E-Commerce Chapter 5, E-Commerce Chapter 5 MCQ, Final Exam Ch 5, Ecommerce chapter 5 quiz 1, Ecommerce Ch 5, WK 3 - CH5, chapter 5 e-commerce, 660 MT - Chp 5, E-Commerce Chapter 5 T/F
If you used a symmetric key encryption for large documents, with public key encryption to encrypt and send the symmetric key, you would be using a digital:
envelope.
digital cash is legal tender that is instantly convertible into other forms of value without the intermediation of any third parties
false
According to the 2008 Computer Crime and Security Survey, the two most expensive types of security incidents experienced by respondent firms were:
financial fraud and dealing with bot computers.
A ________ is a hardware or software component that acts as a filter to prevent unwanted packets from entering a network.
firewall
A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network.
firewall
a____ is hardware or software that acts as a filter to prevent unwanted packets from entering a network
firewall
To internal computers, a proxy server is known as the ________.
gateway
Which dimension(s) of security is spoofing a threat to?
integrity and authenticity
Which dimensions of security is spoofing a threat to?
integrity and authenticity
All of the following are features of cash except:
it provides float.
The overall rate of online credit card fraud is ________ of all online card transactions.
less than 1%
the overall rate of online credit card fraud is _____ of all online card transactions
less than 1%
What is the most frequent cause of stolen credit cards and card information today?
looting of corporate servers storing credit card information
Both cash and personal checks share which of the following characteristics?
low fixed costs for merchant
Information technology 79) Malicious code is sometimes also referred to as ________.
malware Page Ref: 261 Difficulty: Moderate
drive-by download
malware that comes with a downloaded file that a user requests
In 2014, online bill payment accounted for ________ of all bill payments, while paper checks accounted for ________.
more than 50%; less than 25%
PayPal is an example of what type of payment system?
online stored value payment system
paypal is an example of
online stored value payment system
All of the following are used for authentication except:
packet filters.
Which is not used for authentication
packet filters.
what is the first step in developing an e-commerce security plan
perform a risk assessment
The most common payment system based on total dollar amount of transactions is:
personal check.
Automatically redirecting a Web link to a different address is an example of which of the following?
pharming
Information technology 70) Automatically redirecting a Web link to a different address is called ________.
pharming Page Ref: 272 Difficulty: Moderate
E-Commerce Security
Six dimensions: Integrity Nonrepudiation Authenticity Confidence Privacy Availability
Information technology 68) ________ relies on human curiosity, greed, and gullibility to trick people into taking action that will result in the downloading of malware.
Social engineering Page Ref: 266 Difficulty: Moderate
Information technology 66) ________ was designed to cripple Iranian nuclear centrifuges.
Stuxnet Page Ref: 249 Difficulty: Moderate
________ is a private organization that monitors and tracks online criminal activity reported to it by private corporations and government agencies.
The CERT Coordination Center
Spoofing
When someone pretends to be someone else with the intent of obtaining unauthorized data.
a fingerprint scan is an example of
biometrics
An intrusion detection system can perform all of the following functions except:
blocking suspicious activity.
availability
the ability to ensure that an e-commerce site continues to function as intended
Slammer is an example of which of the following?
worm
trojan horse
zeuse is an example
18) Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as: A) spyware. B) a backdoor. C) browser parasite. D) adware.
A
19) In 2016, Yahoo revealed that it had experienced which of the following? A) a high-profile data breach B) a DDoS attack that shut down its website C) a hacktivist attack to protest its employment policies D) a browser parasite
A
2) ________ refers to the ability to ensure that e-commerce participants do not deny their online actions. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
A
27) Which of the following was designed to cripple Iranian nuclear centrifuges? A) Stuxnet B) Flame C) Snake D) Storm
A
51) A digital certificate contains all of the following except the: A) subject's private key. B) subject's public key. C) digital signature of the certification authority. D) digital certificate serial number.
A
54) A ________ is a hardware or software component that acts as a filter to prevent unwanted packets from entering a network. A) firewall B) virtual private network C) proxy server D) PPTP
A
72) All of the following statements about Apple Pay are true except which of the following? A) Apple Pay is subject to recent regulations issued by the Bureau of Consumer Financial Protection applicable to GPR transactions. B) Apple Pay is based on Touch ID biometric fingerprint scanning. C) Apple Pay can be used for mobile payments at the point of sale at a physical store. D) Apple Pay relies on NFC chip technology.
A
73) PayPal is an example of a(n): A) online stored value payment system. B) digital checking system. C) accumulating balance system. D) digital credit card system.
A
75) Which of the following is not a major trend in e-commerce payments in 2016-2017? A) Mobile retail payment volume decreases. B) PayPal remains the most popular alternative payment method. C) Google refocuses Google Wallet solely on sending and receiving money. D) Payment by credit and/or debit card remains the dominant form of online payment.
A
Information technology 20) Privacy is sometimes confused with: A) confidentiality. B) authenticity. C) integrity. D) nonrepudiation.
A Page Ref: 257 Difficulty: Easy
Information technology 29) Which of the following is a prominent hacktivist group? A) Anonymous B) Anti-Phishing Working Group C) IC3 D) Symantec
A Page Ref: 268 Difficulty: Moderate
Information technology 34) In 2013, the Target retail chain experienced which of the following? A) a large-scale data breach B) a DDoS attack that shut down its Web site C) a hacktivist attack to protest its wage policies D) a browser parasite
A Page Ref: 269-270 Difficulty: Easy
Information technology 18) The overall rate of online credit card fraud is ________ % of all online card transactions. A) less than 1 B) around 5 C) around 10 D) around 15
A Page Ref: 271 Difficulty: Difficult
Information technology 44) A digital certificate contains all of the following except the: A) subject's private key. B) subject's public key. C) digital signature of the certification authority. D) digital certificate serial number.
A Page Ref: 288-289 Difficulty: Difficult
Information technology 47) A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network. A) firewall B) virtual private network C) proxy server D) PPTP
A Page Ref: 293 Difficulty: Easy
Information technology 60) Which of the following is not a major trend in e-commerce payments in 2014-2015? A) Mobile retail payment volume decreases. B) PayPal remains the most popular alternative payment method. C) Apple introduces Apple Pay. D) Payment by credit and/or debit card remains the dominant form of online payment.
A Page Ref: 302 Difficulty: Moderate
Information technology 19) In the United States, the primary form of online payment is: A) PayPal. B) Bill Me Later. C) Amazon Payment. D) Google Wallet.
A Page Ref: 303 Difficulty: Easy
Information technology 57) PayPal is an example of what type of payment system? A) online stored value payment system B) digital checking system C) accumulating balance system D) digital credit card system
A Page Ref: 305 Difficulty: Moderate
Information technology 56) All of the following statements about Apple Pay are true except which of the following? A) Apple Pay is available for both iPhone 5s and iPhone 6s. B) Apple Pay is based on Touch ID biometric fingerprint scanning. C) Apple Pay can be used for mobile payments at the point of sale at a physical store. D) Apple Pay relies on the consumer having a credit card on file with Apple's iTunes.
