Deck 12: Information Security Management

Question 1

Which of the following is an example of a data safeguard?

A)application design
B)dissemination of information
C)physical security
D)malware protection

Answer 1

C

Question 2

Which of the following is a synonym for phishing?

A)drive-by sniffing
B)e-mail spoofing
C)IP spoofing
D)system hacking

Answer 2

B

Question 3

A ________ pretends to be a legitimate company and sends emails requesting confidential data.

A)hacker
B)phisher
C)drive-by sniffer
D)sniffer

Answer 3

B

Question 4

A password ________ a user.

A)authenticates
B)identifies
C)conceals
D)encrypts

Question 5

Mark recently received an email from what appeared to be a legitimate company,asking him to update and verify his credit card details.Unknowingly,he obliged and later realized that the information had been misused.Mark is a victim of ________.

A)hacking
B)phishing
C)pretexting
D)sniffing

Question 6

________ occurs when a person gains unauthorized access to a computer system.

A)Usurpation
B)Spoofing
C)Hacking
D)Phishing

Question 7

________ occur when bogus services flood a Web server.

A)Spoofing attacks
B)Hacking attacks
C)Phishing attacks
D)DOS attacks

Question 8

A problem in a customer billing system that occurs due to errors made during software installation is a case of ________.

A)faulty service resulting from human error
B)distributed denial of service resulting from malicious activity
C)faulty service resulting from malicious activity
D)distributed denial of service resulting from human error

Question 9

________ is a technique for intercepting computer communications.

A)Spoofing
B)Hacking
C)Pretexting
D)Sniffing

Question 10

Which of the following is an example of a security threat resulting from malicious human activity?

A)an employee who misunderstands operating procedures
B)an employee who accidentally deletes customer records
C)an employee who inadvertently installs an old database on top of the current one
D)an employee who intentionally destroys data or other system components

Question 11

A person calls the Stark residence and pretends to represent a credit card company.He asks Mrs.Stark to confirm her credit card number.This is an example of ________.

A)hacking
B)phishing
C)pretexting
D)sniffing

Question 12

An employee carelessly releases proprietary data to the media.This is a case of ________.

A)loss of infrastructure resulting from human error
B)unauthorized data disclosure resulting from human error
C)loss of infrastructure resulting from malicious activity
D)unauthorized data disclosure resulting from malicious activity

Question 13

A user name ________ a user.

A)authenticates
B)identifies
C)conceals
D)encrypts

Question 14

Which of the following is a technical safeguard against security threats?

A)passwords
B)backup and recovery
C)compliance
D)identification and authorization

Question 15

Users of smart cards are required to enter a ________ to be authenticated.

A)PIN
B)password
C)biometric detail
D)key

Question 16

Which of the following is a human safeguard against security threats?

A)backup
B)firewalls
C)physical security
D)procedure design

Question 17

Which of the following is considered a personal security safeguard?

A)create backups of cookies and temporary files
B)use https at trusted,reputable vendors
C)use a single valid password for all accounts
D)send all valuable data only via email or IM

Question 18

________ simply take computers with wireless connections through an area and search for unprotected wireless networks.

A)Drive-by sniffers
B)Spoofers
C)Hackers
D)Phishers

Question 19

Some unauthorized programs are able to ________ legitimate systems and substitute their own processing.

A)usurp
B)spoof
C)hack
D)flood

Question 20

A(n)________ is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.

A)intrusion detection system
B)account administration system
C)key escrow
D)malware definition

Question 21

What is the similarity between adware and spyware?

A)Both masquerade as useful programs.
B)Both are specifically programmed to spread.
C)Both are installed without the user's permission.
D)Both are used to steal data.

Question 22

Organizations should protect sensitive data by storing it in ________ form.

A)digital
B)standardized
C)encrypted
D)authenticated

Question 23

A(n)________ card has a microchip on it that is loaded with identifying data.

A)USB
B)biometric
C)smart
D)encryption

Question 24

________ is the process of transforming clear text into coded,unintelligible text for secure storage or communication.

A)Usurpation
B)Authentication
C)Standardization
D)Encryption

Question 25

________ are the patterns that should be downloaded and updated frequently.

A)Data safeguards
B)Patches
C)Antivirus scans
D)Malware definitions

Question 26

Which of the following is true regarding an incident-response plan?

A)The plan should provide decentralized reporting of all security incidents.
B)The plan should require minimal training on the part of employees.
C)The plan should identify critical personnel and their off-hours contact information.
D)The plan should be simple enough to ensure a fast response with limited practice.

Question 27

________ use(s)personal physical characteristics such as fingerprints,facial features,and retinal scans to verify users.

A)Passwords
B)Smart cards
C)Biometric authentication
D)Personal identification numbers

Question 28

Typically,a help-desk information system has answers to questions that only a true user would know,such as the user's birthplace,mother's maiden name,or last four digits of an important account number.This information ________.

A)allows help-desk representatives to create new passwords for users
B)reduces the strength of the security system
C)protects the anonymity of a user
D)helps authenticate a user

Question 29

Enforcement of security procedures and policies consists of three interdependent factors: ________.

