ITC ch 8 questions

Evil twins are: bogus wireless network access points that look legitimate to users. computers that fraudulently access a website or network using the IP address and identification of an authorized computer. email messages that mimic the email messages of a legitimate business. fraudulent websites that mimic a legitimate business's website. Trojan horses that appear to the user to be a legitimate commercial software application.

bogus wireless network access points that look legitimate to users

A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of: evil twins. phishing. click fraud. spoofing. pharming.

click fraud.

Which of the following is a virus that uses flaws in Windows software to take over a computer remotely? Zeus ILOVEYOU Sasser Conficker Cryptolocker

conficker

A foreign country attempting to access government networks in order to disable a national power grid is an example of: cyberwarfare. denial-of-service attacks. evil twins. cyberterrorism. phishing.

cyberwarfare

A firewall allows the organization to: create access rules for a network. check the content of all incoming and outgoing email messages. enforce a security policy on data exchanged between its network and the Internet. check the accuracy of all transactions between its network and the Internet. create an enterprise system on the Internet.

enforce a security policy on data exchanged between its network and the Internet.

When hackers gain access to a database containing your personal private information, this is an example of: phishing. pharming. spoofing. social engineering. identity theft.

identity theft

________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors. Intrusion detection systems Stateful inspections Application proxy filtering technologies Firewalls Packet filtering technologies

intrusion detection systems

A Trojan horse: is malware named for a breed of fast-moving Near-Eastern horses. is a virus installed as a drive-by download. installs spyware on users' computers. is a type of sniffer used to infiltrate corporate networks. is software that appears to be benign but does something other than expected.

is software that appears to be benign but does something other than expected.

The HIPAA Act of 1996: requires financial institutions to ensure the security of customer data. outlines medical security and privacy rules. identifies computer abuse as a crime and defines abusive activities. specifies best practices in information systems security and control. imposes responsibility on companies and management to safeguard the accuracy of financial information.

outlines medical security and privacy rules.

Most computer viruses deliver a: payload. keylogger. driveby download. Trojan horse. worm.

payload

all of the following are specific security challenges that threaten the communications lines in a client/server environment except: sniffing. tapping. radiation. theft and fraud. phishing

radiation

All of the following are specific security challenges that threaten corporate systems in a client/server environment except: copying of data. theft of data. alteration of data. radiation. hardware failure.

radiation.

________ is malware that hijacks a user's computer and demands payment in return for giving back access. An evil twin A virus Ransomware Spyware A Trojan horse

ransomware

According to Ponemon Institute's 2017 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for benchmarked companies in seven different countries was approximately: $117 million. $117 billion. $11.7 million. $117,000. $11.7 billion.

$11.7 million

our company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure? $1,250 $1,000 $500 $1,500 $2,500

1,250

Which of the following is a type of ambient data? A set of raw data from an environmental sensor A file deleted from a hard disk A file that contains an application's user settings Data that has been recorded over Computer log containing recent system errors

A file deleted from a hard disk

________ is spyware that logs and transmits everything a user types. Spyware A keylogger A sniffer A Trojan horse A worm

A keylogger

Which of the following defines acceptable uses of a firm's information resources and computing equipment? An AUP A MSSP An information systems audit policy A CA policy A UTM system

AN AUP

Which of the following techniques stops data packets originating outside the organization, inspects them, and passes the packets to the other side of an organization's firewall? Stateful inspection Application proxy filtering Deep packet inspection Packet filtering NAT

Application proxy filtering

Which of the following statements about passwords is not true? Passwords are often disregarded by employees. Passwords can be sniffed when being transmitted over a network. Passwords can be stolen through social engineering. Password systems that are too rigorous may hinder employee productivity. Authentication cannot be established by the use of a password.

Authentication cannot be established by the use of a password.

Pharming involves: redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser. pretending to be a legitimate business's representative in order to garner information about a security system. using emails for threats or harassment. setting up fake Wi-Fi access points that look as if they are legitimate public networks. setting up fake website to ask users for confidential information.

redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.

Fault tolerant information systems offer 100 percent availability because they use: redundant hardware, software, and power supplies. high-capacity storage. a multitier server network. a digital certificate system. dedicated phone lines.

redundant hardware, software, and power supplies.

The Gramm-Leach-Bliley Act: requires financial institutions to ensure the security of customer data. specifies best practices in information systems security and control. identifies computer abuse as a crime and defines abusive activities. outlines medical security and privacy rules. imposes responsibility on companies and management to safeguard the accuracy of financial information.

requires financial institutions to ensure the security of customer data.

