question

Smartphones have the same security flaws as other Internet-connected devices

answer

TRUE

question

In 2013, the security firm McAfee identified approximately 35,000 kinds of mobile malware

answer

TRUE

question

Viruses can be spread through e-mail

answer

TRUE

question

The term cracker is used to identify a hacker whose specialty is breaking open security systems

answer

FALSE

question

To secure mobile devices, a company will need to implement special mobile device management software

answer

TRUE

question

Wireless networks are vulnerable to penetration because radio frequency bands are easy to scan

answer

TRUE

question

Computer worms spread much more rapidly than computer viruses

answer

TRUE

question

One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender

answer

TRUE

question

Sniffers enable hackers to steal proprietary information from anywhere on a network, including e-mail messages, company files, and confidential reports

answer

TRUE

question

DoS attacks are used to destroy information and access restricted areas of a company's information system

answer

FALSE

question

The distributed nature of cloud computing makes it somewhat easier to track unauthorized access

answer

FALSE

question

Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years

answer

TRUE

question

An acceptable use policy defines the acceptable level of access to information assets for different users

answer

FALSE

question

Biometric authentication is the use of physical characteristics such as retinal images to provide identification

answer

TRUE

question

Packet filtering catches most types of network attacks

answer

FALSE

question

NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs

answer

TRUE

question

SSL is a protocol used to establish a secure connection between two computers

answer

TRUE

question

Public key encryption uses two keys

answer

TRUE

question

Over 70 percent of malware today is aimed at small businesses

answer

FALSE

question

Smartphones typically feature state-of-the-art encryption and security features, making them highly secure tools for businesses

answer

FALSE

question

________ refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems. A) "Security" B) "Controls" C) "Benchmarking" D) "Algorithms"

answer

A. "Security"

question

________ refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards. A) "Legacy systems" B) "SSID standards" C) "Vulnerabilities" D) "Controls"

answer

D. "Controls"

question

Large amounts of data stored in electronic form are ________ than the same data in manual form. A) less vulnerable to damage B) more secure C) vulnerable to many more kinds of threats D) more critical to most businesses

answer

C. Vulnerable to many more kinds of threats

question

Electronic data are more susceptible to destruction, fraud, error, and misuse because information systems concentrate data in computer files that: A) are easily decrypted. B) can be opened with easily available software. C) may be accessible by anyone who has access to the same network. D) are unprotected by up-to-date security systems.

answer

C. May be accessible by anyone who has access to the same network

question

Specific security challenges that threaten the communications lines in a client/server environment include: A) tapping; sniffing; message alteration; radiation. B) hacking; vandalism; denial of service attacks. C) theft, copying, alteration of data; hardware or software failure. D) unauthorized access; errors; spyware.

answer

A. Tapping; sniffing; message alteration; radiation

question

Specific security challenges that threaten clients in a client/server environment include: A) tapping; sniffing; message alteration; radiation. B) hacking; vandalism; denial of service attacks. C) theft, copying, alteration of data; hardware or software failure. D) unauthorized access; errors; spyware.

answer

D. Unauthorized access; errors; spyware

question

Specific security challenges that threaten corporate servers in a client/server environment include: A) tapping; sniffing; message alteration; radiation. B) hacking; vandalism; denial of service attacks. C) theft, copying, alteration of data; hardware or software failure. D) unauthorized access; errors; spyware.

answer

B. Hacking; vandalism; denial of service attacks.

question

The Internet poses specific security problems because: A) it was designed to be easily accessible. B) Internet data is not run over secure lines. C) Internet standards are universal. D) it changes so rapidly.

answer

A. It was designed to be easily accessible

question

Which of the following statements about the Internet security is not true? A) The use of P2P networks can expose a corporate computer to outsiders. B) A corporate network without access to the Internet is more secure than one that provides access. C) VoIP is more secure than the switched voice network. D) Instant messaging can provide hackers access to an otherwise secure network.

answer

C. VoIP is more secure than the switched voice network.

question

An independent computer program that copies itself from one computer to another over a network is called a: A) worm. B) Trojan horse. C) bug. D) pest.

answer

A. Worm

question

A salesperson clicks repeatedly on the online ads of a competitor's in order to drive the competitor's advertising costs up. This is an example of: A) phishing. B) pharming. C) spoofing. D) click fraud.

answer

D. Click fraud

question

In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On the vendor's site, a small program called Mitglieder was downloaded to the user's machine. The program enabled outsiders to infiltrate the user's machine. What type of malware is this an example of? A) Trojan horse B) Virus C) Worm D) Spyware

answer

A. Trojan horse

question

Redirecting a Web link to a different address is a form of: A) snooping. B) spoofing. C) sniffing. D) war driving.

