Deck 10: Information Systems Security

Question 1

Molly received a call from a person claiming to be her bank representative. The representative asked her to verify her bank account details and credit card number. A few days after the call Molly noticed unusual activity on her account; a large sum had been withdrawn. Molly was a victim of ________.

A)hacking
B)usurping
C)sniffing
D)pretexting

Answer 1

D

Question 2

________ occurs through human error when employees do not follow proper procedures or when procedures have not been well designed.

A)Unauthorized data disclosure
B)Incorrect data modification
C)Denial of service
D)Loss of infrastructure

Answer 2

B

Question 3

Email spoofing is a synonym for ________.

A)hacking
B)phishing
C)usurping
D)sniffing

Answer 3

B

Question 4

Spoofing occurs when a person receives a confidential text message by mistake.

Question 5

________ is a technique for intercepting computer communications through a physical connection to a network or without a physical connection in the case of wireless networks.

A)Spoofing
B)Phishing
C)Sniffing
D)Pretexting

Question 6

________ take computers with wireless connections through an area and search for unprotected wireless networks, and then monitor and intercept wireless traffic on unsecured wireless networks.

A)Keyloggers
B)Pretexters
C)Wardrivers
D)Phishers

Question 7

Which of the following usually happens in a malicious denial-of-service attack?

A)A hacker monitors and intercepts wireless traffic at will.
B)A hacker floods a Web server with millions of bogus service requests.
C)An intruder uses another site's IP address to masquerade as that other site.
D)A phisher pretends to be a legitimate company and requests confidential data.

Question 8

A computer crime is committed if an employee inadvertently installs an old database on top of the current one.

Question 9

Which of the following is considered a threat caused by human error?

A)an employee inadvertently installing an old database on top of the current one
B)an employee intentionally destroying data and system components
C)a virus and worm writer infecting computer systems
D)a hacker breaking into a system to steal for financial gain

Question 10

A ________ is a person or an organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge.

A)target
B)vulnerability
C)threat
D)key escrow

Question 11

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own, unauthorized ones that shut down legitimate applications.

A)Encryption
B)Spoofing
C)Phishing
D)Usurpation

Question 12

Phishing is a technique for intercepting computer communications.

Question 13

Kate was among the top ten applicants for an honorary scholarship at her university. The scholarship would be decided by a written exam and an interview. Kate had outperformed the others in the interview, but she was not sure of her written exam's results. She illegally accessed the system where the final results were stored and changed her grades before the results were sent out to the scholarship committee. Kate's act can be termed as ________.

A)pretexting
B)phishing
C)hacking
D)spoofing

Question 14

Kenneth is working on a confidential government project. Daniel, a coworker, and he are the only two members who are authorized to access the project's information system. Kenneth, while away on a business trip, receives an email from Daniel asking for his login credentials as Daniel was unable to access the system. Kenneth finds the request unusual, and calls Daniel to confirm if the email was sent by him. Kenneth deletes the email when he learns that Daniel had not sent it. This scenario is an example of attempted ________.

A)hacking
B)phishing
C)sniffing
D)wardriving

Question 15

Unauthorized data disclosure is possible due to human error.

Question 16

Which of the following is considered a computer crime?

A)accidental deletion of important records
B)poorly written programs resulting in information loss
C)loss of data as a result of flooding
D)hacking of information systems

Question 17

Which of the following is most likely to be a result of hacking?

A)certain Web sites being censored for hurting sentiments
B)small amounts of spam in a user's inbox
C)an unauthorized transaction from a user's credit card
D)pop-up ads appearing frequently

Question 18

In the context of security threats, pretexting, sniffing, spoofing, and phishing are all examples of ________.

A)unauthorized data disclosure
B)incorrect data modification
C)faulty services
D)loss of infrastructure

Question 19

________ present(s)the largest risk for an organization's infrastructure loss.

A)Employees' dissatisfaction
B)Natural disasters
C)Hackers
D)Competitors

Question 20

Which of the following is a sniffing technique?

A)IP spoofing
B)caches
C)denial of service
D)adware

Question 21

Describe the magnitude of security problems in the present day.

Question 22

Define pretexting, phishing, spoofing, and sniffing.

Question 23

The losses due to human error are minimal, and hence, organizations tend to ignore these losses.

Question 24

What is meant by denial of service?

Question 25

Nonword passwords are vulnerable to a ________ attack in which the password cracker tries every possible combination of characters.

A)denial-of-service
B)sniffing
C)brute force
D)phishing

Question 26

________ are small files that enables a browser to access Web sites without having to sign in every time.

A)Cookies
B)Botnets
C)Payloads
D)Public keys

Question 27

Sniffing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 28

Which of the following is a personal security safeguard?

A)sending valuable data only via email or IM
B)using single password for all the sites
C)removing high-value assets from computers
D)storing browsing history, temporary files, and cookies

Question 29

A denial-of-service attack is launched when a hacker floods a Web server with millions of bogus service requests.

Question 30

What are the three general sources of security threats?

Question 31

Email spoofing is a synonym for phishing.

Question 32

List various personal security safeguards.

Question 33

Cookies enable an individual to access Web sites without having to sign in every time.

Question 34

Define threat, vulnerability, safeguard, and target.

Question 35

Removing and disabling ________ that may contain sensitive security data presents an excellent example of the trade-off between improved security and cost.

A)bookmarks
B)pop-ups
C)cookies
D)toolbars

Question 36

Which of the following statements is true about losses due to computer security threats?

A)Surveys on computer crimes provide accurate results since they use standard parameters to measure and tally computer crime costs.
B)Surveys suggest that some organizations do not report all their computer crime losses, and some will not report such losses at all.
C)Losses due to natural disasters can be measured accurately.
D)Losses due to human error are insignificant.

Question 37

One of the personal security safeguards is to use https at trusted, reputable vendors.

Question 38

Most emails and IMs are protected by encryption.

Question 39

Faulty service excludes problems that result due to incorrect data modification.

Question 40

Natural disasters present the largest risk for infrastructure loss.

Question 41

What is the basic information that a security policy must stipulate?

Question 42

A ________ examines each part of a message and determines whether to let that part pass.

A)packet-filtering firewall
B)private key
C)mail server
D)wardriver

Question 43

Which of the following statements is true about biometric identification?

A)It involves the use of a personal identification number (PIN)for authentication.
B)It provides weak authentication.
C)It is a relatively inexpensive mode of authentication.
D)It often faces resistance from users for its invasive nature.

Question 44

Mark is transferring funds online through the Web site of a reputed bank. Which of the following will be displayed in the address bar of his browser that will let him know that the bank is using the Secure Sockets Layer (SSL)protocol?

A)ftp
B)www
C)https
D))com

Question 45

Packet-filtering firewalls ________.

A)can filter both inbound and outbound traffic
B)examine the destination address but not the source address
C)are the most complex type of firewall
D)seldom examine the data or the addresses of the message

Question 46

In the context of malware protection, the program code that causes the unwanted actions is called the ________.

A)payload
B)kernel
C)bot herder
D)key escrow

Question 47

Which of the following is classified as a technical safeguard?

A)cookies
B)firewalls
C)key escrow
D)passwords

Question 48

Which of the following was passed to give individuals the right to access their own health data created by doctors and other healthcare providers?

A)the Privacy Act of 1974
B)the Sarbanes-Oxley Act
C)the HIPAA of 1996
D)the Gramm-Leach-Bliley Act

Question 49

A ________ is a string of bits used to encrypt data.

A)key
B)honeypot
C)cookie
D)cache

Question 50

Secure Sockets Layer is also known as ________.

A)Advanced Persistent Threat Layer
B)Transport Layer Security
C)Presentation Interface Layer
D)Network Interface Layer Security

Question 51

Which of the following is a critical security function that should be addressed by the senior management of an organization?

