Deck 4: E-Commerce Security and Payment Systems

Question 1

According to Symantec, almost half of the e-mail addresses involved in business e-mail compromise (BEC) phishing that it analyzed had an IP address originating in:

A) China.
B) Russia.
C) Nigeria.
D) North Korea.

Answer 1

C

Question 2

All of the following are examples of cryptocurrencies except:

A) Ethereum.
B) Ripple.
C) Zelle.
D) Monero.

Answer 2

C

Question 3

Which of the following statements about data breaches in 2018 is not true?

A) According to the Identity Theft Resource Center, the number of breaches in 2018 decreased by almost 23% from 2017.
B) According to the Identity Theft Resource Center, almost 50% of data breaches involved social security numbers.
C) According to the Identity Theft Resource Center, employee error was the leading cause of data breaches.
D) According to the Identity Theft Resource Center, data breaches involving the business sector represented over 46% of all breaches.

Answer 3

C

Question 4

Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as:

A) spyware.
B) a backdoor.
C) browser parasite.
D) adware.

Question 5

Which of the following is not a key factor for establishing e-commerce security?

A) data integrity
B) technology
C) organizational policies
D) laws and industry standards

Question 6

________ is the ability to ensure that an e-commerce site continues to function as intended.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 7

Accessing data without authorization on Dropbox is an example of a:

A) social network security issue.
B) cloud security issue.
C) mobile platform security issue.
D) sniffing issue.

Question 8

What is the most frequent cause of stolen credit cards and card information today?

A) lost cards
B) the hacking and looting of corporate servers storing credit card information
C) sniffing programs
D) phishing attacks

Question 9

Which of the following did the Internet Advertising Bureau urge advertisers to abandon?

A) HTML
B) HTML5
C) Adobe Flash
D) Adobe Acrobat

Question 10

Which of the following is an example of an online privacy violation?

A) your e-mail being read by a hacker
B) your online purchasing history being sold to other merchants without your consent
C) your computer being used as part of a botnet
D) your e-mail being altered by a hacker

Question 11

Conficker is an example of a:

A) virus.
B) worm.
C) Trojan horse.
D) botnet.

Question 12

Which of the following is the leading cause of data breaches?

A) theft of a computer
B) accidental disclosures
C) hackers
D) DDoS attacks

Question 13

Confidentiality is sometimes confused with:

A) privacy.
B) authenticity.
C) integrity.
D) nonrepudiation.

Question 14

________ is the ability to ensure that messages and data are only available to those authorized to view them.

A) Confidentiality
B) Integrity
C) Privacy
D) Availability

Question 15

Why is it difficult to accurately estimate the actual amount of cybercrime?

Question 16

Which of the following is an example of an integrity violation of e-commerce security?

A) A website is not actually operated by the entity the customer believes it to be.
B) A merchant uses customer information in a manner not intended by the customer.
C) A customer denies that he is the person who placed the order.
D) An unauthorized person intercepts an online communication and changes its contents.

Question 17

________ is the ability to identify the person or entity with whom you are dealing on the Internet.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 18

The overall rate of online credit card fraud is ________ of all online card transactions.

A) less than 1%
B) around 5%
C) around 10%
D) around 15%

Question 19

________ is the ability to ensure that e-commerce participants do not deny their online actions.

A) Nonrepudiation
B) Authenticity
C) Availability
D) Integrity

Question 20

Typically, the more security measures added to an e-commerce site, the slower and more difficult it becomes to use.

Question 21

WannaCry is an example of ransomware.

Question 22

Which dimension(s) of security is spoofing a threat to?

A) integrity
B) availability
C) integrity and authenticity
D) availability and integrity

Question 23

FREAK is an example of a software vulnerability.

Question 24

A Trojan horse appears to be benign, but then does something other than expected.

Question 25

According to the Identity Theft Resource Center, the number of data breaches in 2018 decreased by ________ compared to 2017.

A) 13%
B) 33%
C) 23%
D) 3%

Question 26

Which of the following is not an example of malicious code?

A) scareware
B) Trojan horse
C) bot
D) sniffer

Question 27

________ typically attack governments, organizations, and sometimes individuals for political purposes.

A) Crackers
B) White hats
C) Grey hats
D) Hacktivists

Question 28

According to Ponemon Institute's 2019 survey, which of the following was not among the causes of the most costly cybercrimes?

