Deck 5: E-Commerce Security and Payment Systems

Question 1

A Trojan horse appears to be benign, but then does something other than expected.

Answer 1

True

Question 2

Drive-by downloads are now the most common method of infecting computers.

Answer 2

True

Question 3

TLS does not guarantee server-side authentication.

Answer 3

False

Question 4

The use of a digital signature helps to ensure integrity, authenticity, and nonrepudiation.

Question 5

Insiders present a greater security threat to e-commerce sites than outsiders.

Question 6

According to the Computer Security Institute's 2011 Computer Crime and Security Survey, which of the following was the most commonly reported type of attack?

A) malware infection
B) laptop theft
C) Web site defacement
D) insider abuse

Question 7

The Computer Security Institute reported in its 2011 survey that approximately ________ percent of responding organizations experienced a computer security incident within the previous 12 months.

A) 25
B) 45
C) 75
D) 95

Question 8

Digital cash is legal tender that is instantly convertible into other forms of value without the intermediation of any third parties.

Question 9

A worm does not need to be activated by a user in order for it to replicate itself.

Question 10

The overall rate of online credit card fraud is ________ percent of all online card transactions.

A) less than 1
B) around 1
C) around 5
D) around 10

Question 11

All of the following are factors in contributing to the increase in cybercrime except:

A) the ability to remotely access the Internet.
B) the Internet's similarity to telephone networks.
C) the ability to anonymously access the Internet.
D) the Internet is an open, vulnerable design.

Question 12

In order to accept payments by credit card, online merchants typically must have a merchant account established with a bank or financial institution.

Question 13

Phishing attacks rely on browser parasites.

Question 14

The six key dimensions to e-commerce security are nonrepudiation, authenticity, availability, integrity, privacy, and:

A) confidentiality.
B) usability.
C) functionality.
D) viability.

Question 15

PayPal requires the recipient of a payment to have a PayPal account to receive funds.

Question 16

Smishing attacks exploit SMS messages.

Question 17

The easiest and least expensive way to prevent threats to system integrity is to install anti-virus software.

Question 18

Credit cards are the dominant form of online payment throughout the world.

Question 19

Typically, the more security measures added to a Web site, the slower and more difficult it becomes to use.

Question 20

The United States federal government has historically not been in favor of the development and export of strong encryption systems.

Question 21

Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as:

A) spyware.
B) a backdoor.
C) pupware.
D) adware.

Question 22

Botnets are typically used for all of the following except:

A) DDoS attacks.
B) phishing attacks.
C) storing network traffic for analysis.
D) stealing information from computers.

Question 23

The Data Encryption Standard uses a(n) ________-bit key.

A) 8
B) 56
C) 256
D) 512

Question 24

All of the following were computer crimes committed in 2011-2012 except:

A) Russian hackers posting over 6 million Facebook usernames and passwords online.
B) 77 million user credit card numbers stolen from Sony's PlayStation gameserver.
C) A Stuxnet worm wiped computers in the Iranian Oil Ministry clean.
D) Melissa worm spreads through Microsoft Word templates.

Question 25

What is the most frequent cause of stolen credit cards and card information today?

A) lost cards
B) the hacking and looting of corporate servers storing credit card information
C) sniffing programs
D) phishing attacks

Question 26

________ refers to the ability to ensure that an e-commerce site continues to function as intended.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 27

Symmetric key encryption is also known as:

A) public key encryption.
B) secret key encryption.
C) PGP.
D) PKI.

Question 28

________ refers to the ability to identify the person or entity with whom you are dealing on the Internet.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 29

Netsky.P, which spreads by sending e-mails from an infected computer to all of the e-mail addresses found on that infected computer, is an example of a:

A) macro virus.
B) worm/Trojan horse.
C) Trojan horse/virus.
D) bot program.

Question 30

Most of the world's spam is delivered via which of the following?

A) viruses
B) worms
C) Trojan horses
D) botnets

Question 31

Which of the following is a prominent hacktivist group?

A) Anonymous
B) Anti-Phishing Working Group
C) IC3
D) Symantec

Question 32

Which of the following is not a key point of vulnerability when dealing with e-commerce?

A) the client computer
B) the server
C) the communications pipeline
D) the credit card companies

Question 33

The Conficker worm targeted:

A) Microsoft Word.
B) Microsoft Outlook Express.
C) Microsoft operating systems.
D) Microsoft Access database software.

Question 34

All the following statements about symmetric key encryption are true except:

A) In symmetric key encryption, both the sender and the receiver use the same key to encrypt and decrypt a message.
B) The Data Encryption Standard is a symmetric key encryption system.
C) Symmetric key encryption is computationally slower.
D) Symmetric key encryption is a key element in digital envelopes.

Question 35

Which dimension(s) of security is spoofing a threat to?

A) integrity
B) availability
C) integrity and authenticity
D) availability and integrity

Question 36

________ refers to the ability to ensure that messages and data are only available to those authorized to view them.

A) Confidentiality
B) Integrity
C) Privacy
D) Availability

Question 37

Which of the following is an example of an integrity violation of e-commerce security?

A) A Web site is not actually operated by the entity the customer believes it to be.
B) A merchant uses customer information in a manner not intended by the customer.
C) A customer denies that he or she is the person who placed the order.
D) An unauthorized person intercepts an online communication and changes its contents.

Question 38

All of the following are examples of malicious code except:

A) viruses.
B) bots.
C) worms.
D) sniffers.

Question 39

________ refers to the ability to ensure that e-commerce participants do not deny their online actions.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 40

An example of a privacy violation of e-commerce security is:

A) your e-mail being read by a hacker.
B) your online purchasing history being sold to other merchants without your consent.
C) your computer being used as part of a botnet.
D) your e-mail being altered by a hacker.