A Page Ref: 307, 313-315 Difficulty: Moderate
Application of knowledge 17) Bitcoins are an example of: A) digital cash. B) virtual currency. C) a stored value payment system. D) an EBPP system.
A Page Ref: 309 Difficulty: Moderate
18) The overall rate of online credit card fraud is ________ % of all online card transactions. A) less than 1 B) around 1 C) around 5 D) around 10
Answer: A
20) The six key dimensions to e-commerce security are nonrepudiation, authenticity, availability, integrity, privacy, and: A) confidentiality. B) usability. C) functionality. D) viability.
Answer: A
21) ________ refers to the ability to ensure that e-commerce participants do not deny their online actions. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
Answer: A
26) ________ refers to the ability to ensure that messages and data are only available to those authorized to view them. A) Confidentiality B) Integrity C) Privacy D) Availability
Answer: A
29) Which of the following is a prominent hacktivist group? A) Anonymous B) Anti-Phishing Working Group C) IC3 D) Symantec
Answer: A
32) Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as: A) spyware. B) a backdoor. C) pupware. D) adware.
Answer: A
33) Online bill payments are believed to cost ________ to process compared to ________ for paper bills. A) 20 to 30 cents, $3 to $7 B) $1 to $2, $10 to $20 C) 3 to $7, 20 to 30 cents D) $10 to $20, $ 1 to $2
Answer: A
44) A digital certificate contains all of the following except the: A) subject's private key. B) subject's public key. C) digital signature of the certification authority. D) digital certificate serial number.
Answer: A
47) A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network. A) firewall B) virtual private network C) proxy server D) PPTP
Answer: A
57) P2P payment systems are a variation on what type of payment system? A) stored value payment system B) digital checking system C) accumulating balance system D) digital credit card system
Answer: A
19) In the United States, the primary form of online payment is: A) PayPal. B) credit cards. C) debit cards. D) Google Wallet.
Answer: B
22) ________ refers to the ability to identify the person or entity with whom you are dealing on the Internet. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
Answer: B
25) An example of a privacy violation of e-commerce security is: A) your e-mail being read by a hacker. B) your online purchasing history being sold to other merchants without your consent. C) your computer being used as part of a botnet. D) your e-mail being altered by a hacker.
Answer: B
28) Which of the following did Dropbox implement after a series of security snafus in 2011 and 2012? A) anti-virus software B) two-factor authentication C) SSL/TLS D) firewall
Answer: B
31) Botnets are typically used for all of the following except: A) DDoS attacks. B) phishing attacks. C) storing network traffic for analysis. D) stealing information from computers.
Answer: B
35) What is the most frequent cause of stolen credit cards and card information today? A) lost cards B) the hacking and looting of corporate servers storing credit card information C) sniffing programs D) phishing attacks
Answer: B
38) Symmetric key encryption is also known as: A) public key encryption. B) secret key encryption. C) PGP. D) PKI.
Answer: B
40) The Data Encryption Standard uses a(n) ________-bit key. A) 8 B) 56 C) 256 D) 512
Answer: B
41) All of the following statements about public key encryption are true except: A) public key encryption uses two mathematically related digital keys. B) public key encryption ensures authentication of the sender. C) public key encryption does not ensure message integrity. D) public key encryption is based on the idea of irreversible mathematical functions.
Answer: B
45) Which of the following dimensions of e-commerce security is not provided for by encryption? A) confidentiality B) availability C) message integrity D) nonrepudiation
Answer: B
54) To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use: A) access controls. B) an authorization management system. C) security tokens. D) an authorization policy.
Answer: B
58) Which of the following countries has been found to have engaged in cyberespionage against Google? A) Russia B) China C) Iran D) Iraq
Answer: B
59) Rustock is an example of which of the following? A) worm B) botnet C) phishing D) hacktivism
Answer: B
63) All of the following are limitations of the existing online credit card payment system except: A) poor security. B) cost to consumers. C) cost to merchant. D) social equity.
Answer: B
65) Which of the following is a set of short-range wireless technologies used to share information among devices within about 2 inches of each other? A) DES B) NFC C) IM D) text messaging
Answer: B
24) ________ refers to the ability to ensure that an e-commerce site continues to function as intended. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
Answer: C
36) Which dimension(s) of security is spoofing a threat to? A) integrity B) availability C) integrity and authenticity D) availability and integrity
Answer: C
39) All the following statements about symmetric key encryption are true except: A) in symmetric key encryption, both the sender and the receiver use the same key to encrypt and decrypt a message. B) the Data Encryption Standard is a symmetric key encryption system. C) symmetric key encryption is computationally slower. D) symmetric key encryption is a key element in digital envelopes.
Answer: C
42) Which of the following is the current standard used to protect Wi-Fi networks? A) WEP B) TLS C) WPA2 D) WPA3
Answer: C
SSL is available in which of the following levels?
40-bit and 128-bit
The Data Encryption Standard uses a(n) ________-bit key.
56
Analytical thinking 26) ________ refers to the ability to ensure that messages and data are only available to those authorized to view them. A) Confidentiality B) Integrity C) Privacy D) Availability
A Page Ref: 257 Difficulty: Moderate
Application of knowledge 21) ________ refers to the ability to ensure that e-commerce participants do not deny their online actions. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
A Page Ref: 257 Difficulty: Moderate
Information technology 32) Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as: A) spyware. B) a backdoor. C) pupware. D) adware.
A Page Ref: 266 Difficulty: Moderate
All of the following experienced high-profile data breaches in 2015 except
Amazon
All of the following experienced high-profile data breaches in 2014 except:
Amazon.
All of the following are examples of stored value payment systems except:
American Express accounts.
Which of the following is an example of an integrity violation of e-commerce security?
An unauthorized person intercepts an online communication and changes its contents.
17) Bitcoins are an example of: A) digital cash. B) virtual currency. C) a stored value payment system. D) an EBPP system.
Answer: A
16) All of the following are factors in contributing to the increase in cybercrime except: A) the ability to remotely access the Internet. B) the Internet's similarity to telephone networks. C) the ability to anonymously access the Internet. D) the Internet is an open, vulnerable design.
Answer: B
51) An intrusion detection system can perform all of the following functions except: A) examining network traffic. B) setting off an alarm when suspicious activity is detected. C) checking network traffic to see if it matches certain patterns or preconfigured rules. D) blocking suspicious activity.
Answer: D
47) The Data Encryption Standard uses a(n) ________-bit key. A) 8 B) 56 C) 256 D) 512
B
52) Which of the following dimensions of e-commerce security does not involve encryption? A) confidentiality B) availability C) message integrity D) nonrepudiation
B
78) Which of the following is a set of short-range wireless technologies used to share information among devices within about two inches of each other? A) DES B) NFC C) IM D) text messaging
B
Information technology 22) ________ refers to the ability to identify the person or entity with whom you are dealing on the Internet. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
B Page Ref: 257 Difficulty: Moderate
Application of knowledge 59) Rustock is an example of which of the following? A) worm B) botnet C) phishing D) hacktivism
B Page Ref: 264 Difficulty: Moderate
Information technology 45) Which of the following dimensions of e-commerce security is not provided for by encryption? A) confidentiality B) availability C) message integrity D) nonrepudiation
B Page Ref: 281 Difficulty: Difficult
Information technology 38) Symmetric key cryptography is also known as: A) public key cryptography. B) secret key cryptography. C) PGP. D) PKI.
