Deck 5: Information Systems Security

Question 1

Removing and disabling cookies improves security,but your computer will be more difficult to use.

Answer 1

True

Question 2

Few individuals take security as seriously as they should,and most fail to implement even low-cost safeguards.

Answer 2

True

Question 3

The single most important safeguard for computer security is to create and use strong passwords.

Answer 3

True

Question 4

A vulnerability is some measure that individuals or organizations take to block the threat from obtaining the asset.

Question 5

Most email and messaging are protected by encryption,and you should assume that anything you write in email or messaging is safe.

Question 6

Security policies depend on whether the organization is governmental or nongovernmental.

Question 7

Sniffing is a term used to describe a variety of software that damages or disables computers.

Question 8

If the vendor does not use https,it is still safe to use that online vendor.

Question 9

Information systems security is the process of preventing unauthorized access to an IS or modification of its data.

Question 10

IP spoofing occurs when an intruder uses another site's IP address to masquerade as the other site.

Question 11

Security is rarely breached,and the frequency of security breaches will slow down in the future.

Question 12

Human errors are typically procedure problems: incorrect procedures or procedural
mistakes.

Question 13

Your browser automatically stores a history of your browsing activities and temporary files that contain sensitive data about where you've visited,what you've purchased,and what your account names and passwords are.

Question 14

Increasingly security experts view the cloud as the least secure option for transferring security risks.

Question 15

Human errors and mistakes include accidental or unintended problems caused by both employees and nonemployees.

Question 16

Poorly written application programs and procedures are sources of security threats.

Question 17

Reducing risk always costs,and the elimination of all risk would be exceptionally
expensive if not impossible.

Question 18

Safeguards are a type of control; and like all controls,they limit behavior.

Question 19

The most challenging aspect of security is businesses do not thoroughly test the security of their new systems before they are employed.

Question 20

A company-wide security policy should include how employees and others can request changes to inaccurate data.

Question 21

Technical safeguards block threats from obtaining an asset by using the hardware and software components of an information system.

Question 22

Malware definitions-patterns that exist in malware code-should be downloaded frequently.

Question 23

A key is a physical device that is used to lock and unlock a message.

Question 24

Input validation is an example of secure design.

Question 25

A public key is like the combination lock,and the private key is like the combination.

Question 26

Malware protection is an example of a data safeguard.

Question 27

The user name identifies the user and the password authenticates that user.

Question 28

Users resist biometric identification because they feel it is invasive.

Question 29

Most secure communication over the Internet uses a protocol called HTTP.

Question 30

It is safe to share a password if you don't send it via email.

Question 31

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 32

Safeguards restrict freedoms by limiting what employees can do.

Question 33

One type of attack on common passwords is brute force attack.

Question 34

Safeguards are cost prohibitive and increase work efficiency.

Question 35

An organization should store some back-up database copies off premises,possibly in a remote location.

Question 36

No safeguard by itself is completely effective; there is no silver bullet,no simple solution.

Question 37

Human safeguards result when authorized users follow appropriate procedures for system use and recovery.

Question 38

A smart card uses personal physical characteristics such as fingerprints,facial features,and retinal scans to authenticate users.

Question 39

An organization should store all back-up database copies of premises for easier access.

Question 40

A firewall can be a special use computer,or it can be an app on a general-purpose computer or router.

Question 41

After the initial response to the disaster or incident,computer forensics can help determine
the cause of the event.

Question 42

Given appropriate job descriptions,user accounts should be defined to give users the most possible privilege needed to perform their jobs.

Question 43

Departmental personnel should develop procedures for system recovery.

Question 44

_________blocks access to a computer until the victim pays money to the attacker.

A) Malware
B) Spyware
C) Ransomware
D) Session Hijacking

Question 45

When hiring for high-sensitivity positions,extensive interviews,references,and background investigations are appropriate.

Question 46

__________ is a technique for intercepting computer communications.

A) Spoofing
B) Phishing
C) Pretexting
D) Sniffing

Question 47

Responsibility and accountability are important factors in enforcing security policies.

Question 48

Companies that invest in _________ have been shown to reduce the frequency and severity of their security losses.

A) vulnerability
B) safeguards
C) targets
D) modifications

Question 49

Which of the following is a software threat?

A) session hijacking
B) overflow attack
C) cross-site scripting (XSS)
D) hacking

Question 50

A ______ is a person or organization that seeks to obtain or alter data or other assets illegally,without the owner's permission and often without the owner's knowledge.

A) target
B) vulnerability
C) security breach
D) threat

Question 51

When you buy something online,you provide your credit card data; when that data is transmitted over the Internet,it is an example of:

A) threat
B) vulnerability
C) risk
D) target

Question 52

When a security incident does occur,it's important to slowly and carefully respond.

