Deck 5: Cybersecurity and Risk Management Technology

Question 1

A person who may violate ethical standards or principles,but without malicious intent.

A)White Hat hacker
B)Red Hat hacker
C)Black Hat Hacker
D)Gray Hat Hacker

Answer 1

D

Question 2

___________ tactics are used by hackers and corporate spies to trick people into revealing login information or access codes.

A)Social engineering
B)Backdoor
C)BYOD
D)Password cracking

Answer 2

A

Question 3

The main cause of data breaches is ________,which is so successful because of ________ when management does not do enough to defend against cyberthreats.

A)Hacking;highly motivated hackers
B)Hacking;negligence
C)Malware;BYOD
D)Malware;negligence

Answer 3

B

Question 4

Which of the following was not an outcome of the Yahoo data breaches in 2013 and 2014?

A)Potential target users were informed within a month of the breach
B)Russian agents were indicted for the crime
C)Yahoo's value decreased by over $200 million
D)Users were advised to change their passwords and security questions

Question 5

Negative consequences of lax cybersecurity that companies tend to face include all of the following except ________.

A)Damaged brands and reputations
B)Criminal charges
C)Financial penalties
D)Customer backlash

Question 6

According to a Ponemon study in 2016,the average cost of an overall data breach is:

A)$1 million
B)$2 million
C)$4 million
D)$8 million

Question 7

A stealth network attack in which an unauthorized person gains access to a network and remains undetected for a long time is referred to as a(n)__________ attack.

A)registry denial
B)advanced persistent threat
C)DDOS
D)hacktivist

Question 8

John received a strange message on his computer that asked him to send a hundred dollars in Bitcoin to a link or else he would lose all the data on his computer.John is a victim of:

A)Spyware
B)Ransomware
C)Spear phishing
D)Denial-of-service

Question 9

A person who attempts to find computer security vulnerabilities and exploit them for personal financial gain or other malicious reasons.

A)White Hat hacker
B)Red Hat hacker
C)Black Hat Hacker
D)Gray Hat Hacker

Question 10

Attacks ________ could significantly disrupt the functioning of government and business-and trigger cascading effects far beyond the targeted sector and physical location of the incident.

A)By hacktivists
B)By hackers
C)On critical infrastructure
D)On industrial control systems

Question 11

________ is also known as human hacking-tricking users into revealing their credentials and then using them to gain access to networks or accounts.

A)Android-hacking
B)BYOD
C)Hacktivism
D)Social engineering

Question 12

____________ is/are defined as "systems and assets,whether physical or virtual,so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security,national economic security,national public health or safety,or any combination of those matters."

A)Critical infrastructure
B)Cyber architecture
C)National networks
D)Strategic assets

Question 13

Experts believe the three greatest cybersecurity dangers over the next few years will involve all of the following except __________.

A)persistent threats
B)POS attacks
C)mobile computing
D)the use of social media

Question 14

According to cybersecurity experts,most data breaches go unreported because corporate victims fear that disclosure would damage their stock price,or because ________.

A)they want to hide the attack from the government
B)they never knew they were hacked in the first place
C)they want to cover up the intrusion
D)they do not have to report them.

Question 15

Advanced persistent threat (APT)attackers want to ________.

A)create awareness for their causes
B)remain unnoticed so they can continue to steal data
C)conduct cyberwarfare
D)reveal weaknesses in business and government websites and then force them offline.

Question 16

Cybercrime surveys have reported each of the following trends or findings except ________.

A)security incidents increased steadily despite implementation of security practices
B)current cybersecurity technologies and policies are simply not keeping pace with fast-evolving threats.
C)Many threats and challenges that organizations face today were unimaginable 10 years ago.
D)Older threats such as fraud and identity theft have decreased significantly.

Question 17

A computer security specialist who breaks into protected systems and networks to test and assess their security.

A)White Hat hacker
B)Red Hat hacker
C)Black Hat Hacker
D)Gray Hat Hacker

Question 18

Which of the following represents a cybersecurity concern about employees using their own smartphones for work purposes?

