Deck 9: The Personal and Social Effects of Computers

Question 1

A strong security program begins by assessing the backgrounds of the employees in the organization.

Answer 1

False

Question 2

A 'virus signature' contains the email ID of the virus developer.

Answer 2

False

Question 3

It is not uncommon for computer users to share their login ID and password with coworkers.

Answer 3

True

Question 4

As the complexity of a network increases, the possibility of security breaches decreases.

Question 5

A virus can reside in a file (or many files) on the hard drive, but it would not be active in memory. As such, it is not as important to scan live memory as it is to scan the hard drive.

Question 6

The computer is running, but not responding to your keyboard inputs. You find that the network activities are running very slowly. You have probably been hit by a rootkit.

Question 7

Spam emails make up only a small proportion (<10%) of emails.

Question 8

Those convicted of cyberterrorism are subject to a prison term of 6 months to 1 year.

Question 9

Most organizations do not hesitate to conceal information about a data loss event if there is a fear of bad publicity and loss of customers.

Question 10

Macro viruses are called so because they are written using a macro language.

Question 11

Educational institutions' Websites are the most commonly targeted sites by phishers

Question 12

If an attack is dangerous enough, it may warrant shutting down or disconnecting critical systems from the network.

Question 13

An attack that takes place before the security community and/or software developers become aware of and fix a security vulnerability is called the 'zero-day attack.'

Question 14

You see a deceptive pop-up that says your computer is infected and that you must visit a compromised web site where you pay them to clean your computer. You have just become a victim of ransomware.

Question 15

There are laws that require businesses to prove that their data is secure.

Question 16

An employee who is marked for a lay-off sent threatening emails to his boss, stating that he is going to delete sensitive data. This employee can be charged under the Computer Fraud and Abuse Act.

Question 17

Transmitting a program, code, or command that causes harm to a computer is a crime.

Question 18

Whenever there is a computer security incident, it is not recommended that the organization reveal all they know in public forums.

Question 19

You work at a call center of a large bank where you answer credit card services related questions from customers. Lately, you have noticed an increased number of customers enquiring if you had initiated a call. There can be a scam in progress.

Question 20

Discovery of a vulnerability in a software program can potentially be sold to the government.

Question 21

Any Internet traffic that is not explicitly permitted into the internal network is denied entry through a firewall.

Question 22

These days, the biggest threats to IT security are from ________.

A)"geeks" working on their own and motivated by the desire to gain some degree of notoriety
B)international drug cartels
C) terrorist organizations
D) organized groups that have ample resources, including money and sophisticated tools, to support their efforts

Question 23

Spam emails do not add to costs because nobody reads them anyways.

Question 24

Spear-phishing is when the phisher sends fraudulent emails to a certain organization's employees.

Question 25

You have been hired as the new Information Security consultant at XYZ Inc. Which of these employee behaviors would be a top security concern?

A)Leaving laptop computers unattended in public spaces
B)​Using office computers for personal e-mails
C) Drinking water or coffee while working on computers
D) ​Banging on the keyboard, when the computer is running slow

Question 26

A zombie computer would send requests to access to the target site again and again.

Question 27

A hacktivist is someone who _______.

A)​attempts to gain financially and/or disrupt a company's information systems and business operations
B)hacks computers or Web sites in an attempt to promote a political ideology
C) attempts to destroy the infrastructure components of governments
D) violates computer or Internet security maliciously or for illegal personal gain

Question 28

Which of the following subject areas does the USA Patriot Act cover?

A)​Cyberterrorism
B)​Identity theft
C) Credit card fraud
D) Transmitting virus programs

Question 29

There has been a data breach at your business and the business has lost some customer data. It has led to angry customers who have filed charges. What is a recommended course of action to prepare for future events?

A)activate the forensics analysis team and prepare documentation
B)​meet with your lawyers to prepare to counter-sue the customers
C) settle with the customers, however much it may cost
D) none of these answers

Question 30

Which of the following shortcoming may be revealed during an IT security audit?

A)​whether the IT budget is adequate or not
B)​whether the users are satisfied with IT services or not
C) whether only a limited number of people have access to critical data or not
D) whether the firewall is tall enough

Question 31

Once a _____ is installed, the attacker can gain full access to the computer.

