Deck 10: Information Systems Security

Question 1

Mark receives an email from his bank asking him to update and verify his credit card details. He replies to the email with all the requested details. Mark later learns that the email was not actually sent by his bank and that the information he had shared has been misused. Mark is a victim of ________.

A) hacking
B) sniffing
C) data mining
D) phishing

Answer 1

D

Question 2

Which of the following is a synonym for phishing?

A) pretexting
B) email spoofing
C) hardening
D) system hacking

Answer 2

B

Question 3

Explain the types of events that result in faulty service, a type of security loss.

Answer 3

Faulty service includes problems that result because of incorrect system operation. It could include incorrect data modification. It also could include systems that work incorrectly by sending wrong goods to a customer or the ordered goods to a wrong customer, inaccurately billing customers, or sending the wrong information to employees. Humans can inadvertently cause faulty service by making procedural mistakes. System developers can write programs incorrectly or make errors during installation of hardware, software programs, and data. Usurpation is also a type of faulty service. Faulty service can also result when a service is improperly restored during recovery from natural disasters.

Question 4

________ occurs when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones.

A) Usurpation
B) Cyber stalking
C) Spoofing
D) Sniffing

Question 5

A(n) ________ is a sophisticated, possibly long-running computer hack that is perpetrated by large, well-funded organizations like governments.

A) advanced persistent threat
B) identity threat
C) copyright theft
D) network sniffer attack

Question 6

Advanced persistent threats can be a means to engage in cyber warfare and cyber espionage.

Question 7

A person calls the Stark residence and pretends to represent a credit card company. He asks Mrs. Stark to confirm her credit card number. This is an example of ________.

A) hacking
B) data mining
C) pretexting
D) sniffing

Question 8

Wardrivers are those who engage in phishing to obtain unauthorized access to data.

Question 9

________ take computers with wireless connections through an area and search for unprotected wireless networks.

A) Wardrivers
B) Pretexters
C) Hackers
D) Phishers

Question 10

Incorrectly increasing a customer's discount is an example of incorrect data modification.

Question 11

Spoofing is a technique for intercepting computer communications.

Question 12

________ is a technique for intercepting computer communications.

A) Spoofing
B) Phishing
C) Pretexting
D) Sniffing

Question 13

IP spoofing occurs when an intruder uses another site's IP address to masquerade as that other site.

Question 14

A threat is a person or an organization that seeks to obtain or alter data illegally, without the owner's permission or knowledge.

Question 15

________ occurs when a threat obtains data that is supposed to be protected.

A) Unauthorized data disclosure
B) Incorrect data modification
C) Faulty service
D) Denial of service

Question 16

A ________ pretends to be a legitimate company and sends emails requesting confidential data.

A) hacker
B) phisher
C) wardriver
D) sniffer

Question 17

Which of the following occurs when millions of bogus service requests flood a Web server and prevent it from servicing legitimate requests?

A) spoofing
B) incorrect data modification
C) usurpation
D) denial of service

Question 18

Breaking into computers, servers, or networks to steal proprietary and confidential data is referred to as ________.

A) pretexting
B) spoofing
C) hacking
D) phishing

Question 19

A(n) ________ is a measure that individuals or organizations take to block a threat from obtaining an asset.

A) denial of service
B) safeguard
C) information silo
D) third-party cookie

Question 20

Pretexting occurs when someone deceives by pretending to be someone else.

Question 21

Which of the following is a human safeguard against security threats?

A) encryption
B) firewall
C) physical security
D) procedure design

Question 22

Explain the concept of denial of service (DOS) in information management.

Question 23

In a brute force attack, a password cracker tries every possible combination of characters.

Question 24

Which of the following statements is TRUE of the financial losses due to computer crimes?

A) All studies on the costs of computer crimes are based on surveys.
B) There are several set standards for tallying computer crime costs and financial losses.
C) Companies are legally required to calculate their financial losses due to computer crime every month.
D) Knowledge about the cost of computer crimes is restricted to large companies.

Question 25

Which of the following is considered a personal security safeguard?

A) creating backup of cookies and temporary files
B) removing high-value assets from computers
C) using a single valid password for all accounts
D) conducting transactions using http rather than https

Question 26

There are no standards for tallying costs of computer crime.

Question 27

Backup and recovery against computer security threats are ________.

A) technical safeguards
B) data safeguards
C) human safeguards
D) hardware safeguards

Question 28

A(n) ________ is a computer program that senses when another computer is attempting to scan a disk or access a computer.

A) intrusion detection system
B) adware
C) packet-filtering firewall
D) network security system

Question 29

Damages to security systems caused by natural disasters are minimal when compared to the damages due to human errors.

Question 30

What are some of the recommended personal security safeguards against security threats?

Question 31

Financial institutions must invest heavily in security safeguards because they are obvious targets for theft.

Question 32

Which of the following is a technical safeguard against security threats?

A) password
B) accountability
C) compliance
D) firewall

Question 33

Risk management is a critical security function addressed by an organization's senior management.

Question 34

While making online purchases, a person should buy only from vendors who support https.

Question 35

Malware protection is an example of a technical safeguard.

Question 36

Which of the following is a data safeguard against security threats?

A) application design
B) accountability
C) physical security
D) malware protection

Question 37

Hiring, training, and educating employees in an organization is a technical safeguard.