An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following? Business impact analysis Business continuity plan Security policy AUP Risk assessment

risk assessment

Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems? Algorithms Security Controls Identity management Benchmarking

security

Which of the following statements about wireless security is not true? Intruders can force a user's NIC to associate with a rogue access point. Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers. Radio frequency bands are easy to scan. An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs.

Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.

All of the following are specific security challenges that threaten corporate servers in a client/server environment except: sniffing. denial-of-service attacks. hacking. vandalism. malware.

sniffing

An employee clicks on a link in an email from what looks like a fellow employee and is taken to a fraudulent web site which asks for personal information is an example of: DDOS attack. spear phishing. click fraud. identity theft. pharming.

spear phishing.

All of the following have contributed to an increase in software flaws except: the increase in the number of computer hackers in the world. the inability to fully test programs. demands for timely delivery to markets. the growing size of software programs. the growing complexity of software programs.

the increase in the number of computer hackers in the world.

Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards? Legacy systems Vulnerabilities Controls SSID standards Security policy

Controls

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. phishing DoS DDoS botnet SQL injection

DDoS

An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called: symmetric key authorization. biometric authentication. token authentication. two-factor authentication. smart card authentication.

two-factor authentication.

WPA2 is a more effective way to secure a wireless network than WEP because it: includes an AUP. operates on a VPN. uses much longer encryption keys. is part of most vendors UTM products. uses symmetric encryption methods.

uses much longer encryption keys.

Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic? Snooping Sniffing Drive-by tapping Cybervandalism War driving

war driving

When a hacker discovers a security hole in software that is unknown to the software vendor, it is an example of: phishing. sniffing. zero-day vulnerability. snooping. social engineering.

zero-day vulnerability.

Which of the following is not an example of a computer used as a target of crime? Accessing a computer system without authority Knowingly accessing a protected computer to commit fraud Breaching the confidentiality of protected computerized data Illegally accessing stored electronic communication Threatening to cause damage to a protected computer

Illegally accessing stored electronic communication

Which of the following statements about botnets is not true? It is not possible to make a smartphone part of a botnet. Botnets are often used for click fraud. Ninety percent of the world's spam is delivered by botnets. Eighty percent of the world's malware is delivered by botnets. Botnets are often used to perpetrate DDoS attacks.

It is not possible to make a smartphone part of a botnet.

Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime? National Information Infrastructure Protection Act Data Security and Breach Notification Act Computer Fraud and Abuse Act Electronic Communications Privacy Act Economic Espionage Act

National Information Infrastructure Protection Act

CryptoLocker is an example of which of the following? Worm SQL injection attack Sniffer Evil twin Ransomware

Ransomware

________ is malware that hijacks a user's computer and demands payment in return for giving back access. A virus A Trojan horse Ransomware Spyware An evil twin

Ransomware

________ identify the access points in a Wi-Fi network. UTMs URLs NICs SSIDs Mac addresses

SSIDS

Currently, the protocols used for secure information transfer over the Internet are: HTTP and TCP/IP. S-HTTP and SHTML. S-HTTP and CA. TCP/IP and SSL. SSL, TLS, and S-HTTP.

SSL, TLS, and S-HTTP.

A statement ranking information risks and identifying security goals would be included in which of the following? Security policy Business impact analysis Risk assessment AUP Business continuity plan

Security policy

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? SSL/TLS Symmetric key encryption Private key encryption Public key encryption Distributed encryption

Symmetric key encryption

Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. MSSP PKI DPI NSP UTM

UTM

Which of the following is the single greatest cause of network security breaches? Trojan horses Viruses Bugs Cyberwarfare User lack of knowledge

User lack of knowledge

Which of the following statements about Internet security is not true? Instant messaging can provide hackers access to an otherwise secure network. Wi-Fi networks are not vulnerable to security breaches. The use of P2P networks can expose a corporate computer to outsiders. A corporate network without access to the Internet is more secure than one that provides access. Smartphones have the same security weaknesses as other Internet devices.

Wi-Fi networks are not vulnerable to security breaches.

Which of the following is an example of a keylogger? Sasser Zeus Cryptolocker ILOVEYOU Conficker

Zeus

________ controls formalize standards, rules, procedures, and control disciplines to ensure that the organization's general and application controls are properly executed and enforced. Data security Administrative Input Implementation Software

administrative

All of the following are currently being used as traits that can be profiled by biometric authentication except: retinal images. body odor. facial characteristics. fingerprints. voice.

body odor.