Question 1

There are two broad categories of controls. These are:

Accepted Answer

The two broad categories of controls are general controls and application controls. General controls are designed to provide a secure environment for all the information systems of an organization, while application controls apply to specific applications and are designed to ensure the completeness, accuracy, and validity of transactions processed through those applications. Security and access controls, firewall and biometric controls, logical and operations controls, and management and business process controls are all subcategories of either general or application controls.

Question 2

The annual report of Canadian Tire's financial activities contains a tag containing the time that it was created, modified and moved. This is an example of ________.

Accepted Answer

The tag containing the time that the annual report was created, modified and moved is an example of time stamping, which is the process of adding a time stamp to a document or file to indicate when it was created, modified, or accessed. This is helpful in tracking changes and ensuring the integrity of the document. Auto tagging, digital tagging, authentication, and auto stamping are not relevant to this specific example.

Question 3

A potential problem with some Intrusion Detection Systems is the generation of a large volume of ________.

Accepted Answer

Intrusion Detection Systems sometimes generate a large volume of false-positives, which are alerts that indicate an intrusion has occurred when in fact it has not. This can lead to user frustration and cause important alerts to be ignored or overlooked. False-negatives, which occur when an intrusion goes undetected, are also a concern, but not the potential problem mentioned in the question. True-positives and true-negatives are not problematic outcomes for an IDS to generate.

Question 4

Malicious acts include:

Accepted Answer

Malicious acts specifically refer to intentional harm caused by individuals or groups, such as hacker attacks and viruses. The other options listed may cause harm as well, but they are not necessarily considered malicious acts.

Question 5

An International Development System (IDS) monitors devices and processes for security threats and can alert security personnel of the occurrence of unusual activity as it occurs.

Accepted Answer

An Intrusion Detection System (IDS) monitors devices and processes for security threats and can alert security personnel of the occurrence of unusual activity as it occurs.

Question 6

With current technology, security risks are becoming much less of a concern.

Accepted Answer

It is false. While technology continues to advance, there are always new security risks and threats emerging, making it necessary to continually improve and update security measures.

Question 7

Logical access controls include locking the door to the server room.

Accepted Answer

Logical access controls are digital measures used to limit access to information and systems, such as passwords, biometrics, and access control lists, whereas locking the door to the server room is a physical access control measure.

Question 8

Firewalls are only one component of an overall security program.

Accepted Answer

Firewalls are important in preventing unauthorized access to a network, but they should be used in conjunction with other security measures such as antivirus software, intrusion detection systems, and access controls. A comprehensive security program should address multiple layers of protection to effectively secure a network.

Question 9

An access control technique used on the web to prevent unauthorized software from masquerading as a person, presenting a set of distorted squiggly letters and numbers that people can decipher but computers cannot is called ________.

Accepted Answer

CAPTCHA is a technology used to prevent automated bots from performing actions on websites that should only be performed by humans. It works by displaying a distorted set of characters that humans can easily read, but computers cannot decipher. This technique helps to ensure that the user of the website is a real person and not a software program.

Question 10

A company can build its security platform on public key infrastructure.

Accepted Answer

Public key infrastructure (PKI) is a system that uses digital certificates and public key cryptography to secure communication over the internet. A company can utilize PKI to build an effective security platform that can protect its digital assets and data. The technology can also be used to authenticate users, secure email communication, and protect online transactions. Therefore, it is true that a company can build its security platform on public key infrastructure.

Question 11

The use of electronic devices attached to transmission lines that can detect and capture data transmissions on those lines is called:

Accepted Answer

The use of electronic devices to capture data transmissions on transmission lines is known as sniffing.

Question 12

The most basic privilege in a computerized business system is ________.

Accepted Answer

Access refers to the ability to enter and view data in the system. Without access, a user cannot perform any functions within the system.

Question 13

S-HTTP is an extension of HTTP that enables individual messages to be encrypted.

Accepted Answer

S-HTTP is an extension of HTTP that enables individual messages to be encrypted.

Question 14

Lack of standards, regulations and rules, and support systems are examples of internal risks associated with new business models.

Accepted Answer

These are examples of external risks because they are influenced by factors outside the control of the business, such as regulatory environments and market conditions.

Question 15

The encryption of information is all that is needed to ensure that a network is safe from attacks.

Accepted Answer

Encryption is an important part of network security, but it is not the only measure that needs to be taken to ensure a safe network. Other security measures such as strong passwords, firewalls, access controls, and regular software updates are also necessary to protect against attacks.

Question 16

An entity's security program must address all but the following:

Accepted Answer

While business process improvement is important for overall organizational efficiency, it is not directly related to security. The other options listed are all necessary components of a comprehensive security program.

Question 17

Biometrics include all of the following except:

Accepted Answer

Biometrics are physical or behavioral characteristics that can be used to identify and authenticate individuals. Signatures and fingerprints are physical characteristics that can be used for biometric identification, while voice recognition and retina scans are behavioral and physical characteristics, respectively. However, passwords are not considered biometrics as they are knowledge-based and not physical or behavioral characteristics.

Question 18

All applications that a business uses require controls for input, processing, output, storage, and:

Accepted Answer

Applications require controls for communications to ensure data is transmitted securely and accurately between systems and users.

Question 19

The process of encryption converts data into a form called cipher.

Accepted Answer

Encryption converts data into a form called cipher which is a secret code that can only be deciphered by authorized parties who have access to the encryption key.

Question 20

Studies on stock prices of ebusiness entities have shown that security breaches involving access to confidential data and website outages are associated with significant stock price declines.

Accepted Answer

Studies have indeed shown that security breaches and website outages have a negative impact on the stock prices of ebusiness entities.

Quiz 5: Security and Controls

There are two broad categories of controls. These are:

The annual report of Canadian Tire's financial activities contains a tag containing the time that it was created, modified and moved. This is an example of ________.

A potential problem with some Intrusion Detection Systems is the generation of a large volume of ________.

Malicious acts include:

An International Development System (IDS) monitors devices and processes for security threats and can alert security personnel of the occurrence of unusual activity as it occurs.

With current technology, security risks are becoming much less of a concern.

Logical access controls include locking the door to the server room.

Firewalls are only one component of an overall security program.

An access control technique used on the web to prevent unauthorized software from masquerading as a person, presenting a set of distorted squiggly letters and numbers that people can decipher but computers cannot is called ________.

A company can build its security platform on public key infrastructure.

The use of electronic devices attached to transmission lines that can detect and capture data transmissions on those lines is called:

The most basic privilege in a computerized business system is ________.

S-HTTP is an extension of HTTP that enables individual messages to be encrypted.

Lack of standards, regulations and rules, and support systems are examples of internal risks associated with new business models.

The encryption of information is all that is needed to ensure that a network is safe from attacks.

An entity's security program must address all but the following:

Biometrics include all of the following except:

All applications that a business uses require controls for input, processing, output, storage, and:

The process of encryption converts data into a form called cipher.

Studies on stock prices of ebusiness entities have shown that security breaches involving access to confidential data and website outages are associated with significant stock price declines.