A)Employees will spend too much time playing games or using entertainment and recreation apps,thus reducing productivity.
B)Managers will be unable to monitor the time spent on personal calls made during work hours.
C)Many personal smartphones do not have anti-malware or data encryption apps,creating a security problem with respect to any confidential business data stored on the device.
D)Consumer-quality equipment are more likely to break or malfunction than enterprise quality devices.

Question 19

A(n)________ attack bombards a network or website with traffic to crash it and leave it vulnerable to other threats.

A)advanced persistent threat
B)distributed denial-of-service
C)malware
D)phishing

Question 20

One of the methods that could have prevented the Yahoo data breach is ____________,when a user is asked to enter information such as username and password,then a mobile app generates and sends a random number code for the user to enter before being granted access to his or her account.

A)Password Verification
B)Mobile Access Verification
C)Two Factor Authentication
D)Mobile Code Authentication

Question 21

In Cybersecurity terminology,a vulnerability is defined as ________:

A)A weakness that threatens the confidentiality,integrity,or availability of data.
B)Something or someone that can damage,disrupt,or destroy an asset.
C)Estimated cost,loss,or damage that can result from an exploit.
D)Tools or techniques that take compromise a network.

Question 22

When sending sensitive email,James uses a program that transforms data into unreadable text to protect it from being understood by unauthorized users.James is using ________ to protect his email communications.

A)Authentication
B)Defense-in-depth
C)Encryption
D)Hashing

Question 23

Most organizations use software or hardware devices to control access to their private networks from the Internet by analyzing incoming and outgoing data packets.These devices are called ___________.

A)Antimalware
B)Firewalls
C)Intrusion detection systems
D)Middleware

Question 24

The ability of an IS to continue to operate when a failure occurs,but usually for a limited time or at a reduced level is referred to as __________.

A)Fault tolerance
B)Hot site ready
C)Cold site ready
D)System override

Question 25

LulzSec and Anonymous are examples of ________ that have claimed responsibility for high profile attacks designed to make a political statement,embarrass an organization or government,or to gain publicity.

A)Hacktivists
B)Hostile government agents
C)Industrial spies
D)Cyber terrorists

Question 26

The three key cybersecurity principles are:

A)Data protection,equipment protection,reputation protection
B)Confidentiality,integrity,availability
C)Anticipate,defend,counter-attack
D)Identify,assess risk,take action

Question 27

IT professionals work hard to protect key characteristics of an asset from security breaches.One of these characteristics is ________,or the avoidance of unauthorized disclosure of information or data.

A)Integrity
B)Confidentiality
C)Availability
D)Reliability

Question 28

Government and corporate officials concerned about security threats do not bring their own cell phones or laptops when traveling overseas.Instead,they bring loaner devices and follow strict security procedures including not connecting to their domestic network while out of the country.These procedures are referred to as _________.

A)Black Ops procedures
B)Do-Not-Carry rules
C)Foreign Threat Prevention procedures
D)Strict Security standards

Question 29

An employee can pose an internal threat by entering false or fraudulent data into a computer,or changing or deleting existing data.This called _________.

A)data mining
B)data tampering
C)ransomware
D)a remote-access Trojan

Question 30

The 2016 Defense Trade Secrets Act was designed to prevent the theft of trade secrets,also known as __________________.

A)intrusion prevention
B)critical infrastructure
C)corporate identity
D)intellectual property

Question 31

The preferred method of hackers who want to steal trade secrets and other confidential information from business organizations is ___________.

A)To bribe employees to get access codes and passwords.
B)To bombard websites or networks with so much traffic that they "crash",exposing sensitive data.
C)To break into employees' mobile devices and leapfrog into employers' networks-stealing secrets without a trace.
D)Use a combination of sophisticated hardware tools designed to defeat IT security defenses.

Question 32

U.S.cybersecurity experts and government officials are increasingly concerned about breaches from __________ into corporate networks,either through mobile devices or by other means.

A)Domestic terrorists
B)Amateur hackers
C)Organized crime syndicates based in the United States
D)Other countries

Question 33

IT professionals work hard to protect key characteristics of an asset from security breaches.One of these characteristics is ____________,or the property that data or files have not been altered in an unauthorized way.

