Deck 10: Ethics, Privacy, and Security

Question 1

The incidence response plan is used by organizational staff to categorize threats, determine the cause, preserve evidence, and get the systems back online.

Answer 1

True

Question 2

Phishing attacks tend to start with an email luring users to click on a link.

Answer 2

True

Question 3

Liability is a powerful driver for surveillance as employers are held responsible for employees' offensive emails or web-surfing habits.

Answer 3

True

Question 4

Laws cover all ethical principles because they are grounded in ethical principles.

Question 5

Plagiarism refers to borrowing the words of another and crediting the source.

Question 6

When a person tries to judge what action would create the greatest good for the greatest number, he or she is using a utilitarian scheme.

Question 7

A drawback of using proxy servers for online anonymity is the need to rely on the company that operates the proxy servers and its promise to protect its customers' identities.

Question 8

Trade secrets, software, patents, and copyrighted works comprise intellectual property.

Question 9

The single sign-on is a gateway service that permits users to log in once with a single user ID and password to gain access to multiple software applications.

Question 10

A cognitive obstacle to strong passwords is the limited capacity of human memory.

Question 11

Using fake names, nicknames, free email, and public computers ensures that one is perfectly anonymous on the Internet.

Question 12

Biometric identifiers refer to something the user knows, such as a user ID, password, PIN, or answer to a security question.

Question 13

All ethical actions are legal, but not all legal actions are ethical.

Question 14

A computer which is infected with malware and is added to a group's growing botnet is known as a zombie.

Question 15

The downside of using surveillance techniques at work is that it pits management against staff.

Question 16

Social engineering refers to extracting confidential information from information systems through legal procedures.

Question 17

Botnets are computers configured with specific vulnerabilities so they can attract different varieties of malware in the wild, study their properties, and find out who started them.

Question 18

Laws always result from the pushes and pulls of lobbying efforts and political pressures and have nothing to do with ethics.

Question 19

Honeypots are human-made threats that barrage servers and computers every day with automated attempts to install all types of malware.

Question 20

Digitization of intellectual property (IP)results in better enforcement of IP laws.

Question 21

Which of the following is an accurate definition of digital rights management?

A)It deals with provisions that protect the privacy and security of individually identifiable health information.
B)It refers to technologies that intellectual property owners use to control access to their digital content.
C)It prohibits businesses from sending misleading or deceptive commercial emails, but denies recipients any legal digital recourse on their own.
D)It establishes privacy rights over educational records.

Question 22

________ is a type of intellectual property theft that involves reproducing the words of another and passing them off as one's own original work, without crediting the source.

A)Shadowing
B)Plagiarism
C)Incitement
D)Embezzlement

Question 23

Digital rights management offers IP holders the benefit of ________.

A)preventing loss of critical organization data
B)collaborating online to create open source products
C)adding visual appeal to their digital products
D)offering technological protection for their products

Question 24

A drawback of online anonymity is that it ________.

A)protects whistleblowers and oppressive governments
B)increases inhibitions in online communication
C)increases accountability of users
D)protects spammers and imposters

Question 25

Which of the following principles is consistent with the natural laws and rights ethical framework?

A)First, do no harm
B)Thou shalt not kill
C)The greatest good for the greatest number
D)The needs of the many outweigh the needs of the few

Question 26

Which of the following is a drawback of digital rights management encountered by users today?

A)DRM systems prevent legitimate duplication of digital content in the event of hardware failure.
B)DRM systems do not function efficiently across geographical borders.
C)DRM systems often violate intellectual property rights of creators of IP.
D)DRM systems do not consistently manage the different formats of digital content.

Question 27

________ is an ethical framework that judges the morality of an action based on how well it adheres to broadly accepted rules, regardless of the action's actual consequences.

A)Utilitarianism
B)Legal positivism
C)Natural laws and rights
D)Rationalism

Question 28

Margaret O'Connor is an upcoming poet from Georgia who recently updated her blog with her piece of writing titled, "Shadows." One of her readers copied her piece onto his own blog and passed it off as his original work. This is an example of ________.

