Question 1

Research shows that most companies 95%) that suffer a significant data loss are able to recover and are still in business five years later.

Accepted Answer

Research indicates that a significant percentage of companies that suffer a major data loss do not recover easily, with many going out of business within a few years after the incident.

Question 2

The Sarbanes-Oxley Act SOX) is an anti-fraud law that forces more accurate business reporting and disclosure of GAAP generally accepted accounting principles) violations.

Accepted Answer

The statement accurately describes the purpose and main provisions of the Sarbanes-Oxley Act (SOX).

Question 3

Symptoms of fraud that can be detected by internal controls include all of the following: missing documents, delayed bank deposits and employees who don't take vacations or work inordinate amounts of overtime.

Accepted Answer

These are all common signs of fraud that can be detected by internal controls. Missing documents may indicate that someone is attempting to cover up their fraudulent activities, delayed bank deposits may suggest that funds are being diverted or misused, and employees who don't take vacations or work excessive overtime may be trying to conceal their fraudulent behavior or are simply overburdened with tasks related to their fraudulent activities.

Question 4

When dealing with consumer-facing applications, such as online banking and e-commerce, strong authentication must be balanced with convenience.

Accepted Answer

Consumers value convenience and will be less likely to use an application that requires overly complicated authentication methods. However, strong authentication is necessary to protect sensitive information and prevent fraud, so a balance between the two is crucial in consumer-facing applications.

Question 5

To protect their wireless network, organizations should ensure that each wireless device connected to the network matches an authorized configuration and security profile, with a documented owner of the connection and a defined business need.

Accepted Answer

This statement is true. To ensure the security of a wireless network, organizations should control access to the network by authenticating each device and its user, and ensuring that the device configuration and security meet the organization's standards. Each connection should have a defined owner with a legitimate business need for network access. These measures help prevent unauthorized access and protect the organization's sensitive information.

Question 6

A gateway is a system, or group of systems, that enforces an access-control policy between two networks.

Accepted Answer

The answer of A gateway is a system, or group...

Question 7

Network security involves three types of defenses, which are referred to as 1) perimeter security layer, 2) administrative layer, and 3) operational layer.

Accepted Answer

Network security is often described in terms of three key components or layers: physical, technical (or logical), and administrative. These layers address different aspects of security, including physical access controls, cybersecurity measures, and policies/procedures, respectively.

Question 8

The major objective of authentication is to identify a legitimate user and determine the actions) he or she is allowed to perform.

Accepted Answer

Authentication is the process of confirming the identity of a user or device. Its main objective is to verify that the user is legitimate and to grant appropriate access privileges based on their identity.

Question 9

The internal control environment is the work atmosphere that a company sets for its employees and is designed to achieve reliability of financial reporting and compliance with laws, regulations and policies.

Accepted Answer

The statement is correct. The internal control environment is designed to ensure the reliability of financial reporting and compliance with laws, regulations, and policies. It includes factors such as the company's management style, organizational structure, code of conduct, and communication channels.

Question 10

Performing authorization and authentication are examples of administrative controls.

Accepted Answer

Authorization and authentication are examples of technical controls, as they involve the use of technology to restrict and manage access to resources. Administrative controls involve policies, procedures, and guidelines.

Question 11

To protect their wireless network, organizations should use Wireless Intrusion Detection Systems WIDS) to identify rogue wireless devices and detect attack attempts and successful compromises.

Accepted Answer

Wireless Intrusion Detection Systems (WIDS) help to detect rogue wireless devices and potential attacks on the wireless network, therefore using WIDS is an effective measure to protect the wireless network.

Question 12

An estimated 93% of companies that suffer a significant data loss often go out of business within five years.

Accepted Answer

This is a widely cited statistic in the field of data management and has been supported by various studies and surveys. It highlights the critical importance of effective data backup and disaster recovery strategies for businesses of all sizes.

Question 13

To keep unauthorized users out of the network, companies need to implement network access controls.

Accepted Answer

Network access controls are necessary to prevent unauthorized access to a company's network. These controls include methods such as passwords, firewalls, and authentication protocols to ensure that only authorized users have access to the network.

Question 14

The purpose of a business continuity plan is to keep the business running after a disaster occurs. Each function in the business should have a valid recovery capability plan.

Accepted Answer

A business continuity plan is designed to ensure that essential business functions can continue in the event of a disaster. To achieve this, each function within the business should have a recovery capability plan in place to enable them to continue operating even if their normal processes and systems are disrupted.

Question 15

When dealing with consumer-facing applications, such as online banking and e-commerce, strong authentication must be balanced with cost.

Accepted Answer

The answer of When dealing with consumer-facing applications, such as...

Question 16

The major objective of endpoint security is to identify a legitimate user and determine the actions) he or she is allowed to perform.

Accepted Answer

The major objective of endpoint security is to protect devices (endpoints) on a network from malicious activities and cyber threats, not just to identify and determine the actions of legitimate users.

Question 17

The internal control environment is the work atmosphere that a company sets for its employees and is designed to enhanced managerial decision making and business intelligence BI) capabilities.

Accepted Answer

The internal control environment is primarily focused on the organization's attitude towards risk management, control, and governance processes, rather than directly enhancing managerial decision-making and business intelligence (BI) capabilities.

Question 18

An important element in any security system is the business continuity plan, also known as the disaster recovery plan.

Accepted Answer

A business continuity plan (BCP) or disaster recovery plan (DRP) is an essential component of any security system. It outlines the procedures and protocols to follow in the event of a disaster or disruption to business operations, ensuring that critical systems and data can be quickly restored and operations can continue. Without a BCP, an organization may face severe consequences, including data loss, financial loss, and reputational damage, in the event of a disaster.

Question 19

Network security involves three types of defenses, which are referred to as 1) perimeter security layer, 2) authentication layer, and 3) authorization layer.

Accepted Answer

This statement is true. Network security typically involves these three types of defenses to protect against unauthorized access and other security threats. The perimeter security layer includes firewalls and other measures to block unauthorized access from outside the network. The authentication layer verifies the identity of users and devices attempting to access the network, and the authorization layer controls what resources and actions those authenticated users and devices are allowed to access.

Question 20

To protect their wireless network, organizations should prohibit employees from using social media and cloud-based APs because they increase the risk of security breach.

Accepted Answer

Prohibiting employees from using social media and cloud-based APs is not the only solution to protect the wireless network. There are other methods such as implementing strong passwords, encryption, and regular network monitoring to ensure security. Additionally, social media and cloud-based APs can provide many benefits to the organization, including networking, collaboration, and productivity. It is important to find a balance between security and usability.

Quiz 5: Cybersecurity, Compliance, and Business Continuity