answer

B. Spoofing

question

A keylogger is a type of: A) worm. B) Trojan horse. C) virus. D) spyware.

answer

D. Spyware

question

Hackers create a botnet by: A) infecting Web search bots with malware. B) using Web search bots to infect other computers. C) causing other people's computers to become "zombie" PCs following a master computer. D) infecting corporate servers with "zombie" Trojan horses that allow undetected access through a back door.

answer

C. Causing other people's computers to become "zombie" PCs following a master computer

question

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. A) DDoS B) DoS C) SQL injection D) phishing

answer

A. DDoS

question

Which of the following is not an example of a computer used as a target of crime? A) Knowingly accessing a protected computer to commit fraud B) Accessing a computer system without authority C) Illegally accessing stored electronic communication D) Threatening to cause damage to a protected computer

answer

C. Illegally accessing stored electronic communication

question

Which of the following is not an example of a computer used as an instrument of crime? A) Theft of trade secrets B) Intentionally attempting to intercept electronic communication C) Unauthorized copying of software D) Breaching the confidentiality of protected computerized data

answer

D. Breaching the confidentiality of protected computerized data

question

Phishing is a form of: A) spoofing. B) logging. C) sniffing. D) driving.

answer

A. Spoofing

question

An example of phishing is: A) setting up a bogus Wi-Fi hot spot. B) setting up a fake medical Web site that asks users for confidential information. C) pretending to be a utility company's employee in order to garner information from that company about their security system. D) sending bulk e-mail that asks for financial aid under a false pretext.

answer

B. Setting up a fake medical Web site that asks users for confidential information

question

Evil twins are: A) Trojan horses that appears to the user to be a legitimate commercial software application. B) e-mail messages that mimic the e-mail messages of a legitimate business. C) fraudulent Web sites that mimic a legitimate business's Web site. D) bogus wireless network access points that look legitimate to users.

answer

D. Bogus wireless network access points that look legitimate to users

question

Pharming involves: A) redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser. B) pretending to be a legitimate business's representative in order to garner information about a security system. C) setting up fake Web sites to ask users for confidential information. D) using e-mails for threats or harassment.

answer

A. Redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser

question

You have been hired as a security consultant for a law firm. Which of the following constitutes the greatest source of security threats to the firm? A) Wireless network B) Employees C) Authentication procedures D) Lack of data encryption

answer

B. Employees

question

Tricking employees to reveal their passwords by pretending to be a legitimate member of a company is called: A) sniffing. B) social engineering. C) phishing. D) pharming.

answer

B. Social engineering

question

How do software vendors correct flaws in their software after it has been distributed? A) They issue bug fixes. B) They issue patches. C) They re-release the software. D) They release updated versions of the software.

answer

B. They issue patches

question

The HIPAA Act of 1996: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules

answer

D. Outline medical security and privacy rules

question

The Gramm-Leach-Bliley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules.

answer

A. Requires financial institutions to ensure the security of customer data

question

The Sarbanes-Oxley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules.

answer

C. Imposes responsibility on companies and management to safeguard the accuracy of financial information

question

The most common type of electronic evidence is: A) voice-mail. B) spreadsheets. C) instant messages. D) e-mail.

answer

D. E-mail

question

Your company, an online clothing store, has calculated that a loss of Internet connectivity for 5 hours results in a potential loss of $1,000 to $2,000 and that there is a 50% chance of this occurring. What is the annual expected loss from this exposure? A) $750 B) $1,000 C) $1,500 D) $3,000

answer

A. $750

question

Application controls: A) can be classified as input controls, processing controls, and output controls. B) govern the design, security, and use of computer programs and the security of data files in general throughout the organization. C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. D) include software controls, computer operations controls, and implementation controls.

answer

A. Can be classified as input controls, processing controls, and output controls

question

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage. A) Software B) Administrative C) Data security D) Implementation

answer

C. Data Security

question

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n): A) security policy. B) AUP. C) risk assessment. D) business impact analysis.

answer

C. Risk assessment

question

Statements ranking information risks and identifying security goals are included in a(n): A) security policy. B) AUP. C) risk assessment. D) business impact analysis.

answer

A. Security policy

question

Which of the following specifications replaces WEP with a stronger security standard that features changing encryption keys? A) TLS B) AUP C) VPN D) WPA2

answer

D. WPA2

question

Rigorous password systems: A) are one of the most effective security tools. B) may hinder employee productivity. C) are costly to implement. D) are often disregarded by employees.