A)centralized reporting,preparation,and practice
B)account administration,systems procedures,and security monitoring
C)separation of duties,least privilege,and position sensitivity
D)responsibility,accountability,and compliance

Question 30

The program code that causes unwanted activity is called the ________.

A)key escrow
B)metadata
C)widget
D)payload

Question 31

Which of the following are malware masquerading as useful programs?

A)macro viruses
B)Trojan horses
C)worms
D)payloads

Question 32

The broadest definition of ________ includes viruses,worms,Trojan horses,spyware,and adware.

A)malware
B)metadata
C)software
D)widgets

Question 33

A(n)________ sits outside the organizational network and is the first device that Internet traffic encounters.

A)internal firewall
B)perimeter firewall
C)packet-filtering firewall
D)malware firewall

Question 34

Which of the following statements is true regarding position sensitivity?

A)It is a type of data safeguard.
B)It enables security personnel to prioritize their activities.
C)It is documented only for high-sensitivity positions.
D)It applies to new employees only.

Question 35

Activity log analysis is an important ________ function.

A)account administration
B)security monitoring
C)backup
D)data administration

Question 36

Every organization should have a(n)________ as part of the security program,which should include how employees are to react to security problems,whom they should contact,the reports they should make,and steps they can take to reduce further loss.

A)key escrow
B)smart card
C)human safeguard plan
D)incident-response plan

Question 37

________ firewalls can prohibit outsiders from starting a session with any user behind the firewall.

A)Perimeter
B)Internal
C)Packet-filtering
D)Malware

Question 38

________ is an example of a data safeguard against security threats.

A)Application design
B)Backup and recovery
C)Accountability
D)Procedure design

Question 39

In terms of password management,when an account is created,users should ________.

A)create two passwords and switch back and forth between those two
B)immediately change the password they are given to a password of their own
C)maintain the same password they are given for all future authentication purposes
D)ensure that they do not change their passwords frequently,thereby reducing the risk of password loss

Question 40

Because encryption keys can be lost or destroyed,a copy of the key should be stored with a trusted party.This safety procedure is sometimes called ________.

A)key escrow
B)white hat
C)key encryption
D)biometric authentication

Question 41

Incorrectly increasing a customer's discount is an example of incorrect data modification.

Question 42

Viruses,worms,and Trojan horses are types of firewalls.

Question 43

Technical safeguards involve just the software components of an information system.

Question 44

Packet-filtering firewalls examine each part of a message and determine whether to let that part pass.

Question 45

In a brute force attack,the password cracker tries every possible combination of characters.

Question 46

A criticism against biometric authentication is that it provides weak authentication.

Question 47

An Advanced Persistent Threat (APT)is a sophisticated,possibly long-running,computer hack that is perpetrated by large,well-funded organizations like governments.

Question 48

Malware protection is an example of a technical safeguard.

Question 49

Senior management has two critical security functions: security policy and risk management.

Question 50

Pretexting occurs when someone deceives by pretending to be someone else.

Question 51

Sniffing is usually initiated via email.

Question 52

Denial-of-service attacks are caused by human error,not malicious intent.

Question 53

Smart cards are convenient and easy to use since they don't require a PIN number for authentication.

Question 54

Internal firewalls sit outside the organizational network.

Question 55

Creating backup copies of database contents is a technical safeguard.

Question 56

Perimeter firewalls are the simplest type of firewall.

Question 57

Most secure communication over the Internet uses a protocol called HTTP.

Question 58

System errors are not caused by human error.

Question 59

Technical safeguards include passwords and encryption.

Question 60

The existence of spyware is generally unknown to the user.

Question 61

In the context of human safeguards against security threats,the security sensitivity for each position should be documented.

Question 62

Discuss in brief the pros and cons of biometric authentication.

Question 63

Backup procedures for system users include backing up Web site resources,databases,administrative data,account and password data,and other data.

Question 64

Distinguish between phishing,spoofing,and sniffing.

Question 65

List some important malware safeguards.

Question 66

Once a backup of database contents is made,it is safe to assume that the database is protected.

Question 67

What are firewalls? What types of firewalls are commonly used?

Question 68

Describe an incident-response plan.

Question 69

Most spyware is benign in that it does not perform malicious acts or steal data.

Question 70

Explain account management.

Question 71

What is the difference between adware and spyware?

Question 72

How is a Trojan horse different from a worm?

Question 73

Explain denial of service (DOS)in information management.

Question 74

How can data safeguards protect against security threats?

Question 75

What should an organization do when a security breach occurs in its information systems?

Question 76

Differentiate between symmetric and asymmetric encryption.

Question 77

Every organization must have an incident-response plan that allows for decentralized reporting of all security incidents.

Question 78

The existence of accounts that are no longer necessary do not pose a serious security threat.

Question 79

Explain how defining positions in an organization can safeguard against security threats.

Question 80

What are the three interdependent factors involved in the enforcement of security policies and procedures?