A)online identity theft
B)embezzlement
C)shadowing
D)plagiarism

Question 29

________ is a widely accepted ethical system that considers the greatest good for the greatest number and considers the consequences of an action, weighing its positive effects against its harmful ones.

A)Structuralism
B)Individualism
C)Utilitarianism
D)Libertarianism

Question 30

Which of the following statements is true of natural laws and rights?

A)Natural laws and rights does not consider the actual consequences of an action when judging its morality.
B)Natural laws and rights is an ethical framework that takes into account the effects of an action, weighing its good effects against its harmful ones.
C)Natural laws and rights involves judging what action would create the greatest good for the greatest number of people.
D)Natural laws and rights is a framework based on the central tenet that states, "The needs of the many outweigh the needs of the few."

Question 31

________ refers to a system of moral principles that human beings use to judge right and wrong and to develop rules of conduct.

A)Religion
B)Ethics
C)Creativity
D)Theology

Question 32

Under which of the following circumstances is information privacy most difficult to achieve?

A)when information is stored on highly interconnected systems
B)when information is mainly on paper
C)when information is maintained on isolated systems
D)when information is converted to code form using mathematical equations

Question 33

Which of the following is an advantage of online anonymity?

A)It increases individuals' accountability and makes them feel responsible for their own actions.
B)It helps in the prosecution of spammers, astroturfers, and other cyber criminals.
C)It helps people participate in face-to-face meetings where they reveal personal details without fear of disclosure.
D)It protects corporate whistleblowers and political activists in oppressive regimes.

Question 34

Which of the following principles is consistent with the utilitarian ethical framework?

A)First, do no harm
B)Thou shalt not kill
C)Protect free speech
D)Liberté, égalité, fraternité

Question 35

Which of the following statements is true of information privacy?

A)It is most easily achieved online and is impossible to maintain on paper.
B)It is governed by laws that are universal in all countries.
C)It refers to the protection of data about individuals.
D)It emphasizes the importance of sharing data over protecting personally identifiable information.

Question 36

Enforcing intellectual property laws becomes difficult when ________.

A)it is used for commercial purposes
B)the protection of intellectual property involves immovable assets
C)it is digitized
D)it comprises tangible assets

Question 37

________ consists of intangible assets which are expressions of the human mind that give the creator of the property the right to its commercial value.

A)Immovable property
B)Freehold property
C)Intellectual property
D)Public property

Question 38

Which of the following is an example of intellectual property owned by an IT firm?

A)software code
B)real estate
C)office stationery
D)legal documents

Question 39

Halcyon, an e-publisher, has recently decided to use an information system that administers the way its customers access its online publications. The system assigns each customer with a unique ID, maintains records of the books purchased by them, encrypts electronic documents for transmission, and includes options to order hard copies of the electronic documents they read online. Which of the following refers to the set of technologies used in this case?

A)online identity management
B)digital rights management
C)Internet resource management
D)inventory management

Question 40

Which of the following is an element of privacy?

A)the right to be left alone
B)the right to view, correct, and edit private, protected information
C)the right to withhold taxes
D)the right to demand information

Question 41

________ are used to monitor email, web surfing, and other online communications in organizations.

A)Proxy servers
B)Surveillance technologies
C)Trojan horses
D)Subnetworks

Question 42

A ________ is an intermediary server that receives and analyzes requests from clients and then directs them to their destinations.

A)captive portal
B)proxy
C)firewall
D)keylogger

Question 43

Which of the following is a reason why employers adopt surveillance technologies to track online communications?

A)to increase employee productivity
B)to enable efficient data mining
C)to prevent data redundancy
D)to facilitate faster communication

Question 44

A ________ is a self-replicating program that sends copies to other nodes on a computer network and may contain malicious code intended to cause damage.

A)honeypot
B)worm
C)Trojan horse
D)cookie

Question 45

Which of the following statements is true of honeypots?

A)They deny the entry or exit of specific IP addresses, products, Internet domains, and enforce other communication restrictions.
B)They are highly restrictive programs that permit communication only with approved entities and/or in an approved manner.
C)They traverse available web links in an attempt to discover documents for indexing and retrieval.
D)They have specific vulnerabilities that attract different varieties of malware in the wild, study their properties, and find out who started them.