A) malware
B) web-based attacks
C) denial of service
D) botnets

Question 29

Which of the following is not an example of a potentially unwanted program (PUP)?

A) adware
B) browser parasite
C) drive-by download
D) spyware

Question 30

IoT botnets became the preferred platform for launching DDoS attacks in 2017.

Question 31

Phishing attacks rely on browser parasites.

Question 32

Exploit kits can be purchased by users to protect their computers from malware.

Question 33

Malware that comes with a downloaded file that a user requests is called a:

A) Trojan horse.
B) backdoor.
C) drive-by download.
D) PUP.

Question 34

The attack on Dyn Inc. in 2016 is an example of which of the following?

A) SQL injection attack
B) browser parasite
C) DDoS attack
D) MitM attack

Question 35

What is the Internet of Things (IoT) and what security issues and challenges does it raise?

Question 36

Beebone is an example of which of the following?

A) worm
B) botnet
C) phishing
D) hacktivism

Question 37

Spoofing is the attempt to hide a hacker's true identity by using someone else's e-mail or IP address.

Question 38

Which of the following was designed to cripple Iranian nuclear centrifuges?

A) Stuxnet
B) Shamoon
C) Snake
D) Storm

Question 39

A drive-by download is malware that comes with a downloaded file that a user intentionally or unintentionally requests.

Question 40

Automatically redirecting a web link to a different address is an example of which of the following?

A) sniffing
B) social engineering
C) pharming
D) DDoS attack

Question 41

All of the following are methods of securing channels of communication except:

A) SSL/TLS.
B) digital certificates.
C) VPN.
D) FTP.

Question 42

All the following statements about symmetric key cryptography are true except:

A) in symmetric key cryptography, both the sender and the receiver use the same key to encrypt and decrypt a message.
B) the Data Encryption Standard is a symmetric key encryption system.
C) symmetric key cryptography is computationally slower.
D) symmetric key cryptography is a key element in digital envelopes.

Question 43

Proxy servers are also known as:

A) firewalls.
B) application gateways.
C) dual home systems.
D) packet filters.

Question 44

Next generation firewalls provide all of the following except:

A) an application-centric approach to firewall control.
B) the ability to identify applications regardless of the port, protocol, or security evasion tools used.
C) the ability to automatically update applications with security patches.
D) the ability to identify users regardless of the device or IP address.

Question 45

Which of the following statements is not true?

A) A VPN provides both confidentiality and integrity.
B) A VPN uses both authentication and encryption.
C) A VPN uses a dedicated secure line.
D) The primary use of VPNs is to establish secure communications among business partners.

Question 46

Which of the following dimensions of e-commerce security is not provided for by encryption?

A) confidentiality
B) availability
C) message integrity
D) nonrepudiation

Question 47

A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network.

A) firewall
B) virtual private network
C) proxy server
D) PPTP

Question 48

The Data Encryption Standard uses a(n) ________-bit key.

A) 8
B) 56
C) 256
D) 512

Question 49

A digital certificate contains all of the following except the:

A) subject's private key.
B) subject's public key.
C) digital signature of the certification authority.
D) digital certificate serial number.

Question 50

All of the following are features of WPA3 except:

A) it implements a more robust key exchange protocol.
B) it enables the creation of a VPN.
C) it provides a more secure way to connect IoT devices.
D) it features expanded encryption for public networks.

Question 51

Discuss and explain the various types of malicious code and how they work. Include the different types of viruses.

Question 52

All of the following statements about public key cryptography are true except:

A) public key cryptography uses two mathematically related digital keys.
B) public key cryptography ensures authentication of the sender.
C) public key cryptography does not ensure message integrity.
D) public key cryptography is based on the idea of irreversible mathematical functions.

Question 53

Asymmetric key cryptography is also known as:

A) public key cryptography.
B) secret key cryptography.
C) PGP.
D) PKI.

Question 54

What is a sniffing attack and how does it differ from a MitM attack?

Question 55

All of the following statements about PKI are true except:

A) the term PKI refers to the certification authorities and digital certificate procedures that are accepted by all parties.
B) PKI is not effective against insiders who have a legitimate access to corporate systems including customer information.
C) PKI guarantees that the verifying computer of the merchant is secure.
D) the acronym PKI stands for public key infrastructure.