A)Integrity
B)Confidentiality
C)Availability
D)Reliability

Question 34

In Cybersecurity terminology,a threat is defined as ________.

A)A weakness that threatens the confidentiality,integrity,or availability of data.
B)Something or someone that can damage,disrupt,or destroy an asset.
C)Estimated cost,loss,or damage that can result from an exploit.
D)Tools or techniques that take compromise a network.

Question 35

IT professionals work hard to protect key characteristics of an asset from security breaches.One of these characteristics is _________,or the property that data is accessible and modifiable when needed by those authorized to do so.

A)Integrity
B)Confidentiality
C)Availability
D)Reliability

Question 36

In Cybersecurity terminology,an exploit is defined as ________:

A)A weakness that threatens the confidentiality,integrity,or availability of data.
B)Something or someone that can damage,disrupt,or destroy an asset.
C)Estimated cost,loss,or damage that can result from an exploit.
D)Tools or techniques that take advantage of a vulnerability.

Question 37

In Cybersecurity terminology,a risk is defined as ________:

A)A weakness that threatens the confidentiality,integrity,or availability of data.
B)Something or someone that can damage,disrupt,or destroy an asset.
C)Estimated cost,loss,or damage that can result from an exploit.
D)The probability of a threat exploiting a vulnerability and the resulting cost.

Question 38

Chris is a network manager for a large company.She receives daily updates about various malware and then assesses how to best protect her organization's network from attack.In cybersecurity terminology,she is involved in __________.

A)Identifying exposure
B)Risk management
C)A security audit
D)Encryption defenses

Question 39

Access to top secret or highly secure networks associated with Homeland Security or national defense use authentication methods based on a biological feature,such as a fingerprint or retinal scan to identify a person.These methods are called _____________.

A)Bio-Engineering
B)Physical security
C)Biometrics
D)Human factors

Question 40

One source of cybersecurity threats today are ____________who breach networks in an attempt to gain media attention or for their cause.

A)Hacktivists
B)Political criminals
C)Industrial spies
D)Social engineers

Question 41

Storm worm,which is spread via spam,is a ________ agent embedded inside over 25 million computers.Storm's combined power has been compared to the processing power of ________.

A)botnet;a supercomputer
B)spyware;a DDoS attack
C)vector;zombies
D)spear phishing;a server

Question 42

The purpose of the ________ is to improve customers' trust in e-commerce,especially when it comes to online payments,and to increase the Web security of online merchants.

A)IT governance
B)Internal control
C)PCI DSS
D)FISMA

Question 43

The IT security defense-in-depth model ends with ________.

A)Senior management commitment and support
B)IT security procedures and enforcement
C)Hardware and software selection
D)Acceptable use policies and IT security training

Question 44

________ is the supervision,monitoring,and control of an organization's IT assets.

A)IT governance
B)Internal control
C)PCI DSS
D)FISMA

Question 45

The principle of ________ acknowledges that the cost of information security needs to be balanced with its benefits.It is the basic cost-benefit principle with which you are familiar.

A)accounting
B)economic use of resources
C)legality
D)COBIT

Question 46

Samuel received an email that looked like it came from his bank.The email told him to click a link that opened an official looking Webpage where he was asked to enter his account information.But when Samuel examined the URL,he noticed it was a strange address he did not recognize.Most likely,someone was attempting to steal Samuel's confidential information using a technique called __________.

A)Botnets
B)Phishing
C)Spoofing
D)Click hijacking

Question 47

Intrusion Detection Systems (IDS)are designed to monitor network traffic and identify threats that have breached the networks' initial defenses.IDS identify all of the following except:

A)An attacker who is trying to break into the credentials of a legitimate user in order to gain access to an IS,device,or network.
B)A legitimate user who performs actions he is not authorized to do.
C)A user who tries to disguise or cover up his actions by deleting audit files or system logs.
D)Employees who use computing or network resources inefficiently.

