Deck 14: Risks, Security, and Disaster Recovery

Question 1

With encryption,the original,unencrypted message is called ciphertext.

Answer 1

False

Question 2

In recent years,identity theft has been more prevalent as part of phishing.

Answer 2

True

Question 3

The purpose of using atomic transactions is to ensure encrypting of all appropriate files.

Answer 3

False

Question 4

Unintentional damage to software occurs because of poor training,lack of adherence to simple backup procedures,or simple human error.

Question 5

Companies that choose not to fully develop their own recovery plan can outsource it to companies that specialize in either disaster recovery planning or provision of alternative sites.

Question 6

Symmetric encryption is also called "public­key" encryption.

Question 7

Several manufacturers of computer equipment offer individual keyboard-embedded and mouse-embedded fingerprint devices.

Question 8

Controls translate business policies into system features.

Question 9

With single sign-on,users are required to identify themselves every time they access each of several different systems.

Question 10

The best defense against unauthorized access to systems over the Internet is a firewall.

Question 11

Redundancies increase expected downtime in business information systems.

Question 12

The greater the number of interdependent systems,the greater the expected downtime.

Question 13

Information System managers discourage users from frequently changing their passwords.

Question 14

A protocol called Transport Layer Security (TLS) is used for transactions on the Web.

Question 15

In blackouts,the voltage of the power decreases,or very short interruptions occur in the flow of power.

Question 16

To aid in business recovery,copies of applications are usually kept in a safe place to replace those that get damaged.

Question 17

Encryption slows down communication because the software must encrypt and decrypt every message.

Question 18

Bots are implemented not only for access but also to implement policies and ensure that nonsensical data is not entered into corporate databases.

Question 19

A digital certificate associates a user's identity with the user's public key.

Question 20

Computer viruses are so named because they act on programs and data in a fashion similar to the way viruses act on living tissue.

Question 21

A___________ is a bogus record in a networked database that neither employees nor business partners would ever access for legitimate purposes.

A)canary trap
B)phish
C)flame
D)honeytoken

Question 22

Hijacking is carried out by surreptitiously installing a small program called a ___________on a computer.

A)mine
B)bot
C)sinkhole
D)trapdoor

Question 23

A(n) ___________is a set of indivisible transactions that are either all executed or none are-never only some.

A)long-running transaction
B)ready-copy-update transaction
C)biometric transaction
D)atomic transaction

Question 24

A___________ is a server with invalid records set up to make intruders think they have accessed a production database.

A)honeytoken
B)phish
C)bogus server
D)honeypot

Question 25

A___________ is a type of malware that spreads in a network without human intervention.

A)logic bomb
B)trapdoor
C)worm
D)Trojan horse

Question 26

_____ encryption is defined as encryption that comprises two keys: a public key,and a private key.

A)Parallel
B)Asymmetric
C)Cascade
D)Super

Question 27

In___________ ,criminals use personal information to attack organizational systems.

A)hijacking
B)spear phishing
C)spamming
D)penetration testing

Question 28

___________software records individual keystrokes.

A)Clickstream
B)Keylogging
C)Honeytoken
D)Public-key encryption

Question 29

A con artist telephones an employee,pretends to be from his own organization's IT unit,and says he must have the employee's password to fix a problem.This is an example of ___________.

A)social pathology
B)data encryption
C)social engineering
D)data mining

Question 30

___________is a set of disks that is programmed to replicate stored data to provide a higher degree of reliability.

A)SSP
B)CIFS
C)RAID
D)SAN

Question 31

A___________ represents another server for all information requests from resources inside the trusted network.

A)proxy server
B)honeypot server
C)DNS server
D)bogus server

Question 32

___________are measures taken to ensure that only those who are authorized can use a computer or network or to certain applications or data.

A)Near field communication
B)Honeytokens
C)Code reviews
D)Access controls

Question 33

___________is the secure version of HTTP.

A)SHTTP
B)HTMLSec
C)HTTPS
D)HTMLS

Question 34

With encryption,the coded message is called ___________.

A)plaintext
B)privatetext
C)ciphertext
D)publictext

Question 35

To increase security,some companies implement the ___________approach.

A)demilitarized zone
B)denial of service
C)atomic transaction
D)boarding key

Question 36

___________occurs when a website receives an overwhelming number of information requests,such as merely logging on to a site.

A)Denial of service (DoS)
B)Hijacking
C)Global attack
D)Meet-in-the-middle (MITM)

Question 37

___________a computer means using some or all of the resources of a computer linked to a public network without the consent of its owner.

A)Hijacking
B)Bit flipping
C)Phishing
D)Auditing

Question 38

In ___________,the voltage of the power decreases,or there are very short interruptions in the flow of power.