Question 53

_________is simply the chance of loss.

A) Threat
B) Vulnerability
C) Risk
D) Target

Question 54

Management needs to cultivate a culture of compliance.

Question 55

Standard human resource policies should ensure that system administrators receive notification in advance of the employee's last day so they can remove accounts and passwords.

Question 56

Many organizations create honey-pots,which are false targets for hackers to attack.

Question 57

Every organization should have an incident response plan as part of the security program.

Question 58

_________is simply the chance of loss.

A) Threat
B) Vulnerability
C) Risk
D) Target

Question 59

Companies often allow employees to use their own personal mobile device to conduct company activities,a policy called Bring Your Own Device (BYOD).

Question 60

In most cases,companies can screen vendor,partner personnel and public users.

Question 61

Which of these following is a true statement about using the cloud?

A) Cloud vendors use current technology and can afford to hire leading security experts.
B) Cloud vendors restrict freedoms by limiting what employees can do.
C) Cloud vendors have complicated polices.
D) Cloud vendors are not audited frequently.

Question 62

Which of the following is an example of inadvertent human error:

A) sabotage
B) a procedure problem
C) pretexting
D) theft

Question 63

The first safeguard against security threats is:

A) use strong passwords
B) to take security seriously
C) use a secure https connection
D) remove your browsing history

Question 64

The process ____________of verifies the credentials of the individual seeking access to a computer resource.

A) identification
B) authentication
C) encryption
D) hardening

Question 65

Which of these following is a true statement about using the cloud?

A) Cloud vendors use current technology and can afford to hire leading security experts.
B) Cloud vendors restrict freedoms by limiting what employees can do.
C) Cloud vendors have complicated polices.
D) Cloud vendors are not audited frequently.

Question 66

__________is a sophisticated,possibly long-running computer hack that is perpetrated by large,well-funded organizations such as governments.

A) Usurpation
B) An overflow attack
C) Advanced Persistent Threat (APT)
D) Malware

Question 67

A/An _______________attack in which a malicious hacker floods a Web server with millions of bogus service requests that so occupy the server that it cannot service legitimate requests.

A) overflow attack
B) denial-of-service (DoS)
C) advanced persistent threat (APT)
D) usurpation

Question 68

Which of the following statements is true about biometric authentication?

A) It uses personal physical characteristics for authentication.
B) It is less invasive than other methods of authentication.
C) It uses a microchip loaded with identifying data to authenticate users.
D) It provides weak authentication compared to other methods.

Question 69

Which of the following is not an example of external threat that can affect software?

A) overflow attack
B) denial-of-service (DoS)
C) pretexting
D) usurpation

Question 70

Which of the following is a valid difference between a password and user name?

A) A password is used to encode information, whereas a user name is used to decode information.
B) Unlike a password, a user name is more complex.
C) A user name identifies the user, whereas a password authenticates the user.
D) A user name is common among users, whereas a password is unique.

Question 71

___________are small files that your browser stores on your computer when you visit Web sites.

A) Temp files
B) Browsing history
C) Viruses
D) Cookies

Question 72

________ is the process of transforming clear text into coded,unintelligible text for secure storage or communication.

A) Code injection
B) Pretexting
C) Encryption
D) Authentication

Question 73

Which of these following is a true statement about safeguards:

A) safeguards increase work efficiency
B) one safeguard by itself is completely effective
C) safeguards are inexpensive
D) safeguards restrict freedoms by limiting what employees can do.

Question 74

Firewalls are an example of what type of safeguard?

A) technical
B) data
C) procedural
D) human

Question 75

Security is a trade-off with_________.

A) benefits
B) risks
C) freedom
D) defense

Question 76

In a typical _________ attack,the criminal posts a reply to a discussion board but along with
The plaintext reply adds malicious code invisible to the discussion board.

A) brute force attack
B) denial-of-service (DoS)
C) cross-site scripting (XSS)
D) SQL injection attack

Question 77

___________are small files that your browser stores on your computer when you visit Web sites.

A) Temp files
B) Browsing history
C) Viruses
D) Cookies

Question 78

The preventative measures used by organizations to reduce IS security are called:

A) encryption
B) avoidance
C) safeguards
D) risks

Question 79

When an unsuspecting user accesses a fake Wi-Fi access point,which has the same name as a legitimate Wi-Fi access point,this is an example of a/an:

A) cross site scripting (XSS)
B) sniffing
C) IP Spoofing
D) evil twin

Question 80

When criminals replace a legitimate user or software program with their own access or illegitimate software program to give the attacker unauthorized control of some part of the IS,it is known as:

A) usurpation
B) an overflow attack
C) SQL injection attack
D) malware