Question 48

Facebook,YouTube,Twitter,LinkedIn,and other social networks are making IT security dangers worse.Why?

A)Users invite in and build relationships with others.Cybercriminals hack into these trusted relationships using stolen log-in credentials.
B)E-mail viruses and malware have been increasing for years even though e-mail security has improved.
C)Communication has shifted from social networks to smartphones.
D)Web filtering,user education,and strict policies cannot help prevent IT security dangers on Facebook and other social networks.

Question 49

Cybersecurity is ___________.

A)an ongoing unending process
B)a problem that is solved with hardware or software
C)defined in the AUP that is enforced periodically
D)primarily the responsibility of the IT and legal departments

Question 50

In cybersecurity terms,the function of a password together with a username is to __________ a user's identity to verify that the person has the right to access a computer or network.

A)Record
B)Authenticate
C)Substantiate
D)Validate

Question 51

Sometimes system failures and data or information loss can result from reasons other than an intentional attempt to breach security.Unintentional threats are all of the following except ___________.

A)Political/civic unrest
B)Human errors
C)Environmental hazards
D)Computer systems failures

Question 52

In the United States,the Sarbanes-Oxley Act (SOX)requires businesses to __________________________.

A)Report security breaches via media sources to inform the public
B)Backup sensitive data to offsite locations
C)Set up comprehensive internal controls
D)Inform the public about network failures in a timely manner

Question 53

Most APT attacks are launched through ________.

A)Data tampering
B)Worms
C)Phishing
D)Vectors

Question 54

The IT security defense-in-depth model starts with ________.

A)Senior management commitment and support
B)IT security procedures and enforcement
C)Hardware and software selection
D)Acceptable use policies and IT security training

Question 55

__________ is the elapsed time between when vulnerability is discovered and when it is exploited and has shrunk from months to __________.

A)Time-to-exploitation;days
B)Time-to-exploitation;minutes
C)Denial of service;days
D)Denial of service;seconds

Question 56

According to Cisco in 2015,the most common form of malware distributed was _________.

A)Facebook scams
B)Ransomware
C)Rogue mobile apps
D)Spyware

Question 57

When new vulnerabilities are found in operating systems,applications,or wired and wireless networks,vendors of those products release __________ or __________ to fix the vulnerabilities.

A)Patches;service packs
B)Patches;downloads
C)Firewalls;spyware
D)Service packs;firewalls

Question 58

Which of the following statements about malware is false?

A)Technically,malware is a computer program or code that can infect anything attached to the Internet and is able to process the code.
B)Setting an e-mail client,such as Microsoft Outlook or Gmail,to allow scripting blocks malware.
C)RATS create an unprotected backdoor into a system through which a hacker can remotely control that system.
D)The payload carries out the purpose of the malware.

Question 59

The director of the Federal Trade Commission (FTC)bureau of consumer protection warned that the agency would bring enforcement action against small businesses that ________

A)failed to inform the public about network failures in a timely manner
B)failed to transmit sensitive data
C)did not report security breaches to law enforcement
D)lacked adequate policies and procedures to protect consumer data.

Question 60

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved,threats from __________ have increased considerably in recent years.

A)Software errors
B)Malicious employees
C)Social networks and cloud computing
D)Vendor sabotage

Question 61

The cybersecurity defense strategy and controls that should be used depend on __________.

A)The source of the threat
B)Industry regulations regarding protection of sensitive data
C)What needs to be protected and the cost-benefit analysis
D)The available IT budget

Question 62

The Payment Card Industry Data Security Standard (PCI DSS)created by Visa,MasterCard,American Express,and Discover is a __________.

A)Set of standards required by U.S.and international law for protecting credit card transaction data.
B)Set of industry standards required for all online merchants that store,process,or transmit cardholder data.
C)Set of voluntary security guidelines for retailers who accept Visa,MasterCard,American Express,and Discover credit cards.
D)Set of regulations (that vary from state to state,and country to country)that apply to credit card companies.

Question 63

A defense strategy requires several controls._________are established to protect the system regardless of the specific application.

