ch 8

Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure? $1,000 $500 $2,500 $1,250 $1,500

$1,250

According to Ponemon Institute's 2017 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for benchmarked companies in seven different countries was approximately: $11.7 billion. $11.7 million. $117 billion. $117 million. $117,000.

$11.7 million.

According to the 2018 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2017? $17 billion $1.7 billion $170 million $17 million $1.7 million

$17 billion

Which of the following is a type of ambient data? A file deleted from a hard disk A file that contains an application's user settings Computer log containing recent system errors Data that has been recorded over A set of raw data from an environmental sensor

A file deleted from a hard disk

________ is spyware that logs and transmits everything a user types. A worm A sniffer A Trojan horse A keylogger Spyware

A keylogger

________ controls formalize standards, rules, procedures, and control disciplines to ensure that the organization's general and application controls are properly executed and enforced. Data security Software Input Administrative Implementation

Administrative

Which of the following defines acceptable uses of a firm's information resources and computing equipment? A UTM system An AUP An information systems audit policy A MSSP A CA policy

An AUP

Which of the following techniques stops data packets originating outside the organization, inspects them, and passes the packets to the other side of an organization's firewall? NAT Packet filtering Deep packet inspection Stateful inspection Application proxy filtering

Application proxy filtering

Implementation controls: can be classified as input controls, processing controls, and output controls. Audit the systems development process at various points to ensure that the process is properly controlled and managed. include software controls, computer operations controls, and implementation controls. govern the design, security, and use of computer programs and the security of data files in general throughout the organization. apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.

Audit the systems development process at various points to ensure that the process is properly controlled and managed.

Which of the following statements about passwords is not true? Password systems that are too rigorous may hinder employee productivity. Passwords are often disregarded by employees. Authentication cannot be established by the use of a password. Passwords can be sniffed when being transmitted over a network. Passwords can be stolen through social engineering.

Authentication cannot be established by the use of a password.

Which of the following statements about wireless security is not true? An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs. Radio frequency bands are easy to scan. Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers. Intruders can force a user's NIC to associate with a rogue access point.

Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.

Which of the following is a virus that uses flaws in Windows software to take over a computer remotely? Zeus Conficker Cryptolocker Sasser ILOVEYOU

Conficker

Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards? Vulnerabilities Security policy SSID standards Controls Legacy systems

Controls

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. DDoS DoS botnet SQL injection phishing

DDoS

Which of the following focuses primarily on the technical issues of keeping systems up and running? An AUP Security policies Business continuity planning Disaster recovery planning An information systems audit

Disaster recovery planning

Which of the following is not an example of a computer used as a target of crime? Accessing a computer system without authority Illegally accessing stored electronic communication Threatening to cause damage to a protected computer Knowingly accessing a protected computer to commit fraud Breaching the confidentiality of protected computerized data

Illegally accessing stored electronic communication

________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors. Stateful inspections Firewalls Packet filtering technologies Intrusion detection systems Application proxy filtering technologies

Intrusion detection systems

Which of the following statements about botnets is not true? Botnets are often used to perpetrate DDoS attacks. Eighty percent of the world's malware is delivered by botnets. It is not possible to make a smartphone part of a botnet. Ninety percent of the world's spam is delivered by botnets. Botnets are often used for click fraud.

It is not possible to make a smartphone part of a botnet.

Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime? National Information Infrastructure Protection Act Economic Espionage Act Data Security and Breach Notification Act Electronic Communications Privacy Act Computer Fraud and Abuse Act

National Information Infrastructure Protection Act

As described in the chapter case, which of the following did hackers use to gain access to the Democratic National Committee (DNC) network? Phishing emails Trojan horse SQL injection attack Computer worm Pharming attack

Phishing emails

CryptoLocker is an example of which of the following? Evil twin SQL injection attack Ransomware Sniffer Worm

Ransomware

________ is malware that hijacks a user's computer and demands payment in return for giving back access. Ransomware A Trojan horse Spyware An evil twin A virus

Ransomware

An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following? Security policy AUP Business continuity plan Business impact analysis Risk assessment

Risk assessment

________ identify the access points in a Wi-Fi network. NICs SSIDs Mac addresses URLs UTMs

SSIDs

Currently, the protocols used for secure information transfer over the Internet are: SSL, TLS, and S-HTTP. TCP/IP and SSL. HTTP and TCP/IP. S-HTTP and CA. S-HTTP and SHTML.

SSL, TLS, and S-HTTP.

Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems? Controls Identity management Security Benchmarking Algorithms

Security

A statement ranking information risks and identifying security goals would be included in which of the following? Risk assessment Security policy Business continuity plan Business impact analysis AUP

Security policy

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? Private key encryption Distributed encryption SSL/TLS Symmetric key encryption Public key encryption

Symmetric key encryption

Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. PKI DPI NSP UTM MSSP

UTM

Which of the following is the single greatest cause of network security breaches? Trojan horses Bugs User lack of knowledge Cyberwarfare Viruses

User lack of knowledge

Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic? Snooping War driving Drive-by tapping Cybervandalism Sniffing

War driving

Which of the following statements about Internet security is not true? Instant messaging can provide hackers access to an otherwise secure network. Smartphones have the same security weaknesses as other Internet devices. The use of P2P networks can expose a corporate computer to outsiders. A corporate network without access to the Internet is more secure than one that provides access. Wi-Fi networks are not vulnerable to security breaches.

Wi-Fi networks are not vulnerable to security breaches.

Which of the following is an example of a keylogger? Zeus Sasser Conficker ILOVEYOU Cryptolocker

Zeus

Two-factor authentication utilizes a(n): a digital certificate. encrypted connection. unique password. a multistep process of authentication. a firewall.

a multistep process of authentication.

