Question 1

Insiders are illegitimate users who purposely or accidentally misuse their access to the environment to do business.

Accepted Answer

Insiders are legitimate users who have authorized access to an organization's network, systems, or data, and may misuse their access intentionally or unintentionally, but they are not inherently illegitimate users.

Question 2

Organizations address security risks through two lines of defense. The first is people and the second is technology.

Accepted Answer

People are the first line of defense against security risks because they are the ones who are most likely to notice and report suspicious activity.

Question 3

Identity theft is the category of computer security that addresses the protection of data from unauthorized disclosure and confirmation of data source authenticity.

Accepted Answer

Identity theft refers to the fraudulent acquisition and use of a person's private identifying information, usually for financial gain, rather than the protection of data from unauthorized disclosure or confirming data source authenticity, which relates more to data security and integrity measures.

Question 4

A firewall scrambles information into an alternative form that requires a key or password to decrypt.

Accepted Answer

A firewall is designed to block unauthorized access while permitting outward communication. It does not scramble information but rather monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. Scrambling or encrypting information is the function of encryption software, not a firewall.

Question 5

Pretexting is a form of social engineering in which one individual lies to obtain confidential data about another individual.

Accepted Answer

Pretexting is indeed a social engineering technique where the attacker creates a fabricated scenario (the pretext) to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances.

Question 6

One of the most ineffective ways to set up authentication techniques is by setting up user IDs and passwords.

Accepted Answer

User IDs and passwords are one of the most common ways to set up authentication techniques, but they are also one of the most ineffective. This is because user IDs and passwords can be easily guessed, stolen, or hacked.

Question 7

The three primary information security areas are 1) authentication and authorization, 2) policies and rewards, and 3) detection and response.

Accepted Answer

The three primary information security areas are typically considered to be 1) confidentiality, 2) integrity, and 3) availability, often referred to as the CIA triad.

Question 8

Information security policies detail how an organization will implement the information security plan.

Accepted Answer

The answer of Information security policies detail how an organization...

Question 9

Ransomware is a form of social engineering in which one individual lies to obtain confidential data about another individual.

Accepted Answer

Ransomware is a type of malicious software designed to block access to a computer system or data until a sum of money is paid, not a form of social engineering aimed at obtaining confidential data through deception.

Question 10

Through pretexting, hackers use their social skills to trick people into revealing access credentials or other valuable information.

Accepted Answer

The answer of Through pretexting, hackers use their social skills...

Question 11

Legitimate users who purposely or accidentally misuse their access to the environment and cause some kind of business-affecting incident are called insiders.

Accepted Answer

Insiders are individuals within an organization who have authorized access and may misuse that access to negatively affect the organization, whether intentionally or accidentally.

Question 12

A process of providing a user with permission including access levels and abilities such as file access, hours of access, and amount of allocated storage space is called authentication.

Accepted Answer

Authentication is the process of verifying a user's identity, typically through credentials like usernames and passwords, whereas the description given refers to authorization, which involves granting or denying rights and permissions to authenticated users.

Question 13

Dumpster diving is another security breach for companies and is where people not associated with the company jump into the company's outside garbage bins and try to gather and steal any valuable company products they can resell on eBay.

Accepted Answer

Dumpster diving in the context of security refers to individuals searching through a company's trash to find sensitive information that can be used for malicious purposes, not specifically to steal physical products for resale.

Question 14

Spear phishing is a phishing expedition in which the emails are carefully designed to target a particular person or organization.

Accepted Answer

Spear phishing involves sending emails that are specifically tailored to the recipient, often using personal information to make the attack more convincing and to target a particular individual or organization.

Question 15

The technique to gain personal information for the purpose of identity theft, often through fraudulent emails that look as though they came from legitimate businesses, is called phishing.

Accepted Answer

Phishing is a cybercrime in which targets are contacted by email, telephone, or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.

Question 16

Tokens are small electronic devices that change user passwords automatically.

Accepted Answer

Tokens, particularly security tokens, can generate dynamic, time-sensitive passwords or codes, often changing every few minutes, to enhance security by providing a form of two-factor authentication.

Question 17

Through social engineering, hackers use their social skills to trick people into revealing access credentials or other valuable information.

Accepted Answer

Social engineering involves manipulating individuals into divulging confidential or personal information that may be used for fraudulent purposes, often by exploiting human psychology rather than technical hacking techniques.

Question 18

Identity theft is the forging of someone's identity for the purpose of fraud.

Accepted Answer

Identity theft involves stealing personal information, such as Social Security numbers or bank account details, to commit fraud or other crimes, often for financial gain.

Question 19

Biometrics is the identification of a user based on a physical characteristic, such as a fingerprint, iris, face, voice, or handwriting.

Accepted Answer

Biometrics refers to the methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits, such as fingerprints, iris patterns, facial structure, voice, or handwriting.

Question 20

A phishing expedition is a masquerading attack that combines spam with spoofing. The perpetrator sends millions of spam emails that appear to be from a respectable company. The emails contain a link to a website that is designed to look exactly like the company's website. The victim is encouraged to enter his or her username, password, and sometimes credit card information.

Accepted Answer

Phishing expeditions indeed involve sending fraudulent emails that appear to be from reputable sources to trick individuals into revealing personal information, such as passwords and credit card numbers, by directing them to fake websites that mimic legitimate ones.

Quiz 25: Valuing and Storing Organizational Informationdatabases