B Page Ref: 282 Difficulty: Moderate
Information technology 40) The Data Encryption Standard uses a(n) ________-bit key. A) 8 B) 56 C) 256 D) 512
B Page Ref: 283 Difficulty: Difficult
28) Automatically redirecting a web link to a different address is an example of: A) sniffing. B) social engineering. C) pharming. D) DDoS attack.
C
43) All of the following statements about PKI are true except: A) The term PKI refers to the certification authorities and digital certificate procedures that are accepted by all parties. B) PKI is not effective against insiders who have a legitimate access to corporate systems including customer information. C) PKI guarantees that the verifying computer of the merchant is secure. D) The acronym PKI stands for public key infrastructure.
Answer: C
48) Proxy servers are also known as: A) firewalls. B) application gateways. C) dual home systems. D) packet filters.
Answer: C
15) All of the following are prominent hacktivist groups except: A) Anonymous. B) LulzSec. C) Impact Team. D) Avid Life.
D
Firewall
Designed to prevent unauthorized access to your computer when connected to a network such as the Internet
Which of the following was designed to cripple Iranian nuclear centrifuges?
Stuxnet
10) The easiest and least expensive way to prevent threats to system integrity is to install anti-virus software.
TRUE
11) The U.S. federal government has historically not been in favor of the development and export of strong encryption systems.
TRUE
13) In order to accept payments by credit card, online merchants typically must have a merchant account established with a bank or financial institution.
TRUE
5) Insiders present a greater security threat to e-commerce sites than outsiders.
TRUE
7) Drive-by downloads are now the most common method of infecting computers.
TRUE
8) Smishing attacks exploit SMS messages.
TRUE
1) Typically, the more security measures added to an e-commerce site, the slower and more difficult it becomes to use.
TRUE Page Ref: 258-259 Difficulty: Moderate
Information technology 5) CryptoLocker is an example of ransomware.
TRUE Page Ref: 263 Difficulty: Moderate
In 2014, Sony experienced which of the following?
a high-profile data breach
In 2016, Yahoo revealed that it had experienced which of the following?
a high-profile data breach
Angler is an example of:
an exploit kit.
Which of the following dimensions of e-commerce security is not provided for by encryption?
availability
The six key dimensions to e-commerce security are: nonrepudiation, authenticity, availability, integrity, privacy, and:
confidentiality.
All of the following are limitations of the existing online credit card payment system except:
cost to consumers.
All of the following statements about debit cards are true except:
debit cards enable consumers to make purchases even if they do not have sufficient funds at the time of purchase.
According to Ponemon Institute's 2015 survey, which of the following was not among the causes of the most costly cybercrimes?
denial of service
Which of the following is best suited for processing micropayments?
digital accumulating balance payment system
Bitcoins are an example of
digital cash
Bitcoins are an example of:
digital cash.
Which of the following is not an example of an access control?
digital signatures
which of the following is not an example of an access control
digital signatures
Malware that comes with a downloaded file requested by a user is called a:
drive-by download
Which of the following is not an example of a PUP?
drive-by download
Malware that comes with a downloaded file that a user requests is called a:
drive-by download.
proxy servers are also known as
dual home systems
Information technology 77) To internal computers, a proxy server is known as the ________.
gateway Page Ref: 294 Difficulty: Moderate
Which of the following is the leading cause of data breaches?
hackers
which of the following is the leading cause of data breaches
hackers
Automatically redirecting a web link to a different address is an example of:
pharming.
All of the following statements about public key cryptography are true except:
public key cryptography ensures authentication of the sender.
What is not true about public key encryption
public key encryption ensures authentication of the sender.
botnet
rustock is an example
Symmetric key encryption is also known as:
secret key encryption.
securing channels of communication
secure sockets layer: SSL establishes a secure negotiated client server session that is encrypted. S-http: https provides secure message oriented communications protocol to use with http. VPN to allow remote users to access internal network via the internet using PPTP.
EZPass is an example of a contactless ________.
smart card
Which of the following is not an example of malicious code?
sniffer
What is not an example of malicious code
sniffers.
Spyware
software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive.
FREAK is an example of which of the following?
software vulnerability
Shellshock is an example of which of the following?
software vulnerability
Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as:
spyware
Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as:
spyware.
Software that is used to obtain private user information such as user's keystrokes or copies of e-mail is referred to as:
spyware.
P2P payment systems are a variation on what type of payment system?
stored value payment system
None of the following payment systems offers immediate monetary value except:
stored value/debit card.
A digital certificate contains all of the following except the:
subject's private key.
A digital certificate does not contain this information
subject's private key.
all of the following statements about symmetric key cryptography are true except
symmetric key cryptography is computationally slower
What is not true about symmetric key encryption
symmetric key encryption is computationally slower.
Next generation firewalls provide all of the following except:
the ability to automatically update applications with security patches.
What is the most frequent cause of stolen credit cards and card information today?
the hacking and looting of corporate servers storing credit card information
What is the most common type of attack against computer systems?
viruses
stuxnet
was designed to cripple iranian nuclear centrifuges
Information technology 69) A(n) ________ helps organizations locate and fix security flaws.
white hat Page Ref: 268 Difficulty: Easy
Conficker is an example of a:
worm
Which of the following is an example of an online privacy violation?
your online purchasing history being sold to other merchants without your consent
An example of a privacy violation of e-commerce security is:
your online purchasing history being sold to other merchants without your consent.
Information technology 71) A(n) ________ vulnerability involves a vulnerability unknown to security experts that is actively exploited before there is a patch available.
zero-day Page Ref: 275 Difficulty: Moderate
50) What is the first step in developing an e-commerce security plan? A) Create a security organization. B) Develop a security policy. C) Perform a risk assessment. D) Perform a security audit.
Answer: C
52) Which of the following is not an example of an access control? A) firewalls B) proxy servers C) digital signatures D) login passwords
Answer: C
53) Online bill payment now accounts for ________ of all bill payments. A) 10% B) 25% C) 50% D) 100%
Answer: C
55) Which of the following left the WikiLeaks Web site effectively inoperable in August 2012? A) SQL injection attack B) browser parasite C) DDoS attack D) botnet
Answer: C
56) The research firm Cybersource estimated that online credit card fraud in the United States amounted to about ________ in 2012. A) $35 million B) $350 million C) $3.5 billion D) $35 billion
Answer: C
60) None of the following payment systems offers immediate monetary value except: A) personal checks. B) credit cards. C) stored value/debit card. D) accumulating balance.
Answer: C
61) Malware that comes with a downloaded file that a user requests is called a: A) Trojan horse. B) backdoor. C) drive-by download. D) PUP.