A)​botnet
B)zombie
C) ​worm
D) ​rootkit

Question 32

When you receive a text message that there is a problem with your bank account and you are required you to click on a link to submit some information, you are likely seeing a vishing attack.

Question 33

Even legitimate organizations sometimes use email spam for promoting products.

Question 34

Which of the following is NOT a popular vendor of firewall software?

A)​Red Hat
B)​Check Point
C) ​Kaspersky
D) ​Total Defense

Question 35

The US-CERT incident reporting system is used to ____.

A)​alert the bank about stolen credit cards
B)alert the government about missing computers
C) alert the Border Patrol about undocumented workers
D) ​alert the Department of Homeland Security about information security incidents

Question 36

Default usernames and passwords should always be changed.

Question 37

A botnet is a ____.

A)network of robots that control an assembly line at a factory
B)network of servers that exchange traffic data
C) ​network of devices that are used for managing security
D) ​network of computers that send out access requests to servers repeatedly

Question 38

Suppose your computer network was compromised in a large scale virus attack last Thursday. Most of the data files got corrupted beyond repair. The last data backup was done the Sunday before the virus attack. This means your company has an adequate backup process in place.

Question 39

There are bots that can sign up for thousands of email accounts.

Question 40

Downloading games from unknown websites can be risky. The software may be a Trojan horse.

Question 41

Many organizations use _______ to provide a comprehensive display of all vital data related to an organization's security defenses, including threats, exposures, policy compliance, and incident alerts.

Question 42

Which of the following security incidents is least costly to fix?

A)​theft of program source code
B)​alteration of corporate database
C) theft of trade secrets
D) defacing of web pages

Question 43

You recently installed a game that you got for free. After a few days, you find that your computer's log has entries of logins that were not initiated by you. The perpetrator was most likely logging in using a _______.

Question 44

Assume your organization is experiencing an intruder attack. You have an intrusion detection system (IDS) set up. Which of the following events occurs first?

A)​Messages from the IDS are routed to the network security team
B)​The IDS warns the firewall of suspicious traffic
C) The network router sends traffic to the firewall as well as to the IDS
D) Network security team decides to block traffic from that IP address

Question 45

Which of the following laws covers false claims regarding unauthorized use of credit cards?

A)​Computer Fraud and Abuse Act
B)​Fraud and Related Activity in Connection with Access Devices Statute
C) Identity Theft and Assumption Deterrence Act
D) Stored Wire and Electronic Communications and Transactional Records Access Statutes

Question 46

Which of the following is the correct description of a firewall?

A)​It is a software that deletes viruses from attachments.
B)​It is hardware that prevents unauthorized data to enter the private network.
C) It is a software and hardware combination that limits the incoming and outgoing Internet traffic.
D) ​It is a concept used in developing security policies.

Question 47

Your business has a web server that has suddenly become unresponsive. When you study the server's logs there are a huge number of requests from what appear to be legitimate computers. The problem is likely because of _____.

A)a CAPTCHA issue
B)a denial-of-service attack
C) too many Spam emails
D) a logic bomb

Question 48

On the back of a credit card the three-digit number above the signature panel is used to _____.

A)​verify the identity of the credit card holder
B)​verify the card is legitimate and not a stolen card number
C) ​enter your account into a raffle
D) ​track your transactions for rewards program purposes

Question 49

This harmful malware is triggered by a specific event, such as Friday the 13th.

A)​Virus
B)Worm
C) Logic bomb
D) Trojan bomb

Question 50

The purpose of Advanced Persistent Threat (APT) usually is to ____.

A)​steal money
B)interrupt service
C) steal data
D) ​annoy the users

Question 51

A company's risk assessment process can include numerous threats to the computers and networks. Which of the following can be considered an adverse event?

A)​Distributed denial-of-service attack
B)Email attachment with harmful worm
C) Harmful virus
D) All of the above

Question 52

A(n) _______ is an individual who captures trade secrets and attempts to gain an unfair competitive advantage.

Question 53

You wish to use your personal laptop computer at work. However, the IT department folks are unwilling to allow you. The likely reason is ______.

