Using MIS Kroenke Ch 12

Using MIS, 3e (Kroenke)

Chapter 12 Information Security Management

12.1 True/False Questions

1) An example of a human mistake is an employee entering the wrong data into an account. Answer: TRUE

Diff: 1Page Ref: 444

AACSB: Analytic skills

Study Question: Study Question 1

2) An example of malicious human activity could include an employee who, in the course of backing up a database, inadvertently installs an old database on top of the current one. Answer: FALSE

Diff: 1Page Ref: 444

AACSB: Analytic skills

Study Question: Study Question 1

3) Unauthorized data disclosures can occur from malicious human activity.

Answer: TRUE

Diff: 2Page Ref: 444

AACSB: Analytic skills

Study Question: Study Question 1

4) Phishing is when someone sends an email pretending to be a legitimate company and asking for confidential data, such as account numbers.

Answer: TRUE

Diff: 1Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

5) Pretexting occurs when you receive a confidential SMS by mistake.

Answer: FALSE

Diff: 1Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

6) Spoofing is a technique for intercepting computer communications.

Answer: FALSE

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

7) Email spoofing is a synonym for phishing.

Answer: TRUE

Diff: 1Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

8) Drive-by spoofers take computers with wireless connections through an area and search for unprotected wireless networks.

Answer: FALSE

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

9) Drive-by sniffers can be prevented from accessing wireless networks by protecting them. Answer: FALSE

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

10) People who intentionally gain unauthorized access to computer systems are called hackers. Answer: TRUE

Diff: 1Page Ref: 446

AACSB: Analytic skills

Study Question: Study Question 1

11) Faulty service can be caused by usurpation.

Answer: TRUE

Diff: 1Page Ref: 446

AACSB: Analytic skills

Study Question: Study Question 1

12) Denial of service always occurs because of malicious attacks on the system.

Answer: FALSE

Diff: 2Page Ref: 446

AACSB: Analytic skills

Study Question: Study Question 1

13) When a hacker floods a Web server with millions of bogus service requests so that it cannot service legitimate requests, this is called a denial-of-service attack.

Answer: TRUE

Diff: 2Page Ref: 446

AACSB: Analytic skills

Study Question: Study Question 1

14) Any action, device, procedure, technique, or other measure that reduces a system's vulnerability to a threat is a safeguard.

Answer: TRUE

Diff: 1Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

15) The IT department should set the security policy for an organization.

Answer: FALSE

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

16) Everyone in the department must adequately safeguard company assets. This statement is in accordance with the elements of company security outlined in the NIST Handbook. Answer: FALSE

Diff: 2Page Ref: 448

AACSB: Reflective thinking

Study Question: Study Question 2

17) According to the elements of company security outlined in the NIST Handbook, computer security should not be constrained by societal factors.

Answer: FALSE

Diff: 2Page Ref: 448-449

AACSB: Analytic skills

Study Question: Study Question 2

18) Uncertainty is the likelihood of an adverse occurrence.

Answer: FALSE

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

19) Risk management can only be approximated because of uncertainty.

Answer: TRUE

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

20) The Privacy Act of 1974 gives individuals the right to access health data.

Answer: FALSE

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

21) HIPAA sets limits on who can receive your health information.

Answer: TRUE

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

22) The Gramm-Leach-Bliley Act set limits on how health care providers use your medical information.

Answer: FALSE

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

23) Vulnerabilities in a security system are its weaknesses.

Answer: TRUE

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

24) Tangible consequences include such things as loss of customer goodwill due to an outage. Answer: TRUE

Diff: 2Page Ref: 452

AACSB: Reflective thinking

Study Question: Study Question 2

25) Probable loss is the probability that a given asset will be compromised by a given threat, despite the safeguards.

Answer: FALSE

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

26) The "bottom line" of risk assessment is termed probable loss.

Answer: TRUE

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

27) Technical safeguards involve the hardware and software components of an information system.

Answer: TRUE

Diff: 2Page Ref: 453

AACSB: Analytic skills

Study Question: Study Question 3

28) Smart cards are convenient and easy to use since they don't require any PIN numbers for authentication.

