Deck 12: Law and Ethics

Question 1

Historically,the United Kingdom has led the development and implementation of information security legislation to prevent misuse and exploitation of information and information technology.

Answer 1

False

Question 2

The Sarbanes-Oxley Act of 2002 is also known as the Public Company Accounting Reform and Investor Protection Act.

Answer 2

True

Question 3

The Financial Services Modernization Act is also known as the Gramm-Leach-Bliley Act of 1999 (GLB).

Answer 3

True

Question 4

The Sarbanes-Oxley Act of 2002 was designed to enforce accountability for the financial record keeping and reporting at publicly traded corporations.

Question 5

The Gramm-Leach-Bliley Act ensures that an organization's privacy policies are fully disclosed when a customer initiates a business relationship with the organization.

Question 6

The National Information Infrastructure Protection Act of 1996 assigned the National Bureau of Standards,in cooperation with the National Security Agency,with the task of developing standards,guidelines,and associated methods and techniques for computer systems.

Question 7

The Secret Service is responsible for the security of communications and information systems at many government agencies associated with national security.

Question 8

Digital forensics (also known as e-discovery)involves the preservation,identification,extraction,documentation,and interpretation of computer media for evidentiary and/or root cause analysis.

Question 9

Ethics tend to be based on cultural mores.

Question 10

The Freedom of Information Act of 1966 does not create a right of access to records held by Congress,the courts,or by state or local government agencies.

Question 11

The privacy standards of HIPAA severely restrict the dissemination and distribution of private health information without written consent.

Question 12

The current law regarding nationwide search warrants for e-mail does not require the government to use a search warrant to compel a provider to disclose unopened e-mail that is less than six months old.

Question 13

The first method of deterring ignorance within an organization is disciplinary action.

Question 14

By adding felony violations of the Computer Fraud and Abuse Act to the list of offenses associated with computer hacking,the Patriot Act identifies specific crimes under which investigators may obtain a wiretap order for wire communications.

Question 15

Credit agencies are exempted from some of the regulations of the Federal Privacy Act so that they can perform their functions.

Question 16

The Federal Privacy Act was created to ensure that government agencies protect the privacy of individuals' and businesses' information.

Question 17

The utilitarian ethical approach emphasizes that an ethical action is one that results in the most good,or the least harm; the utilitarian approach seeks to link consequences to choices.

Question 18

The key difference between policy and law is that,in the case of the former,ignorance is an acceptable defense.

Question 19

In 1996,HIPAA was enacted to protect the confidentiality and security of business data.

Question 20

In digital forensics,all investigations follow the same basic methodology,beginning with the acquisition or seizure of evidence without alteration or damage.

Question 21

The Normative ethics framework is the study of what makes actions right or wrong; also known as deontological theory._________________________

Question 22

The Health Insurance Portability & Accountability Act of 1996 has five essential privacy principles focusing on the protection of personal identity information._________________________

Question 23

(ISC)²,which offers the CISSP,requires its members to agree to a code of ethics consisting of four mandatory canons._________________________

Question 24

The National InfoGard Program began as a joint effort between the FBI's Cleveland office and local technology professionals._________________________

Question 25

A(n)search warrant is sworn testimony that certain facts are in the possession of the investigating officer that the officer believes warrant the examination of specific items located at a specific place._________________________

Question 26

The Electronic Communications Privacy Act of 1986 is also known as the Federal Interception Act._________________________

Question 27

Collective mores are relatively fixed moral customs of a societal group._________________________

Question 28

In digital forensics,all investigations follow the same basic methodology,including acquiring or seizing the evidence without disclosure or damage._________________________

Question 29

The FOIA requires organizations that retain health care information to use information security mechanisms to protect this information.__________________________________________________

Question 30

Due care for a wrongful act includes the obligation to make payment or restitution._________________________

Question 31

The Public Company Accounting Reform and Investor Protection Act addresses issues related to the accountability of company executives._________________________

Question 32

Due diligence requires that an organization make a valid and ongoing effort to protect others._________________________

Question 33

The Freedom of Information Act (FOIA)requires all local agencies to disclose records requested in writing by any person._________________________

Question 34

The U.S.Patriot Act addresses the area of encryption export._________________________

Question 35

The fairness or rights ethical approach was founded on the work of Aristotle and other Greek philosophers who contributed the idea that all persons who are equal should be treated equally._________________________

Question 36

The ACM requires its members to perform their duties in a manner befitting an ethical computing professional._________________________

Question 37

The NSA coordinates,directs,and performs highly specialized activities to protect U.S.information systems and produce foreign intelligence information._________________________

Question 38

Public law regulates the relationships among individuals,and among individuals and organizations._________________________

Question 39

Digital forensics is based on the field of traditional forensics.Forensics is the coherent application of criminal investigatory techniques to present evidence of crimes in a court or court-like setting._________________________

Question 40

The USA PATRIOT act and subsequent Improvement and Reauthorization Act increase the Secret Service's role in investigating computer fraud and related activities._________________________

Question 41

By enacting the ____ in 1996,Congress sought to protect intellectual property and competitive advantage.