A)Application controls
B)Physical controls
C)General controls
D)Authentication controls

Question 64

________ is the most cost-effective approach to fraud.

A)Detection
B)Lawsuits
C)Prevention
D)Prosecution

Question 65

Voice and fingerprint _______ can significantly improve the security of physical devices and provide stronger authentication for remote access or cloud services.

A)cryptography
B)biometrics
C)encryption
D)visualization

Question 66

__________ are essential to the prevention and detection of occupation frauds

A)Anti-malware and firewalls
B)Internal audits and internal controls
C)Encryption and IDS
D)AUPs

Question 67

When it comes to fraud committed by an organization's employees,the single most effective fraud prevention technique is _______.

A)Holding managers responsible for the actions of their employees
B)Peer monitoring (employees monitor each other)
C)Creating the perception that fraud will be detected and punished
D)A clearly written employee policy manual that explains unacceptable behaviors

Question 68

Which of the following is not a type of administrative control for information assurance and risk management?

A)Fostering company loyalty
B)Immediately revoking access privileges of dismissed,resigned,or transferred employees
C)Instituting separation of duties by dividing sensitive computer duties among as many employees as economically feasible
D)Performing authorization and authentication

Question 69

A defense strategy requires several controls.___________ protect computer facilities and resources such as computers,data centers,software,manuals,and networks.

A)Application controls
B)Physical controls
C)General controls
D)Authentication controls

Question 70

People who have their social security or credit card numbers stolen and used by thieves are frequently victims of ___________________.

A)Insider fraud
B)Identity theft
C)Occupational corruption
D)Document sabotage

Question 71

Crime can be divided into two categories depending on the tactics used to carry out the crime: ________.

A)Fraud and felonies
B)Occupational and opportunistic
C)Lethal and misdemeanors
D)violent and nonviolent

Question 72

Physical security includes several controls.Which of the following is not a type of physical control?

A)Security bonds or malfeasance insurance for key employees
B)Emergency power shutoff and backup batteries
C)Shielding against electromagnetic fields
D)Properly designed and maintained air-conditioning systems

Question 73

Business operations are controlled by apps,systems,and networks that are so interconnected that anyone's ________ is an entry point for attacks.

A)mobile device
B)botnet
C)BYOD
D)firewall

Question 74

The _________ is an exercise that determines the impact of losing the support or availability of a resource.

A)Business impact analysis (BIA)
B)Vulnerability audit
C)Asset valuation audit
D)Computing Cost/Benefit (CCB)audit

Question 75

The single-most effective fraud prevention tactic is making employees know that ________.

A)fraudsters will be fired
B)fraudsters will be forced to repay what they stole plus interest
C)fraud could destroy the company and jobs.
D)fraud will be detected by IT monitoring systems and punished by the legal system.

Question 76

Internal fraud prevention and detection measures are based on __________ and __________.

A)A detailed recovery plan;containment,including a fault-tolerant system
B)Perimeter defense technologies,such as e-mail scanners;human resource procedures,such as recruitment screening
C)General controls;application controls
D)Physical controls,including authorization;authentication systems

Question 77

When it comes to defending against employee fraud,regulators look favorably on companies that can demonstrate good __________ and best practices in operational risk management.

A)Corporate governance
B)Access to legal counsel
C)Relationships with security vendors
D)Awareness of industry standards

Question 78

Detecting internal fraud has become sophisticated.Audit trails from key systems and personnel records are stored in data warehouses and subjected to __________ where things like excessive hours worked,unusual transactions,copying of huge amounts of data and other unusual patterns of behavior are identified.

A)Security audits
B)Pattern analysis
C)Behavior recognition scans
D)Anomaly detection analysis

Question 79

___________ is a term referring to a variety of criminal behaviors perpetrated by an organization's own employees or contractors.

A)Managerial corruption
B)Insider or internal fraud
C)Corporate fraud
D)Intentional fraud

Question 80

Most information security incidents will occur because of _________.

A)Increases in hacker skills and capabilities
B)Poorly designed network protection software
C)Increasing sophistication of computer viruses and worms
D)Users who do not follow secure computing practices and procedures