Deck 14: Information Security and Computer Fraud

Question 1

Spam is a self-replicating program that runs and spreads by modifying other programs or files.

Answer 1

False

Question 2

Symmetric-key encryption is rarely used today due to key distribution and key management issues.

Answer 2

False

Question 3

The symmetric-key encryption method is used to authenticate users.

Answer 3

False

Question 4

The goal of information security management is to enhance the confidence,integrity and authority (CIA)of a firm's information.

Question 5

Encryption is a preventive control ensuring data confidentiality and privacy during transmission and for storage.

Question 6

The goal of information security management is to maintain confidentiality,integrity and availability of a firm's information.

Question 7

A company's audit committee is solely responsible for fraud risk assessments.

Question 8

When using asymmetric encryption algorithm,for two trading parties to conduct e-business,they need to use two keys.

Question 9

A Certificate Authority (CA)issues digital certificates to bond the subscriber with a public key and a private key.

Question 10

Asymmetric-key encryption is suitable for encrypting large data sets or messages.

Question 11

Which of the following statements is incorrect about digital signatures?

A)A digital signature can ensure data integrity.
B)A digital signature also authenticates the document creator.
C)A digital signature is an encrypted message digest.
D)A digital signature is a message digest encrypted using the document creator's public key.

Question 12

Most companies use both symmetric-key and asymmetric-key encryption methods when conducting e-business.

Question 13

The purpose of using a digital signature is for authentication.

Question 14

Hashing process can be reversed and it is used for maintaining data confidentiality.

Question 15

A Trojan Horse is a self-replicating,self-propagating,self-contained program that uses networking mechanisms to spread itself.

Question 16

Encryption and hashing are similar process to maintain data confidentiality.

Question 17

Disaster recovery planning and business continuity management are unrealted.

Question 18

Key distribution and key management are problematic under the symmetric-key encryption.

Question 19

Information security is a critical factor in maintaining systems integrity.

Question 20

One type of fault tolerance is using redundant units to provide a system the ability to continue functioning when part of the system fails.

Question 21

Why do Certificate Authority (CA)play an important role in a company's information security management?

A)Using a CA is required by SOX in managing information security.
B)A CA is responsible to generate session keys for encryption purposes.
C)Most companies use CA to manage their employees' public keys.
D)CA creates and maintains both the public and private keys for a company's employees.

Question 22

Bacchus,Inc.is a large multinational corporation with various business units around the world.After a fire destroyed the corporation headquarters and largest manufacturing site,plans for which of the following would help Bacchus ensure a timely recovery?

A)Daily backup.
B)Network security.
C)Business continuity.
D)Backup power.

Question 23

Which of the following statements is incorrect?

A)A fraud prevention program starts with a fraud risk assessment across the entire firm
B)The audit committee typically has an oversight role in risk assessment process
C)Communicating a firm's policy file to employees is one of the most important responsibilities of management
D)A fraud prevention program should include an evaluation on the efficiency of business processes.

Question 24

When client's accounts payable computer system was relocated,the administrator provided support through a dial-up connection to server.Subsequently,the administrator left the company.No changes were made to the accounts payable system at that time.Which of the following situations represents the greatest security risk?

A)User passwords are not required to the in alpha-numeric format.
B)Management procedures for user accounts are not documented.
C)User accounts are not removed upon termination of employees.
D)Security logs are not periodically reviewed for violations.

Question 25

A disaster recovery approach should include which of the following elements?

A)Encryption.
B)Firewalls.
C)Regular backups.
D)Surge protectors.

Question 26

Select a correct statement regarding encryption methods?

A)To use symmetric-key encryption,each user needs two different keys.
B)Most companies prefer using symmetric-key encryption than asymmetric-key encryption method.
C)Both symmetric-key and asymmetric-key encryption methods require the involvement of a certificate authority.
D)When conducting e-business,most companies use both symmetric-key and asymmetric-key encryption methods.

Question 27

Select a correct statement regarding a hashing process.

