Deck 10: Information Systems Security

Question 1

Human error cannot cause unauthorized data disclosure.

Answer 1

False

Question 2

A ________ is a person or an organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge.

A) target
B) vulnerability
C) threat
D) key escrow
E) cipher

Answer 2

C

Question 3

Spoofing occurs when someone pretends to be someone else.

Answer 3

True

Question 4

Sally has been working really hard lately and asks her manager for a raise. Her manager tells her that she is already the highest paid employee on the floor. Sally doesn't believe her manager, and illegally accesses the employee database to look at salary data. Sally's act can be termed as ________.

A) pretexting
B) phishing
C) hacking
D) spoofing
E) skimming

Question 5

Email spoofing is a synonym for ________.

A) hacking
B) phishing
C) usurping
D) sniffing
E) baiting

Question 6

________ present(s) the largest risk for an organization's infrastructure loss.

A) Employees' dissatisfaction
B) Natural disasters
C) Hackers
D) Competitors
E) Electromagnetic pulse weapons

Question 7

Which of the following usually happens in a malicious denial-of-service attack?

A) A hacker monitors and intercepts wireless traffic at will.
B) A hacker floods a Web server with many millions of bogus service requests.
C) An intruder uses another site's IP address to masquerade as that other site.
D) A phisher pretends to be a legitimate company and requests confidential data.
E) A hacker identifies vulnerabilities in network hosts.

Question 8

Which of the following is most likely to be a result of hacking?

A) certain Web sites being censored for hurting sentiments
B) small amounts of spam in a user's inbox
C) an unauthorized transaction from a user's credit card
D) pop-up ads appearing frequently
E) slowing of network speed

Question 9

Which of the following is considered a computer crime?

A) accidental deletion of important records
B) poorly written programs resulting in information loss
C) loss of data as a result of flooding
D) hacking of information systems
E) failure to correctly back up customer data

Question 10

Which of the following is a sniffing technique?

A) IP spoofing
B) caches
C) denial of service
D) adware
E) port scanner

Question 11

In the context of security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A) unauthorized data disclosure
B) incorrect data modification
C) faulty services
D) loss of infrastructure
E) SQL injection

Question 12

________ take computers with wireless connections through an area and search for unprotected wireless networks, and then monitor and intercept wireless traffic on unsecured wireless networks.

A) Keyloggers
B) Pretexters
C) Wardrivers
D) Phishers
E) Tibutors

Question 13

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A) Unauthorized data disclosure
B) Incorrect data modification
C) Denial of service
D) Loss of infrastructure
E) Unauthorized data encryption

Question 14

Stan loves collecting stamps. He receives an email that appears to come from a well-known stamp auction site asking him to reset his username and password. He clicks on the link and it takes him to a site that looks similar to the auction site, but the Web address is "scrambled" and unreadable. He emails the customer service desk at the auction site and discovers they never sent the email. This scenario is an example of attempted ________.

A) hacking
B) phishing
C) sniffing
D) wardriving
E) stack smashing

Question 15

________ is a sophisticated, possibly long-running computer hack that is perpetrated by large, well-funded organizations such as governments.

A) State sponsored threat
B) Lengthy collective
C) Poisoned pool
D) Hacker collective
E) Advanced persistent threat

Question 16

Which of the following is considered a threat caused by human error?

A) an employee inadvertently installing an old database on top of the current one
B) an employee intentionally destroying data and system components
C) a virus and worm writer infecting computer systems
D) a hacker breaking into a system to steal for financial gain
E) a tsunami floods a data center causing total data loss

Question 17

A person claiming to be from central IT called Chris and asked him to participate in a password reset audit. The person had Chris change his password to the word "123456", and then again to a secret passphrase only Chris knew. Later that day Chris noticed odd system behavior, and then the system crashed. Chris was a victim of ________.

A) hacking
B) usurping
C) sniffing
D) pretexting
E) appropriating

Question 18

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own, unauthorized ones that shut down legitimate applications.

A) Encryption
B) Spoofing
C) Phishing
D) Usurpation
E) Spear Phishing

Question 19

________ is a technique for intercepting computer communications through a physical connection to a network or without a physical connection in the case of wireless networks.

