Deck 5: IT Security, crime, compliance, and Continuity

Question 1

Crime can be divided into two categories depending on the tactics used to carry out the crime.What are those two categories?

A)personal and non-personal
B)felonies and misdemeanors
C)insider and outsider
D)violent and nonviolent

Answer 1

D

Question 2

__________ is the ability of an IS to continue to operate when a failure occurs,usually operating for a limited time or at a reduced level.

A)Botnet
B)Exposure
C)Fault tolerance
D)Spoofing

Answer 2

C

Question 3

Internal fraud prevention and detection measures are based on __________ and __________.

A)a detailed recovery plan;containment,including a fault-tolerant system
B)perimeter defense technologies,such as e-mail scanners;human resource procedures,such as recruitment screening
C)general controls;application controls
D)physical controls,including authorization;authentication systems

Answer 3

B

Question 4

Who stole account data from HSBC's Private Bank in Switzerland and how did HSBC learn about the data theft?

A)Account data was stolen by a former HSBC IT specialist;HSBC learned about the theft from French Authorities several years after the theft.
B)Account data was stolen by a group of hackers who cracked passwords;HSBC detected the data theft from their IT staff within a few days.
C)Malware was used to steal the account data;network intrusion detection systems detected the theft as it was happening.
D)Competitors stole the account data;HSBC learned about the theft months later when customers complained about identity theft.

Question 5

When new vulnerabilities are found in operating systems,applications,or wired and wireless networks,vendors of those products release __________ or __________ to fix the vulnerabilities.

A)patches;service packs
B)patches;downloads
C)firewalls;spyware
D)service packs;firewalls

Question 6

Facebook,YouTube,Twitter,LinkedIn,and other social networks are making IT security dangers worse.Why?

A)Users invite in and build relationships with others.Cybercriminals hack into these trusted relationships using stolen log-ins.
B)E-mail viruses and malware have been increasing for years even though e-mail security has improved.
C)Communication has shifted from social networks to smartphones.
D)Web filtering,user education,and strict policies cannot help prevent IT security dangers on Facebook and other social networks.

Question 7

A majority of data breaches involve:

A)insider error or action that is either intentional or unintentional.
B)insider action that is intentional.
C)former employees and IT staff.
D)hackers.

Question 8

Prior to 2002,what was the common perspective on infosec?

A)Infosec was mostly a financial issue assigned to the accounting department.
B)The focus was on preemptive approaches to protect ahead of the threats.
C)The biggest concerns were risks from employees and malware.
D)Infosec was viewed as a cost rather than as a resource for preventing business disruptions.

Question 9

Which of the following is not a characteristic of IT security?

A)IT security is so integral to business objectives that it cannot be treated as a stand-alone function.
B)Internal threats are not a major challenge because firewalls prevent employee malicious activity.
C)Infosec failures have a direct impact on business performance,customers,business partners,and stakeholders.
D)Infosec failures can lead to fines,legal action,and steep declines in stock prices as investors react to the crisis.

Question 10

Hackers involve unsuspecting insiders in their crimes using tactics called __________ that trick insiders into revealing access codes that outsiders should not have.

A)social engineering
B)phishing
C)spoofing
D)botnets

Question 11

Managers have a legal and ethical obligation,which is called __________,to protect the confidential data of the people and partners that they collect,store,and share.

A)security duty
B)fiduciary responsibility
C)confidentiality contract
D)secrecy function

Question 12

__________ is the elapsed time between when vulnerability is discovered and when it's exploited and has shrunk from months to __________.

A)Time-to-exploitation;weeks
B)Time-to-exploitation;minutes
C)Denial of service;days
D)Denial of service;seconds

Question 13

A(n)__________ is the probability of a threat exploiting a vulnerability.

A)threat
B)risk
C)vulnerability
D)exploit

Question 14

Which of the following is not one of the essential defenses against botnets and malware?

A)Anti-malware tools and anti-virus software
B)Intrusion detection systems (IDS)
C)Spyware and warez software
D)Intrusion prevention systems (IPS)

Question 15

Which of the following is a characteristic of information security in organizations?

A)losses due to IT security breaches can destroy a company financially
B)disruptions due to IT security breaches can seriously harm a company operationally
C)to comply with international,federal,state,and foreign laws,companies must invest in IT security to protect their data,other assets,the ability to operate,and net income
D)All of the above

Question 16

IT risk management includes all of the following except:

A)keeping information security convenient for users and inexpensive.
B)securing corporate systems while ensuring their availability.
C)planning for disaster recovery and business continuity.
D)complying with government regulations and license agreements.

Question 17

Protecting data and business operations involves all of the following efforts except:

A)making data and documents available and accessible 24x7 while also restricting access.
B)implementing and enforcing procedures and acceptable use policies for company-owned data,hardware,software,and networks.
C)storing and archiving all databases and data warehouses on-site protected by firewalls.
D)recovering from business disasters and disruptions quickly.

Question 18

A(n)__________ is something or someone that may result in harm to an asset.

A)threat
B)risk
C)vulnerability
D)exploit

Question 19

A(n)__________ occurs when a server or Web site receives a flood of traffic-much more traffic or requests for service than it can handle,causing it to crash.

