Chapter 8 - Managing the Information Systems Function
70) Which of the following statements about passwords is not true? A) Authentication cannot be established by the use of a password. B) Password systems that are too rigorous may hinder employee productivity. C) Passwords can be stolen through social engineering. D) Passwords are often disregarded by employees. E) Passwords can be sniffed when being transmitted over a network.
A) Authentication cannot be established by the use of a password
16) Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. A) DDoS B) DoS C) SQL injection D) phishing E) botnet
A) DDoS
1) Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems? A) Security B) Controls C) Benchmarking D) Algorithms E) Identity management
A) Security
62) A statement ranking information risks and identifying security goals would be included in which of the following? A) Security policy B) AUP C) Risk assessment D) Business impact analysis E) Business continuity plan
A) Security policy
26) Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic? A) War driving B) Sniffing C) Cybervandalism D) Drive-by tapping E) Snooping
A) War driving
32) Which of the following is an example of a keylogger? A) Zeus B) Conficker C) Sasser D) ILOVEYOU E) Cryptolocker
A) Zeus
78) All of the following are types of information systems general controls except: A) application controls. B) computer operations controls. C) hardware controls. D) software controls. E) administrative controls.
A) application controls.
73) A firewall allows the organization to: A) enforce a security policy on data exchanged between its network and the Internet. B) check the accuracy of all transactions between its network and the Internet. C) create an enterprise system on the Internet. D) check the content of all incoming and outgoing email messages. E) create access rules for a network.
A) enforce a security policy on data exchanged between its network and the Internet
5) All of the following are specific security challenges that threaten the communications lines in a client/server environment except: A) errors. B) tapping. C) theft and fraud. D) radiation. E) sniffing.
A) errors
10) A Trojan horse: A) is software that appears to be benign but does something other than expected. B) is a virus that replicates quickly. C) is malware named for a breed of fast-moving Near-Eastern horses. D) installs spyware on users' computers. E) is a type of sniffer used to infiltrate corporate networks.
A) is software that appears to be benign but does something other than expected
22) Pharming involves: A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser. B) pretending to be a legitimate business's representative in order to garner information about a security system. C) setting up fake website to ask users for confidential information. D) using emails for threats or harassment. E) setting up fake Wi-Fi access points that look as if they are legitimate public networks.
A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.
50) The Gramm-Leach-Bliley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities.
A) requires financial institutions to ensure the security of customer data
54) Blockchain refers to a technology that: A) uses a distributed ledger system of transactions. B) uses a centralized data store in the cloud. C) relies on the Internet to provide secure transactions. D) uses existing banking systems to transfer funds. E) relies on peer-to-peer networks.
A) uses a distributed ledger system of transactions
77) A digital certificate system: A) uses third party CAs to validate a user's identity. B) uses digital signatures to validate a user's identity. C) uses tokens to validate a user's identity. D) is used primarily by individuals for personal correspondence. E) protects a user's identity by substituting a certificate in place of identifiable traits.
A) uses third party CAs to validate a user's identity.
25) According to Ponemon Institute's 2016 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for benchmarked companies in six different countries was approximately: A) $900,000. B) $9 million. C) $90 million. D) $9 billion. E) $90 billion.
B) $9 million
52) Which of the following is a type of ambient data? A) Computer log containing recent system errors B) A file deleted from a hard disk C) A file that contains an application's user settings D) A set of raw data from an environmental sensor E) Data that has been recorded over
B) A file deleted from a hard disk
60) ________ controls formalize standards, rules, procedures, and control disciplines to ensure that the organization's general and application controls are properly executed and enforced. A) Software B) Administrative C) Data security D) Implementation E) Input
B) Administrative
74) ________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors. A) Stateful inspections B) Intrusion detection systems C) Application proxy filtering technologies D) Packet filtering technologies E) Firewalls
B) Intrusion detection systems
33) As described in the chapter case, which of the following did hackers use to gain access to the DNC network? A) Trojan horse B) Phishing emails C) SQL injection attack D) Computer worm E) Pharming attack
B) Phishing emails
13) ________ is malware that hijacks a user's computer and demands payment in return for giving back access. A) A Trojan horse B) Ransomware C) Spyware D) A virus E) An evil twin
B) Ransomware
76) In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? A) SSL/TLS B) Symmetric key encryption C) Public key encryption D) Private key encryption E) Distributed encryption
B) Symmetric key encryption
23) Which of the following is the single greatest cause of network security breaches? A) Viruses B) User lack of knowledge C) Trojan horses D) Cyberwarfare E) Bugs
B) User lack of knowledge
20) The intentional defacement or destruction of a website is called: A) spoofing. B) cybervandalism. C) cyberwarfare. D) phishing. E) pharming.
B) cybervandalism
80) In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data. A) high availability computing B) deep packet inspection C) application proxy filtering D) stateful inspection E) unified threat management
B) deep packet inspection
58) Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure? A) $500 B) $1,000 C) $1,250 D) $1,500 E) $2,500
C) $1,250
14) ________ is spyware that logs and transmits everything a user types. A) Spyware B) A Trojan horse C) A keylogger D) A worm E) A sniffer
C) A keylogger
82) Which of the following techniques stops data packets originating outside the organization, inspects them, and passes the packets to the other side of an organizations firewall? A) NAT B) Packet filtering C) Deep packet inspection D) Stateful inspection E) Application proxy filtering
C) Deep packet inspection
64) Which of the following focuses primarily on the technical issues of keeping systems up and running? A) Business continuity planning B) Security policies C) Disaster recovery planning D) An AUP E) An information systems audit
C) Disaster recovery planning
19) Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime? A) Computer Fraud and Abuse Act B) Economic Espionage Act C) Electronic Communications Privacy Act D) Data Security and Breach Notification Act E) National Information Infrastructure Protection Act
C) Electronic Communications Privacy Act
17) Which of the following is not an example of a computer used as a target of crime? A) Knowingly accessing a protected computer to commit fraud B) Accessing a computer system without authority C) Illegally accessing stored electronic communication D) Threatening to cause damage to a protected computer E) Breaching the confidentiality of protected computerized data
C) Illegally accessing stored electronic communication
61) An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following? A) Security policy B) AUP C) Risk assessment D) Business impact analysis E) Business continuity plan
C) Risk assessment
9) Which of the following statements about Internet security is not true? A) The use of P2P networks can expose a corporate computer to outsiders. B) A corporate network without access to the Internet is more secure than one that provides access. C) VoIP is more secure than the switched voice network. D) Instant messaging can provide hackers access to an otherwise secure network. E) Smartphones have the same security weaknesses as other Internet devices.
C) VoIP is more secure than the switched voice network
71) Two-factor authentication utilizes a(n): A) unique password. B) encrypted connection. C) a multistep process of authentication. D) a firewall. E) a digital certificate.
C) a multistep process of authentication
72) All of the following are currently being used as traits that can be profiled by biometric authentication except: A) fingerprints. B) facial characteristics. C) body odor. D) retinal images. E) voice.
C) body odor
53) Computer forensics tasks include all of the following except: A) presenting collected evidence in a court of law. B) securely storing recovered electronic data. C) collecting physical evidence on the computer. D) finding significant information in a large volume of electronic data. E) recovering data from computers while preserving evidential integrity.
C) collecting physical evidence on the computer
29) A foreign country attempting to access government networks in order to disable a national power grid is an example of: A) phishing. B) denial-of-service attacks. C) cyberwarfare. D) cyberterrorism. E) evil twins.
C) cyberwarfare
51) The Sarbanes-Oxley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information
79) Fault tolerant information systems offer 100 percent availability because they use: A) high-capacity storage. B) a multitier server network. C) redundant hardware, software, and power supplies. D) dedicated phone lines. E) a digital certificate system.
C) redundant hardware, software, and power supplies
18) An employee clicks on a link in an email from what looks like a fellow employee and is taken to a fraudulent web site which asks for personal information is an example of: A) click fraud. B) DDOS attack. C) spear phishing. D) pharming. E) identity theft.
C) spear phishing
81) An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called: A) smart card authentication. B) biometric authentication. C) two-factor authentication. D) symmetric key authorization. E) token authentication.
C) two-factor authentication.
69) WPA2 is a more effective way to secure a wireless network than WEP because it: A) includes an AUP. B) operates on a VPN. C) uses much longer encryption keys. D) uses symmetric encryption methods. E) is part of most vendors UTM products.
C) uses much longer encryption keys
27) When hackers gain access to a database containing your personal private information, this is an example of: A) phishing. B) spoofing. C) social engineering. D) identity theft. E) pharming.
D) identity theft
49) The HIPAA Act of 1996: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities.
D) outlines medical security and privacy rules
7) All of the following are specific security challenges that threaten corporate systems in a client/server environment except: A) theft of data. B) copying of data. C) alteration of data. D) radiation. E) hardware failure
D) radiation
6) All of the following are specific security challenges that threaten corporate servers in a client/server environment except: A) hacking. B) malware. C) denial-of-service attacks. D) sniffing. E) vandalism.
D) sniffing
24) When a hacker discovers a security hole in software that is unknown to the software vendor it is an example of: A) sniffing. B) social engineering. C) phishing. D) zero-day vulnerability E) snooping
D) zero-day vulnerability
30) According to the 2017 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2016? A) $1.6 million B) $16 million C) $160 million D) $1.6 billion E) $16 billion
E) $16 billion
63) Which of the following defines acceptable uses of a firm's information resources and computing equipment? A) An information systems audit policy B) A CA policy C) A MSSP D) A UTM system E) An AUP
E) An AUP
59) Implementation controls: A) can be classified as input controls, processing controls, and output controls. B) govern the design, security, and use of computer programs and the security of data files in general throughout the organization. C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. D) include software controls, computer operations controls, and implementation controls. E) Audit the systems development process at various points to ensure that the process is properly controlled and managed.
E) Audit the systems development process at various points to ensure that the process is properly controlled and managed
4) Which of the following statements about wireless security is not true? A) SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs. B) Radio frequency bands are easy to scan. C) An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. D) Intruders can force a user's NIC to associate with a rogue access point. E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.
E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers
12) Which of the following is a virus that uses flaws in Windows software to take over a computer remotely? A) Sasser B) Zeus C) Cryptolocker D) ILOVEYOU E) Conficker
E) Conficker
2) Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards? A) Legacy systems B) SSID standards C) Vulnerabilities D) Security policy E) Controls
E) Controls
15) Which of the following statements about botnets is not true? A) Eighty percent of the world's malware is delivered by botnets. B) Botnets are often used to perpetrate DDoS attacks. C) Ninety percent of the world's spam is delivered by botnets. D) Botnets are often used for click fraud. E) It is not possible to make a smartphone part of a botnet.
E) It is not possible to make a smartphone part of a botnet
8) CryptoLocker is an example of which of the following? A) Worm B) SQL injection attack C) Sniffer D) Evil twin E) Ransomware
E) Ransomware
28) ________ identify the access points in a Wi-Fi network. A) NICs B) Mac addresses C) URLs D) UTMs E) SSIDs
E) SSIDs
75) Currently, the protocols used for secure information transfer over the Internet are: A) TCP/IP and SSL. B) S-HTTP and CA. C) HTTP and TCP/IP. D) S-HTTP and SHTML. E) SSL, TLS, and S-HTTP.
E) SSL, TLS, and S-HTTP
83) Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. A) DPI B) MSSP C) NSP D) PKI E) UTM
E) UTM
21) Evil twins are: A) Trojan horses that appears to the user to be a legitimate commercial software application. B) email messages that mimic the email messages of a legitimate business. C) fraudulent websites that mimic a legitimate business's website. D) computers that fraudulently access a website or network using the IP address and identification of an authorized computer. E) bogus wireless network access points that look legitimate to users.
E) bogus wireless network access points that look legitimate to users
11) A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of: A) phishing. B) pharming. C) spoofing. D) evil twins. E) click fraud.
E) click fraud
3) Most computer viruses deliver a: A) worm. B) Trojan horse. C) driveby download. D) keylogger. E) payload.
E) payload
31) All of the following have contributed to an increase in software flaws except: A) the growing complexity of software programs. B) the growing size of software programs. C) demands for timely delivery to markets. D) the inability to fully test programs. E) the increase in malicious intruders seeking system access.
E) the increase in malicious intruders seeking system access
35) As described in the chapter case, losing smartphones is a rare cause of data breaches.
FALSE
38) Wireless networks are more difficult for hackers to gain access to because radio frequency bands are difficult to scan.
FALSE
39) A computer virus replicates more quickly than a computer worm.
FALSE
42) DoS attacks are used to destroy information and access restricted areas of a company's information system.
FALSE
44) Most IoT devices support sophisticated security approaches.
FALSE
45) Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses.
FALSE
84) Organizations can use existing network security software to secure mobile devices.
FALSE
85) In cloud computing, accountability and responsibility for protection of sensitive data is transferred to the cloud provider.
FALSE
86) Biometric authentication is the use of personal, biographic details such as the high school you attended and the first street you lived on to provide identification.
FALSE
87) Packet filtering catches most types of network attacks.
FALSE
90) Symmetric encryption uses two keys.
FALSE
91) Smartphones typically feature state-of-the-art encryption and security features, making them highly secure tools for businesses.
FALSE
34) Smartphones have the same security flaws as other Internet-connected devices.
TRUE
36) A computer worm is a program that can copy itself to other computers on the network.
TRUE
37) The term cracker is used to identify a hacker with criminal or malicious intent.
TRUE
40) Phishing is a form of spoofing.
TRUE
41) Sniffers enable hackers to steal proprietary information from anywhere on a network, including email messages, company files, and confidential reports.
TRUE
43) Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.
TRUE
65) An acceptable use policy defines acceptable uses of the firm's information resources and computing equipment.
TRUE
88) Application proxy filtering examines the application content of packets.
TRUE
89) SSL is a protocol used to establish a secure connection between two computers.
TRUE
92) Authentication refers to verifying that a person is who he or she claims to be.
TRUE
93) In public key encryption the keys are mathematically related so that data encrypted with one key can be decrypted using only the other key.
TRUE
94) A firewall is a combination of hardware and software that controls the flow of incoming and outgoing network traffic
TRUE