Answer: C
62) Which of the following is not an example of a PUP? A) adware B) browser parasite C) drive-by download D) spyware
Answer: C
23) Which of the following is an example of an integrity violation of e-commerce security? A) A Web site is not actually operated by the entity the customer believes it to be. B) A merchant uses customer information in a manner not intended by the customer. C) A customer denies that he or she is the person who placed the order. D) An unauthorized person intercepts an online communication and changes its contents.
Answer: D
27) Which of the following is not a key point of vulnerability when dealing with e-commerce? A) the client computer B) the server C) the communications pipeline D) the credit card companies
Answer: D
30) Most of the world's spam is delivered via which of the following? A) viruses B) worms C) Trojan horses D) botnets
Answer: D
37) All of the following are examples of malicious code except: A) viruses. B) bots. C) worms. D) sniffers.
Answer: D
46) All of the following are methods of securing channels of communication except: A) SSL/TLS. B) certificates. C) VPN. D) FTP.
Answer: D
49) All of the following are used for authentication except: A) digital signatures. B) certificates of authority. C) biometric devices. D) packet filters.
Answer: D
Trojan Horse
Appears to benign, but then does something other than expected
Which of the following statements is not true?
Apple's Touch ID stores a user's actual fingerprint.
20) What is the most frequent cause of stolen credit cards and card information today? A) lost cards B) the hacking and looting of corporate servers storing credit card information C) sniffing programs D) phishing attacks
B
24) Angler is an example of: A) a worm. B) an exploit kit. C) phishing. D) hacktivism.
B
29) Shellshock is an example of which of the following? A) mobile malware B) software vulnerability C) botnet D) Trojan horse
B
3) ________ refers to the ability to identify the person or entity with whom you are dealing on the Internet. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
B
45) Symmetric key cryptography is also known as: A) public key cryptography. B) secret key cryptography. C) PGP. D) PKI.
B
48) All of the following statements about public key cryptography are true except: A) public key cryptography uses two mathematically related digital keys. B) public key cryptography ensures authentication of the sender. C) public key cryptography does not ensure message integrity. D) public key cryptography is based on the idea of irreversible mathematical functions
B
6) Which of the following is an example of an online privacy violation? A) your e-mail being read by a hacker B) your online purchasing history being sold to other merchants without your consent C) your computer being used as part of a botnet D) your e-mail being altered by a hacker
B
62) Which of the following is the most common protocol for securing a digital channel of communication? A) DES B) SSL/TLS C) VPN D) HTTP
B
69) To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use: A) access controls. B) an authorization management system. C) security tokens. D) an authorization policy.
B
71) All of the following are examples of social/mobile peer-to-peer payment systems except: A) Venmo. B) Bill Me Later. C) Square Cash. D) Google Wallet.
B
74) PCI-DSS is a standard established by which of the following? A) the banking industry B) the credit card industry C) the federal government D) the retail industry
B
76) All of the following are limitations of the existing online credit card payment system except: A) poor security. B) cost to consumers. C) cost to merchant. D) social equity.
B
77) Linden Dollars, created for use in Second Life, are an example of: A) digital cash. B) virtual currency. C) EBPP. D) peer-to-peer payment systems.
B
Information technology 25) An example of an online privacy violation is: A) your e-mail being read by a hacker. B) your online purchasing history being sold to other merchants without your consent. C) your computer being used as part of a botnet. D) your e-mail being altered by a hacker.
B Page Ref: 257-258 Difficulty: Moderate
Information technology 35) What is the most frequent cause of stolen credit cards and card information today? A) lost cards B) the hacking and looting of corporate servers storing credit card information C) sniffing programs D) phishing attacks
B Page Ref: 271 Difficulty: Moderate
Information technology 28) Accessing data without authorization on Dropbox is an example of which of the following? A) social network security issue B) cloud security issue C) mobile platform security issue D) sniffing
B Page Ref: 280 Difficulty: Moderate
Information technology 41) All of the following statements about public key cryptography are true except: A) public key cryptography uses two mathematically related digital keys. B) public key cryptography ensures authentication of the sender. C) public key cryptography does not ensure message integrity. D) public key cryptography is based on the idea of irreversible mathematical functions.
B Page Ref: 283-284 Difficulty: Difficult
Information technology 54) To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use: A) access controls. B) an authorization management system. C) security tokens. D) an authorization policy.
B Page Ref: 298 Difficulty: Easy
Information technology 63) All of the following are limitations of the existing online credit card payment system except: A) poor security. B) cost to consumers. C) cost to merchant. D) social equity.
B Page Ref: 305 Difficulty: Moderate
Information technology 65) Which of the following is a set of short-range wireless technologies used to share information among devices within about 2 inches of each other? A) DES B) NFC C) IM D) text messaging
B Page Ref: 307 Difficulty: Difficult
Application of knowledge 64) Linden Dollars, created for use in Second Life, are an example of: A) digital cash. B) virtual currency. C) EBPP. D) peer-to-peer payment systems.
B Page Ref: 308 Difficulty: Moderate
All of the following are examples of social/mobile peer-to-peer payment systems except:
Bill Me Later.
Symmetric Key Encryption
Both the sender and the receiver use the same key to encrypt and decrypt the message
10) All of the following experienced high-profile data breaches in 2015 except: A) CVS. B) Walgreens. C) Amazon. D) Experian.
C
13) Which of the following has the Internet Advertising Bureau urged advertisers to abandon? A) HTML B) HTML5 C) Adobe Flash D) Adobe Acrobat
C
17) Which of the following is the leading cause of data breaches? A) theft of a computer B) accidental disclosures C) hackers D) DDoS attacks
C
21) Which dimension(s) of security is spoofing a threat to? A) integrity B) availability C) integrity and authenticity D) availability and integrity
C
23) The attack on Dyn, Twitter, Amazon, and other major organizations in October 2016, is an example of which of the following? A) SQL injection attack B) browser parasite C) DDoS attack D) MitM attack
C
25) Malware that comes with a downloaded file requested by a user is called a: A) Trojan horse. B) backdoor. C) drive-by download. D) PUP
C
26) Which of the following is not an example of a PUP? A) adware B) browser parasite C) drive-by download D) spyware
C
44) Next generation firewalls provide all of the following except: A) an application-centric approach to firewall control. B) the ability to identify applications regardless of the port, protocol, or security evasion tools used. C) the ability to automatically update applications with security patches. D) the ability to identify users regardless of the device or IP address.
C
46) All the following statements about symmetric key cryptography are true except: A) in symmetric key cryptography, both the sender and the receiver use the same key to encrypt and decrypt a message. B) the Data Encryption Standard is a symmetric key encryption system. C) symmetric key cryptography is computationally slower. D) symmetric key cryptography is a key element in digital envelopes.
C
49) ________ is the current standard used to protect Wi-Fi networks. A) WEP B) TLS C) WPA2 D) WPA3
C
5) ________ refers to the ability to ensure that an e-commerce site continues to function as intended. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
C
50) All of the following statements about PKI are true except: A) the term PKI refers to the certification authorities and digital certificate procedures that are accepted by all parties. B) PKI is not effective against insiders who have a legitimate access to corporate systems including customer information. C) PKI guarantees that the verifying computer of the merchant is secure. D) the acronym PKI stands for public key infrastructure.
