Deck 5: Protecting Information Resources

Question 1

In contrast to pharming,phishing involves hijacking an official Web site address by hacking a Domain Name System server.

Answer 1

False

Question 2

_____ can interfere with users' control of their computers,through such methods as installing additional software and redirecting Web browsers.

A)Keystroke loggers
B)Spyware
C)Firmware
D)Script loggers

Answer 2

B

Question 3

Terminal resource security is a software feature that erases the screen and signs a user off automatically after a specified length of inactivity.

Answer 3

True

Question 4

Auction fraud is sending fraudulent e-mails that seem to come from legitimate sources,such as a bank or university.

Question 5

The cost of setting up a virtual private network (VPN)is usually high.

Question 6

The main drawback of an intrusion detection system (IDS)is its inability to prevent denial-of-service (DoS)attacks.

Question 7

When a program containing a virus is used,the virus attaches itself to other files,and the cycle continues.

Question 8

When using mirror disks,if one of the two disks containing the same data fails,the other disk also fails.

Question 9

Viruses can be transmitted through a network or through e-mail attachments.

Question 10

The three important aspects of computer and network security,confidentiality,integrity,and availability,are collectively referred to as the CIA triangle.

Question 11

When disaster strikes,an organization should contact the insurance company to resume normal operations as soon as possible.

Question 12

An intrusion detection system (IDS)can protect networks against both external and internal access.

Question 13

When an organization develops a comprehensive security plan,it should set up a security committee with representatives from all departments as well as upper management.

Question 14

In the context of intentional computer and network threats,social engineers protects the integrity of information resources.

Question 15

In some instances,after examining an incoming packet,a firewall can send a message to the packet's sender that the attempt to transmit the packet has failed.

Question 16

Level 1 security protects back-end systems to ensure confidentiality,accuracy,and integrity of data.

Question 17

Application-filtering firewalls are less expensive than packet-filtering firewalls.

Question 18

If a drive in a redundant array of independent disks (RAID)system fails,data stored on it can be reconstructed from data stored on the remaining drives.

Question 19

In the context of the CIA triangle,confidentiality means that computers and networks are operating and authorized users can access the information they need.

Question 20

Social engineering is an attack that takes advantage of the backdoors in security systems.

Question 21

Which statement best describes spyware?

A)It is software that secretly gathers information about users while they browse the Web.
B)It is an attack that floods a server with service requests to prevent legitimate users' access to the system.
C)It is encryption security that manages transmission security on the Internet.
D)It is a programming routine built into a system by its designer to bypass system security and sneak back into the system later to access programs or files.

Question 22

In the context of computer and network security,_____ means that computers and networks are operating and authorized users can access the information they need.

A)validity
B)confidentiality
C)integrity
D)availability

Question 23

Which statement is true of phishing?

A)It involves monitoring and recording keystrokes.
B)It involves sending fraudulent e-mails that seem to come from legitimate sources.
C)It consists of self-propagating program code that is triggered by a specified time or event.
D)It prevents the disclosure of information to anyone who is not authorized to access it.

Question 24

Which of the following statements is true of a worm?

A)It is usually hidden inside a popular program,but it is not capable of replicating itself.
B)It floods a network or server with service requests to prevent legitimate users' access to the system.
C)It is an independent program that can spread itself without attaching itself to a host program.
D)It enables a system designer to bypass the security of a system and sneak back into the system later to access files.

Question 25

Spoofing happens when:

A)a word is converted into a digital pattern.
B)keystrokes are monitored and recorded.
C)an illegitimate program poses as a legitimate one.
D)a firewall rejects the incoming data packets.

Question 26

In the context of computer and network security,_____ means a quick recovery in the event of a system failure or disaster.

A)availability
B)confidentiality
C)integrity
D)validity

Question 27

A level 1 security system is used to protect _____ against unauthorized access.

A)users' workstations
B)back-end systems
C)internal database servers
D)front-end servers

Question 28

Similar to phishing,_____ is directing Internet users to fraudulent Web sites with the intention of stealing their personal information,such as Social Security numbers,passwords,bank account numbers,and credit card numbers.

A)sniffing
B)screening
C)pharming
D)cybersquatting

Question 29

In the context of computer and network security,_____ refers to the accuracy of information resources within an organization.

A)validity
B)confidentiality
C)integrity
D)availability

Question 30

When a computer is infected by a virus,_____.

A)the system's disk access is fast
B)system updates are recommended often
C)some programs suddenly increase in size
D)the available memory space remains constant

Question 31

A level 3 security system focuses on protecting the _____ against intrusion,denial-of-service attacks,and unauthorized access.

A)back-end server
B)corporate network
C)user's work station
D)front-end server

Question 32

_____ is a computer crime that involves destroying or disrupting computer services.

A)Keystroke logging
B)Dumpster diving
C)Bombing
D)Sabotage

Question 33

In the context of computer and network security,_____ means that a system must not allow the disclosing of information by anyone who is not authorized to access it.