Answer: FALSE

Diff: 3Page Ref: 453

AACSB: Analytic skills

Study Question: Study Question 3

29) A retina scan would be considered a biometric authentication technique.

Answer: TRUE

Diff: 2Page Ref: 453

AACSB: Analytic skills

Study Question: Study Question 3

30) Windows, Linux, Unix, and other operating systems employ Kerberos and thus can authenticate user requests across networks of computers using a mixture of these operating systems.

Answer: TRUE

Diff: 2Page Ref: 454

AACSB: Analytic skills

Study Question: Study Question 3

31) WEP is considered to be state-of-the-art wireless security.

Answer: FALSE

Diff: 2Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

32) Wireless networks are more secure than wired networks.

Answer: FALSE

Diff: 2Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

33) Encryption is an example of a technical safeguard.

Answer: TRUE

Diff: 1Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

34) With symmetric encryption, both parties use the same key.

Answer: TRUE

Diff: 2Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

35) Secure Socket Layer (SSL) is a protocol that is restricted to asymmetric encryption. Answer: FALSE

Diff: 3Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

36) One should never send sensitive data over the Internet unless they see "https://" in the browser's address bar.

Answer: TRUE

Diff: 3Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

37) Digital signatures use public keys to encrypt the message digest.

Answer: FALSE

Diff: 3Page Ref: 457

AACSB: Analytic skills

Study Question: Study Question 3

38) Public keys are supplied by third parties called certificate authorities.

Answer: TRUE

Diff: 2Page Ref: 457

AACSB: Ethical reasoning

Study Question: Study Question 3

39) A CA verifies the legitimacy of the business sending the digital certificate. Answer: FALSE

Diff: 3Page Ref: 458

AACSB: Analytic skills

Study Question: Study Question 3

40) Viruses and worms are examples of malware.

Answer: TRUE

Diff: 2Page Ref: 458

AACSB: Analytic skills

Study Question: Study Question 3

41) A Trojan horse is a virus that masquerades as a useful program or file.

Answer: TRUE

Diff: 2Page Ref: 459

AACSB: Analytic skills

Study Question: Study Question 3

42) Most spyware is benign in that it does not perform malicious acts or steal data. Answer: FALSE

Diff: 2Page Ref: 459

AACSB: Analytic skills

Study Question: Study Question 3

43) A worm propagates by attaching itself to normal programs.

Answer: FALSE

Diff: 2Page Ref: 459

AACSB: Analytic skills

Study Question: Study Question 3

44) Adware can change the user's default window or modify search results and switch the user's search engine.

Answer: TRUE

Diff: 2Page Ref: 459

AACSB: Analytic skills

Study Question: Study Question 3

45) Most antimalware programs check email attachments for malware code.

Answer: TRUE

Diff: 2Page Ref: 460

AACSB: Analytic skills

Study Question: Study Question 3

46) A bot is a computer program that is surreptitiously installed and that takes actions unknown and uncontrolled by the computer's owner or administrator.

Answer: TRUE

Diff: 2Page Ref: 460

AACSB: Analytic skills

Study Question: Study Question 3

47) A botnet is a network of bots that is created and managed by the individual or organization that infected the network with the bot program.

Answer: TRUE

Diff: 2Page Ref: 460

AACSB: Analytic skills

Study Question: Study Question 3

48) Data safeguards are measures used to protect computer hardware from external threat. Answer: FALSE

Diff: 1Page Ref: 461

AACSB: Analytic skills

Study Question: Study Question 4

49) Key escrow refers to the safety procedure of using a private key for encryption. Answer: FALSE

Diff: 2Page Ref: 461

AACSB: Analytic skills

Study Question: Study Question 4

50) To protect against lost or sabotaged encryption keys, a trusted party should keep a copy of the key.

Answer: TRUE

Diff: 2Page Ref: 461

AACSB: Analytic skills

Study Question: Study Question 4

51) Even if a potential new hire will not have access to sensitive data and systems, they should be extensively screened for security purposes.

Answer: FALSE

Diff: 2Page Ref: 463

AACSB: Reflective thinking

Study Question: Study Question 5

52) Care must be taken when terminating employees because they may take harmful and malicious actions.

Answer: TRUE

Diff: 1Page Ref: 464

AACSB: Analytic skills

Study Question: Study Question 5

53) Hardened sites use special versions of the operating system, and they lock down or eliminate operating systems features and functions that are not required by the application.

Answer: TRUE

Diff: 2Page Ref: 464

AACSB: Analytic skills

Study Question: Study Question 5

54) When an account is created, the new user should continue to use the safe password provided to him.

Answer: FALSE

Diff: 1Page Ref: 465

AACSB: Analytic skills

Study Question: Study Question 5

55) The different systems procedure types are: normal operations, review, control, and recovery. Answer: FALSE

Diff: 2Page Ref: 466

AACSB: Analytic skills

Study Question: Study Question 5

56) Firewalls produce activity logs of their activities, including lists of all dropped packets, infiltration attempts, and unauthorized access attempts from within the firewall.

Answer: TRUE

Diff: 2Page Ref: 467

AACSB: Analytic skills

Study Question: Study Question 5

57) The best safeguard against a natural disaster is to have a safe location.

Answer: TRUE

Diff: 2Page Ref: 468

AACSB: Analytic skills

Study Question: Study Question 6

58) Following a disaster, hot sites provide office space, but customers themselves must come and provide and install the equipment needed to continue operations.

Answer: FALSE

Diff: 3Page Ref: 468

AACSB: Analytic skills

Study Question: Study Question 6

59) It makes business sense for every company to have backup facilities because they are inexpensive.

Answer: FALSE

Diff: 2Page Ref: 468

AACSB: Analytic skills

Study Question: Study Question 6

60) Organizations need a rehearsed incident-response plan in place.

Answer: TRUE

Diff: 2Page Ref: 468

AACSB: Use of IT

Study Question: Study Question 6

61) A survey conducted by the Computer Security Institute revealed that the number of virus attacks has steadily increased during the last ten years.

Answer: FALSE

Diff: 2Page Ref: 470

AACSB: Analytic skills

Study Question: Study Question 7

12.2 Multiple Choice Questions

1) Which of the following is not considered malicious human activity?

A) hacking

B) intentional destruction of data

C) terrorism

D) poorly written programs

Answer: D

Diff: 1Page Ref: 444

AACSB: Analytic skills

Study Question: Study Question 1

2) The ________ pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

A) hawker

B) phisher

C) spoofer

D) sniffer

Answer: B

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

3) ________ is a technique for intercepting computer communications.

A) Spoofing

B) Phishing

C) Sniffing

D) Pretexting

Answer: C

Diff: 3Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

4) ________ is when someone deceives by pretending to be someone else.

A) Hacking

B) Baiting

C) Sniffing

D) Pretexting

Answer: D

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

5) Email spoofing is a synonym for ________.

A) spoofing

B) phishing

C) pretexting

D) sniffing

Answer: B

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

6) ________ take computers with wireless connections through an area and search for unprotected wireless networks and then monitor and intercept wireless traffic at will.

A) Drive-by sniffers

B) Drive-by spoofers

C) Pretexters

D) Drive-by phishers

Answer: A

Diff: 1Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

7) Which of the following is an example of a sniffing technique?

A) IP spoofing

B) Adblocker

C) Cache

D) Adware

Answer: D

Diff: 2Page Ref: 445

AACSB: Analytic skills

Study Question: Study Question 1

8) ________ occurs when a person gains unauthorized access to a computer system.

A) Pretexting

B) Phishing

C) Hacking

D) Spoofing

Answer: C

Diff: 1Page Ref: 446

AACSB: Analytic skills

Study Question: Study Question 1

9) Which of the following could most likely be the result of hacking?

A) unexplained reduction in account balance

B) certain Web sites being blocked from viewing due to security reasons

C) mysterious increase in the amount spam received in your inbox

D) pop-up ads appearing frequently

Answer: A

Diff: 1Page Ref: 446

AACSB: Reflective thinking

Study Question: Study Question 1

10) Which of the following usually happens in a malicious denial-of-service attack?

A) A hacker monitors and intercepts wireless traffic at will.

B) A hacker floods a Web server with millions of bogus service requests.