A)brownouts
B)blackouts
C)keystroke logging
D)spear phishing

Question 39

Sometimes a(n)___________ is automatically created using data,such as the date and time of a transaction or the name or password of the user updating the file.

A)atomic transaction
B)audit trail
C)denial of service
D)global transaction

Question 40

Coding a message into a form unreadable to an interceptor is called ___________.

A)classification
B)encryption
C)modulation
D)demodulation

Question 41

The ___________,as it is popularly known,gives law enforcement agencies surveillance and wiretapping rights they did not have before 2001.

A)PATRIOT Act
B)Civil Contingencies Act
C)National Security Act
D)Domestic Security Enhancement Act

Question 42

When tapping communications,law enforcement agencies need the cooperation of a third party such as a(n)___________ .

A)internet service provider (ISP)
B)sell side platform (SSP)
C)website
D)systems developer

Question 43

___________is a security measure in which users are required to identify themselves only once before accessing several different systems which are linked through a network.

A)Digital footprint
B)SP (single password)
C)Multiple encryption
D)SSO (single sign-on)

Question 44

Experience in ___________certain systems,such as ERP and SCM systems,can teach the IT staff for how many minutes or seconds per year the system is likely to fail.

A)operating
B)developing
C)maintaining
D)archiving

Question 45

CIOs often cite ___________as an effective way to bring down the amount of work their subordinates must do.

A)secure sockets layer (SSL)
B)security assertion markup language (SAML)
C)mandatory access control (MAC)
D)single sign-on (SSO)

Question 46

___________are constraints and other restrictions imposed on a user or a system,and they can be used to secure systems against risks or to reduce damage caused to systems,applications,and data.

Question 47

A(n)___________ characteristic is a unique physical,measurable characteristic of a human being that is used to identify a person.

Question 48

Once criminals have a person's identifying details,such as a Social Security number,driver's license number,or credit-card number,they can pretend to be this person,which is a crime called___________ .

Question 49

To determine how much security is enough security,experts are employed to estimate the cost and ___________of damages,as well as the cost of security measures.

A)impact
B)probabilities
C)effect
D)causes

Question 50

Managers should focus on the asset they must protect,which in most cases is___________ ,not applications.

A)hardware
B)software
C)information
D)systems

Question 51

___________,those without which the business cannot conduct its operations,are given the highest priority by the disaster recovery coordinator.

A)Backup applications
B)Customer applications
C)Mission-critical applications
D)Recovery applications

Question 52

In computer terms,a(n)___________ is any virus disguised as legitimate software or useful software that contains a virus.

Question 53

CIOs often find the tasks of earmarking funds for___________ difficult because they cannot show the return on investment (ROI) of such planning.

A)backup programs
B)disaster recovery programs
C)archival programs
D)database security programs

Question 54

A(n) ___________is software that is programmed to cause damage at a specified time to specific applications and data files.

Question 55

___________,the time during which ISs or data are not available in the course of conducting business,has become a dreaded situation for almost every business worldwide.

Question 56

Perpetrators use other people's computers in distributed denial-of-service (DDoS) attacks.Professionals call such computers___________ .

Question 57

Probably the easiest way to protect against loss of data is to automatically duplicate all data periodically,a process referred to as data _____.

Question 58

To ensure against interruptions in power supply,organizations use ___________systems,which provide an alternative power supply for a short time,as soon as a power network fails.

Question 59

An issuer of digital certificates is called a ___________.

A)certificate dealer (CD)
B)certificate bank (CB)
C)certificate authority (CA)
D)certificate warehouse (CW)

Question 60

___________are total losses of electrical power.

Question 61

___________is the process of ensuring that senders and receivers of messages are indeed who they claim to be.

Question 62

___________provide backup and operation facilities to which a client's employees can move and continue operations in case of a disaster.

Question 63

What is a Trojan horse?

Question 64

To prepare for mishaps,either natural or malicious,many organizations have well-planned programs in place,called_____.

Question 65

The cost of damage is the aggregate of all the potential damages multiplied by their respective___________ .

Question 66

What are the main goals of information security?

Question 67

Discuss natural disasters that pose a risk to ISs.

Question 68

When both the sender and recipient use the same secret key,the technique is called___________ .

Question 69

A(n) ___________is a way to authenticate online messages,analogous to a physical signature on a piece of paper,but implemented with public-key cryptography.

Question 70

A professional whose job it is to find erroneous or fraudulent cases and investigate them is known as a(n)___________ .

Question 71

___________are computer files that serve as the equivalent of ID cards by associating one's identity with one's public key.

Question 72

A(n)___________ is a series of documented facts that help detect who recorded which transactions,at what time,and under whose approval.

Question 73

Hardware or software that blocks access to computing resources is called a(n) ___________.

Question 74

What are honeytokens?

Question 75

List common controls to protect systems from risks.