Question 46

The term ________ refers to configured computers with specific vulnerabilities so they can attract different varieties of malware in the wild, study their properties, and find out who started them.

A)expert systems
B)web crawlers
C)honeypots
D)server farms

Question 47

The term ________ refers to a seemingly harmless or useful program that installs malicious code allowing remote access to a computer, as for a botnet.

A)honeypot
B)Trojan horse
C)firewall
D)black swan

Question 48

Lora Jones is a security expert hired by a Manhattan-based law firm to perform a formal risk assessment of the firm's data assets. Which of the following steps should she undertake first in order to assess the firm's readiness to face any potential security breaches?

A)understanding which information assets need protection
B)evaluating controls and filling in security gaps
C)predicting future risks and devising strategies to prevent them
D)recovering existing assets from damage

Question 49

The term ________ refers to software that monitors a user's activity on a computer and on the Internet, often installed without the user's knowledge.

A)honeypot
B)browser
C)black swan
D)spyware

Question 50

The term ________ refers to a collection of computers that have been compromised by malware, often through some vulnerability in their software or operating system.

A)honeypot
B)botnet
C)Trojan horse
D)black swan

Question 51

When does a computer become a zombie?

A)when it becomes immune to botnets
B)when it enters a secure site
C)when it is infected by malware
D)when it is hidden behind a firewall

Question 52

Botnets function with the use of ________.

A)malware
B)middleware
C)application software
D)firmware

Question 53

Which of the following is a drawback of using a proxy server to ensure online anonymity?

A)the parasitic and unauthorized use of hundreds of computer systems owned by individuals for masking online identity
B)the lack of uniform and binding legislation across different countries that determines the legality of using proxy servers
C)the need to rely on the promise of the company that operates the proxy to protect its customers' identities
D)the inability to consistently ensure online anonymity, especially when government agencies are among the parties involved

Question 54

For which of the following purposes are botnets most likely to be used?

A)capturing Internet users' sensitive information
B)attracting different types of malware to track their origins
C)encrypting critical information to protect it from loss or corruption
D)tracking and eliminating computer worms and viruses

Question 55

Evelyn Birch is a freelance content writer whose desktop computer has been infected with a software program that installed itself without her knowledge. The program monitors the websites she visits, her email communications, etc. Data gathered from the monitoring activity is sent to a remotely located hacker. Which of the following is most likely to have infected Evelyn's computer?

A)spyware
B)web crawler
C)black swan
D)firewall

Question 56

Which of the following is an accurate definition of a computer virus?

A)It is a software program that can damage files or other programs.
B)It is a software program that attracts potentially malicious attacks to study their origin.
C)It is a software program that masks the browsing history and preferences of Internet users.
D)It is a software program that inspects incoming or outgoing traffic to a computer network.

Question 57

Which of the following is a negative impact of surveillance in online communications?

A)lowered productivity of employees
B)compromised company security
C)increased levels of confidentiality
D)increased pressure on corporate email systems

Question 58

Which of the following is an accurate definition of a keylogger?

A)a process which helps a user increase productivity by deleting spam emails before they reach him
B)a monitoring software that records a user's keystrokes
C)software that prevents fraudsters from hacking into email accounts
D)a program that controls permissions for web traffic into and out of a computer network

Question 59

Which of the following is an accurate definition of malware?

A)software for end-user applications such as word processors and ERP software
B)software used to test a hardware or software package
C)software used to track and prevent malicious attacks on systems
D)software designed to attack computer systems

Question 60

What is the first step involved in risk management?

A)determining the cause of damage
B)evaluating controls and filling in security gaps
C)understanding what information assets need protection
D)recovering the system from damage

Question 61

What is the step involved in risk management after vulnerabilities of an organization have been examined?

A)determination of the source of threats
B)assessment of threats
C)evaluation of controls that fill in security gaps
D)finalization of broadly defined goals

Question 62

Which of the following is an accurate definition of multifactor authentication?