Question 56

All of the following are used for authentication except:

A) digital signatures.
B) certificates of authority.
C) biometric devices.
D) packet filters.

Question 57

Which of the following statements is not true?

A) Apple's Touch ID stores a digital replica of a user's actual fingerprint in Apple's iCloud.
B) Biometric devices reduce the opportunity for spoofing.
C) A retina scan is an example of a biometric device.
D) Biometric data stored on an iPhone is encrypted.

Question 58

Which of the following is not an example of an access control?

A) firewalls
B) proxy servers
C) digital signatures
D) login passwords

Question 59

Define the terms tiger team, white hat, black hat, and grey hat and discuss the difference between them.

Question 60

An intrusion detection system can perform all of the following functions except:

A) examining network traffic.
B) setting off an alarm when suspicious activity is detected.
C) checking network traffic to see if it matches certain patterns or preconfigured rules.
D) blocking suspicious activity.

Question 61

Which of the following statements about blockchain is not true?

A) A blockchain system is composed of a distributed network of computers.
B) A blockchain system is inherently centralized.
C) A blockchain system is a transaction processing system.
D) Cryptocurrencies are based on blockchain technology.

Question 62

SSL/TLS cannot provide irrefutability.

Question 63

Which of the following is the most common protocol for securing a digital channel of communication?

A) DES
B) SSL/TLS
C) VPN
D) HTTP

Question 64

What is the first step in developing an e-commerce security plan?

A) Create a security organization.
B) Develop a security policy.
C) Perform a risk assessment.
D) Perform a security audit.

Question 65

Face ID is an example of which of the following?

A) biometrics
B) encryption
C) IDS
D) firewall

Question 66

The creation of Bitcoins consumes a significant amount of energy.

Question 67

Which of the following statements is not true?

A) A majority of states require companies that maintain personal data on their residents to publicly disclose when a security breach affecting those residents has occurred.
B) The USA Patriot Act broadly expanded law enforcement's investigative and surveillance powers.
C) The Cybersecurity Information Sharing Act was strongly supported by most large technology companies and privacy advocates.
D) The Federal Trade Commission has asserted that it has authority over corporations' data security practices.

Question 68

To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use:

A) a firewall.
B) an authorization management system.
C) security tokens.
D) an authorization policy.

Question 69

Explain the difference between symmetric key cryptography and public key cryptography. Which dimensions of e-commerce security does encryption address?

Question 70

PCI-DSS is a standard established by which of the following?

A) the banking industry
B) the credit card industry
C) the federal government
D) the retail industry

Question 71

The easiest and least expensive way to prevent threats to system integrity is to install anti-virus software.

Question 72

Zelle is an example of a P2P mobile payment app.

Question 73

All of the following statements about Apple Pay are true except which of the following?

A) Apple Pay is the most popular alternative payment method in the United States.
B) Apple Pay is an example of a universal proximity mobile wallet.
C) Apple Pay can be used for mobile payments at the point of sale at a physical store.
D) Apple Pay has more users than either Google Pay or Samsung Pay.

Question 74

What dimensions do digital signatures and hash digests add to public key cryptography and how do they work?

Question 75

Which of the following is not a major trend in e-commerce payments in 2018-2019?

A) Mobile retail payment volume decreases.
B) PayPal remains the most popular alternative payment method.
C) Large banks enter the mobile wallet and P2P payments market.
D) Payment by credit and/or debit card remains the dominant form of online payment.

Question 76

Discuss the security of communications channels. Include definitions and explanations for the terms Secure Sockets Layer/Transport Layer Security (SSL/TLS), secure negotiated session, session key, and VPN.

Question 77

Which of the following statements about Bitcoin is not true?

A) The computational power required to mine Bitcoins has increased over time.
B) Bitcoins are completely secure.
C) Bitcoins are illegal in some countries.
D) In 2018, Bitcoin represented just under 40% of the full market for cryptocurrencies.

Question 78

All of the following are limitations of the existing online credit card payment system except:

A) poor security.
B) cost to consumers.
C) cost to merchant.
D) social equity.

Question 79

PayPal is an example of what type of payment system?

A) online stored value payment system
B) digital checking system
C) accumulating balance system
D) digital credit card system

Question 80

Which of the following is a set of short-range wireless technologies used to share information among devices within about two inches of each other?

A) DES
B) NFC
C) IM
D) text messaging