Quiz 8 MIS
The HIPAA Act of 1996: requires financial institutions to ensure the security of customer data. outlines medical security and privacy rules. identifies computer abuse as a crime and defines abusive activities. imposes responsibility on companies and management to safeguard the accuracy of financial information. specifies best practices in information systems security and control.
outlines medical security and privacy rules.
A statement ranking information risks and identifying security goals would be included in which of the following? Business impact analysis Risk assessment Security policy Business continuity plan AUP
security policy
An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called: token authentication. biometric authentication. symmetric key authorization. two-factor authentication. smart card authentication.
two-factor authentication.
Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure? $1,500 $2,500 $500 $1,250 $1,000
$1,250
According to the 2016 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2015? $1.5 billion $150 million $1.5 million $15 million $15 billion
$15 billion
According to Ponemon Institute's 2015 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for companies in the United States was approximately: $150 million. $1.5 billion. $1.5 million. $15 million. $15 billion.
$15 million.
Which of the following statements about wireless security is not true? Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers. Radio frequency bands are easy to scan. Intruders can force a user's NIC to associate with a rogue access point. An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs.
Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.
Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. botnet phishing SQL injection DoS DDoS
DDoS
_______ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage. Administrative Software Input Implementation Data security
Data security
Which of the following focuses primarily on the technical issues of keeping systems up and running? An AUP Disaster recovery planning Security policies Business continuity planning An information systems audit
Disaster recovery planning
Which of the following is the most common type of electronic evidence? VOIP data Instant messages Voice-mail E-mail Spreadsheets
Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime? National Information Infrastructure Protection Act Computer Fraud and Abuse Act Electronic Communications Privacy Act Data Security and Breach Notification Act Economic Espionage Act
National Information Infrastructure Protection Act
CryptoLocker is an example of which of the following? Selected Answer: Sniffer SQL injection attack Worm Evil twin Ransomware
Ransomware
________ is malware that hijacks a user's computer and demands payment in return for giving back access. An evil twin A virus A Trojan horse Spyware Ransomware
Ransomware
________ identify the access points in a Wi-Fi network. Mac addresses NICs SSIDs UTMs URLs
SSIDs
Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. MSSP NSP UTM DPI PKI
UTM
All of the following are currently being used as traits that can be profiled by biometric authentication except: facial characteristics. voice. fingerprints. retinal images. body odor.
body odor.
Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards? Security policy Vulnerabilities Legacy systems SSID standards Controls
controls
In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data. deep packet inspection stateful inspection unified threat management application proxy filtering high availability computing
deep packet inspection
_______ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else. Evil twins Identity theft Pharming Spoofing Social engineering
Identity theft
true or false? DoS attacks are used to destroy information and access restricted areas of a company's information system.
false
true or false? Wireless networks are more difficult for hackers to gain access too because radio frequency bands are difficult to scan.
false
Most computer viruses deliver a: driveby download. keylogger. payload. worm. Trojan horse.
payload.
true or false? When errors are discovered in software programs, the sources of the errors are found and eliminated through a process called debugging.
true
true or false? You can test software before it is even written by conducting a walkthrough.
true
true or false? Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.
true
________ is malware that logs and transmits everything a user types. A keylogger Spyware A sniffer A Trojan horse A worm
A keylogger
Which of the following is not an example of a computer used as a target of crime? Breaching the confidentiality of protected computerized data Accessing a computer system without authority Threatening to cause damage to a protected computer Illegally accessing stored electronic communication Knowingly accessing a protected computer to commit fraud
Illegally accessing stored electronic communication
Which of the following provides additional security by determining whether packets are part of an ongoing dialogue between a sender and receiver? Application proxy filtering NAT Stateful inspection Packet filtering Deep packet inspection
Stateful inspection
In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? Distributed encryption SSL/TLS Private key encryption Symmetric key encryption Public key encryption
Symmetric key encryption
Which of the following statements about Internet security is not true? The use of P2P networks can expose a corporate computer to outsiders. Instant messaging can provide hackers access to an otherwise secure network. A corporate network without access to the Internet is more secure than one that provides access. VoIP is more secure than the switched voice network. Smartphones have the same security weaknesses as other Internet devices.
VoIP is more secure than the switched voice network.
Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic? Cybervandalism War driving Drive-by tapping Snooping Sniffing
War driving
Application controls: apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. include software controls, computer operations controls, and implementation controls. monitor the use of system software and prevent unauthorized access to software and programs. govern the design, security, and use of computer programs and the security of data files in general throughout the organization. can be classified as input controls, processing controls, and output controls.
can be classified as input controls, processing controls, and output controls.
The intentional defacement or destruction of a website is called: cybervandalism. phishing. cyberwarfare. spoofing. pharming.
cybervandalism.
A foreign country attempting to access government networks in order to disable a national power grid is an example of: cyberterrorism. phishing. evil twins. cyberwarfare. denial-of-service attacks.
cyberwarfare.
A firewall allows the organization to: check the content of all incoming and outgoing e-mail messages. check the accuracy of all transactions between its network and the Internet. create access rules for a network. enforce a security policy on data exchanged between its network and the Internet. create an enterprise system on the Internet.
enforce a security policy on data exchanged between its network and the Internet.
All of the following are specific security challenges that threaten the communications lines in a client/server environment except: theft and fraud. errors. sniffing. tapping. radiation.
errors
true or false? A computer virus replicates more quickly than a computer worm.
false
true or false? An acceptable use policy defines the acceptable level of access to information assets for different users.
false
true or false? Biometric authentication is the use of personal, biographic details such as the high school you attended and the first street you lived on to provide identification.
false
true or false? Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses.
false
true or false? Most IoT devices support sophisticated security approaches.
false
true or false? Packet filtering catches most types of network attacks.
false
true or false? Smartphones typically feature state-of-the-art encryption and security features, making them highly secure tools for businesses.
false
true or false? The Apple iOS platform is the mobile platform most frequently targeted by hackers.
false
For 100-percent availability, online transaction processing requires: a digital certificate system. high-capacity storage. a multi-tier server network. fault-tolerant computer systems. dedicated phone lines.
fault-tolerant computer systems.
For 100-percent availability, online transaction processing requires: dedicated phone lines. a multi-tier server network. a digital certificate system. fault-tolerant computer systems. high-capacity storage.
fault-tolerant computer systems.
An authentication token is a(n): type of smart card. gadget that displays passcodes. electronic marker attached to a digital authorization file. device the size of a credit card that contains access permission data.
gadget that displays passcodes.
The HIPAA Act of 1996: imposes responsibility on companies and management to safeguard the accuracy of financial information. specifies best practices in information systems security and control. outlines medical security and privacy rules. identifies computer abuse as a crime and defines abusive activities. requires financial institutions to ensure the security of customer data.
outlines medical security and privacy rules.
Pharming involves: setting up fake website to ask users for confidential information. using e-mails for threats or harassment. setting up fake Wi-Fi access points that look as if they are legitimate public networks. pretending to be a legitimate business's representative in order to garner information about a security system. redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.
redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.
The Gramm-Leach-Bliley Act: imposes responsibility on companies and management to safeguard the accuracy of financial information. requires financial institutions to ensure the security of customer data. identifies computer abuse as a crime and defines abusive activities. outlines medical security and privacy rules. specifies best practices in information systems security and control.
requires financial institutions to ensure the security of customer data.
All of the following are specific security challenges that threaten corporate servers in a client/server environment except: sniffing. hacking. denial-of-service attacks. vandalism. malware.
sniffing.
Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called: social engineering. snooping sniffing. pharming. phishing.
social engineering.
true or false? Authentication refers to verifying that a person is who he or she claims to be.
true
true or false? NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs.
true
true or false? One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender.
true
true or false? Public key encryption uses two keys.
true
true or false? SSL is a protocol used to establish a secure connection between two computers.
true
true or false? Smartphones have the same security flaws as other Internet-connected devices.
true
true or false? The dispersed nature of cloud computing makes it difficult to track unauthorized access.
true
true or false? Viruses can be spread through e-mail.
true
Which of the following is the single greatest cause of network security breaches? user lack of knowledge Cyberwarfare Bugs Trojan horses Viruses
user lack of knowledge
Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems? Algorithms Controls Security Benchmarking Identity management
Security
