MIS Chapter 8

According to Ponemon Institute's 2015 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for companies in the United States was approximately:

B) $15 million.

Which of the following is a type of ambient data?

B) A file deleted from a hard disk

________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors.

B) Intrusion detection systems

________ is malware that hijacks a user's computer and demands payment in return for giving back access.

B) Ransomware

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key?

B) Symmetric key encryption

Which of the following is the single greatest cause of network security breaches?

B) User lack of knowledge

The intentional defacement or destruction of a website is called:

B) cybervandalism.

In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data.

B) deep packet inspection

Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called:

B) social engineering.

Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure?

C) $1,250

________ is malware that logs and transmits everything a user types.

C) A keylogger

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

C) Data security

Which of the following focuses primarily on the technical issues of keeping systems up and running?

C) Disaster recovery planning

Which of the following is not an example of a computer used as a target of crime?

C) Illegally accessing stored electronic communication

An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following?

C) Risk assessment

Which of the following statements about Internet security is not true?

C) VoIP is more secure than the switched voice network.

All of the following are currently being used as traits that can be profiled by biometric authentication except:

C) body odor.

Computer forensics tasks include all of the following except:

C) collecting physical evidence on the computer.

A foreign country attempting to access government networks in order to disable a national power grid is an example of:

C) cyberwarfare.

For 100-percent availability, online transaction processing requires:

C) fault-tolerant computer systems.

An authentication token is a(n):

C) gadget that displays passcodes.

The Sarbanes-Oxley Act:

C) imposes responsibility on companies and management to safeguard the accuracy of financial information.

An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called:

C) two-factor authentication.

Which of the following is not an example of a computer used as an instrument of crime?

D) Breaching the confidentiality of protected computerized data

Which of the following is the most common type of electronic evidence?

D) E-mail

Which of the following provides additional security by determining whether packets are part of an ongoing dialogue between a sender and receiver?

D) Stateful inspection

Which of the following specifications replaced WEP with a stronger security standard that features changing encryption keys?

D) WPA2

The HIPAA Act of 1996:

D) outlines medical security and privacy rules.

All of the following are specific security challenges that threaten corporate systems in a client/server environment except:

D) radiation.

All of the following are specific security challenges that threaten corporate servers in a client/server environment except:

D) sniffing.

According to the 2016 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2015?

E) $15 billion

Which of the following defines acceptable uses of a firm's information resources and computing equipment?

E) An AUP

Which of the following statements about wireless security is not true?

E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.

Which of the following is a virus that uses flaws in Windows software to take over a computer remotely?

E) Conficker

Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards?

E) Controls

Which of the following statements about botnets is not true?

E) It is not possible to make a smartphone part of a botnet.

Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime?

E) National Information Infrastructure Protection Act

CryptoLocker is an example of which of the following?

E) Ransomware

________ identify the access points in a Wi-Fi network.

E) SSIDs

Currently, the protocols used for secure information transfer over the Internet are:

E) SSL, TLS, and S-HTTP.

Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems.

E) UTM

Evil twins are:

E) bogus wireless network access points that look legitimate to users.

A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of:

E) click fraud.

Most computer viruses deliver a:

E) payload.

All of the following have contributed to an increase in software flaws except:

E) the increase in malicious intruders seeking system access.

Which of the following statements about passwords is not true?

A) Authentication cannot be established by the use of a password.

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack.

A) DDoS

________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.

A) Identity theft

Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems?

A) Security

A statement ranking information risks and identifying security goals would be included in which of the following?

A) Security policy

Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic?

A) War driving

Which of the following is an example of a keylogger?

A) Zeus

All of the following are types of information systems general controls except:

A) application controls.

Application controls: 

A) can be classified as input controls, processing controls, and output controls.

A firewall allows the organization to:

A) enforce a security policy on data exchanged between its network and the Internet.

All of the following are specific security challenges that threaten the communications lines in a client/server environment except:

A) errors.

A Trojan horse:

A) is software that appears to be benign but does something other than expected.

Pharming involves:

A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.

The Gramm-Leach-Bliley Act:

A) requires financial institutions to ensure the security of customer data.

A digital certificate system:

A) uses third-party CAs to validate a user's identity.