C
55) Proxy servers are also known as: A) firewalls. B) application gateways. C) dual home systems. D) packet filters
C
58) Which of the following is not an example of an access control? A) firewalls B) proxy servers C) digital signatures D) login passwords
C
59) Which of the following statements is not true? A) A VPN provides both confidentiality and integrity. B) A VPN uses both authentication and encryption. C) A VPN uses a dedicated secure line. D) The primary use of VPNs is to establish secure communications among business partners. `
C
68) What is the first step in developing an e-commerce security plan? A) Create a security organization. B) Develop a security policy. C) Perform a risk assessment. D) Perform a security audit.
C
4) Which of the following is an example of an integrity violation of e-commerce security? A) A website is not actually operated by the entity the customer believes it to be. B) A merchant uses customer information in a manner not intended by the customer. C) A customer denies that he or she is the person who placed the order. D) An unauthorized person intercepts an online communication and changes its contents.
D
53) All of the following are methods of securing channels of communication except: A) SSL/TLS. B) certificates. C) VPN. D) FTP.
D
56) All of the following are used for authentication except: A) digital signatures. B) certificates of authority. C) biometric devices. D) packet filters.
D
57) An intrusion detection system can perform all of the following functions except: A) examining network traffic. B) setting off an alarm when suspicious activity is detected. C) checking network traffic to see if it matches certain patterns or preconfigured rules. D) blocking suspicious activity.
D
Information technology 74) ________ typically attack governments, organizations, and sometimes individuals for political purposes.
Hacktivists Page Ref: 268 Difficulty: Moderate
________ refers to the ability to ensure that information being displayed on a Web site, or transmitted or received over the Internet, has not been altered in any way by an unauthorized party.
Integrity
Which of the following is a set of short-range wireless technologies used to share information among devices within about two inches of each other?
NFC
which of the following is a set of short-range wireless technologies used to share information among devices within about two inches of each other
NFC
all of the following are true about PKI except
PKI guarantees that the verifying computer of the merchant is secure
All of the following statements about PKI are true except:
PKI guarantees that the verifying computer of the merchant is secure.
What is not a true statement about PKI?
PKI guarantees that the verifying computer of the merchant is secure.
________ is an encoding mechanism that allows one local network to connect to another using the Internet as the conduit.
PPTP/point-to-point tunneling protocol
What is the first step in developing an e-commerce security plan?
Perform a risk assessment.
What is the last step in developing an e-commerce security plan?
Perform a security audit.
Which of the following is the most common protocol for securing a digital channel of communication?
SSL/TLS
Information technology 75) The most common form of securing a digital channel of communication is ________.
SSL/TLS, Secure Sockets Layer/Transport Layer Security Page Ref: 290 Difficulty: Difficult
The most common form of securing a digital channel of communication is ________.
SSL/secure sockets layer
To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use:
an authorization management system.
which of the following is an example of an integrity violation of e-commerce security
an unauthorized person intercepts an online communication and changes it contents
all of the following statements about apple pay are true except which
apple pay is available for both iPhone 5s and 6s
A(n) ________ is a type of firewall that filters communications based on the application being requested.
application gateway
pharming
automatically redirecting a web link to a different address is an example
Encryption provides all of the dimensions of e-commerce security except for privacy and ________.
availability
Which of the following dimensions of e-commerce security does not involve encryption?
availability
which of the following dimensions of e-commerce security is not provided for by encryption
availability
Information technology 76) A(n) ________ is a feature of viruses, worms, and Trojans that allows an attacker to remotely access a compromised computer.
backdoor Page Ref: 263 Difficulty: Moderate
A fingerprint scan is an example of which of the following?
biometrics
Information technology 72) A fingerprint or retina (eye) scan is an example of ________.
biometrics Page Ref: 298 Difficulty: Moderate
Rustock is an example of which of the following?
botnet
According to Ponemon Institute's 2015 survey, which of the following was not among the causes of the costliest cybercrimes?
botnets
All of the following payment systems provide some security against unauthorized use except:
cash.
Accessing data without authorization on Dropbox is an example of which of the following?
cloud security issue
Information technology 78) Using a technique referred to as ________, mobile application developers use their private key to encrypt a digital signature.
code signing Page Ref: 289 Difficulty: Moderate
Proxy Server
computer on a network which acts on behalf of another, or through which all internet data must pass
Proxy servers are also known as:
dual home systems.
visiting attacks exploit SMS messages
false
Confidentiality is sometimes confused with:
privacy
technology solutions
protecting internet communications - cryptography. securing channels of communication - ssl, tls, vpn, wi-fi. protecting networks - firewalls, proxy servers, IDs, IPs. protecting servers and clients - OS security, anti-virus.
Symmetric key cryptography is also known as:
secret key cryptography.
All the following statements about symmetric key cryptography are true except:
symmetric key cryptography is computationally slower.
next generation firewalls provide all of the following except
the ability to automatically update applications with security patches
nonrepudiation
the ability to ensure that e-commerce participants do not deny their online actions
confidentiality
the ability to ensure that messages and data are only availably to those authorized to view them
authenticity
the ability to identify the person or entity with whom you are dealing on the internet
Which of the following is not a key point of vulnerability when dealing with e-commerce?
the credit card companies
PCI-DSS is a standard established by which of the following?
the credit card industry
PCI-DSS is standard established by which of the following
the credit card industry
SLS/TLS cannot provide irrefutability
true
apple pay uses near field communication (NFC) chips
true
exploit knits are often rented or sold as commercial product
true
paypal is the most popular alternative payment method in the US
true
shellshock is an example of a software vulnerability
true
the easiest and least expensive way to prevent threats to system integrity is to install anti-virus software
true
there is a finite number of bitcoins that can be created
true
Public Key Encryption
uses two keys, one shared (or public) and one private
Linden Dollars, created for use in Second Life, are an example of:
virtual currency.
60) Which of the following statements is not true? A) Apple's Touch ID stores a user's actual fingerprint. B) Biometric devices reduce the opportunity for spoofing. C) A retina scan is an example of a biometric device. D) Biometric data stored on an iPhone is encrypted.
A
61) A fingerprint scan is an example of which of the following? A) biometrics B) encryption C) IDS D) firewall
A
7) ________ refers to the ability to ensure that messages and data are only available to those authorized to view them. A) Confidentiality B) Integrity C) Privacy D) Availability
A
Which of the following statements is not true?
A VPN uses a dedicated secure line.
Cyber Crime
A crime that occurs online, in the virtual community of the internet
Botnet
A logical computer network of zombies under the control of an attacker.
________ is not an example of malicious code.
A sniffer
Which of the following has the Internet Advertising Bureau urged advertisers to abandon?
Adobe Flash
Digital Cash
Allows you to pay by transmitting a number from one computer to another(authenticated tokens)
34) Reventon is an example of: A) a macro virus. B) ransomware. C) a backdoor. D) a bot program.
Answer: B
64) Linden Dollars, created for use in Second Life, are an example of: A) digital cash. B) virtual currency. C) EBPP. D) peer-to-peer payment systems.
Answer: B
All of the following statements about Apple Pay are true except which of the following?