answer

B. May hinder employee productivity

question

An authentication token is a(n): A) device the size of a credit card that contains access permission data. B) type of smart card. C) gadget that displays passcodes. D) electronic marker attached to a digital authorization file.

answer

C. Gadget that displays passcodes

question

Biometric authentication: A) is inexpensive. B) is used widely in Europe for security applications. C) can use a person's voice as a unique, measurable trait. D) only uses physical measurements for identification.

answer

C. Can use a person's voice as a unique, measurable trait

question

A firewall allows the organization to: A) enforce a security policy on data exchanged between its network and the Internet. B) check the accuracy of all transactions between its network and the Internet. C) create an enterprise system on the Internet. D) check the content of all incoming and outgoing e-mail messages.

answer

A. Enforce a security policy on data exchanged between its network and the Internet

question

Which of the following is a type of ambient data? A) Computer log containing recent system errors B) A file deleted from a hard disk C) A file that contains an application's user settings D) A set of raw data from an environmental sensor

answer

B. A file deleted from a hard disk

question

________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors. A) Stateful inspections B) Intrusion detection systems C) Application proxy filtering technologies D) Packet filtering technologies

answer

B. Intrusion detection systems

question

Currently, the protocols used for secure information transfer over the Internet are: A) TCP/IP and SSL. B) S-HTTP and CA. C) HTTP and TCP/IP. D) SSL, TLS, and S-HTTP.

answer

D. SSL, TLS, and S-HTTP

question

Most antivirus software is effective against: A) only those viruses active on the Internet and through e-mail. B) any virus. C) any virus except those in wireless communications applications. D) only those viruses already known when the software is written.

answer

D. Only those viruses already known when the software is written

question

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? A) SSL B) Symmetric key encryption C) Public key encryption D) Private key encryption

answer

B. Symmetric key encryption

question

A digital certificate system: A) uses third-party CAs to validate a user's identity. B) uses digital signatures to validate a user's identity. C) uses tokens to validate a user's identity. D) is used primarily by individuals for personal correspondence

answer

A. Uses third-party CAs to validate a user's identity

question

All of the following are types of information systems general controls except: A) application controls. B) computer applications controls. C) physical hardware controls. D) administrative controls.

answer

A. Application controls

question

For 100 percent availability, online transaction processing requires: A) high-capacity storage. B) a multi-tier server network. C) fault-tolerant computer systems. D) dedicated phone lines.

answer

C. Fault-tolerant computer systems

question

In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data. A) high availability computing B) deep-packet inspection C) application proxy filtering D) stateful inspection

answer

B. Deep-packet inspection

question

The development and use of methods to make computer systems resume their activities more quickly after mishaps is called: A) high-availability computing. B) recovery-oriented computing. C) fault-tolerant computing. D) disaster-recovery planning.

answer

B. Recovery-oriented computing

question

Smaller firms may outsource some or many security functions to: A) ISPs. B) MISs. C) MSSPs. D) CAs.

answer

C. MSSPs

question

A practice in which eavesdroppers drive by buildings or park outside and try to intercept wireless network traffic is referred to as: A) war driving. B) sniffing. C) cybervandalism. D) driveby tapping.

answer

A. War driving

question

Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses

answer

FALSE

question

________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else. A) Identity theft B) Spoofing C) Social engineering D) Evil twins

answer

A. Identity theft

question

Computer forensics tasks include all of the following except: A) presenting collected evidence in a court of law. B) securely storing recovered electronic data. C) collecting physical evidence on the computer. D) finding significant information in a large volume of electronic data.

answer

C. Collecting physical evidence on the computer

question

________ identify the access points in a Wi-Fi network. A) NICs B) Mac addresses C) URLs D) SSIDs

answer

D. SSIDs

question

A foreign country attempting to access government networks in order to disable a national power grid would be an example of: A) phishing. B) denial-of-service attacks. C) cyberwarfare. D) cyberterrorism.

answer

C. Cyberwarfare

question

Authorization refers to the ability to know that a person is who he or she claims to be

answer

FALSE

question

Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. A) DPI B) MSSP C) NSP D) UTM

answer

D. UTM

question

A walkthrough is a type of software testing used before software is even written

answer

TRUE

question

When errors are discovered in software programs, the sources of the errors are found and eliminated through a process called debugging

answer

TRUE

IS 3003 Chapter 8 Review

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards