Question 1

Application controls
A) can be classified as input controls, processing controls, and output controls.
B) govern the design, security, and use of computer programs and the security of data files in general throughout the organization.
C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.
D) include software controls, computer operations controls, and implementation controls.
E) monitor the use of system software and prevent unauthorized access to software and programs.

Accepted Answer

Application controls can be classified into three categories which are input controls, processing controls, and output controls.

Question 2

Hackers and their companion viruses are an increasing problem, especially on the Internet. What are the most important measurers for a firm to take to protect itself from this?
 Is full protection feasible?
 Why or why not?

Accepted Answer

The answer of Hackers and their companion viruses are an...

Question 3

Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses.

Accepted Answer

Spyware is a distinct category of malicious software programs that are designed to gather information from a computer system without the user's knowledge or consent. While spyware can be spread through viruses, worms, and Trojan horses, it is not the same thing as these types of threats.

Question 4

Three major concerns of system builders and users are disaster, security, and human error. Of the three, which do you think is most difficult to deal with?
 Why?

Accepted Answer

The answer of Three major concerns of system builders and...

Question 5

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.
A) Software
B) Administrative
C) Data security
D) Implementation
E) Input

Accepted Answer

Data security controls are specifically designed to protect data files from unauthorized access, modification, or destruction. These controls may include encryption, access controls, and backups to ensure data integrity and availability. While software and implementation may play a role in data security, administrative and input controls are not specifically focused on protecting data files.

Question 6

How can a firm's security policies contribute and relate to the six main business objectives?
 Give examples.

Accepted Answer

The answer of How can a firm's security policies contribute...

Question 7

Explain how an SQL injection attack works and what types of systems are vulnerable to this type of attack.

Accepted Answer

The answer of Explain how an SQL injection attack works...

Question 8

An acceptable use policy defines the acceptable level of access to information assets for different users.

Accepted Answer

The answer of An acceptable use policy defines the acceptable...

Question 9

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)
A) security policy.
B) AUP.
C) risk assessment.
D) business impact analysis.
E) business continuity plan.

Accepted Answer

A risk assessment is a formal analysis of an information system's vulnerabilities and potential threats. It includes an evaluation of the likelihood of a security incident occurring and its potential cost, among other factors. Therefore, this is the correct answer. While the other options may involve similar evaluations, they do not specifically address the analysis of the likelihood and cost of security incidents.

Question 10

Which of the following specifications replaces WEP with a stronger security standard that features changing encryption keys?
A) TLS
B) AUP
C) VPN
D) WPA2
E) UTM

Accepted Answer

WPA2 (Wi-Fi Protected Access 2) is a security protocol that replaces WEP (Wired Equivalent Privacy) with a stronger security standard. WPA2 features changing encryption keys, making it more difficult for hackers to gain unauthorized access to a wireless network. TLS (Transport Layer Security) is a security protocol used to encrypt network communications, but it is not specifically designed to replace WEP. AUP (Acceptable Use Policy) is a set of guidelines outlining acceptable uses of a network, but it does not provide security measures. VPN (Virtual Private Network) is a network technology that provides secure remote access to a network, but it is not a replacement for WEP. UTM (Unified Threat Management) is a security solution that combines multiple security features, but it does not specifically replace WEP.

Question 11

The Sarbanes-Oxley Act
A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) identifies computer abuse as a crime and defines abusive activities.

Accepted Answer

The Sarbanes-Oxley Act imposes responsibility on companies and management to safeguard the accuracy of financial information. It was enacted in response to a series of corporate financial scandals and aimed at improving financial reporting, corporate governance, and accountability. While the act may indirectly impact information systems security and control, its primary focus is on financial reporting and accountability. The other options listed are not related to the Sarbanes-Oxley Act.

Question 12

The most common type of electronic evidence is
A) voice-mail.
B) spreadsheets.
C) instant messages.
D) e-mail.
E) VOIP data.

