Question 1

International, federal, and state laws and industry regulations mandate that organizations invest in cybersecurity defenses, audits, and internal controls to secure confidential data and defend against fraud and unauthorized transactions, such as money laundering.

Accepted Answer

International, federal, and state laws and industry regulations require organizations to invest in cybersecurity defenses, audits, and internal controls to protect sensitive data and prevent fraudulent activities like money laundering.

Question 2

According to a Forrester Research, Inc. report, companies are increasingly prohibiting employees from using their personal mobile devices for work related purposes because of security and compliance challenges.

Accepted Answer

Many companies are actually implementing BYOD (Bring Your Own Device) policies that allow employees to use their personal mobile devices for work-related purposes, with measures in place to address security and compliance challenges.

Question 3

Despite the recent increase in popularity of mobile devices, PCs continue to outnumber mobile devices in terms of number of units sold.

Accepted Answer

Mobile devices, including smartphones and tablets, have significantly outsold PCs for several years due to their convenience, portability, and the increasing reliance on mobile technology for both personal and professional use.

Question 4

Implementing security programs raises many ethical issues. Which of the following is not an ethical issue associated with network security identified in your textbook?

Accepted Answer

The answer of Implementing security programs raises many ethical issues....

Question 5

Many smartphones are not being managed as secure devices, with fewer than one in five adding anti-malware and only half using data encryption. This can create security problems for organizations.

Accepted Answer

The statement mentions that only fewer than one in five smartphones have anti-malware and only half use data encryption, which implies that many smartphones are not being managed as secure devices. This can pose security risks for organizations.

Question 6

An audit is an important part of any control system. Which of the following is not a question that would typically be asked as part of an information systems audit?

Accepted Answer

While the cost and ROI of controls may be a consideration for management, it is not a typical question asked as part of an information systems audit. The focus of an audit is on evaluating the effectiveness and implementation of controls, as well as identifying any areas lacking in sufficient controls or procedures for reporting and corrective actions.

Question 7

Symptoms of fraud that can be detected by internal controls include all of the following except:

Accepted Answer

Large increase in network traffic is not necessarily a symptom of fraud that can be detected by internal controls. The other options, such as missing documents, delayed bank deposits, and employees who do not take vacations or go out of their way to work overtime, are typical red flags that can indicate fraudulent activity.

Question 8

An estimated __________ of companies that suffer a significant data loss often go out of business within five years.

Accepted Answer

The answer of An estimated __________ of companies that suffer...

Question 9

When dealing with consumer-facing applications, such as online banking and e-commerce, strong authentication must be balanced with __________.

Accepted Answer

While strong authentication is crucial for security, it can also create inconvenience for consumers if the process is too complex or time-consuming. Balancing strong authentication with convenience is necessary to ensure a positive user experience and encourage adoption of the application.

Question 10

When conducting a risk management analysis, each of the following factors is used to calculate expected loss except:

Accepted Answer

The probability of an attack remaining undetected is not directly used to calculate expected loss. Expected loss is typically calculated using the probability of an attack occurring, the probability of the attack being successful, and the potential loss if the attack is successful. The detection of an attack is more related to response and mitigation strategies rather than the calculation of expected loss.

Question 11

Most smartphones come equipped with anti-malware and data encryption apps which make them secure devices for use on enterprise workplace) networks and for handling work-related data.

Accepted Answer

While some smartphones may have pre-installed security features, these are not always sufficient for enterprise-level security. Additional security measures such as mobile device management (MDM) software and strong password policies may be necessary to ensure the protection of sensitive work-related data.

Question 12

Cost savings associated with allowing employees to use their own mobile devices can be wiped out by increased IT costs-mostly for IT personnel who struggle to maintain control over new and existing mobile devices.

Accepted Answer

Allowing employees to use their own mobile devices (known as BYOD) can lead to various IT challenges such as managing security, configuring devices, and providing technical support. These challenges can create a significant workload for IT personnel, leading to increased IT costs that can offset any potential cost savings from BYOD.

Question 13

All of the following describe The Sarbanes-Oxley Act SOX) except:

Accepted Answer

The statement that the Sarbanes-Oxley Act has been adopted by all countries in North America and the European Union is not accurate. SOX is a US law and does not have treaty agreements with other countries requiring adoption.

Question 14

Wireless networks are more difficult to protect than wired ones. Which of the following is not a control or practice recommended by your textbook for protecting wireless networks?

Accepted Answer

The recommendation to prohibit the use of social media and cloud-based access points is not a control or practice recommended by the textbook for protecting wireless networks. Instead, the textbook recommends implementing controls such as ensuring authorized configurations and security profiles, using enterprise management tools for APs, and using WIDS to detect threats.

Question 15

People wanting to use their mobile devices at work has led to the practice of "bring your own device BYOD)"

Accepted Answer

BYOD is a practice where employees bring and use their personal mobile devices for work purposes. It has become popular due to the increasing reliance on mobile devices for work and the desire for employees to use their own devices rather than being provided with a company-issued device.

Question 16

People wanting to use their mobile devices at work is part of a growing trend called Dual-Use Mobile Equipment.

Accepted Answer

The trend of people wanting to use their mobile devices at work is commonly referred to as Bring Your Own Device (BYOD), not Dual-Use Mobile Equipment.

Question 17

__________ is the chain of events linking the business continuity plan to protection and to recovery.

Accepted Answer

Disaster recovery involves the process of recovering and restoring normal operations following a disruptive event. This includes linking the business continuity plan, which outlines the steps necessary to maintain critical operations during and after a disaster, to protection measures that prevent the event from occurring or mitigate its impact, and ultimately to the recovery process. Auditing, data recovery, and internal control are related concepts but do not directly involve the chain of events linking the business continuity plan to protection and recovery.

Question 18

Forrester Research, Inc. estimates that a majority of companies had begun allowing employees to use their own mobile devices for some aspects of their work by 2012.

Accepted Answer

According to the statement, Forrester Research estimates that a majority of companies had begun allowing employees to use their own mobile devices for some aspects of their work by 2012. Therefore, the statement is true and the answer is A.

Question 19

Authentication methods based on user name and password plus other information such as biometrics, are called _________________ authentication.

Accepted Answer

Two-factor or multifactor authentication provides an additional layer of security by requiring a second form of authentication, such as a biometric, in addition to the traditional username and password. This helps to prevent unauthorized access even if the username and password are compromised.

Question 20

The internal control environment is the work atmosphere that a company sets for its employees and is designed to achieve all of the following except _________________.

Accepted Answer

The internal control environment is designed to achieve the reliability of financial reporting, compliance with laws, regulations, and policies. It also helps in ensuring the effectiveness and efficiency of operations and promoting enhanced decision making. Therefore, option B is not a correct answer as it actually does promote enhanced decision making.

Quiz 5: Cybersecurity, Compliance, and Business Continuity