A) DMCA
B) EEA
C) HIPAA
D) FOIA

Question 42

The Federal Wiretapping Act,which is also known as ____,addresses the area of cryptography.

A) The Electronic Communications Privacy Act of 1986
B) The Telecommunications Deregulation and Competition Act of 1996
C) National Information Infrastructure Protection Act of 1996
D) Federal Privacy Act of 1974

Question 43

The ____ defines and formalizes laws to counter threats from computer-related acts and offenses.

A) National Information Infrastructure Protection Act of 1996
B) Economic Espionage Act of 1996
C) Fraud and Related Activity in Connection with Computers Act
D) Computer Security Act of 1987

Question 44

In an investigation,once the evidence is acquired,both the ____ and the ____ should be handled so as to avoid legal challenges based on authenticity and preservation of integrity.

A) affidavit; search warrant
B) evidence; forensic report
C) copy image; original drive
D) suspect's computer; data backup

Question 45

The ____ regulates interception and disclosure of electronic information and is also referred to as the Federal Wiretapping Act.

A) Computer Fraud and Abuse Act
B) Sarbanes-Oxley Act
C) U.S.A. Patriot Act
D) Electronic Communications Privacy Act

Question 46

Which law requires all federal computer systems that contain classified information to have security plans in place?

A) The Telecommunications Deregulation and Competition Act
B) National Information Infrastructure Protection Act
C) Federal Privacy Act
D) The Computer Security Act

Question 47

____ law is classified as a private law.

A) Commercial
B) Administrative
C) Criminal
D) Constitutional

Question 48

Strong procedures for the handling of potential evidentiary material can minimize the probability of an organization's losing a legal challenge.Organizations should develop specific procedures,along with guidance on the use of these procedures.The policy document should specify all but which of the following?

A) Who may conduct an investigation
B) What methodology should be followed
C) Who may authorize an investigation
D) All of these should be specified

Question 49

Security of health information is a principle of the ____.

A) FOIA
B) HIPAA
C) DMCA
D) EEA

Question 50

Which law categorizes crimes based on a defendant's authority to access a protected computer system and criminal intent?

A) USA Patriot Act of 2001
B) Computer Fraud and Abuse Act of 2001
C) National Information Infrastructure Protection Act of 1996
D) Computer Security Act of 1987

Question 51

In digital forensics,all investigations follow the same basic methodology.Which of the following should be performed FIRST in a digital forensics investigation?

A) Report the findings to the proper authority
B) Acquire (seize) the evidence without alteration or damage
C) Identify relevant items of evidentiary value (EM)
D) Analyze the data without risking modification or unauthorized access

Question 52

____ is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences and is also known as duty- or obligation-based ethics.

A) Applied ethics
B) Descriptive ethics
C) Normative ethics
D) Deontological ethics

Question 53

Which law governs the federal agency use of personal information?

A) The Telecommunications Deregulation and Competition Act of 1996
B) Computer Security Act of 1987
C) USA Patriot Act of 2001
D) Federal Privacy Act of 1974

Question 54

Most organization cannot sustain a permanent digital forensics team.In most organizations,such expertise is so rarely called upon that it may be better to collect the data and then outsource the analysis component to a ____.

A) law enforcement officer
B) regional expert
C) security management organization
D) crime scene investigator

Question 55

Enacted in 1999,the Gramm-Leach-Bliley Act addresses ____ issues.

A) financial
B) trade secrets
C) cryptography
D) identity theft

Question 56

____ law is pursued in civil court and is not prosecuted by the state.

A) Civil
B) Criminal
C) Tort
D) Public

Question 57

The ____ provides guidelines for the use of electronic signatures based on security standards in order to ensure message integrity,user authentication,and nonrepudiation.

A) HIPAA
B) FOIA
C) EEA
D) DMCA

Question 58

The ____ was enacted to prevent abuse of information while employed elsewhere.

A) Electronic Communications Privacy Act of 1986
B) Public Company Accounting Reform and Investor Protection Act of 2002
C) Economic Espionage Act of 1996
D) Financial Services Act of 1999

Question 59

The Economic Espionage Act addresses the area of ____.

A) criminal intent
B) trade secrets
C) accountability
D) cryptography

Question 60

____ law is classified as a public law.

A) Commercial
B) Administrative
C) Labor
D) Family

Question 61

Founded in 1989,____ has a membership of over 156,000 security professionals,auditors,system administrators,and network administrators.

A) (ISC)²
B) ISACA
C) ISSA
D) SANS

Question 62

There are three general categories of unethical behavior that organizations and society should seek to eliminate.Which of the following is NOT one of them?

A) Ignorance
B) Deterrence
C) Accident
D) Intent

Question 63

____ law embodies a wide variety of laws pertaining to relationships between and among individuals and organizations.

A) Civil
B) Criminal
C) Ethical
D) Tort

Question 64

Which of the following organizations does not promote a particular code of ethics?

A) SANS
B) ISACA
C) (ISC)²
D) CSI

Question 65

Laws and policies and their associated penalties only deter if three conditions are present.Which of the following is NOT one of them?

A) Fear of penalty
B) Probability of being caught
C) Probability of penalty being administered
D) Probability of prosecution

Question 66

The ____ is a professional organization that was established in 1947 as the world's first educational and scientific computing society.

A) SANS
B) ACM
C) (ISC)²
D) CSI

Question 67

Which of the following is a U.S.-based international effort to reduce the impact of copyright,trademark,and privacy infringement?

A) Federal Privacy Act
B) The Electronic Communications Privacy Act
C) Digital Millennium Copyright Act
D) Computer Fraud and Abuse Act

Question 68

Laws and policies and their associated penalties only deter if three conditions are present.Which of the following is NOT one of these conditions?

A) Fear of penalty
B) Probability of being caught
C) Fear of social contempt
D) Probability of penalty being administered

Question 69

The ____ is a nonprofit organization that is focused on the development and implementation of information security certifications and credentials including the CISSP.

A) (ISC)²
B) SANS
C) ISACA
D) ISSA

Question 70

Any court can impose its authority over an individual or organization if it can establish ____,a court's right to hear a case if the act was committed in its territory or involving its citizenry.

A) Jurisprudence
B) Jurisdiction
C) Liability
D) Restitution

Question 71

____ requires that an organization make a valid and ongoing effort to protect others.

A) Liability
B) International law
C) Due diligence
D) Jurisdiction

Question 72

Under the U.S.legal system,any court can impose its authority over an individual or organization if it can establish ____ - a court's right to hear a case if the act was committed in its territory or involving its citizenry.

A) liability
B) jurisdiction
C) restitution
D) due diligence

Question 73

The organizations must choose one of two approaches when employing digital forensics; ____ and ____.

A) Protect and forget; Apprehend and prosecute
B) Protect and prosecute; Apprehend and pursue
C) Patch and proceed; Protect and forget
D) Pursue and prosecute; Identify and apprehend

Question 74

Which of the following ethical frameworks is the study of the choices that have been made by individuals in the past; that is,what do others think is right?

A) Applied ethics
B) Descriptive ethics
C) Normative ethics
D) Deontological ethics

Question 75

____ is the coherent application of methodical investigatory techniques to present evidence of crimes in a court or court-like setting.

A) Root cause analysis
B) Digital malfeasance
C) Forensics
D) Evidentiary procedures

Question 76

A crime against or using digital media,computer technology,or related components (computer as source or object of crime)is referred to as ____.

A) root cause analysis
B) evidentiary material
C) digital malfeasance
D) digital forensics

Question 77

____ is the best method for preventing an illegal or unethical activity.Examples include laws,policies and technical controls.

A) Remediation
B) Deterrence
C) Prosecution
D) Regulation

Question 78

The ____ ethical approach emphasizes that an ethical action is one that results in the most good,or the least harm.

A) Utilitarian
B) Rights
C) Virtue
D) Common Good

Question 79

The U.S.Congress enacted the ____,which is designed to enforce accountability for the financial record keeping and reporting at publicly traded corporations.

A) Sarbanes-Oxley Act
B) Gramm-Leach-Bliley Act
C) Federal Privacy Act
D) Computer Fraud and Abuse Act

Question 80

Personal information is defined as:

A) Personally identifiable data about a customer's medical condition, if the data are not generally considered to be public knowledge
B) Personally identifiable data provided by a customer to a business upon opening an account or applying for a loan or credit
C) Personally identifiable data about a customer's federal, state, or local income tax return
D) All of these