Accepted Answer

E-mail is the most commonly used form of electronic communication and is therefore the most common type of electronic evidence. It is widely used in both personal and professional contexts and is easily stored, retrieved, and analyzed. Voice-mail, spreadsheets, instant messages, and VOIP data are also commonly used electronic evidence but they are not as prevalent as e-mail.

Question 13

Computer forensics tasks include all of the following except
A) presenting collected evidence in a court of law.
B) securely storing recovered electronic data.
C) collecting physical evidence on the computer.
D) finding significant information in a large volume of electronic data.

Accepted Answer

Computer forensics does not involve the collection of physical evidence but rather the analysis and recovery of digital data.

Question 14

The HIPAA Act of 1996
A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) identifies computer abuse as a crime and defines abusive activities.

Accepted Answer

The HIPAA Act of 1996 outlines medical security and privacy rules, specifically surrounding protected health information (PHI). It establishes national standards to protect the privacy of individuals' identifiable health information and sets requirements for the security and confidentiality of PHI.

Question 15

How is the security of a firm's information system and data affected by its people, organization, and technology?
 Is the contribution of one of these dimensions any more important than the other?
 Why?

Accepted Answer

The answer of How is the security of a firm's...

Question 16

What are the security challenges faced by wireless networks?

Accepted Answer

The answer of What are the security challenges faced by...

Question 17

The Gramm-Leach-Bliley Act
A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) identifies computer abuse as a crime and defines abusive activities.

Accepted Answer

The Gramm-Leach-Bliley Act (also known as the Financial Modernization Act) includes provisions that require financial institutions to ensure the security and confidentiality of customer data. It mandates that they implement and maintain safeguards to protect sensitive customer information from unauthorized access or use.

Question 18

Statements ranking information risks and identifying security goals are included in a(n)
A) security policy.
B) AUP.
C) risk assessment.
D) business impact analysis.
E) business continuity plan.

Accepted Answer

Statements ranking information risks and identifying security goals are typically included in a security policy, which outlines an organization's overall approach to managing security risks. AUPs (Acceptable Use Policies) typically focus on specifying acceptable behavior for users accessing an organization's IT resources, while risk assessments, business impact analyses, and business continuity plans provide more detailed analysis and planning related to specific security risks and their potential impact on an organization.

Question 19

Your company, an online discount stationers, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure?
A) $500
B) $1,000
C) $1,250
D) $1,500
E) $2,500

Accepted Answer

The annual expected loss can be calculated as the product of the potential loss and the probability of occurrence, which is:

$2,000-$3,000 x 50% = $1,000-$1,500

The midpoint between $1,000 and $1,500 is $1,250, which is the expected annual loss from this exposure. Therefore, the best choice is C.

Question 20

Which of the following is a type of ambient data?
A) computer log containing recent system errors
B) a file deleted from a hard disk
C) a file that contains an application's user settings
D) a set of raw data from an environmental sensor
E) data that has been recorded over

Accepted Answer

The answer of Which of the following is a type...

Quiz 8: Securing Information Systems

Application controls

Hackers and their companion viruses are an increasing problem, especially on the Internet. What are the most important measurers for a firm to take to protect itself from this? Is full protection feasible? Why or why not?

Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses.

Three major concerns of system builders and users are disaster, security, and human error. Of the three, which do you think is most difficult to deal with? Why?

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

How can a firm's security policies contribute and relate to the six main business objectives? Give examples.

Explain how an SQL injection attack works and what types of systems are vulnerable to this type of attack.

An acceptable use policy defines the acceptable level of access to information assets for different users.

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)

Which of the following specifications replaces WEP with a stronger security standard that features changing encryption keys?

The Sarbanes-Oxley Act

The most common type of electronic evidence is

Computer forensics tasks include all of the following except

The HIPAA Act of 1996

How is the security of a firm's information system and data affected by its people, organization, and technology? Is the contribution of one of these dimensions any more important than the other? Why?

What are the security challenges faced by wireless networks?

The Gramm-Leach-Bliley Act

Statements ranking information risks and identifying security goals are included in a(n)

Your company, an online discount stationers, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure?

Which of the following is a type of ambient data?