A)advanced persistent threat (APT)
B)spoofing attack
C)malware intrusion
D)denial of service (DoS)attack

Question 20

Which of the following is not a characteristic of money laundering and terrorist financing?

A)Transnational organized crime groups use money laundering to fund their operations,which creates international and national security threats.
B)Cybercrime is safer and easier than selling drugs,dealing in black market diamonds,or robbing banks.
C)Funds used to finance terrorist operations are easy to track,which provides evidence to identify and locate leaders of terrorist organizations and cells.
D)Online gambling offers easy fronts for international money-laundering operations.

Question 21

Which of the following is not a type of administrative control for information assurance and risk management?

A)Fostering company loyalty
B)Immediately revoking access privileges of dismissed,resigned,or transferred employees
C)Instituting separation of duties by dividing sensitive computer duties among as many employees as economically feasible
D)Performing authorization and authentication

Question 22

Locking a Blackberry does not provide strong data protection.Why?

A)Security company IronKey reported that password cracking software can quickly copy the contents of a BlackBerry's SD card and crack a 4-digit PIN in 30 seconds.
B)Password cracking software can crack security on a handheld device without alerting the owner that the device's security has been compromised.
C)password cracking software can store log-in information for the cracked handheld,allowing a hacker to access the hacked device again,unless the user changes the password.
D)All of the above.

Question 23

The objective of IT security management practices is to defend __________.

A)data and data processing capabilities
B)hardware and software applications and wireless devices
C)data and networks
D)data,hardware,software applications,and networks

Question 24

A __________ is a system,or group of systems,that enforces an access-control policy between two networks.

A)firewall
B)switch
C)router
D)gateway

Question 25

__________ refers to the deliberate misuse of the assets of one's employer for personal gain.

A)Corruption
B)Conflict of interest
C)Occupational fraud
D)Earnings management

Question 26

When dealing with consumer-facing applications,such as online banking and e-commerce,strong authentication must be balanced with __________.

A)convenience
B)encryption
C)authorization
D)all of the above

Question 27

Fraud is nonviolent crime that is carried out using __________.

A)a gun,knife,or other small weapon
B)deception,confidence,and trickery
C)embezzlement and electronic transfers of money
D)bribery and threats

Question 28

Fraud management starts with corporate governance culture and ethics __________.

A)in the accounting department
B)in the IT department
C)at the top levels of the organization
D)at the lowest levels of the organization

Question 29

Bernard Madoff is in jail after pleading guilty in 2009 to the biggest fraud in Wall Street history.Madoff carried out his fraud over four decades by relying on __________.

A)financial expertise and human error
B)social engineering and the predictability of human nature
C)red flags and accounting loopholes
D)unbelievable returns that defied the market

Question 30

What is the most cost-effective approach to managing fraud?

A)prevention
B)detection
C)prosecution
D)compliance

Question 31

__________ is a security technology for wireless networks that improves on the authentication and encryption features of WEP.

A)Network access control (NAC)
B)Security exchange commission (SEC)
C)Wi-Fi protected access (WPA)
D)Intrusion detection system (IDS)

Question 32

The major objective of __________ is proof of identity to identify the legitimate user and determine the action he or she is allowed to perform.

A)authorization
B)authentication
C)endpoint security
D)information assurance

Question 33

All of the following are characteristics of firewalls except:

A)Firewalls are a barrier between a corporate intranet or other internal networks and the Internet.
B)Firewalls function by deciding what traffic to allow into and out of the network and what traffic to block.
C)Firewalls must be configured to enforce the company's security procedures and policies.
D)Network firewalls stop all viruses and most other types of malware.

Question 34

Network security involves three types of defenses,which are referred to as layers.Those layers consist of each of the following except:

A)perimeter security layer to control access to the network.
B)authentication layer to verify the identity of the person requesting access to the network.
C)biometrics layer to monitor network usage.
D)authorization layer to control what authenticated users can do once they are given access to the network.

Question 35

One of the worst and most prevalent crimes is __________.

A)stolen computers
B)identity theft
C)network intrusion
D)malware

Question 36

Sensitive data that are encrypted with wired equivalent privacy (WEP)and transmitted between two wireless devices __________.

A)is fully secured
B)cannot be authenticated
C)has a moderate level of security
D)may be intercepted and disclosed

Question 37

Fingerprints,retinal scans,and voice scans for user identification are examples of __________ controls.

A)access
B)biometric
C)application
D)physical

Question 38

__________,such as AirSnort and WEPcrack,are readily available tools that can be used to gain unauthorized access to networks putting them at great risk.

A)Wireless packet analyzers
B)Password crackers
C)Firewall sniffers
D)Intrusion detectors

Question 39

Before the people who are responsible for security make any decisions about infosec defenses,they must understand __________.

A)the requirements and operations of the business
B)how firewalls,anti-virus software,and other technology function
C)tactics of hackers,fraudsters,botnets,and identity thieves
D)how much to invest in risk management

Question 40

Physical security includes several controls.Which of the following is not a type of physical control?

