Question 1

Firewalls and intrusion detection systems are placed throughout networks to monitor and control traffic into and out of a network.

Accepted Answer

Firewalls and intrusion detection systems are security measures that are used to monitor and control traffic entering and exiting a network, helping to prevent unauthorized access and potential security threats.

Question 2

Symptoms of fraud that can be detected by internal controls include all of the following except:
A)missing documents.
B)delayed bank deposits.
C)employees who do not take vacations or go out of their way to work overtime.
D)large increase in network traffic.

Accepted Answer

The other options listed are all symptoms of fraud that can be detected by internal controls. A missing document could indicate that someone is trying to cover up their tracks, delayed bank deposits could signify that funds are being held back for personal gain, and employees who do not take vacations or work overtime excessively may be trying to hide fraudulent behavior. However, a large increase in network traffic may not necessarily be a symptom of fraud and would need to be investigated further to determine if it is related to fraudulent activity.

Question 3

According to a Workplace E-Mail and Instant Messaging Survey of 840 U.S.companies,approximately__________ have had employee e-mail or text messages subpoenaed as part of a lawsuit or regulatory investigation.
A)5%
B)10%
C)20%
D)33%

Accepted Answer

Approximately 20% of U.S. companies have had employee e-mail or text messages subpoenaed as part of a lawsuit or regulatory investigation, according to the survey.

Question 4

Despite the challenges organizations face trying to protect against threats from employees,insider incidents can be minimized with a layered defense strategy consisting of security procedures,acceptable use policies,and technology controls.

Accepted Answer

A layered defense strategy that includes security procedures, acceptable use policies, and technology controls can help minimize insider incidents in organizations.

Question 5

There has been a steep increase in malware because of the availability of free,easy to use,powerful toolkits that even novice cyber criminals can use to develop malware.

Accepted Answer

The availability of free, easy to use, powerful toolkits has made it easier for novice cyber criminals to develop malware, leading to a steep increase in malware.

Question 6

Today,infosec is mostly a technology issue assigned to the IT department.Incidents are handled on a case-by-case "cleanup" basis rather than by taking a preemptive approach to protect ahead of the threats.

Accepted Answer

Information security (infosec) has evolved to be a comprehensive organizational issue, involving proactive strategies and collaboration across departments, not just a reactive IT responsibility.

Question 7

The Sarbanes-Oxley Act (SOX):
A)is an antifraud law.
B)forces more accurate business reporting and disclosure of GAAP (generally accepted accounting principles)violations.
C)makes it necessary to find and root out fraud.
D)All of the above

Accepted Answer

The Sarbanes-Oxley Act (SOX) is an antifraud law that forces more accurate business reporting and disclosure of GAAP (generally accepted accounting principles) violations, as well as making it necessary to find and root out fraud. Therefore, all of the above options are correct.

Question 8

A majority of data breaches involve some sort of insider error or action either intentional or unintentional.That is,the greatest infosec risks are employees and managers.

Accepted Answer

Studies show that a large percentage of data breaches are caused by employee mistakes, negligence, or malicious actions. Therefore, the greatest information security risks are often internal, rather than external threats.

Question 9

IT security is so integral to business objectives that it needs to be treated as a stand-alone function.

Accepted Answer

IT security should be integrated into all business processes and objectives, rather than being isolated, to ensure comprehensive protection and alignment with overall business goals.

Question 10

A fiduciary responsibility is both a legal and an ethical obligation.

Accepted Answer

A fiduciary responsibility is both a legal obligation, as it is established by law, and an ethical obligation, as it involves a duty of care towards another party's interests.

Question 11

Sarbanes-Oxley Act is an antifraud law.It forces more accurate business reporting and disclosure of GAAP (generally accepted accounting principles)violations,thus making it necessary to find and root out fraud.

Accepted Answer

The statement accurately describes the purpose of the Sarbanes-Oxley Act.

Question 12

__________ is the chain of events linking the business continuity plan to protection and to recovery.
A)Disaster recovery
B)Auditing
C)Date recovery
D)Internal control

Accepted Answer

The chain of events linking the business continuity plan (BCP) to protection and recovery is known as the disaster recovery process. This involves actions such as identifying potential disasters, implementing measures to prevent or minimize damage, and creating a plan for recovery in case of a disaster. Auditing, data recovery, and internal control are related concepts but do not specifically refer to the process of connecting BCP to protection and recovery.

Question 13

An estimated __________ of companies that suffer a significant data loss often go out of business within five years.
A)23%
B)43%
C)73%
D)93%

Accepted Answer

According to a study by the National Archives and Records Administration, 93% of companies that lost their data for 10 or more days filed for bankruptcy within one year, and 50% filed for bankruptcy immediately. Therefore, option D is the correct answer.

Question 14

Types of unintentional threats that organizations must defend against as part of their IT security measures are human errors,sabotage,environmental hazards,and computer system failures.

Accepted Answer

Sabotage is not an unintentional threat; it is a deliberate act. Unintentional threats include human errors, environmental hazards, and computer system failures.

Question 15

The theft of confidential account data from HSBC Private Bank in Switzerland in 2007 had been done by hackers because of inadequate security controls.

Accepted Answer

The theft was carried out by a former employee, Hervé Falciani, who leaked the data, not by external hackers exploiting inadequate security controls.

Question 16

Newly released viruses with unidentified signatures or that are hidden in an e-mail attachment are blocked by firewalls and antivirus software from entering a company's network.

Accepted Answer

Firewalls and antivirus software may not always block newly released viruses with unidentified signatures, as they rely on known signatures and patterns to detect threats. Advanced threats may require additional security measures like behavior analysis or machine learning.

Question 17

The infosec defense strategies and controls depend on what needs to be protected and the cost-benefit analysis.That is,companies should neither under-invest nor over-invest.

Accepted Answer

The statement is true as it is crucial for companies to weigh the value of the asset they need to protect against the cost of investing in security measures. Over-investing can result in unnecessary expenses, while under-investing can lead to significant security breaches.

Question 18

Corporate and government secrets are currently being stolen by a serious threat called advanced persistent threat (APT),which are designed for long-term espionage.Once installed on a network,ATPs transmit copies of documents,such as Microsoft Office files and PDFs,in stealth mode.

Accepted Answer

APTs are designed for long-term espionage and once installed, they transmit copies of documents, including Microsoft Office files and PDFs, in stealth mode. Therefore, the statement is true.

Question 19

In general,risk management is expensive to the organization,but convenient for users.

Accepted Answer

Risk management may require additional resources and investments, which can be costly for the organization. However, it is important for the security and protection of the organization's assets and operations, as well as for the safety and convenience of its users. Therefore, risk management can be inconvenient for users as well, as they may have to follow certain policies or procedures to ensure security and avoid potential risks.

Question 20

Financial institutions,data processing firms,and retail businesses do not have to notify potential victims or reveal data breaches in which customers' personal financial information may have been stolen,lost,or compromised.

Accepted Answer

Under various state and federal laws, financial institutions, data processing firms, and retail businesses are generally required to notify potential victims and reveal data breaches in which customers' personal financial information may have been stolen, lost, or compromised. Failure to do so can result in penalties and legal action.

Quiz 5: IT Security, crime, compliance, and Continuity