A) Spoofing
B) Phishing
C) Sniffing
D) Pretexting
E) Port scanning

Question 20

A computer crime is committed if an employee inadvertently installs an old database on top of the current one.

Question 21

Most emails and IMs are protected by encryption.

Question 22

Email spoofing is a synonym for phishing.

Question 23

Which of the following is a personal security safeguard?

A) sending valuable data only via email or IM
B) using single password for all the sites
C) removing high-value assets from computers
D) storing browsing history, temporary files, and cookies
E) disabling operating system updates

Question 24

One of the personal security safeguards is to use https at trusted, reputable vendors.

Question 25

IP spoofing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 26

Cookies enable an individual to access Web sites without having to sign in every time.

Question 27

Which of the following statements is True about losses due to computer security threats?

A) Surveys on computer crimes provide accurate results since they use standard parameters to measure and tally computer crime costs.
B) Surveys suggest that some organizations do not report all their computer crime losses, and some will not report such losses at all.
C) Losses due to natural disasters can be measured accurately.
D) Losses due to human error are insignificant.
E) Losses due to hacking may be overstated.

Question 28

Faulty service excludes problems that result due to incorrect data modification.

Question 29

________ are small files that enables a browser to access Web sites without having to sign in every time.

A) Cookies
B) Botnets
C) Payloads
D) Public keys
E) Web bugs

Question 30

Define threat, vulnerability, safeguard, and target.

Question 31

Describe the magnitude of security problems in the present day.

Question 32

Nonword passwords are vulnerable to a ________ attack in which the password cracker tries every possible combination of characters.

A) denial-of-service
B) sniffing
C) brute force
D) phishing
E) nuanced

Question 33

What is meant by denial of service?

Question 34

Phishing is a technique for obtaining unauthorized data that uses pretexting via email.

Question 35

Define pretexting, phishing, spoofing, and sniffing.

Question 36

Natural disasters present the largest risk for infrastructure loss.

Question 37

Removing and disabling ________ that may contain sensitive security data presents an excellent example of the trade-off between improved security and cost.

A) bookmarks
B) pop-ups
C) cookies
D) toolbars
E) key loggers

Question 38

The losses due to human error are minimal, and hence, organizations tend to ignore these losses.

Question 39

What are the three general sources of security threats?

Question 40

A denial-of-service attack is launched when a hacker takes computers with wireless connections through an area and searches for unprotected wireless networks.

Question 41

Which of the following statements is True about the Secure Sockets Layer (SSL)?

A) It uses asymmetric encryption exclusively.
B) It is used to send sensitive data such as credit card numbers.
C) It uses one set of encryption keys for multiple sessions.
D) It is a stronger version of https.
E) It is used in wireless encryption suites.

Question 42

A(n) ________ has a microchip in it to hold data.

A) ATM card
B) smart card
C) cookie
D) key escrow
E) dropper

Question 43

A ________ examines each part of a message and determines whether to let that part pass.

A) packet-filtering firewall
B) private key
C) mail server
D) wardriver
E) nmap

Question 44

In the context of malware protection, the program code that causes the unwanted actions is called the ________.

A) payload
B) kernel
C) bot herder
D) key escrow
E) bundler

Question 45

A ________ is a string of bits used to encrypt data.

A) key
B) honeypot
C) cookie
D) cache
E) cipher

Question 46

Layla is purchasing a new laptop from an online vendor. Which of the following will be displayed in the address bar of his browser that will let her know that the online retailer is using the Secure Sockets Layer (SSL) protocol?

A) ftp
B) www
C) https
D) )com
E) smtp

Question 47

List various personal security safeguards.

Question 48

Which of the following is classified as a technical safeguard?

A) cookies
B) firewalls
C) key escrow
D) passwords
E) training

Question 49

In information security, which of the following is True about managing risk?

A) All organizations except financial institutions should invest heavily in security safeguards.
B) Organizations should implement safeguards that balance the trade-off between risk and cost.
C) Passwords are classified as technical safeguards.
D) Physical security is classified as human safeguards.
E) All risks should be eliminated.

Question 50

With ________, the sender and receiver transmit a message using different keys.

A) asymmetric encryption
B) a block cipher
C) symmetric encryption
D) a stream cipher
E) a Caesar shift

Question 51

What is the basic information that a security policy must stipulate?

Question 52

Packet-filtering firewalls ________.