A)It is reversible.
B)The outcome is a message digest.
C)It is not necessary to use a hashing process in creating a digital signature.
D)It is used for authentication.

Question 28

Which of the following controls would most likely assure that a company can reconstruct its financial records?

A)Security controls such as firewalls.
B)Backup data are tested and stored safely.
C)Personnel understand the data very well.
D)Paper records.

Question 29

Which of the following statements about asymmetric-key encryption is correct?

A)When using asymmetric-key encryption method,a total of two keys are necessary in electronic communication between two parties.
B)Employees in the same company share the same public key.
C)Most companies would like to manage the private keys for their employees.
D)Most companies would like to use a Certificate Authority to manage the public keys of their employees.
E)Two of the above are correct.

Question 30

Which of the following IT controls would best prevent a developer from inappropriately accessing the system?

A)Forced password changes.
B)Secondary code review.
C)Symmetric encryption.
D)Lack of authentication.

Question 31

Which of the following is not included in the remediation phase for vulnerability management?

A)Risk Response Plan.
B)Policy and procedures for remediation.
C)Vulnerability Prioritization.
D)Control Implementation.

Question 32

What is the primary objective of data security controls?

A)To establish a framework for controlling the design,security,and use of computer programs throughout an organization.
B)To ensure that data storage media are subject to authorization prior to access,change,or destruction.
C)To formalize standard,rules,and procedures to ensure the organization's control are properly executed.
D)To monitor the use of system software to prevent unauthorized access to system software and computer programs.

Question 33

When computer programs or files can be accessed from terminals,users should be required to enter a(n):

A)Parity check.
B)Password as a personal identification code.
C)Check digit.
D)Echo check.

Question 34

Why would companies want to use digital signatures when conducting e-business?

A)They are cheap.
B)They are always the same so it can be verified easily.
C)They are more convenient than requiring a real signature.
D)They can authenticate the document sender and maintain data integrity.

Question 35

To prevent invalid data input,a bank added an extra number at the end of each account number and subjected the new number to an algorithm.This technique is known as:

A)A validation check.
B)check digit verification.
C)A dependency check.
D)A format check.

Question 36

Which of the following is a password security weakness?

A)Users are assigned passwords when accounts are created,but do not change them.
B)Users have accounts on several systems with different passwords.
C)Users write down their passwords on a note paper,and carry it with them.
D)Users select passwords that are not part of an online password dictionary.

Question 37

Which of the following does not represent a viable data backup method?

A)Disaster recovery plan.
B)Redundant arrays of independent drives.
C)Virtualization.
D)Cloud computing.

Question 38

An entity doing business on the internet most likely could use any of the following methods to prevent unauthorized intruders from accessing proprietary information except:

A)Password management.
B)Data encryption.
C)Digital certificates.
D)Batch processing.

Question 39

An information technology director collected the names and locations of key vendors,current hardware configuration,names of team members,and an alternative processing location.What is the director most likely preparing?

A)Data restoration plan.
B)Disaster recovery plan.
C)System security policy.
D)System hardware policy.

Question 40

Which of the following statements regarding authentication in conducting e-business is incorrect?

A)It is a process that establishes the origin of information or determines the identity of a user,process,or device.
B)Only one key is used for encryption and decryption purposes in the authentication process.
C)Successful authentication can prevent repudiation in electronic transactions.
D)We need to use asymmetric-key encryption to authenticate the sender of a document or data set.

Question 41

Which of the following describes the recommended prerequisites for managing vulnerabilities?

A)Implement the COSO ERM framework,and identify key vulnerabilities.
B)Determine the main objective of vulnerability management,and assign roles and responsibilities.
C)Identify the key vulnerabilities,and implement appropriate controls to minimize the vulnerabilities.
D)Implement suitable controls,and assess those controls for potential vulnerabilities.

Question 42

Which of the following is not one of the main components of vulnerability management and assessment?

