BTE 210 Chapter 4 Questions

_________ is any danger to which a system may be exposed.
A. Exposure
B. Information security
C. Threat
D. Security
Threat
_________ is the possibility that the system will be harmed by a threat.
A. Exposure
B. Threat
C. Security
D. Vulnerability
Vulnerability
Wireless is a(n) inherently _________ network.
A. trusted
B. neutral
C. untrusted
D. useful
Untrusted
*Which of the following is FALSE?
A. It is easier to be a hacker nowadays.
B. Mainframes make it easy to communicate freely and seamlessly with everyone.
C. Management doesn’t always support security efforts.
D. Thumb drives make it easy to steal huge amounts of sensitive information.
Mainframes make it easy to communicate freely and seamlessly with everyone.
Cybercriminals _________
A. are violent criminals.
B. can be easily arrested, once they are found.
C. don’t make that much money; they do it for fun.
D. target known software security weaknesses.
Target known software security weaknesses.
Which of the following is NOT one of the most dangerous employees to information security?
A. Accountants
B. HR employees
C. Janitors
D. MIS employees
Accountants
The airport’s self check-in computers are a(n) __________ threat.
A. outside
B. employee
C. hardware
D. software
Hardware
*Weak passwords are a(n) ___________ threat.
A. outside
B. employee
C. hardware
D. software
Employee
*Which of the following is NOT an unintentional threat to information systems?
A. Careless monitoring of environmental hazards
B. Choosing a weak password
C. Having an unlocked desk or filing cabinet after going home
D. Viruses
Viruses
_____________________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords.
A. Dumpster diving
B. Shoulder surfing
C. Social engineering
D. Tailgating
Social engineering
*Social engineering is a(n) ___________ threat on the part of the employee and a(n) _________ threat on the part of the social engineer.
A. deliberate; unintentional
B. deliberate; deliberate
C. unintentional; deliberate
D. unintentional; unintentional
Unintentional; deliberate
OpenSSL is __________ software.
A. Banking
B. Encryption
C. Hacking
D. Free
Encryption
The Heartbleed bug is an encryption security flaw in the ___________ software package that was an _____________ mistake by the software developer.
A. Microsoft; intended
B. Microsoft; unintended
C. OpenSSL; intended
D. OpenSSL; unintended
OpenSSL; unintended
Google created a code fix for the Heartbleed bug. Which of the following is a TRUE statement?
A. Home internet routers should be largely safe from this bug since they don’t exchange enough sensitive data to be a target.
B. Industrial control systems are highly vulnerable since they are updated infrequently.
C. Organizations simply have to install the fix.
D. Organizations need to install the fix and just create new private key-public key pairs.
Industrial control systems are highly vulnerable since they are updated infrequently.
___________ is threatening to steal or actually stealing information from a company and then demanding payment to not use or release that information.
A. Competitive intelligence
B. Espionage
C. Information extortion
D. Intellectual property
Information extortion
*Phishing is an example of __________.
A. Copyright infringement
B. Espionage
C. Sabotage
D. Software attack
Software attack
You start browsing your favorite home improvement company’s website and notice someone has changed all the logos to their main competitor’s logos. This is an example of ___________.
A. Espionage
B. Identity theft
C. Information extortion
D. Sabotage
Sabotage
__________ is an identity theft technique.
A. Dumpster diving
B. Espionage
C. Sabotage
D. Vandalism
Dumpster diving
Coca-Cola’s formula is an example of a ___________.
A. Copyright
B. Patent
C. Trade secret
D. All of the above
Trade secret
A ___________ is a remote attack requiring user action.
A. back door
B. denial-of-service attack
C. logic bomb
D. phishing attack
phishing attack
*A ___________ is a remote attack needing no user action.
A. back door
B. denial-of-service attack
C. logic bomb
D. phishing attack
denial-of-service attack
A ___________ is an attack by a programmer developing a system.
A. back door
B. denial-of-service attack
C. phishing attack
D. virus
back door
A ___________ is an attack by a programmer developing a system.
A. denial-of-service attack
B. logic bomb
C. phishing attack
D. worm
logic bomb
*Which of the following is NOT an example of alien software?
A. Adware
B. Blockware
C. Spamware
D. Spyware
Blockware
The goal of CAPTCHA is to ___________.
A. ensure you aren’t alien software
B. hack into secure networks
C. protect networks against hackers
D. remove alien software from your computer
ensure you aren’t alien software
*SCADA attacks typically occur on ___________.
A. Hacker networks
B. Industrial control systems
C. Personal computers
D. Government networks
Industrial control systems
Shodan’s primary purpose is ___________.
A. a hacker website
B. a service that searches the internet for devices connected to the internet
C. a website that shows which devices are vulnerable to hackers
D. to help users search for other people who use similar devices
a service that searches the internet for devices connected to the internet
Shodan is used for _________.
A. creating a backdoor
B. SCADA attacks
C. spreading viruses
D. phishing
SCADA attacks
The Shodan case illustrates ___________.
A. how vulnerable all devices are, even if they aren’t connected to the internet
B. strong passwords aren’t necessary on home devices since most hackers don’t care about such a small target
C. that hackers and security researchers use the same sites to identify vulnerabilities
D. the government is doing nothing to protect our privacy
that hackers and security researchers use the same sites to identify vulnerabilities
_______________ is a process whereby the organization takes concrete actions against risks, such as implementing controls and developing a disaster recovery plan.