A) can filter both inbound and outbound traffic
B) examine the destination address but not the source address
C) are the most complex type of firewall
D) seldom examine the data or the addresses of the message
E) can examine the contents of VPN packets

Question 53

Which of the following is a critical security function that should be addressed by the senior management of an organization?

A) sharing the private key with all systems connected to the network
B) creating IS security software programs
C) establishing the security policy
D) avoiding the use of perimeter firewalls
E) reducing internal systems auditing

Question 54

Which of the following is used for biometric authentication?

A) smart cards
B) facial features
C) passwords
D) personal identification numbers
E) MD5 hashes

Question 55

________ is a broad category of software that includes viruses, spyware, and adware.

A) Malware
B) Cookie
C) Firewall
D) Spam
E) Crackers

Question 56

In asymmetric encryption, each site has a ________ for encoding messages.

A) botnet
B) private key
C) public key
D) cookie
E) cipher

Question 57

Secure Sockets Layer is also known as ________.

A) Advanced Persistent Threat Layer
B) Transport Layer Security
C) Presentation Interface Layer
D) Network Interface Layer Security
E) Media Access Security

Question 58

Which of the following was passed to give individuals the right to access their own health data created by doctors and other healthcare providers?

A) the Privacy Act of 1974
B) the Sarbanes-Oxley Act
C) the HIPAA of 1996
D) the Gramm-Leach-Bliley Act
E) the Computer Privacy Act of 2014

Question 59

Which of the following statements is True about biometric identification?

A) It involves the use of a personal identification number (PIN) for authentication.
B) It provides weak authentication.
C) It is a relatively inexpensive mode of authentication.
D) It often faces resistance from users for its invasive nature.
E) It will decline in usage in the future.

Question 60

Users of smart cards are required to enter a ________ to be authenticated.

A) Social Security number
B) public key
C) personal identification number
D) private key
E) passphrase

Question 61

Sarah was browsing an online shopping site when a program got downloaded onto her system without her knowledge. The next day she found that her search engine had been changed, and she received pop-up advertisements of the shopping site she had visited the previous day. The program on Sarah's system is ________.

A) a cookie
B) adware
C) a payload
D) a Trojan horse
E) a stack smasher

Question 62

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 63

Define encryption and explain symmetric and asymmetric encryption for computer systems.

Question 64

________ refers to an organization-wide function that is in charge of developing data policies and enforcing data standards.

A) Data administration
B) Authentication
C) Usurpation
D) Data encryption
E) Access Control

Question 65

Describe the difference between a perimeter firewall and an internal firewall?

Question 66

Technical safeguards involve the hardware and software components of an information system.

Question 67

Biometric authentication uses physical characteristics such as retinal scans to authenticate users.

Question 68

Which of the following statements is True about data administration?

A) It is a line function to the chief information officer.
B) It merely involves developing data policies.
C) It applies to individuals and not to the entire organization.
D) It is involved in establishing data safeguards.
E) It defines standards for the use of cryptographic suites.

Question 69

Describe six malware safeguards.

Question 70

What are spyware and adware programs?

Question 71

Improper data disclosure and data damage and loss are possible consequences of an SQL injection attack.

Question 72

Secure Sockets Layer (SSL) is a protocol that is restricted to asymmetric encryption.

Question 73

What is a virus? Differentiate between Trojan horses and worms.

Question 74

A ________ is a type of virus that self-propagates using the Internet or other computer network.

A) worm
B) sniffer
C) Trojan horse
D) phisher
E) mole

Question 75

________ is a function pertaining to a particular database that develops procedures and practices to control and protect the database.

A) Data encryption
B) Database administration
C) Data authentication
D) Database normalization
E) Data access control

Question 76

________ are viruses that masquerade as useful programs or files.

A) Adware programs
B) Spyware programs
C) Trojan horses
D) Worms
E) Hydras

Question 77

Which of the following is likely to be accepted by a poorly designed application thereby leading to improper disclosure of data?

A) public key
B) asymmetric encryption
C) key escrow
D) SQL injection
E) SHA1 hash

Question 78

A Trojan horse is a virus that masquerades as a useful program or file.

Question 79

Most spyware programs are benign in that they do not perform malicious acts or steal data.

Question 80

A magnetic strip holds far more data than a microchip.