C) A hacker uses unauthorized programs to invade a computer system and replace legitimate programs.

D) A phisher pretends to be a legitimate company and sends an email requesting confidential data.

Answer: B

Diff: 3Page Ref: 446-447

AACSB: Reflective thinking

Study Question: Study Question 1

11) Which of the following presents the largest risk for infrastructure loss?

A) thefts

B) terror attacks

C) natural disasters

D) human mistakes

Answer: C

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

12) Which of the following is a critical security function of senior-management involvement?

A) safeguarding computer hardware and software

B) planning response to security incidents

C) establishing the security policy

D) managing the security program on a real-time basis

Answer: C

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

13) Which of the following is a critical security function of senior-management involvement?

A) implementing disaster-recovery safeguards

B) protecting the organizational network from sneak attacks

C) training junior employees about the security policy

D) managing risk by balancing the costs and benefits of the security program

Answer: D

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 2

14) Which of the following is an example of a technical safeguard?

A) backup and recovery

B) encryption

C) procedure design

D) compliance

Answer: B

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

15) Which of the following is an example of a human safeguard?

A) procedure design

B) firewalls

C) malware protection

D) application design

Answer: A

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

16) Which of the following is an example of a data safeguard?

A) administration

B) assessment

C) compliance

D) physical security

Answer: D

Diff: 2Page Ref: 447

AACSB: Analytic skills

Study Question: Study Question 1

17) Customers do not want to have their retinas scanned before they can place an order. Which element of computer security described in the NIST Handbook is discussed here?

A) System owners have computer security responsibilities outside their own organizations.

B) Computer security is an integral element of sound management.

C) Computer security should be periodically reassessed.

D) Computer security is constrained by societal factors.

Answer: D

Diff: 2Page Ref: 449

AACSB: Reflective thinking

Study Question: Study Question 2

18) A security policy covering personal use of computers at work would be an example of a

________.

A) data policy

B) issue-specific policy

C) system-specific policy

D) personnel policy

Answer: B

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

19) An example of a system-specific security policy would be ________.

A) limiting personal use of its computer systems

B) deciding what customer data from the order-entry system will be shared with other organizations

C) a general statement of the organization's security program

D) inspection of personal email for compliance

Answer: B

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

20) Which element of the security policy specifies how the organization will ensure enforcement of security programs and policies?

A) general statement of the security program

B) issue-specific policy

C) network policy

D) system-specific policy

Answer: A

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

21) ________ refers to things we do not know that we do not know.

A) Risk

B) Uncertainty

C) Assessment

D) Vulnerability

Answer: B

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

22) ________ refers to threats and consequences that we know about.

A) Risk

B) Uncertainty

C) Hedge

D) Indemnity

Answer: A

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

23) ________ is the likelihood of an adverse occurrence.

A) Uncertainty

B) Assessment

C) Vulnerability

D) Risk

Answer: D

Diff: 2Page Ref: 449

AACSB: Analytic skills

Study Question: Study Question 2

24) Which of the following is covered by the Gramm-Leach-Bliley Act of 1999?

A) financial information stored by the SEC

B) records maintained by the U.S. government

C) consumer financial data stored by financial institutions

D) health data created by doctors and other health-care providers

Answer: C

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

25) Which of the following was passed to give individuals the right to access their own health data created by doctors and other health-care providers?

A) Privacy Act of 1974

B) Sarbanes-Oxley Bill

C) HIPAA

D) Gramm-Leach-Bliley Act

Answer: C

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

26) The Privacy Act of 1974 provides protection for individuals against ________.

A) records held by private companies

B) records held by the U.S. government

C) records held by banks and other financial institutions

D) records held by medical organizations

Answer: B

Diff: 2Page Ref: 450

AACSB: Analytic skills

Study Question: Study Question 2

27) ________ is defined as any action device, procedure, technique, or other measure that reduces a system's vulnerability to a threat.

A) Antivirus software

B) Firewall

C) Safeguard

D) Biometric protection

Answer: C

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

28) Which of the following is the first step in risk management?

