FPT University

ITA 301

Chap 8

1)____________refers to policies, procedures, and technical measures used to prevent unauthorized access, alternation, theft, or physical damage to information systems.

1. 1. "Security"
   2. "Controls"
   3. "Benchmarking"
   4. "Algorithms"

2)             refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards.

A)"Legacy systems"

B)"SSID standards"

C)"Vulnerabilities"

D)"Controls"

3. Large amounts of data stored in electronic form are                                      than the same data in manual form.
   1. less vulnerable to damage
   2. more secure
   3. vulnerable to many more kinds of threats
   4. more critical to most businesses

4. Electronic data are more susceptible to destruction, fraud, error, and misuse because information systems concentrate data in computer files that
   1. are usually bound up in legacy systems that are difficult to access and difficult to correct in case of error.
   2. are not secure because the technology to secure them did not exist at the time the files were created.
   3. have the potential to be accessed by large numbers of people and by groups outside of the organization.

1. 4. are frequently available on the Internet.

5. Specific security challenges that threaten the communications lines in a client/server environment include
   1. tapping; sniffing; message alteration; radiation.
   2. hacking; vandalism; denial of service attacks.
   3. theft, copying, alteration of data; hardware or software failure.
   4. unauthorized access; errors; spyware.

6. Specific security challenges that threaten clients in a client/server environment include
   1. tapping; sniffing; message alteration; radiation.
   2. hacking; vandalism; denial of service attacks.
   3. theft, copying, alteration of data; hardware or software failure.
   4. unauthorized access; errors; spyware.

7. Specific security challenges that threaten corporate servers in a client/server environment include
   1. tapping; sniffing; message alteration; radiation.
   2. hacking; vandalism; denial of service attacks.
   3. theft, copying, alteration of data; hardware or software failure.
   4. unauthorized access; errors; spyware.

8. The Internet poses specific security problems because
   1. it was designed to be easily accessible.
   2. everyone uses the Internet.
   3. Internet standards are universal.
   4. it changes so rapidly.

9. The main security problem on the Internet is
   1. radiation.
   2. bandwidth theft.
   3. hackers.
   4. natural disasters, such as floods and fires.

10. An independent computer program that copies itself from one computer to another over a network is called a
    1. worm.
    2. Trojan horse.
    3. bug.
    4. pest.

11. Sobig.F and MyDoom.A are
    1. viruses that use Microsoft Outlook to spread to other systems.
    2. worms attached to e-mail that spread from computer to computer.
    3. multipartite viruses that can infect files as well as the boot sector of the hard drive.
    4. Trojan horses used to create bot nets.

12. In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On the vendor's site, a small program called Mitglieder was downloaded to the user's machine. The program enabled outsiders to infiltrate the user's machine. What type of malware is this an example of?
    1. Trojan horse
    2. virus
    3. worm
    4. spyware

13. Redirecting a Web link to a different address is a form of
    1. snooping.
    2. spoofing.
    3. sniffing.
    4. war driving.

14. A key logger is a type of
    1. worm.
    2. Trojan horse.
    3. virus.
    4. spyware.

15. How do hackers create a botnet?
    1. by infecting Web search bots with malware
    2. by using Web search bots to infect other computers
    3. by causing other people's computers to become "zombie" PCs following a master computer
    4. by infecting corporate servers with "zombie" Trojan horses that allow undetected access through a back door

16. Using numerous computers to inundate and overwhelm the network from numerous launch points is called a      attack.
    1. DDoS
    2. DoS
    3. pharming
    4. phishing

17. Which of the following is NOT an example of a computer used as a target of crime?
    1. knowingly accessing a protected computer to commit fraud
    2. accessing a computer system without authority
    3. illegally accessing stored electronic communication
    4. threatening to cause damage to a protected computer

18. Which of the following is NOT an example of a computer used as an instrument of crime?
    1. theft of trade secrets
    2. intentionally attempting to intercept electronic communication
    3. unauthorized copying of software
    4. breaching the confidentiality of protected computerized data

19. Phishing is a form of
    1. spoofing.
    2. spinning.
    3. snooping.
    4. sniffing.

20. Phishing involves
    1. setting up bogus Wi-Fi hot spots.
    2. setting up fake Web sites to ask users for confidential information.
    3. pretending to be a legitimate business's representative in order to garner information about a security system.
    4. using e-mails for threats or harassment.

21. Evil twins are
    1. Trojan horses that appears to the user to be a legitimate commercial software application.
    2. e-mail messages that mimic the e-mail messages of a legitimate business.
    3. fraudulent Web sites that mimic a legitimate business's Web site.
    4. bogus wireless networks that look legitimate to users.

22. Pharming involves
    1. redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser.
    2. pretending to be a legitimate business's representative in order to garner information about a security system.
    3. setting up fake Web sites to ask users for confidential information.
    4. using e-mails for threats or harassment.