A)reliability
B)confidentiality
C)integrity
D)availability

Question 34

John downloaded Alten Cleaner,a program that poses as a computer registry cleaner,on his computer.Once he installed the program on his computer,the program illegitimately gained access to John's passwords and credit card information.In this scenario,it is evident that John was a victim of _____.

A)spoofing
B)phishing
C)baiting
D)pharming

Question 35

In a level 2 security system,_____ must be protected to ensure confidentiality,accuracy,and integrity of data.

A)back-end systems
B)external databases
C)private networks
D)front-end servers

Question 36

In the context of computer crimes and attacks,the difference between phishing and spear phishing is that:

A)in spear phishing,the attack is targeted toward a specific person or a group.
B)spear phishing involves monitoring and recording keystrokes.
C)in spear phishing,hackers capture and record network traffic.
D)spear phishing involves collecting sensitive information via phone calls.

Question 37

The process of capturing and recording network traffic is referred to as _____.

A)sniffing
B)phishing
C)bombing
D)pharming

Question 38

The Committee on National Security Systems (CNSS)proposed a model known as the _____ for evaluating information security.

A)McCumber cube
B)Six Sigma model
C)Bohr model
D)SWOT analysis

Question 39

In the context of the common intentional security threats,which statement best describes a worm?

A)It travels from computer to computer in a network,but it does not usually erase data.
B)It attaches itself to a host program to spread to other files in a computer.
C)It is a programming routine built into a system by its designer to bypass system security and sneak back into the system later to access data.
D)It floods a network or server with service requests to prevent legitimate users' access to the system.

Question 40

In the context of computer and network security,a security system is said to possess _____ when it does not allow data to be corrupted or allow unauthorized changes to a corporate database.

A)integrity
B)confidentiality
C)validity
D)availability

Question 41

In the context of security,_____ is an attack that takes advantage of the human element of security systems.

A)disk mirroring
B)weblogging
C)voice recognition
D)social engineering

Question 42

_____ primarily control access to computers and networks and include devices for securing computers and peripherals from theft.

A)Nonbiometric security measures
B)Virtual security measures
C)Biometric security measures
D)Physical security measures

Question 43

Which security measure uses a physiological element that is unique to a person and cannot be stolen,lost,copied,or passed on to others?

A)A physical security measure
B)A firewall security measure
C)An e-commerce security measure
D)A biometric security measure

Question 44

In the context of intentional security threats,_____ can erase data and wreak havoc on computers and networks but do not replicate themselves.

A)Trojan programs
B)worms
C)viruses
D)McCumber cubes

Question 45

Which of the following is a biometric security measure?

A)Terminal resource security
B)A corner bolt
C)A callback modem
D)Signature analysis

Question 46

In the context of intentional computer and network threats,a _____ combines the characteristics of computer viruses,worms,and other malicious codes with vulnerabilities found on public and private networks.

A)blended threat
B)mirror disk
C)backdoor threat
D)firewall

Question 47

A(n)_____ network is often used so that remote users have a secure connection to an organization's network.

A)biometric security
B)intrusion detection
C)virtual private
D)terminal resource 

Question 48

Which statement is true of firewalls?

A)They protect against external access,but they leave networks unprotected from internal intrusions.
B)They can identify attack signatures,trace patterns,and generate alarms for a network administrator.
C)They monitor network traffic and use the "prevent,detect,and react" approach to security.
D)They cause routers to terminate connections with suspicious sources.

Question 49

Which type of access control is used to protect systems from unauthorized access?

A)Electronic trackers
B)Passwords
C)Firewalls
D)Identification badges

Question 50

Which is a nonbiometric security measure?

A)Electronic trackers
B)Retinal scanning
C)Callback modems
D)Signature analysis

Question 51

Which of the following intentional computer and network threats is a type of Trojan program used to release a virus,worm,or other destructive code?

A)A logic bomb
B)Dumpster diving
C)A blended threat
D)Shoulder surfing

Question 52

_____ are usually placed in front of a firewall and can identify attack signatures,trace patterns,generate alarms for a network administrator,and cause routers to terminate connections with suspicious sources.

A)Intrusion detection systems
B)Proxy servers
C)Identification badges
D)Virtual private networks

Question 53

In the context of intentional computer and network threats,a _____ is a programming routine built into a system by its designer or programmer to bypass system security and sneak back into the system later to access programs or files.

A)logic bomb
B)proxy server
C)firewall
D)backdoor

Question 54

Which biometric security measure compares the length of each finger,the translucence of fingertips,and the webbing between fingers against stored data to verify users' identities?

A)Hand geometry
B)Fingerprint recognition
C)Vein analysis
D)Palm prints

Question 55

As a physical security measure,_____.

A)electronic trackers are attached to a computer at the power outlet
B)passwords are used to restrict access to computers
C)firewalls are used to filter data packets
D)a user's signature is verified before granting accessibility

Question 56

A _____ is a type of an intentional computer and network threat.

A)latch
B)proxy server
C)backdoor
D)corner bolt

Question 57

In the context of firewall as a nonbiometric security measure,a _____ is software that acts as an intermediary between two systems.