Question 38

________ are small files that browsers store on users' computers when they visit Web sites.

A) Cookies
B) Honeypots
C) Mashups
D) Entity tags

Question 39

Davian, a professional hacker, tries every possible combination of characters to crack his victim's email password. Using this technique, he can crack a six-character password of either upper- or lowercase letters in about ten minutes. Which of the following techniques is used by Davian to obtain access to his victim's email?

A) denial-of-service attack
B) brute force attack
C) pretexting
D) spoofing

Question 40

As one of the safeguards against security threats, a person should preferably use the same password for different sites so as to avoid confusion.

Question 41

A(n) ________ sits outside an organizational network and is the first device that Internet traffic encounters.

A) internal firewall
B) perimeter firewall
C) adware
D) malware

Question 42

________ is the process of transforming clear text into coded, unintelligible text for secure storage or communication.

A) Usurpation
B) Authentication
C) Malware protection
D) Encryption

Question 43

Technical safeguards include encryption and usage of passwords.

Question 44

Smart cards are convenient to use because they do not require a personal identification number for authentication.

Question 45

Which of the following information should be provided by users of smart cards for authentication?

A) personal identification number
B) permanent account number
C) fingerprint
D) retinal scan

Question 46

With https, data are encrypted using a protocol called the ________.

A) Secure Shell (SSH)
B) Secure Sockets Layer (SSL)
C) File Transfer Protocol (FTP)
D) Post Office Protocol (POP)

Question 47

A user name authenticates a user, and a password identifies that user.

Question 48

Which of the following uses an individual's personal physical characteristics such as fingerprints, facial features, and retinal scans for verification purposes?

A) credit card
B) smart card
C) biometric authentication
D) symmetric encryption

Question 49

A(n) ________ examines the source address, destination address, and other data of a message and determines whether to let that message pass.

A) encrypted firewall
B) internal malware
C) packet-filtering firewall
D) perimeter shareware

Question 50

Technical safeguards involve both software and hardware components of an information system.

Question 51

What are the two critical security functions that an organization's senior management needs to address?

Question 52

Every information system today should require users to sign on with a user name and a password. In this case, which of the following functions is performed by the user's password?

A) authentication
B) identification
C) decryption
D) encryption

Question 53

Which of the following types of encryption is used by the secure sockets layer protocol?

A) optical encryption
B) physical layer encryption
C) disk encryption
D) public key encryption

Question 54

Adware and spyware are similar to each other in that they both ________.

A) masquerade as useful programs
B) are specifically programmed to spread
C) are installed with a user's permission
D) reside in the background and observe a user's behavior

Question 55

A ________ is a plastic card that has a microchip loaded with identifying data.

A) credit card
B) biometric passport
C) smart card
D) flashcard

Question 56

Most secure communications over the Internet use a protocol called ________.

A) smtp
B) ftp
C) https
D) nntp

Question 57

Which of the following statements is TRUE of symmetric encryption?

A) It uses the same key for both encoding and decoding.
B) It is more difficult and slower than asymmetric encryption.
C) It does not require a key to encrypt or decrypt data.
D) It uses a special version called public/private key on the Internet for a secure communication.

Question 58

________ is a broad category of software that includes viruses, worms, Trojan horses, spyware, and adware.

A) Malware
B) Payload
C) Shareware
D) Firewall

Question 59

________ are viruses that masquerade as useful programs like a computer game, an MP3 file, or some other useful innocuous program.

A) Key loggers
B) Trojan horses
C) Worms
D) Payloads

Question 60

To safeguard data against security threats, every information system today requires a user name and a password. In this case, which of the following functions is performed by the user name?

A) authentication
B) identification
C) decryption
D) encryption

Question 61

Explain how secure sockets layer works when a user communicates securely with a Web site.

Question 62

Spyware programs are installed on a user's computer without the user's knowledge.

Question 63

The creation of backup copies of database contents makes the data more vulnerable to security threats.

Question 64

What are the precautions to be taken when opening email attachments to avoid malwares?

Question 65

Viruses, worms, and Trojan horses are types of firewalls.

Question 66

Packet-filtering firewalls are the most sophisticated type of firewall.

Question 67

Thomas is responsible for creating backup copies of information in a system. He also works along with IT personnel to ensure that the backups are valid and that effective recovery procedures exist. Thomas is involved in establishing ________.

A) human safeguards
B) data safeguards
C) technical safeguards
D) hardware safeguards

Question 68

The procedure of entrusting a party with a copy of an encryption key that can be used in case the actual key is lost or destroyed is called ________.

A) key escrow
B) pledged encryption
C) insured encryption
D) key replication

Question 69

________ refers to an organization-wide function that is in charge of developing data policies and enforcing data standards.

A) Database administration
B) Data encapsulation
C) Data administration
D) Database encapsulation

Question 70

Explain the functions performed by packet-filtering firewalls.

Question 71

The loss of encryption keys by employees is referred to as key escrow.

Question 72

Packet-filtering firewalls cannot prohibit outsiders from starting a session with any user behind the firewall.

Question 73

A virus is a computer program that replicates itself.

Question 74

Malware definitions are patterns that exist in malware code.

Question 75

Explain the functions of the two organizational units responsible for data safeguarding.

Question 76

A criticism of biometric authentication is that it provides weak authentication.

Question 77

In the case of public key encryption, each site has a private key to encode a message and a public key to decode it.

Question 78

A key is a number used with an encryption algorithm to encrypt data.

Question 79

With asymmetric encryption, two different keys are used for encoding and decoding a message.

Question 80

Discuss briefly the pros and cons of biometric authentication.