Question 41

All of the following are used for authentication except:

A) digital signatures.
B) certificates of authority.
C) biometric devices.
D) packet filters.

Question 42

All of the following are features of cash except:

A) It is instantly convertible into other forms of value without intermediation.
B) It requires no authentication.
C) It is anonymous.
D) It provides float.

Question 43

None of the following payment systems offers immediate monetary value except:

A) personal checks.
B) credit cards.
C) stored value/debit card.
D) accumulating balance.

Question 44

All of the following are examples of stored value payment systems except:

A) smart cards.
B) credit cards.
C) gift certificates.
D) prepaid cards.

Question 45

What is the last step in developing an e-commerce security plan?

A) Perform a security audit.
B) Develop an implementation plan.
C) Create a security organization.
D) Develop a security policy.

Question 46

All the following are stakeholders in payment systems except:

A) ISPs.
B) consumers.
C) financial intermediaries.
D) government regulators.

Question 47

All of the following statements about public key encryption are true except:

A) Public key encryption uses two mathematically related digital keys.
B) Public key encryption ensures authentication of the sender.
C) Public key encryption does not ensure message integrity.
D) Public key encryption is based on the idea of irreversible mathematical functions.

Question 48

Proxy servers are also known as:

A) firewalls.
B) application gateways.
C) dual home systems.
D) packet filters.

Question 49

To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use:

A) access controls.
B) an authorization management system.
C) security tokens.
D) an authorization policy.

Question 50

P2P payment systems are a variation on what type of payment system?

A) stored value payment system
B) digital checking system
C) accumulating balance system
D) digital credit card system

Question 51

A digital certificate contains all of the following except the:

A) subject's private key.
B) subject's public key.
C) digital signature of the certification authority.
D) digital certificate serial number.

Question 52

If you used a symmetric key encryption for large documents, with public key encryption to encrypt and send the symmetric key, you would be using a digital:

A) envelope.
B) signature.
C) certificate.
D) hash.

Question 53

A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network.

A) firewall
B) virtual private network
C) proxy server
D) PPTP

Question 54

Which of the following is the primary federal statute used to combat computer crime?

A) Homeland Security Act
B) CAN-SPAM Act
C) Computer Security Enhancement Act
D) Computer Fraud and Abuse Act

Question 55

Which of the following dimensions of e-commerce security is not provided for by encryption?

A) confidentiality
B) availability
C) message integrity
D) nonrepudiation

Question 56

Which of the following is not an example of an access control?

A) firewalls
B) proxy servers
C) digital signatures
D) login passwords

Question 57

All of the following statements about debit cards are true except:

A) Debit cards eliminate the need for consumers to write a paper check when making a purchase.
B) Debit cards enable consumers to make purchases even if they do not have sufficient funds at the time of purchase.
C) Debit cards do not provide any float.
D) Debit cards do not have the protections provided by Regulation Z to credit cards.

Question 58

What is the first step in developing an e-commerce security plan?

A) Create a security organization.
B) Develop a security policy.
C) Perform a risk assessment.
D) Perform a security audit.

Question 59

All of the following are methods of securing channels of communication except:

A) SSL/TLS.
B) certificates.
C) VPN.
D) FTP.

Question 60

All of the following statements about PKI are true except:

A) The term PKI refers to the certification authorities and digital certificate procedures that are accepted by all parties.
B) PKI is not effective against insiders who have a legitimate access to corporate systems including customer information.
C) PKI guarantees that the verifying computer of the merchant is secure.
D) The acronym PKI stands for public key infrastructure.

Question 61

In encryption, the method used to transform plain text to encrypted text is called a(n) ________.

Question 62

The exploitation of human fallibility and gullibility to distribute malware is known as ________.

Question 63

________ typically handle verification of accounts and balances in the credit card system.

Question 64

________ refers to the ability to ensure that information being displayed on a Web site, or transmitted or received over the Internet, has not been altered in any way by an unauthorized party.

Question 65

Malware that comes with a downloaded file that a user requests is called a:

A) Trojan horse.
B) backdoor.
C) drive-by download.
D) PUP.

Question 66

Malicious code that is designed to take advantage of a security hole in computer software or operating system is called a(n) ________.

Question 67

To allow employees to connect securely over the Internet to their corporate network, you would use a(n) ________

Question 68

Linden Dollars, created for use in Second Life, are an example of:

A) digital cash.
B) virtual currency.
C) EBPP
D) peer-to-peer payment systems.

Question 69

To internal computers, a proxy server is known as the ________.

Question 70

Which of the following is not an example of a PUP?

A) adware
B) browser parasite
C) drive-by download
D) spyware

Question 71

________ is a widely used e-mail public key encryption software tool.

Question 72

________ is a form of online payment system for monthly bills.

Question 73

A(n) ________ vulnerability involves a vulnerability unknown to security experts that is actively exploited before there is a patch available.

Question 74

All of the following are limitations of the existing online credit card payment system except:

A) poor security.
B) cost to consumers.
C) cost to merchant.
D) social equity.

Question 75

Spoofing a Web site is also called ________.

Question 76

A(n) ________ is a hacker that believes he or she is pursing some greater good by breaking in and revealing system flaws.

Question 77

A(n) ________ is a type of firewall that filters communications based on the application being requested.

Question 78

Which of the following is a set of short-range wireless technologies used to share information among devices within about 2 inches of each other?

A) DES
B) NFC
C) IM
D) text messaging

Question 79

The most common form of securing a digital channel of communication is ________.

Question 80

The study of measurable biological or physical characteristics is called ________.