A)Security bonds or malfeasance insurance for key employees
B)Emergency power shutoff and backup batteries
C)Shielding against electromagnetic fields
D)Properly designed and maintained air-conditioning systems

Question 41

Firewalls and intrusion detection systems are placed throughout networks to monitor and control traffic into and out of a network.

Question 42

Symptoms of fraud that can be detected by internal controls include all of the following except:

A)missing documents.
B)delayed bank deposits.
C)employees who do not take vacations or go out of their way to work overtime.
D)large increase in network traffic.

Question 43

According to a Workplace E-Mail and Instant Messaging Survey of 840 U.S.companies,approximately__________ have had employee e-mail or text messages subpoenaed as part of a lawsuit or regulatory investigation.

A)5%
B)10%
C)20%
D)33%

Question 44

Despite the challenges organizations face trying to protect against threats from employees,insider incidents can be minimized with a layered defense strategy consisting of security procedures,acceptable use policies,and technology controls.

Question 45

There has been a steep increase in malware because of the availability of free,easy to use,powerful toolkits that even novice cyber criminals can use to develop malware.

Question 46

Today,infosec is mostly a technology issue assigned to the IT department.Incidents are handled on a case-by-case "cleanup" basis rather than by taking a preemptive approach to protect ahead of the threats.

Question 47

The Sarbanes-Oxley Act (SOX):

A)is an antifraud law.
B)forces more accurate business reporting and disclosure of GAAP (generally accepted accounting principles)violations.
C)makes it necessary to find and root out fraud.
D)All of the above

Question 48

A majority of data breaches involve some sort of insider error or action either intentional or unintentional.That is,the greatest infosec risks are employees and managers.

Question 49

IT security is so integral to business objectives that it needs to be treated as a stand-alone function.

Question 50

A fiduciary responsibility is both a legal and an ethical obligation.

Question 51

Sarbanes-Oxley Act is an antifraud law.It forces more accurate business reporting and disclosure of GAAP (generally accepted accounting principles)violations,thus making it necessary to find and root out fraud.

Question 52

__________ is the chain of events linking the business continuity plan to protection and to recovery.

A)Disaster recovery
B)Auditing
C)Date recovery
D)Internal control

Question 53

An estimated __________ of companies that suffer a significant data loss often go out of business within five years.

A)23%
B)43%
C)73%
D)93%

Question 54

Types of unintentional threats that organizations must defend against as part of their IT security measures are human errors,sabotage,environmental hazards,and computer system failures.

Question 55

The theft of confidential account data from HSBC Private Bank in Switzerland in 2007 had been done by hackers because of inadequate security controls.

Question 56

Newly released viruses with unidentified signatures or that are hidden in an e-mail attachment are blocked by firewalls and antivirus software from entering a company's network.

Question 57

The infosec defense strategies and controls depend on what needs to be protected and the cost-benefit analysis.That is,companies should neither under-invest nor over-invest.

Question 58

Corporate and government secrets are currently being stolen by a serious threat called advanced persistent threat (APT),which are designed for long-term espionage.Once installed on a network,ATPs transmit copies of documents,such as Microsoft Office files and PDFs,in stealth mode.

Question 59

In general,risk management is expensive to the organization,but convenient for users.

Question 60

Financial institutions,data processing firms,and retail businesses do not have to notify potential victims or reveal data breaches in which customers' personal financial information may have been stolen,lost,or compromised.

Question 61

__________ is the word that refers to viruses,worms,trojan horses,spyware,and all other types of disruptive,destructive,or unwanted programs.

Question 62

Why do fraud prevention and detection require an effective monitoring system?

Question 63

An important element in any security system is the __________ plan,also known as the disaster recovery plan,which outlines the process by which businesses should recover from a major disaster.

Question 64

A __________ attack occurs when a server or Web site receives a flood of traffic-much more traffic or requests for service than it can handle,causing it to crash.

Question 65

The __________ environment is the work atmosphere that a company sets for its employees in order to achieve reliable financial reporting and compliance with laws,regulations,and policies.

Question 66

Why are internal threats a major challenge for organizations? How can internal threats be minimized?

Question 67

Under the doctrine of __________ ,senior managers and directors have a fiduciary obligation to use reasonable care to protect the company's business operations.When they fail to meet the company's legal and regulatory duties,they can face lawsuits or other legal action.

Question 68

All Internet traffic,which travels as packets,should have to pass through a(n)__________ ,but that is rarely the case for instant messages and wireless traffic.

Question 69

__________ is the supervision,monitoring,and control of the organization's IT assets.COBIT is a guide to best practices in this area.

Question 70

The purpose of the PCI DSS is to improve customers'__________ in e-commerce,especially when it comes to online payments,and to increase the Web security of online merchants.

Question 71

A __________ control is an automated method of verifying the identity of a person,based on physical or behavioral characteristics,such as a fingerprint or voice scan.

Question 72

Implementing security programs raises many ethical issues.Identify two of these ethical issues.

Question 73

Why do social networks and cloud computing increase IT security risks? How can those risks be reduced?

Question 74

From an infosec perspective,__________ has been used by criminals or corporate spies to trick insiders into revealing information or access codes that outsiders should not have