A)​you will use your laptop for non-work related activity
B)​your productivity could not be measured correctly
C) ​your non-work related use of the laptop could increase vulnerability
D) ​your activities could not be monitored

Question 54

You work for a company that is growing. Originally, all the users in all departments had access to all the data in the database. It is considered a security risk. What is an appropriate action to reduce the risk?

A)​Install a two-step login procedure, where the user has to key in additional information for logging in
B)Install and provide stronger anti-virus software on the users' computers
C) Tweak the firewall parameters so that outgoing traffic can be better controlled
D) Assign roles and privileges to users so that only job-relevant data is accessible to the user.

Question 55

Which of these organizations offers guidelines on developing security policies?

A)​DHS
B)​SANS
C) ​IBM
D) ​CISCO

Question 56

The second phase of an Advanced Persistent Threat attack is _____.

A)​capture
B)reconnaissance
C) incursion
D) ​discovery

Question 57

In a denial-of-service (DDoS) attack, the perpetrator ____.

A)instructs the zombie computers to send simple access requests to target computers
B)​sends out a huge number of spam emails to all of those in your contacts list
C) changes the configuration information of the infected computers
D) ​refuses to accept any email from any sender

Question 58

Which of the following is a vendor of popular anti-virus software?

A)​Microsoft
B)​Symantec
C) ​McDonald's
D) ​Bayer

Question 59

Someone who violates computer or Internet security maliciously or for illegal personal gain is known as a(n) _______.

A)​black hat hacker
B)industrial spy
C) hacktivist
D) ​cyberterrorist

Question 60

You had used an online service to apply for a credit card. As part of the process, you submitted your personal information such as SSN, date of birth, employer information, etc. Soon after you started receiving bills for items you did not purchase. You have become a victim of ________.

A)​cyberterrorism
B)​ransomware
C) identity theft
D) cyber espionage

Question 61

Your ex-colleague was apprehended based on the "Fraud and Related Activity in Connection with Access Devices Statute" Act. He was caught using unauthorized or stolen _________.

Question 62

____ is a piece of programming code, usually disguised as something else, that causes a computer to behave in an unexpected and usually undesirable manner.

Question 63

Suppose you wish to inspect the packets of data that are coming in from the Internet into your organization's network. You should use _______.

Question 64

The purpose of _____ is to use email messages to make the recipients reveal personal data.

Question 65

_____ is software that generates and grades tests that humans can pass; however, all but the most sophisticated computer programs cannot.

Question 66

The concept of _______, in connection with IS security, recognizes that managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved.

Question 67

A ______ defines an organization's security requirements, as well as the controls and sanctions needed to meet those requirements.

Question 68

The primary security threat for mobile devices continues to be ______ of the device.

Question 69

You are starting to see unexpected messages on the screen. Some programs that used to work do not work any longer. You find some key files missing. Your computer has been infected by a(n) _________.

Question 70

It is crucial that antivirus software be continually _____ with the latest virus signatures.

Question 71

Some businesses outsource their security management to MSSPs. MSSP stands for ________.

Question 72

_______ try, on a daily basis, to gain unauthorized access to a number of important and sensitive sites, such as the computers at the British, French, Israeli, and United States foreign intelligence agencies.

Question 73

Someone who attempts to destroy the infrastructure components of governments is known as a ______________ .

Question 74

In computing, an attack on an information system that takes advantage of a particular system vulnerability is called a(n) _______.

Question 75

Computer _______ is a discipline that combines elements of law and computer science to identify, collect, examine, and preserve data from computer systems, networks, and storage devices in a manner that preserves the integrity of the data gathered so that it is admissible as evidence in a court of law.

Question 76

_____ is similar to SMiShing except that the victims receive a voice mail message telling them to call a phone number or access a Web site.

Question 77

When the data about Target's customers was stolen, it was an example of a(n) ______.

Question 78

The US-CERT newsletter has alerted you about vulnerabilities in some software installed in your organization. To detect if there is any attempt at exploiting this vulnerability, you would employ ____-based intrusion detection system.

Question 79

The ______ is the agency tasked with the goal of providing for a safer, more secure America, making it resilient against terrorism and other potential threats.

Question 80

A ________ often creates a "backdoor" on a computer that enables an attacker to gain access to the system and compromise confidential or private information.