A)Identification.
B)Remediation.
C)Internalization.
D)Maintenance.

Question 43

Which of the following is not an example of a vulnerability within an Information System?

A)Outdated intrusion detection/prevention system.
B)Lack of a disaster recovery plan.
C)Improper system configuration.
D)Failure to audit and terminate unused accounts in a timely manner.

Question 44

Which of the following describes the primary goals of the CIA approach to information security management?

A)Controls,Innovation,Analysis.
B)Confidentiality,Integrity,Availability.
C)Convenience,Integrity,Awareness.
D)Confidentiality,Innovation,Availability.

Question 45

For businesses considering a cloud computing solution,which of the following should they ask the cloud vendor to provide before entering into a contract for critical business operations?

A)FASB 51 Report.
B)Audit Report.
C)SAS 3 Report.
D)SOC 2 Report.

Question 46

Which of the following IT controls would best prevent a currency trader from concealing his/her trading errors?

A)End user access to source code.
B)Multifactor authentication.
C)Symmetric encryption.
D)Use of a private key.

Question 47

Which of the following is not an example of vulnerability within the process of IT operations?

A)Software not patched.
B)Inappropriate data classification.
C)Ineffective training.
D)Poor firewall rules.

Question 48

Which of the following statements is true regarding risk management and vulnerability management?

A)They both have the objective of reducing the likelihood that detrimental events occur.
B)Risk management is often conducted using an IT asset-based approach.
C)Vulnerability management is more complex and strategic.
D)Both approaches involve processes that typically take many months or years to complete.

Question 49

What could result from the failure to audit and terminate unused accounts in a timely manner?

A)A disgruntled employee may send out phishing emails.
B)A SOC 1 report will be generated.
C)Computer hardware may be taken off premises.
D)A disgruntled employee may tamper with company applications.

Question 50

Encryption is a control that changes plain text into which of the following?

A)Cyberspace.
B)Cryptext.
C)Mnemonic code.
D)Cyphertext.

Question 51

A RAID array implemented in a data center is an example of which of the following?

A)Virtualization.
B)Uninterruptible power supply.
C)Fault tolerance.
D)SOC 3.

Question 52

Which of the following is not one of the common techniques for information security risks and attacks?

A)Spam.
B)Botnet.
C)TraceRT.
D)Social Engineering.

Question 53

Both ISACA and the GTAG define vulnerability.Which of the following does not represent one of these definitions?

A)The nature of IT resources that can be exploited by a threat to cause damage.
B)An organizations' exposure to disaster.
C)Weaknesses or exposures in IT assets that may lead to business,compliance,or security risk.
D)All of the other items represent the definitions of vulnerability stated by ISACA and the GTAG.

Question 54

A Public Key Infrastructure (PKI)provides the ability to do which of the following?

A)Encrypt messages using a private key.
B)Enable debit and credit card transactions.
C)Read plaintext.
D)Issue,maintain,and revoke digital certificates.

Question 55

Asymmetric-key encryption uses which of the following techniques to allow users to communicate securely?

A)A message digest.
B)A 16-bit encryption key.
C)A public key and a private key.
D)A digital signature.

Question 56

Which of the following is not an example of a physical security vulnerability?

A)Unescorted visitors on the premises.
B)Poor choice of passwords.
C)Lack of a smoke detector in the room housing servers.
D)Lack of disaster recovery plan.

Question 57

Which of the following best illustrates the use of multifactor authentication?

A)Requiring password changes every 30,60,or 90 days.
B)Requiring the use of a smart card and a password.
C)Requiring the use of upper case,lower case,numeric,and special characters for a password.
D)The use of a fingerprint scanner for access to a device.

Question 58

Which of the following statements is most accurate with regard to business continuity management (BCM)and disaster recovery planning (DRP)?

A)DRP is an important component of BCM.
B)BCM and DRP should be considered independently of each other.
C)BCM is an important component of DRP.
D)DRP should be considered as optional,while BCM should be considered as necessary.