Question 1

Often a successful attack on an information system is due to poor system design or implementation. Once such a vulnerability is discovered, software developers quickly create and issue a to eliminate the problem.
A) patch
B) bot
C) rootkit
D) Trojan horse

Accepted Answer

A patch is specifically designed to fix vulnerabilities or issues in software or a system. It is often issued by software developers once a vulnerability has been identified and can be downloaded and installed by users to address the issue. Bot, rootkit, and Trojan horse are all types of malware and do not necessarily address system vulnerabilities.

Question 2

Hacktivism involves using illegal means to obtain trade secrets from competitors.

Accepted Answer

Hacktivism involves using hacking or cyber-attacks as a form of political activism or protest, typically targeting government or corporate entities, rather than obtaining trade secrets from competitors.

Question 3

Installation of a corporate firewall is the least common security precaution taken by businesses as it does not provide sufficient security.

Accepted Answer

This statement is false. Installation of a corporate firewall is in fact a common security precaution taken by businesses, as it provides a basic level of protection against unauthorized access and malicious attacks. However, it should be noted that a firewall alone may not provide sufficient security and should be complemented with other security measures such as intrusion detection systems (IDS), antivirus software, and regular security audits.

Question 4

Spammers can defeat the registration process of free email services by launching a coordinated attack that can sign up for thousands of untraceable email accounts.
A) distributed denial-of-service
B) bot
C) CAPTCHA
D) logic bomb

Accepted Answer

Spammers can defeat the registration process of free email services by launching a coordinated attack using bots, which can automate the creation of thousands of untraceable email accounts. Distributed denial-of-service attacks overwhelm servers with traffic, CAPTCHA is a security measure used to check if the user is human and a logic bomb is a malicious code that triggers a harmful event under specific conditions.

Question 5

The protects against unreasonable search and seizure.
A) Fourth Amendment
B) Fifth Amendment
C) Wiretap Act
D) Pen Registers and Trap and Trace Devices Statute

Accepted Answer

The Fourth Amendment protects against unreasonable search and seizure by the government.

Question 6

Discussing security attacks through public trials and the associated publicity has not only enormous potential costs in public relations but real monetary costs as well.

Accepted Answer

Public discussion of security attacks can damage a company's reputation and result in financial losses.

Question 7

In a security incident, the primary goal must be to regain control and limit damage, and not to attempt to monitor or catch an intruder.

Accepted Answer

The primary goal in a security incident is to protect the organization's assets and information by regaining control and limiting the damage as quickly as possible. Attempting to monitor or catch the intruder comes second to this goal.

Question 8

The code gets a rootkit installation started and can be easily activated by clicking on a link to a malicious Web site in an email or opening an infected PDF file.
A) logic bomb
B) zombie
C) dropper
D) loader

Accepted Answer

A dropper is a type of malware that is used to install other types of malware, such as rootkits, onto a victim's computer. It is often disguised as a legitimate program or file and can be activated through various means, such as clicking on a link in an email or opening an infected PDF file.

Question 9

is the abuse of email systems to send unsolicited email to large numbers of people.
A) A botnet
B) Spam
C) Logic bombing
D) A worm

Accepted Answer

Spam refers to unsolicited emails sent to a large number of people. A botnet is a network of infected computers used to carry out malicious tasks, a logic bombing is a type of cyber attack that involves inserting malicious code into software, and a worm is a self-replicating malware that spreads through networks.

Question 10

As a safeguard against attacks by malicious insiders, organizations must define employee roles so that a single employee can input as well as approve purchase orders.

Accepted Answer

It is actually recommended to separate the input and approval functions as a control against fraud and errors. Having one employee doing both can increase the risk of collusion and conflicts of interest. It is better to have different employees responsible for each function, with proper segregation of duties and oversight mechanisms in place.

Question 11

The is a federal law that provides a definition of the term cyberterrorism and under which young people primarily involved in what they consider to be minor computer pranks have been tried as cyberterrorists.
A) Stored Wire and Electronic Communications and Transactional Records Access Statutes
B) USA Patriot Act
C) Identity Theft and Assumption Deterrence Act
D) Computer Fraud and Abuse Act

Accepted Answer

The answer of The is a federal law that provides...

Question 12

The use of cloud computing and virtualization software has significantly reduced computer security concerns.

Accepted Answer

While cloud computing and virtualization software offer potential benefits, they also introduce new security challenges and concerns. These technologies can create new attack vectors and increase the potential impact of security breaches. It is important for organizations to implement appropriate security measures and best practices when using these technologies.

Question 13

The concept of recognizes that managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved.
A) competitive intelligence
B) reasonable assurance
C) separation of duties
D) risk assessment

Accepted Answer

Reasonable assurance is a principle in risk management that recognizes that it is not possible to completely eliminate all risk. Rather, managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved. This approach involves assessing the likelihood and potential impact of risks, and implementing controls that provide reasonable assurance that these risks are managed effectively. It is a balancing act, recognizing that too much control can be costly and inefficient, while too little can lead to unacceptable levels of risk.