23. You have been hired as a security consultant for a legal firm. Which of the following constitutes the greatest threat, in terms of security, to the firm?
    1. wireless network
    2. employees
    3. authentication procedures
    4. lack of data encryption

24. Tricking employees to reveal their passwords by pretending to be a legitimate member of a company is called
    1. sniffing
    2. social engineering
    3. phishing
    4. pharming

25. How do software vendors correct flaws in their software after it has been distributed?
    1. issue bug fixes
    2. issue patches
    3. re-release software
    4. issue updated versions

26. The HIPAA Act of 1997
    1. requires financial institutions to ensure the security of customer data.
    2. specifies best practices in information systems security and control.
    3. imposes responsibility on companies and management to safeguard the accuracy of financial information.
    4. outlines medical security and privacy rules.

27. The Gramm-Leach-Bliley Act
    1. requires financial institutions to ensure the security of customer data.
    2. specifies best practices in information systems security and control.
    3. imposes responsibility on companies and management to safeguard the accuracy of financial information.
    4. outlines medical security and privacy rules.

28. The Sarbanes-Oxley Act
    1. requires financial institutions to ensure the security of customer data.
    2. specifies best practices in information systems security and control.
    3. imposes responsibility on companies and management to safeguard the accuracy of financial information.
    4. outlines medical security and privacy rules.

29. The most common type of electronic evidence is
    1. voice-mail.
    2. spreadsheets.
    3. instant messages.
    4. e-mail.

30. Electronic evidence on computer storage media that is not visible to the average user is called         data.
    1. defragmented
    2. ambient
    3. forensic
    4. recovery

31. Application controls
    1. can be classified as input controls, processing controls, and output controls.
    2. govern the design, security, and use of computer programs and the security of data files in general throughout the organization.
    3. apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.
    4. include software controls, computer operations controls, and implementation controls.

32.                        controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.
    1. Software
    2. Administrative
    3. Data security
    4. Implementation

33. Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)
    1. security policy.
    2. AUP.
    3. risk assessment.
    4. business impact analysis.

34. Statements ranking information risks and identifying security goals are included in a(n)
    1. security policy.
    2. AUP.
    3. risk assessment.
    4. business impact analysis.

35. An analysis of the firm's most critical systems and the impact a system's outage would have on the business is included in a(n)
    1. security policy.
    2. AUP.
    3. risk assessment.
    4. business impact analysis.

36. Rigorous password systems
    1. are one of the most effective security tools.
    2. may hinder employee productivity.
    3. are costly to implement.
    4. are often disregarded by employees.

37. An authentication token is a(n)
    1. device the size of a credit card that contains access permission data.
    2. type of smart card.
    3. gadget that displays passcodes.
    4. electronic marker attached to a digital authorization file.

38. Biometric authentication
    1. is inexpensive.
    2. is used widely in Europe for security applications.
    3. can use a person's face as a unique, measurable trait.
    4. only uses physical traits as a measurement.

39. A firewall allows the organization to
    1. enforce a security policy on traffic between its network and the Internet.
    2. check the accuracy of all transactions between its network and the Internet.
    3. create an enterprise system on the Internet.
    4. check the content of all incoming and outgoing e-mail messages.

40. In which technique are network communications are analyzed to see whether packets are part of an ongoing dialogue between a sender and a receiver?
    1. stateful inspection
    2. intrusion detection system
    3. application proxy filtering
    4. packet filtering

41.                        use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors.
    1. Stateful inspections
    2. Intrusion detection systems
    3. Application proxy filtering technologies
    4. Packet filtering technologies

42. Currently, the protocols used for secure information transfer over the Internet are
    1. TCP/IP and SSL.
    2. S-HTTP and CA.
    3. HTTP and TCP/IP.
    4. SSL, TLS, and S-HTTP.

43. Most antivirus software is effective against
    1. only those viruses active on the Internet and through e-mail.
    2. any virus.
    3. any virus except those in wireless communications applications.
    4. only those viruses already known when the software is written.

44. In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key?
    1. SSL
    2. symmetric key encryption
    3. public key encryption
    4. private key encryption

45. A digital certificate system
    1. uses third-party CAs to validate a user's identity.
    2. uses digital signatures to validate a user's identity.
    3. uses tokens to validate a user's identity.
    4. are used primarily by individuals for personal correspondence.

46. Downtime refers to periods of time in which a
    1. computer system is malfunctioning.
    2. computer system is not operational.
    3. corporation or organization is not operational.
    4. computer is not online.

47. Online transaction processing requires
    1. more processing time.
    2. a large server network.
    3. fault-tolerant computer systems.
    4. dedicated phone lines.

48. In controlling network traffic to minimize slow-downs, a technology called                                   is used to examine data files and sort low-priority data from high-priority data.
    1. high availability computing
    2. deep-packet inspection
    3. application proxy filtering
    4. stateful inspection