Apple Pay is available for both iPhone 5s and iPhone 6s.
________ refers to the ability to identify the person or entity with whom you are dealing on the Internet.
Authenticity
________ refers to the ability to ensure that an e-commerce site continues to function as intended.
Availability
All of the following are prominent hacktivist groups except:
Avid Life.
14) Accessing data without authorization on Dropbox is an example of which of the following? A) social network security issue B) cloud security issue C) mobile platform security issue D) sniffing
B
16) Conficker is an example of a: A) virus B) worm C) Trojan horse D) botnet
B
Information technology 58) In May 2014, the U.S. Department of Justice indicted five army members from which of the following countries for conducting industrial espionage against U.S. Steel and Westinghouse? A) Russia B) China C) Iran D) Iraq
B Page Ref: 250 Difficulty: Moderate
84) In 2015, online bill payment accounted for ________ of all bill payments, while paper checks accounted for ________. A) less than 10%; less than 25% B) about 25%; about 10% C) more than 50%; less than 20% D) 100%; 0%
C
Analytical thinking 24) ________ refers to the ability to ensure that an e-commerce site continues to function as intended. A) Nonrepudiation B) Authenticity C) Availability D) Integrity
C Page Ref: 258 Difficulty: Moderate
Application of knowledge 61) Malware that comes with a downloaded file that a user requests is called a: A) Trojan horse. B) backdoor. C) drive-by download. D) PUP.
C Page Ref: 262 Difficulty: Moderate
Information technology 30) Most of the world's malware is delivered via which of the following? A) viruses B) worms C) Trojan horses D) botnets
C Page Ref: 263 Difficulty: Moderate
Information technology 39) All the following statements about symmetric key cryptography are true except: A) in symmetric key cryptography, both the sender and the receiver use the same key to encrypt and decrypt a message. B) the Data Encryption Standard is a symmetric key encryption system. C) symmetric key cryptography is computationally slower. D) symmetric key cryptography is a key element in digital envelopes.
C Page Ref: 282-283 Difficulty: Difficult
Information technology 73) ________ text is text that has been encrypted and thus cannot be read by anyone other than the sender and the receiver.
Cipher Page Ref: 281 Difficulty: Moderate
________ refers to the ability to ensure that messages and data are only available to those authorized to view them.
Confidentiality
________ refers to the ability to ensure that messages and data are only available to those who are authorized to view them.
Confidentiality
1) Confidentiality is sometimes confused with: A) privacy. B) authenticity. C) integrity. D) nonrepudiation.
A
11) Bitcoins are an example of: A) digital cash. B) virtual currency. C) a stored value payment system. D) an EBPP system.
A
12) The overall rate of online credit card fraud is ________ of all online card transactions. A) less than 1% B) around 5% C) around 10% D) around 15%
A
________ typically attack governments, organizations, and sometimes individuals for political purposes.
Hacktivists
Worm
Malware that is designed to spread from computer to computer
________ refers to the ability to ensure that e-commerce participants do not deny their online actions.
Nonrepudiation
Phishing Attack
Online Attempt by a third party to obtain confidential information for financial gain
1) Typically, the more security measures added to an e-commerce site, the slower and more difficult it becomes to use.
TRUE
Information technology 80) ________ enables the online delivery and payment of monthly bills.
EBPP, Electronic billing presentment and payment Page Ref: 308 Difficulty: Moderate
Information technology 81) Discuss and explain the various types of malicious code and how they work. Include the different types of viruses.
Malicious code includes a variety of threats such as viruses, worms, Trojan horses, ransomware, and bot programs. A virus is a computer program that can replicate or make copies of itself and spread to other files. Viruses can range in severity from simple programs that display a message or graphic as a "joke" to more malevolent code that will destroy files or reformat the hard drive of a computer, causing programs to run incorrectly. Worms are designed to spread not only from file to file but from computer to computer and do not necessarily need to be activated in order to replicate. A Trojan horse is not itself a virus because it does not replicate but it is a method by which viruses or other malicious code can be introduced into a computer system. It appears benign and then suddenly does something harmful. For example, it may appear to be only a game and then it will steal passwords and mail them to another person. A backdoor is a feature of worms, viruses, and Trojans that allow attackers to remotely access compromised computers. Ransomware (or also known as scareware) is a type of malware (often a worm) that locks your computer or files to stop you from accessing them. Bot programs are a type of malicious code that can be covertly installed on a computer when it is attached to the Internet. Once installed, the bot responds to external commands sent by the attacker, and many bots can be coordinated by a hacker into a botnet. Page Ref: 261-264 Difficulty: Moderate
Which of the following is not a major trend in e-commerce payments in 2015-2016?
Mobile retail payment volume decreases.
Which of the following laws makes DoS attacks illegal?
National Information Infrastructure Protection Act
Intrusion Detection
Tools to monitor the most vulnerable points in a network to detect and deter unauthorized intruders
TLS
Transport Layer Security- that ensures privacy between communicating applications and their users on the Internet
Zeus is an example of which of the following?
Trojan horse/botnet
6) Spoofing involves attempting to hide a true identity by using someone else's e-mail or IP address.
True
Information technology 67) To allow employees to connect securely over the Internet to their corporate network, you would use a(n) ________.
VPN, virtual private network Page Ref: 292 Difficulty: Moderate
Which of the following is the current standard used to protect Wi-Fi networks?
WPA2
31) ________ typically attack governments, organizations, and sometimes individuals for political purposes. A) Crackers B) White hats C) Grey hats D) Hacktivists
D
Information technology 2) A worm needs to be activated by a user in order for it to replicate itself.
FALSE Page Ref: 262 Difficulty: Moderate
Information technology 4) Phishing attacks rely on browser parasites.
FALSE Page Ref: 264, 266 Difficulty: Moderate
Information technology 9) SLS/TLS provides irrefutability.
FALSE Page Ref: 292 Difficulty: Difficult
Information technology 12) Credit cards are the dominant form of online payment throughout the world.
FALSE Page Ref: 302 Difficulty: Easy
Application of knowledge 14) Digital cash is legal tender that is instantly convertible into other forms of value without the intermediation of any third parties.
FALSE Page Ref: 308 Difficulty: Difficult
software vulnerability
FREAK is an example
All of the following are methods of securing channels of communication except:
FTP
Which is not a method of securing channels of communication
FTP.
________ is the current standard used to protect Wi-Fi networks.
WPA2
70) Which of the following statements is not true? A) Most states require companies that maintain personal data on their residents to publicly disclose when a security breach affecting those residents has occurred. B) The USA Patriot Act broadly expanded law enforcement's investigative and surveillance powers. C) The Cybersecurity Information Sharing Act was strongly supported by most large technology companies and privacy advocates. D) The Federal Trade Commission has asserted that it has authority over corporations' data security practices.
C
Information technology 62) Which of the following is not an example of a PUP? A) adware B) browser parasite C) drive-by download D) spyware
C Page Ref: 264-265 Difficulty: Difficult
Information technology 16) All of the following experienced high-profile data breaches in 2013 except: A) Evernote. B) Home Depot. C) Sony. D) Adobe.