A. Risk
B. Risk analysis
C. Risk management
D. Risk mitigation
Risk mitigation
You have a small business that has had problems with malware on your employees’ computers. You decide to hire a third-party company such as GFI Software to implement security controls and then monitor your company’s systems. You are adopting a risk ________ strategy.
A. acceptance
B. analysis
C. limitation
D. transference
transference
Risk _______________ means absorbing any damages that occur.
A. acceptance
B. analysis
C. limitation
D. transference
acceptance
If you hire a cybersecurity company like FireEye to identify security weaknesses in your information systems, you are using a risk _________ strategy.
A. acceptance
B. analysis
C. limitation
D. transference
limitation
You decide to use the password “1234” on your computer because you figure nobody cares enough about your information to steal it. This is a risk __________ strategy.
A. acceptance
B. analysis
C. limitation
D. transference
acceptance
According to the “Catching a Hacker” case, ____________ is one of the most sophisticated and destructive malicious software programs ever developed.
A. the Heartbleed bug
B. FireEye
C. Shodan
D. SpyEye
SpyEye
The purpose of SpyEye is to _____________.
A. catch hackers in the act of hacking
B. collect personal and financial information
C. facilitate SCADA attacks by seeing which systems are vulnerable
D. watch what you do on your computer
collect personal and financial information
*A firewall is a _______ control.
A. access
B. communication
C. physical
D. virtual
communication
Biometrics is something the user _______.
A. Does
B. Has
C. Is
D. Knows
Is
A smart ID card is something the user _______.
A. Does
B. Has
C. Is
D. Knows
Has
_________ is one common example of SSL.
A. http
B. https
C. www
D. wwws
https
If you have an empty building you can move into if your primary location is destroyed, you’ve implemented a _________ site.
A. Cold
B. Hot
C. Neutral
D. Warm
Cold
Auditing __________ the computer means inputs, outputs, and processing are checked.
A. Around
B. Into
C. Through
D. With
Through
___ percent of organizational breaches exploit weak or stolen user credentials.
A. 26
B. 51
C. 76
D. 99
76
Security must be balanced with _________ for people to use systems.
A. Convenience
B. Cost
C. Time
D. Trust
Convenience
The main problem with multifactor authentication is _____________.
A. it’s a single point of failure
B. it’s too hard to do
C. it will invade our privacy
D. there are no problems with multifactor authentication
it will invade our privacy
Wireless is an untrusted network.
True
Janitors are no threat to information security since they have no access to company systems.
False
A patent lasts for the life of the creator plus 70 years.
False
A copyright lasts 20 years.
False
Competitive intelligence is industrial espionage.
False
The goal of risk management is to reduce risk to acceptable levels.
True
Tracking down cybercriminals is the most difficult and only real challenge authorities face.
False
Biometrics is an authentication tool.
True
Blacklisting is when everything can run except what is on the list.
True
Whitelisting is when nothing can run unless it is on the list.
True
The emergence of the Internet has decreased the threats to information security.
False
If you have copied a software package (computer program) from a friend without paying for it, you are guilty of software piracy.
True
Backup and recovery procedures are recommended only to safeguard against hardware/software failures.
False
An information system’s ____ is the likelihood that the system or resource will be compromised by a ____ that will result in its ____ to further attacks.
a) vulnerability; threat; exposure
b) vulnerability; security; threat
c) threat; vulnerability; liability
d) threat; vulnerability; exposure
vulnerability; threat; exposure
Low level employees pose the greatest threat to information security.
False
Which of the following is not a social engineering technique?
a) Tailgating
b) Shoulder surfing
c) Careless internet surfing
d) All of the choices are social engineering techniques.
e) None of the choices are social engineering techniques
Careless internet surfing
You should regularly delete any spyware that might be residing on your computer, because it may be dangerous.
True
Which type of alien software uses your computer to send emails that look like they came from you to all the people in your address book?
a) adware
b) spyware
c) spamware
d) cookies
spamware
Which of the following would be an example of a SCADA attack?
a) Bank accounts are hacked into after Internet purchases
b) Social Security numbers are deleted from a company’s database.
c) Computer viruses are introduced into the electrical company’s systems resulting in a shutdown of the power plant.
d) Email accounts are hacked and kinky messages are sent to all of the user’s contacts
Computer viruses are introduced into the electrical company’s systems resulting in a shutdown of the power plant.
Whereas phishing attacks are ____, denial of service attacks are ____.
a) remote attacks requiring user action; remote attacks requiring no user action
b) remote attacks requiring no user action; attacks by a programmer developing a system
c) remote attacks requiring no user action; remote attacks requiring user action
d) distributed remote attacks requiring user action; attacks by a programmer developing a system
remote attacks requiring user action; remote attacks requiring no user action
Risk management identifies, controls, and minimizes the impact of threats to the organization’s information security.
True
Which if the following is not a common risk mitigation strategy?
a) Risk analysis.
b) Risk limitation.
c) Risk acceptance.
d) Risk transference.
Risk analysis.
Which of the following statements is true?
a) Multifactor authentication systems are more reliable and less expensive than single-factor.
b) Multifactor authentication systems are more reliable and more expensive than single-factor.
c) Multifactor authentication systems are less reliable and less expensive than single-factor
d) Multifactor and single-factor authentications have the same degree of reliability.
Multifactor authentication systems are more reliable and more expensive than single-factor.
____________ is an encryption standard used for secure transactions such as credit card processing and online banking.
a) VPN
b) TLS
c) DMZ
d) Whitelisting
TLS
_____ can be used to create strong passwords that are easy to remember.
a) Mnemonics
b) Passphrases
c) Birthdates
d) Numbers
Passphrases