A)logic bomb
B)callback modem
C)proxy server
D)block multiplexer

Question 58

_____ are an inexpensive way to secure a computer to a desktop or counter and often have locks as an additional protection against theft.

A)Corner bolts
B)Identification badges
C)Callback modems
D)Electronic trackers

Question 59

In the context of intentional computer and network threats,a _____ floods a network or server with service requests to prevent legitimate users' access to the system.

A)blended threat
B)denial-of-service attack
C)keystroke logging attack
D)backdoor threat

Question 60

Which statement is true of application-filtering firewalls?

A)They are less secure than packet-filtering firewalls.
B)They filter viruses less effectively than packet-filtering firewalls.
C)They filter faster than packet-filtering firewalls.
D)They are more expensive than packet-filtering firewalls.

Question 61

_____ is a type of data encryption that enables users of the Internet to securely and privately exchange data through the use of a pair of keys that is obtained from a trusted authority and shared through that authority.

A)A public key infrastructure
B)Open key encryption
C)Secret key encryption
D)A private key infrastructure

Question 62

In the event of a network attack or intrusion,a _____ lists the tasks that must be performed by the organization to restore damaged data and equipment.

A)risk assessment plan
B)systems engineering plan
C)disaster recovery plan
D)security compliance plan

Question 63

Which statement is true of symmetric encryption?

A)It uses two different keys to encrypt and decrypt a message.
B)It requires more processing power than asymmetric encryption.
C)It is difficult to share a key over the Internet in symmetric encryption.
D)It is impossible to create digital signatures using symmetric encryption.

Question 64

_____ is an example of antispyware software.

A)STOPzilla
B)AndroZip
C)Tumblr
D)Dogpile

Question 65

_____ is a commonly used encryption protocol that manages transmission security on the Internet.

A)Application Layer
B)Secure Sockets Layer
C)Transmission Control Protocol
D)User Datagram Protocol

Question 66

In data encryption,the https in a browser address bar indicates a safe HTTP connection over _____.

A)Secure Sockets Layer
B)Transport Layer Security
C)User Datagram Protocol
D)Transmission Control Protocol

Question 67

Which form of text needs to be unscrambled using a decryption key?

A)Plaintext
B)Cleartext
C)Teletext
D)Ciphertext

Question 68

_____ outlines procedures for keeping an organization operational in the event of a natural disaster or a network attack or intrusion.

A)An access control system
B)Business continuity planning
C)An intrusion detection system
D)Terminal resource security

Question 69

_____ is a form of spyware that collects information about a user (without the user's consent)to determine which commercials to display in the user's Web browser.

A)Firmware
B)Silverware
C)Freeware
D)Adware

Question 70

When planning a comprehensive security system,the first step is designing _____,which use a combination of hardware and software for improving reliability,a way of ensuring availability in case of a system failure.

A)database-resilient systems
B)vulnerability-evade systems
C)primary-defense systems
D)fault-tolerant systems

Question 71

_____ is an attempt to gain access to a network by posing as an authorized user in order to find sensitive information,such as passwords and credit card information.

A)Phishing
B)Keystroke logging
C)Spoofing
D)Pharming

Question 72

_____,a recent cryptographic protocol,ensures data security and integrity over public networks,such as the Internet.

A)Transport Layer Security
B)Terminal Resource Security
C)Transmission Control Security
D)User Datagram Security

Question 73

_____ uses a public key known to everyone and a private key known only to the recipient.

A)Symmetric encryption
B)Asymmetric encryption
C)Remote key encryption
D)Secret key encryption

Question 74

Data sent through a virtual private network (VPN)can be encrypted using the _____.

A)User Datagram Protocol
B)Transmission Control Protocol
C)Internet Control Message Protocol
D)Layer Two Tunneling Protocol

Question 75

In the context of e-commerce transaction security measures,authentication is a critical factor because it ensures that:

A)a system quickly recovers in the event of a system failure or disaster.
B)the person using a credit card number is the card's legitimate owner.
C)the accuracy of information resources within an organization is maintained.
D)a system can easily be restored to operational status.

Question 76

_____ is the unauthorized use of system data for personal gain,such as transferring money from another's account or charging purchases to someone else's account.

A)Computer fraud
B)Denial-of-service
C)Keystroke logging
D)Social engineering

Question 77

The main function of Cyber Incident Response Capability (CIRC)is to _____.

A)provide level 1 security
B)restrict access controls to unauthorized personnel
C)provide information on security incidents
D)create backdoors to bypass security protocols

Question 78

_____ is also known as secret key encryption.

A)Symmetric encryption
B)Auto key generation
C)Public key cryptography
D)Message authentication

Question 79

_____ monitor and record the keys pressed on a keyboard and can be software or hardware devices.

A)Keystroke loggers
B)Key chain planners
C)Key punchers
D)Key performers

Question 80

Which statement is true of asymmetric encryption?

A)It uses the same key to encrypt and decrypt a message.
B)It requires a large amount of processing power.
C)It can easily share a key over the Internet.
D)It needs the shared key to be a secret between the sender and the receiver.