C Page Ref: 268 Difficulty: Moderate
Information technology 31) Which of the following is the leading cause of data breaches? A) theft of a computer B) accidental disclosures C) hackers D) DDoS attacks
C Page Ref: 268 Difficulty: Moderate
Information technology 36) Which dimension(s) of security is spoofing a threat to? A) integrity B) availability C) integrity and authenticity D) availability and integrity
C Page Ref: 272 Difficulty: Difficult
Information technology 43) All of the following statements about PKI are true except: A) The term PKI refers to the certification authorities and digital certificate procedures that are accepted by all parties. B) PKI is not effective against insiders who have a legitimate access to corporate systems including customer information. C) PKI guarantees that the verifying computer of the merchant is secure. D) The acronym PKI stands for public key infrastructure.
C Page Ref: 288-289 Difficulty: Difficult
Information technology 42) Which of the following is the current standard used to protect Wi-Fi networks? A) WEP B) TLS C) WPA2 D) WPA3
C Page Ref: 292 Difficulty: Moderate
Information technology 33) Next generation firewalls provide all of the following except: A) an application-centric approach to firewall control B) the ability to identify applications regardless of the port, protocol, or security evasion tools used C) the ability to automatically update applications with security patches D) the ability to identify users regardless of the device or IP address
C Page Ref: 293 Difficulty: Difficult
Information technology 48) Proxy servers are also known as: A) firewalls. B) application gateways. C) dual home systems. D) packet filters.
C Page Ref: 294 Difficulty: Moderate
Information technology 50) What is the first step in developing an e-commerce security plan? A) Create a security organization. B) Develop a security policy. C) Perform a risk assessment. D) Perform a security audit.
C Page Ref: 296 Difficulty: Moderate
Information technology 52) Which of the following is not an example of an access control? A) firewalls B) proxy servers C) digital signatures D) login passwords
C Page Ref: 297 Difficulty: Moderate
Information technology 53) Online bill payment now accounts for ________ of all bill payments, while paper checks account for ________. A) less than 10%, less than 25% B) about 25%, about 10% C) more than 50%, less than 25% D) 100%, 0%
C Page Ref: 311 Difficulty: Difficult
22) ________ is not an example of malicious code A) Scareware B) A Trojan horse C) A bot D) A sniffer
D
30) According to Ponemon Institute's 2015 survey, which of the following was not among the causes of the costliest cybercrimes? A) malicious insiders B) malicious code C) denial of service D) botnets
D
Information technology 23) Which of the following is an example of an integrity violation of e-commerce security? A) A Web site is not actually operated by the entity the customer believes it to be. B) A merchant uses customer information in a manner not intended by the customer. C) A customer denies that he or she is the person who placed the order. D) An unauthorized person intercepts an online communication and changes its contents.
D Page Ref: 257 Difficulty: Moderate
Information technology 27) Which of the following is not a key point of vulnerability when dealing with e-commerce? A) the client computer B) the server C) the communications pipeline D) the credit card companies
D Page Ref: 260-261 Difficulty: Moderate
Analytical thinking 37) All of the following are examples of malicious code except: A) viruses. B) bots. C) worms. D) sniffers.
D Page Ref: 261-264 Difficulty: Moderate
Information technology 55) Zeus is an example of which of the following? A) SQL injection attack B) browser parasite C) DDoS attack D) Trojan horse
D Page Ref: 263 Difficulty: Moderate
Information technology 46) All of the following are methods of securing channels of communication except: A) SSL/TLS. B) certificates. C) VPN. D) FTP.
D Page Ref: 290-292 Difficulty: Moderate
Information technology 51) An intrusion detection system can perform all of the following functions except: A) examining network traffic. B) setting off an alarm when suspicious activity is detected. C) checking network traffic to see if it matches certain patterns or preconfigured rules. D) blocking suspicious activity.
D Page Ref: 295 Difficulty: Moderate
Information technology 49) All of the following are used for authentication except: A) digital signatures. B) certificates of authority. C) biometric devices. D) packet filters.
D Page Ref: 297-298 Difficulty: Moderate
The attack on Dyn, Twitter, Amazon, and other major organizations in October 2016, is an example of which of the following?
DDoS attack
Access Control
Determine who can gain legitimate access to a network
Analytical thinking; Information technology; Written and oral communication 83) What dimensions do digital signatures and hash digests add to public key cryptography and how do they work?
Digital signatures and hash digests can add authentication, nonrepudiation, and integrity when used with public key encryption. Encryption technology also allows for digital signatures and authentication. The sender encrypts the message yet again using their private key to produce a digital signature. To check the confidentiality of a message and ensure it has not been altered in transit, a hash function is used first to create a digest of the message. A hash function is an algorithm that produces a fixed-length number called a hash or message digest. To ensure the authenticity of the message and to ensure nonrepudiation, the sender encrypts the entire block of cipher text one more time using the sender's private key. This produces a digital signature or "signed" cipher text. The result of this double encryption is sent over the Internet to the recipient. Then, the recipient first uses the sender's public key to authenticate the message. Once authenticated, the recipient uses his or her private key to obtain the hash result and original message. As a final step, the recipient applies the same hash function to the original text and compares the result with the result sent by the sender. If the results are the same, the recipient now knows the message has not been changed during transmission. The message has integrity. Page Ref: 284-286 Difficulty: Difficult
Analytical thinking; Information technology; Written and oral communication 86) Define and explain how EBPP systems work. Describe each of the main EBPP business models.
EBPP refers to electronic billing presentment and payment systems, which are forms of online payment systems for monthly bills. Analysts expect electronic bill presentment and payment to become one of the fastest growing e-commerce businesses in the United States over the next several years because everyone involved stands to benefit from the process. Billers will cut costs by eliminating printing, paper, envelopes, postage, and the processing of paper checks and payments. Furthermore, EBPP will offer billers an opportunity to enhance customer service and target market. Customers will save time and eliminate checks and postage. Companies can use EBPP to present bills to individual customers electronically or they can contract with a service to handle all billing and payment collection for them. There are two main types of EBPP business models: biller-direct and consolidator. In biller-direct systems, a biller delivers the bill to customers via its own Web site or via a third-party's site. A service bureau is often used to provide the necessary infrastructure. The second major type of EBPP business model is the consolidator model. In this model, a third party, such as a financial institution or portal, aggregates all bills for consumers and ideally permits one-stop bill payment (pay anyone). Page Ref: 308, 311-312 Difficulty: Moderate
12) Credit cards are the dominant form of online payment throughout the world.
FALSE
14) Digital cash is legal tender that is instantly convertible into other forms of value without the intermediation of any third parties.
FALSE
4) Phishing attacks rely on browser parasites.
FALSE
9) TLS does not guarantee server-side authentication.
FALSE
Analytical thinking; Information technology; Written and oral communication 82) Explain the difference between symmetric key cryptography and public key cryptography. Which dimensions of e-commerce security does encryption address?
