall IT strategy and management of an organization's technology functions. They are not directly involved in day-to-day operations or maintenance of the IT system and thus not a duty that needs to be segregated from the others. The other positions listed, such as systems analysts, database administrators, and operations personnel, have more operational roles within the IT system and their responsibilities need to be segregated to ensure proper checks and balances.

Question 20

Which of the following would normally not be found on the IT Governance Committee?

Accepted Answer

Computer input operators typically do not have a high-level decision-making role within an organization and would not typically be included on an IT Governance Committee. The other options listed (CEO, CIO, heads of business units) are all individuals who would typically be included on such a committee.

Quiz 4: Internal Controls and Risks in IT Systems

A self-replicating piece of program code that can attach itself to other programs and data and perform malicious actions is referred to as a(n) :