A) create perfect hedges to mitigate the risks

B) reduce the likelihood of a threat

C) evaluate the results of the risk management process

D) assess what the threats are

Answer: D

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

29) No safeguard is ironclad; there is always a ________ that the safeguard will not protect the assets in all circumstances.

A) residual risk

B) diversifiable risk

C) portfolio risk

D) process risk

Answer: A

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

30) Which factor of risk assessment refers to the probability that a given asset will be compromised by a given threat, despite the safeguards?

A) likelihood

B) uncertainty

C) consequence

D) vulnerability

Answer: A

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

31) Which of the following is an example of of an intangible consequence?

A) dip in sales because the supplies were not replenished

B) loss of customer goodwill due to an outage

C) reduced production because of plant maintenance

D) financial loss reported due to high input costs

Answer: B

Diff: 2Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

32) A weakness in a security system is known as a system ________.

A) uncertainty

B) residue

C) vulnerability

D) condition

Answer: C

Diff: 1Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

33) ________ is the "bottom line" of risk assessment.

A) Residual risk

B) Probable loss

C) Vulnerability

D) Likelihood

Answer: B

Diff: 1Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

34) To obtain a measure of probable loss, companies ________.

A) multiply likelihood by the probability of the occurrence

B) multiply the vulnerability by the probability of the occurrence

C) multiply likelihood by the cost of the consequences

D) multiply residual risk by the likelihood of the occurrence

Answer: C

Diff: 3Page Ref: 452

AACSB: Analytic skills

Study Question: Study Question 2

35) A(n) ________ card has a microchip on it that holds the data.

A) ATM

B) smart

C) credit

D) debit

Answer: B

Diff: 2Page Ref: 453

AACSB: Analytic skills

Study Question: Study Question 3

36) Which of the following is used for biometric authentication?

A) smart cards

B) facial features

C) passwords

D) chromosome data

Answer: B

Diff: 1Page Ref: 453

AACSB: Analytic skills

Study Question: Study Question 2

37) Users often resist biometric identification because they feel it is ________.

A) expensive

B) hard to use

C) too technical

D) invasive

Answer: D

Diff: 2Page Ref: 454

AACSB: Analytic skills

Study Question: Study Question 3

38) A system called ________ authenticates users without sending their passwords across the computer network.

A) Kerberos

B) WPA

C) Chimera

D) DUN

Answer: A

Diff: 2Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

39) The IEEE 802.11 Committee, the group that develops and maintains wireless standards, first developed a wireless security standard called ________.

A) Wireless Fidelity

B) Wi-Fi Protected Access

C) Wired Equivalent Privacy

D) Wireless Security Instruction Set

Answer: C

Diff: 2Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

40) Which of the following is used to eliminate spoofing?

A) HTML

B) SSL/TSL

C) SSL

D) Digital certificates

Answer: D

Diff: 2Page Ref: 455

AACSB: Analytic skills

Study Question: Study Question 3

41) ________ encryption uses the same key for both parties.

A) Symmetric

B) Asymmetric

C) SSL

D) TLS

Answer: A

Diff: 3Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

42) Which of the following observations concerning Secure Socket Layer (SSL) is true?

A) It uses only asymmetric encryption.

B) Most Internet applications, including HTTP, FTP, and email programs, can use it.

C) It works between Levels 2 and 3 of the TCP-OSI architecture.

D) It was originally developed by Microsoft.

Answer: B

Diff: 3Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

43) ________ is a later version of SSL, with more problems fixed.

A) Transport Layer Security

B) Advanced Socket Layer

C) Digital signatures

D) Asymmetric Socket Layer

Answer: A

Diff: 2Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3

44) You are doing an online fund transfer through the Web site of a reputed bank. Which of the following displayed in your browser's address bar will let you know that the bank is using the SSL protocol?

A) http://

B) www3

C) https://

D) .com

Answer: C

Diff: 2Page Ref: 456

AACSB: Reflective thinking

Study Question: Study Question 3

45) ________ is a method of mathematically manipulating the message to create a string of bits that characterize the message.

A) Spoofing

B) Hashing

C) TLS

D) Pinging

Answer: B

Diff: 2Page Ref: 456

AACSB: Analytic skills

Study Question: Study Question 3