A)the process of assessing authentication of reports and manuals to prevent duplication
B)the process of combining two or more authentication strategies
C)the process of assessing authentication of multiple groups using a single strategy
D)the process of assigning unique authentication information to copyrighted content in order to prevent resale

Question 63

Organizations use a(n)________ to categorize a security threat, determine its cause, preserve any evidence, and get systems back online so they can resume business.

A)risk matrix
B)incidence response plan
C)vulnerability assessment scheme
D)total quality management program

Question 64

An incidence response plan is created for the purpose of ________.

A)managing discussion forums efficiently
B)responding to customers' feedback
C)avoiding chaos and missteps
D)improving communication modes

Question 65

According to the incidence response plan, which of the following would be most useful in containing any damage caused by a security threat?

A)preserve evidence of damage done
B)reevaluate risk matrix
C)restrict system access
D)investigate system logs for evidence

Question 66

Which of the following technologies is most likely to be used by organizations as an authentication strategy?

A)intelligent character recognition
B)optical mark recognition
C)voice pattern recognition
D)blood group recognition

Question 67

Which of the following methods is often used for phishing purposes?

A)posting harmless videos on websites
B)monitoring a user's keystrokes
C)soliciting personal information through emails
D)infecting computers with self-replicating programs that slow down the systems

Question 68

A(n)________ lists out and rates the vulnerabilities of an organization.

A)risk matrix
B)incidence response plan
C)public key encryption scheme
D)social engineering plan

Question 69

Which of the following administrative security controls is most likely to be adopted by a company which handles high-level sensitive information?

A)prohibiting downloading data to USB drives
B)restricting employee access to official mails
C)prohibiting public access to the company's website
D)prohibiting entry of employees into shared workspaces

Question 70

________ refers to an attack in which computers in a botnet are directed to flood a single website server with rapid-fire page requests, causing it to slow down or crash.

A)Distributed denial of service
B)Social engineering
C)Keylogging
D)Phishing

Question 71

One way to identify a threat in an incident response plan is to ________.

A)prosecute the offender for security risk
B)improve system efficiency
C)communicate with a crisis management team
D)preserve evidence of security breach

Question 72

________ helps in determining the cause of a security threat in an incidence response plan.

A)Reevaluating the risk matrix
B)Investigating system logs
C)Taking systems offline
D)Restricting system access

Question 73

Which of the following is true of phishing?

A)It is the process of stealing personal data from a victim by convincing him to disclose information.
B)It is useful in monitoring the web traffic into and out of an unsecured computer network.
C)It involves the use of several thousand computers to launch malicious attacks that can cripple websites.
D)It uses small pieces of code inserted into a browser that track an Internet user's activity and transmit the data to third parties.

Question 74

Which of the following authentication strategies is the most difficult to forge, crack, or copy and is hence used for physical security?

A)password
B)RFID chip
C)fingerprint scanner
D)credit card

Question 75

Which of the following authentication strategies is the easiest to compromise or crack?

A)iris configuration
B)reliance on user knowledge
C)fingerprint analysis
D)voice pattern recognition

Question 76

________ refers to an attempt to steal passwords or other sensitive information by persuading the victim to enter the information into a fraudulent website that masquerades as the authentic version.

A)Whitelisting
B)Keylogging
C)Egress filtering
D)Phishing

Question 77

Janet received an email that contained a link to a website that imitated the authentic website of her bank. The email requested her to key in her credit card number, her Social Security number, and her date of birth. She later found that her credit card was fraudulently charged for transactions she never made. It is inferred from this case that Janet is a victim of ________.

A)distributed denial of service
B)keylogging
C)phishing
D)cache poisoning

Question 78

Which of the following technologies serves as a biometric identifier for physical security?

A)iris configuration
B)RFID chip
C)credit card
D)user ID-password combination

Question 79

In Internet terminology, a worm refers to a(n)________.

A)email program created not for communication but to lure spam
B)software program that attracts malicious attacks in order to study their properties and origins
C)self-replicating program that sends copies to other nodes on a computer network
D)software tool used to inspect incoming and outgoing traffic to a computer network

Question 80

________ is one way of recovering systems in an incidence response plan.

A)Prosecuting the offender for security risk
B)Reevaluating the risk matrix
C)Restricting system access
D)Restoring from media known to be good