A)sharing the private key with all systems connected to the network
B)creating IS security software programs
C)establishing the security policy
D)avoiding the use of perimeter firewalls

Question 52

________ are viruses that masquerade as useful programs or files.

A)Adware programs
B)Spyware programs
C)Trojan horses
D)Worms

Question 53

Which of the following is used for biometric authentication?

A)smart cards
B)facial features
C)passwords
D)personal identification numbers

Question 54

With ________, the sender and receiver transmit a message using different keys.

A)asymmetric encryption
B)a block cipher
C)symmetric encryption
D)a stream cipher

Question 55

In information security, which of the following is true about managing risk?

A)All organizations except financial institutions should invest heavily in security safeguards.
B)Organizations should implement safeguards that balance the trade-off between risk and cost.
C)Passwords are classified as technical safeguards.
D)Physical security is classified as human safeguards.

Question 56

A(n)________ has a microchip in it to hold data.

A)ATM card
B)smart card
C)cookie
D)key escrow

Question 57

In asymmetric encryption, each site has a ________ for encoding messages.

A)botnet
B)private key
C)public key
D)cookie

Question 58

Which of the following statements is true about the Secure Sockets Layer (SSL)?

A)It uses asymmetric encryption exclusively.
B)It is used to send sensitive data such as credit card numbers.
C)It uses one set of encryption keys for multiple sessions.
D)It is a stronger version of https.

Question 59

Users of smart cards are required to enter a ________ to be authenticated.

A)Social Security number
B)public key
C)personal identification number
D)private key

Question 60

________ is a broad category of software that includes viruses, spyware, and adware.

A)Malware
B)Cookie
C)Firewall
D)Spam

Question 61

________ is a function pertaining to a particular database that develops procedures and practices to control and protect the database.

A)Data encryption
B)Database administration
C)Data authentication
D)Database normalization

Question 62

Key escrow is a(n)________.

A)protocol used to secure communication over the internet
B)safety procedure that allows a trusted party to have a copy of the encryption key
C)device that prevents unauthorized network access
D)encryption algorithm that uses both public and private keys

Question 63

________ refers to an organization-wide function that is in charge of developing data policies and enforcing data standards.

A)Data administration
B)Authentication
C)Usurpation
D)Data encryption

Question 64

Which of the following is likely to be accepted by a poorly designed application thereby leading to improper disclosure of data?

A)public key
B)asymmetric encryption
C)key escrow
D)SQL injection

Question 65

Symmetric encryption is simpler and much faster than asymmetric encryption.

Question 66

Secure Sockets Layer (SSL)is a protocol that is restricted to asymmetric encryption.

Question 67

Improper data disclosure and data damage and loss are possible consequences of an SQL injection attack.

Question 68

What are spyware and adware programs?

Question 69

What is a virus? Differentiate between Trojan horses and worms.

Question 70

Most spyware programs are benign in that they do not perform malicious acts or steal data.

Question 71

Define encryption and explain symmetric and asymmetric encryption for computer systems.

Question 72

Technical safeguards involve the hardware and software components of an information system.

Question 73

A ________ is a type of virus that self-propagates using the Internet or other computer network.

A)worm
B)sniffer
C)Trojan horse
D)phisher

Question 74

________ protect databases and other organizational data.

A)Cookies
B)Payloads
C)Data safeguards
D)Data strings

Question 75

Describe six malware safeguards.

Question 76

A magnetic strip holds far more data than a microchip.

Question 77

A Trojan horse is a virus that masquerades as a useful program or file.

Question 78

Biometric authentication uses physical characteristics such as retinal scans to authenticate users.

Question 79

Which of the following statements is true about data administration?

A)It is a line function to the chief information officer.
B)It merely involves developing data policies.
C)It applies to individuals and not to the entire organization.
D)It is involved in establishing data safeguards.

Question 80

Sarah was browsing an online shopping site when a program got downloaded onto her system without her knowledge. The next day she found that her search engine had been changed, and she received pop-up advertisements of the shopping site she had visited the previous day. The program on Sarah's system is ________.

A)a cookie
B)adware
C)a payload
D)a Trojan horse