Symmetric key cryptography involves the use of a secret cipher that transforms plain text into cipher text. Both the sender and the receiver use the same key to encrypt and decrypt the message. The possibilities for simple substitution and transposition ciphers are endless, but there are several flaws in these types of systems that make them inadequate for use today. First, in order for the sender and the receiver to have the same key, it must be sent over a communication medium that is insecure or they must meet in person to exchange the key. If the secret key is lost or stolen, the encryption system fails. This method can be used effectively for data storage protection, but is less convenient for e-mail since the correspondents have to pass the secret key to one another over another secure medium prior to commencing the communication. Second, in the digital age, computers are so fast and powerful that these ancient encryption techniques can be quickly and easily broken. Modern digital encryption systems must use keys with between 56 and 512 binary digits in order to ensure that decryption would be unlikely. Third, for commercial use on an e-commerce site each of the parties in a transaction would need a secret key. In a population of millions of Internet users, thousands of millions of keys would be needed to accommodate all e-commerce customers. Public key cryptography solves the problem of exchanging keys. In this method every user has a pair of numeric keys: private and public. The public key is not secret; on the contrary, it is supposed to be disseminated widely. Public keys may be published in company catalogs or on the World Wide Web. The public key is used by outside parties to encrypt the messages addressed to you. The private or secret key is used by the recipient to decipher incoming messages. The main advantage of a public key cryptographic system is its ability to begin secure correspondence over the Internet without prior exchanging of the keys and, therefore, without the need for a meeting in person or using conventional carriers for key exchange. Encryption can provide four of the six key dimensions of e-commerce security. It can provide assurance that the message has not been altered (integrity), prevent the user from denying that he/she has sent the message (nonrepudiation), provide verification of the identity of the message (authentication), and give assurance that the message has not been read by others (confidentiality). Page Ref: 281-284 Difficulty: Moderate
15) PayPal requires the recipient of a payment to have a PayPal account to receive funds.
TRUE
2) A worm does not need to be activated by a user in order for it to replicate itself.
TRUE
3) A Trojan horse appears to be benign, but then does something other than expected.
TRUE
Information technology 7) The Java Runtime Environment is a frequent target of exploit kits.
TRUE Page Ref: 261 Difficulty: Moderate
Information technology 3) A Trojan horse appears to be benign, but then does something other than expected.
TRUE Page Ref: 263 Difficulty: Moderate
Information technology 6) Spoofing involves attempting to hide a true identity by using someone else's e-mail or IP address.
TRUE Page Ref: 272 Difficulty: Difficult
Information technology 11) The Heartbleed bug is an example of a software vulnerability.
TRUE Page Ref: 275-276 Difficulty: Moderate
Information technology 8) Smishing attacks exploit SMS messages.
TRUE Page Ref: 277 Difficulty: Difficult
Information technology 10) The easiest and least expensive way to prevent threats to system integrity is to install anti-virus software.
TRUE Page Ref: 295 Difficulty: Moderate
Application of knowledge 13) Apple Pay uses near field communication (NFC) chips.
TRUE Page Ref: 302 Difficulty: Moderate
Information technology 15) There is a finite number of Bitcoins that can be created.
TRUE Page Ref: 309 Difficulty: Moderate
Which of the following statements is not true?
The Cybersecurity Information Sharing Act is strongly supported by most large technology companies and privacy advocates.
Analytical thinking; Information technology; Written and oral communication 84) Discuss the security of communications channels. Include definitions and explanations for the terms Secure Sockets Layer/Transport Layer Security (SSL/TLS), secure negotiated session, session key, and VPN.
The Secure Sockets Layer of the Transmission Control Protocol/Internet Protocol (TCP/IP) communications protocol is the main method for securing communications channels on the Web. When you receive a message from a Web server then you will be communicating through a secure channel; this means that SSL/TLS will be used to establish a secure negotiated session. A secure negotiated session is a client-server session in which the URL of the requested document, its contents, and the contents of the forms filled out by the user on the page, as well as the cookies that are exchanged, are all encrypted. The browser and the server exchange digital certificates with one another, determine the strongest shared form of encryption, and begin communicating using a unique symmetric encryption key, agreed upon for just this encounter. This is called a session key. SSL/TLS provides data encryption, server authentication, optional client authentication (as yet still rare for individual users), and message integrity for the TCP/IP connections between two computers. SSL/TLS addresses the threat of authenticity by allowing users to verify another user's identity or the identity of a server. It also protects the integrity of the messages exchanged. However, once the merchant receives the encrypted credit and order information, that information is typically stored in unencrypted format on the merchant's servers. While SSL/TLS provides secure transactions between merchant and consumer, it only guarantees server-side authentication. Client authentication is optional. In addition, SSL/TLS cannot provide irrefutability — consumers can order goods or download information products and then claim the transaction never occurred. Virtual private networks (VPNs) enable remote users to access an internal network from the Internet. They use protocols to create a private connection between a user on a local ISP and a private network. This process is called tunneling because it creates a private connection by adding an encrypted wrapper around the message to hide its content. It is called virtual because it appears to be a dedicated secure line when in fact it is a temporary secure line. VPNs are used primarily for transactions between business partners because dedicated connections can be very expensive. The Internet and VPNs can be used to significantly reduce the costs of secure communications. Page Ref: 290-292 Difficulty: Moderate
Analytical thinking; Information technology; Written and oral communication 85) Explain how an online credit card transaction works, identifying the parties involved and describing how SSL/TLS is involved. What are the limitations of online credit card payment systems?
The five parties involved in a credit card transaction are the consumer, the merchant, the clearinghouse, the merchant bank (acquiring bank), and the consumer's card issuing bank. The basic payment transaction process works like this: The consumer first makes an online payment by sending his or her credit card information via an online form at the merchant's Web site. Once this information is received by the merchant, the merchant software contacts a clearinghouse (a financial intermediary that authenticates credit cards and verifies account balances). The clearinghouse contacts the card issuing bank to verify the account information. Once verified, the issuing bank credits the account of the merchant at the merchant's bank. The debit to the consumer account is transmitted to the consumer in a monthly statement. SSL is involved in sending the consumer's credit card information safely to the merchant's Web site. When the consumer checks out using the merchant's shopping cart software, a secure tunnel through the Internet is created using SSL/TLS. Using encryption, SSL/TSL secures the session during which credit card information will be sent to the merchant and protects the information from interlopers on the Internet. There are a number of limitations to the existing credit card payment system, most importantly involving security, merchant risk, cost, and social equity. The security of the transaction is considered to be very poor because neither the merchant nor the consumer can be fully authenticated. The risks merchants face is high. Banks think of Internet credit card orders as the same type of transactions as mail orders or telephone orders. In these transactions, the credit card is not present. There is no way for the merchant to verify the legitimacy of the customer's card or identity before confirming the order. In these transactions, the merchant carries all the risk for fraudulent credit card use. Consumers can disclaim charges even though the items have already been shipped. Merchants also must pay significant charges. These high costs make it unprofitable to sell small items such as individual articles or music tracks over the Internet. Furthermore, credit cards are not very democratic. Millions of young adults and almost 100 million other adult Americans who cannot afford credit cards or who have low incomes and are, therefore, considered poor credit risks cannot participate in e-commerce as it is presently structured in the United States. Page Ref: 303-305 Difficulty: Moderate