Question 14

Competitive intelligence combines elements of law and computer science to identify, collect, examine, and preserve data so that it is admissible in a court of law.

Accepted Answer

Competitive intelligence combines elements of law and business strategy to analyze and organize information about competitors, markets, and industries, but does not typically involve preserving data for use in a court of law. Computer science may be involved in the collection and analysis of data, but not necessarily in a legal context.

Question 15

test the limitations of information systems out of intellectual curiosity to see whether they can gain access and how far they can go.
A) Industrial spies
B) Hackers
C) Cyberterrorists
D) Hacktivists

Accepted Answer

Hackers test the limitations of information systems out of intellectual curiosity to see whether they can gain access and how far they can go. Industrial spies seek to gain access to confidential information for economic gain, cyberterrorists aim to cause harm or destruction, and hacktivists target information systems as a form of political or social activism.

Question 16

An intrusion detection system monitors system and network resources and activities, and notifies the network security when it detects attempts to circumvent the security measures of a networked computer environment.

Accepted Answer

An intrusion detection system does indeed monitor system and network resources and activities, and alerts network security when suspicious behavior is detected.

Question 17

It is not unusual for a security audit to reveal that too many people have access to critical data and that many people have capabilities beyond those needed to perform their jobs.

Accepted Answer

It is common for security audits to uncover excessive access to sensitive information and unnecessary permissions granted to individuals in an organization. This is often due to poor access control policies and lax security practices.

Question 18

The fundamental problem with trying to detect a rootkit is that the operating system cannot be trusted to provide _____.
A) valid test results
B) correct system login ids
C) the correct date and time
D) sufficient memory for operations

Accepted Answer

A rootkit is a type of malware that can hide its presence from normal detection methods by modifying the operating system itself. This means that any test results provided by the operating system may be altered or faked by the rootkit, making it difficult to detect. Therefore, the fundamental problem with trying to detect a rootkit is that the operating system cannot be trusted to provide valid test results.

Question 19

Even when preventive measures are implemented, no organization is completely secure from a determined computer attack.

Accepted Answer

No preventive measures can guarantee 100% security against a determined computer attack. Attackers may find vulnerabilities that were not previously known or may find ways to bypass the implemented security measures. It is important for organizations to have a plan in place to respond to security incidents and to continuously monitor and update their security measures.

Question 20

The is a partnership between the Department of Homeland Security and the public and private sectors, established in 2003 to protect the nation's Internet infrastructure against cyberattacks.
A) Carnegie Mellon's Computer Response Team
B) U.S. Computer Emergency Readiness Team
C) The National Institute of Standards and Technology
D) The Science and Technology Directorate of Homeland Security

Accepted Answer

The U.S. Computer Emergency Readiness Team (US-CERT) is the partnership between the Department of Homeland Security and the public and private sectors, established in 2003 to protect the nation's Internet infrastructure against cyberattacks.

Quiz 3: Computer and Internet Crime

Often a successful attack on an information system is due to poor system design or implementation. Once such a vulnerability is discovered, software developers quickly create and issue a to eliminate the problem.

Hacktivism involves using illegal means to obtain trade secrets from competitors.

Installation of a corporate firewall is the least common security precaution taken by businesses as it does not provide sufficient security.

Spammers can defeat the registration process of free email services by launching a coordinated attack that can sign up for thousands of untraceable email accounts.

The protects against unreasonable search and seizure.

Discussing security attacks through public trials and the associated publicity has not only enormous potential costs in public relations but real monetary costs as well.

In a security incident, the primary goal must be to regain control and limit damage, and not to attempt to monitor or catch an intruder.

The code gets a rootkit installation started and can be easily activated by clicking on a link to a malicious Web site in an email or opening an infected PDF file.

is the abuse of email systems to send unsolicited email to large numbers of people.

As a safeguard against attacks by malicious insiders, organizations must define employee roles so that a single employee can input as well as approve purchase orders.

The is a federal law that provides a definition of the term cyberterrorism and under which young people primarily involved in what they consider to be minor computer pranks have been tried as cyberterrorists.

The use of cloud computing and virtualization software has significantly reduced computer security concerns.

The concept of recognizes that managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved.

Competitive intelligence combines elements of law and computer science to identify, collect, examine, and preserve data so that it is admissible in a court of law.

test the limitations of information systems out of intellectual curiosity to see whether they can gain access and how far they can go.

An intrusion detection system monitors system and network resources and activities, and notifies the network security when it detects attempts to circumvent the security measures of a networked computer environment.

It is not unusual for a security audit to reveal that too many people have access to critical data and that many people have capabilities beyond those needed to perform their jobs.

The fundamental problem with trying to detect a rootkit is that the operating system cannot be trusted to provide _____.

Even when preventive measures are implemented, no organization is completely secure from a determined computer attack.

The is a partnership between the Department of Homeland Security and the public and private sectors, established in 2003 to protect the nation's Internet infrastructure against cyberattacks.