BMIS Final Ch 8

Which of the following is the most common type of electronic evidence?

A. Instant messages *B. E-mail* C. Voice-mail D. VOIP data E. Spreadsheets

Which of the following statements about wireless security is not true?

A. Intruders can force a user's NIC to associate with a rogue access point. *B. Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.* C. Radio frequency bands are easy to scan. D. An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. E. SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs

The intentional defacement or destruction of a website is called:

A. phishing. B. spoofing. C. pharming. D. cyberwarfare. *E. cybervandalism.*

Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called:

A. sniffing. B. snooping C. pharming. D. phishing. *E. social engineering*

Which of the following is not an example of a computer used as an instrument of crime?

A. Intentionally attempting to intercept electronic communication B. Theft of trade secrets *C. Breaching the confidentiality of protected computerized data* D. Schemes to defraud E. Unauthorized copying of software

Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards?

A. Legacy systems B. Security policy C. Vulnerabilities *D. Controls* E. SSID standards

________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.

A. Pharming *B. Identity theft* C. Evil twins D. Social engineering E. Spoofing

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack.

A. SQL injection *B. DDoS* C. phishing D. botnet E. DoS

An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following?

A. Security policy B. Business impact analysis C. Business continuity plan D. AUP *E. Risk assessment*

________ is malware that logs and transmits everything a user types.

A. Spyware B. A worm C. A Trojan horse *D. A keylogger* E. A sniffer

Which of the following is the single greatest cause of network security breaches?

A. Viruses B. Bugs *C. User lack of knowledge* D. Trojan horses E. Cyberwarfare

A foreign country attempting to access government networks in order to disable a national power grid is an example of:

A. evil twins. B. cyberterrorism. C. denial-of-service attacks. D. phishing. *E. cyberwarfare*

Evil twins are:

A. fraudulent websites that mimic a legitimate business's website. *B. bogus wireless network access points that look legitimate to users.* C. e-mail messages that mimic the e-mail messages of a legitimate business. D. Trojan horses that appears to the user to be a legitimate commercial software application. E. computers that fraudulently access a website or network using the IP address and identification of an authorized computer

All of the following are specific security challenges that threaten corporate systems in a client/server environment except:

A. hardware failure. B. theft of data. *C. radiation.* D. copying of data. E. alteration of data.

A Trojan horse:

A. is a virus that replicates quickly. *B. is software that appears to be benign but does something other than expected.* C. installs spyware on users' computers. D. is malware named for a breed of fast-moving Near-Eastern horses. E. is a type of sniffer used to infiltrate corporate networks.

Application controls:

A. monitor the use of system software and prevent unauthorized access to software and programs. B. apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. C. include software controls, computer operations controls, and implementation controls. *D. can be classified as input controls, processing controls, and output controls.* E. govern the design, security, and use of computer programs and the security of data files in general throughout the organization.

Which of the following statements about Internet security is not true?

*A. VoIP is more secure than the switched voice network.* B. The use of P2P networks can expose a corporate computer to outsiders. C. A corporate network without access to the Internet is more secure than one that provides access. D. Smartphones have the same security weaknesses as other Internet devices. E. Instant messaging can provide hackers access to an otherwise secure network.

Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic?

*A. War driving* B. Snooping C. Cybervandalism D. Sniffing E. Drive-by tapping

The Sarbanes-Oxley Act:

*A. imposes responsibility on companies and management to safeguard the accuracy of financial information.* B. identifies computer abuse as a crime and defines abusive activities. C. specifies best practices in information systems security and control. D. outlines medical security and privacy rules. E. requires financial institutions to ensure the security of customer data

According to Ponemon Institute's 2015 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for companies in the United States was approximately:

A. $1.5 billion. B. $150 million. C. $15 billion. *D. $15 million.* E. $1.5 million.

According to the 2016 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2015?

A. $15 million *B. $15 billion* C. $1.5 million D. $150 million E. $1.5 billion

Which of the following defines acceptable uses of a firm's information resources and computing equipment?

A. A MSSP B. A CA policy C. A UTM system D. An information systems audit policy *E. An AUP*

________ is malware that hijacks a user's computer and demands payment in return for giving back access.

A. A virus B. A Trojan horse C. An evil twin *D. Ransomware* E. Spyware

Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems?

A. Benchmarking B. Algorithms C. Controls *D. Security* E. Identity management

Which of the following statements about botnets is not true?

A. Eighty percent of the world's malware is delivered by botnets. *B. It is not possible to make a smartphone part of a botnet.* C. Ninety percent of the world's spam is delivered by botnets. D. Botnets are often used to perpetrate DDoS attacks. E. Botnets are often used for click fraud.

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

A. Implementation B. Software *C. Data security* D. Administrative E. Input

Computer forensics tasks include all of the following except:

A. presenting collected evidence in a court of law. B. securely storing recovered electronic data. C. finding significant information in a large volume of electronic data. D. recovering data from computers while preserving evidential integrity. *E. collecting physical evidence on the computer.*

The Gramm-Leach-Bliley Act:

A. specifies best practices in information systems security and control. B. outlines medical security and privacy rules. *C. requires financial institutions to ensure the security of customer data.* D. identifies computer abuse as a crime and defines abusive activities. E. imposes resp

A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of:

A. spoofing. *B. click fraud.* C. evil twins. D. phishing. E. pharming.

Pharming involves:

A. using e-mails for threats or harassment. B. setting up fake website to ask users for confidential information. *C. redirecting users to a fraudulent website even when the user has typed in the correct* address in the web browser. D. pretending to be a legitimate business's representative in order to garner information about a security system. E. setting up fake Wi-Fi access points that look as if they are legitimate public networks.