All of the following are types of information systems general controls except: computer operations controls. software controls. administrative controls. hardware controls. application controls.

application controls.

All of the following are currently being used as traits that can be profiled by biometric authentication except: facial characteristics. fingerprints. retinal images. voice. body odor.

body odor.

Evil twins are: email messages that mimic the email messages of a legitimate business. fraudulent websites that mimic a legitimate business's website. bogus wireless network access points that look legitimate to users. Trojan horses that appear to the user to be a legitimate commercial software application. computers that fraudulently access a website or network using the IP address and identification of an authorized computer.

bogus wireless network access points that look legitimate to users.

A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of: phishing. spoofing. pharming. evil twins. click fraud.

click fraud.

Computer forensics tasks include all of the following except: recovering data from computers while preserving evidential integrity. securely storing recovered electronic data. finding significant information in a large volume of electronic data. collecting physical evidence on the computer. presenting collected evidence in a court of law.

collecting physical evidence on the computer.

The intentional defacement or destruction of a website is called: phishing. cyberwarfare. spoofing. pharming. cybervandalism.

cybervandalism.

A foreign country attempting to access government networks in order to disable a national power grid is an example of: evil twins. denial-of-service attacks. cyberterrorism. cyberwarfare. phishing.

cyberwarfare.

In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data. high availability computing application proxy filtering unified threat management deep packet inspection stateful inspection

deep packet inspection

A firewall allows the organization to: create an enterprise system on the Internet. enforce a security policy on data exchanged between its network and the Internet. check the accuracy of all transactions between its network and the Internet. create access rules for a network. check the content of all incoming and outgoing email messages.

enforce a security policy on data exchanged between its network and the Internet.

When hackers gain access to a database containing your personal private information, this is an example of: phishing. identity theft. spoofing. social engineering. pharming.

identity theft.

The Sarbanes-Oxley Act: specifies best practices in information systems security and control. imposes responsibility on companies and management to safeguard the accuracy of financial information. outlines medical security and privacy rules. identifies computer abuse as a crime and defines abusive activities. requires financial institutions to ensure the security of customer data.

imposes responsibility on companies and management to safeguard the accuracy of financial information.

A Trojan horse: installs spyware on users' computers. is malware named for a breed of fast-moving Near-Eastern horses. is software that appears to be benign but does something other than expected. is a type of sniffer used to infiltrate corporate networks. is a virus installed as a drive-by download.

is software that appears to be benign but does something other than expected.

The HIPAA Act of 1996: outlines medical security and privacy rules. specifies best practices in information systems security and control. imposes responsibility on companies and management to safeguard the accuracy of financial information. requires financial institutions to ensure the security of customer data. identifies computer abuse as a crime and defines abusive activities.

outlines medical security and privacy rules.

Most computer viruses deliver a: keylogger. driveby download. worm. Trojan horse. payload.

payload.

All of the following are specific security challenges that threaten the communications lines in a client/server environment except: sniffing. tapping. radiation. theft and fraud. phishing

phishing

All of the following are specific security challenges that threaten corporate systems in a client/server environment except: hardware failure. theft of data. radiation. copying of data. alteration of data.

radiation.

Pharming involves: using emails for threats or harassment. redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser. setting up fake website to ask users for confidential information. setting up fake Wi-Fi access points that look as if they are legitimate public networks. pretending to be a legitimate business's representative in order to garner information about a security system.

redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.

Fault tolerant information systems offer 100 percent availability because they use: a digital certificate system. dedicated phone lines. high-capacity storage. redundant hardware, software, and power supplies. a multitier server network.

redundant hardware, software, and power supplies.

The Gramm-Leach-Bliley Act: outlines medical security and privacy rules. specifies best practices in information systems security and control. requires financial institutions to ensure the security of customer data. identifies computer abuse as a crime and defines abusive activities. imposes responsibility on companies and management to safeguard the accuracy of financial information.

requires financial institutions to ensure the security of customer data.

All of the following are specific security challenges that threaten corporate servers in a client/server environment except: malware. denial-of-service attacks. vandalism. hacking. sniffing.

sniffing

An employee clicks on a link in an email from what looks like a fellow employee and is taken to a fraudulent web site which asks for personal information is an example of: pharming. spear phishing. DDOS attack. identity theft. click fraud.

spear phishing.

All of the following have contributed to an increase in software flaws except: demands for timely delivery to markets. the inability to fully test programs. the growing complexity of software programs. the increase in the number of computer hackers in the world. the growing size of software programs.

the increase in the number of computer hackers in the world.

An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called: biometric authentication. token authentication. symmetric key authorization. two-factor authentication. smart card authentication.

two-factor authentication.

Blockchain refers to a technology that: relies on peer-to-peer networks. relies on the Internet to provide secure transactions. uses a centralized data store in the cloud. uses existing banking systems to transfer funds. uses a distributed ledger system of transactions.

uses a distributed ledger system of transactions.

WPA2 is a more effective way to secure a wireless network than WEP because it: uses much longer encryption keys. operates on a VPN. is part of most vendors UTM products. includes an AUP. uses symmetric encryption methods.

uses much longer encryption keys.

A digital certificate system: uses tokens to validate a user's identity. uses government-issued certificates of authority. uses third party CAs to validate a user's identity. protects a user's identity by substituting a certificate in place of identifiable traits. uses digital signatures to validate a user's identity.

uses third party CAs to validate a user's identity.

When a hacker discovers a security hole in software that is unknown to the software vendor, it is an example of: snooping. zero-day vulnerability. sniffing. social engineering. phishing.

zero-day vulnerability.