MIS Flashcards
Which of the following is an automated method of seeking passwords?
a) Phishing
b) Social Engineering
c) Software Bugs
d) Backdoors
e) Careless behavior
Phishing
Chapter 13 (page 353)
The process of social engineering can be “automated” using a technique called phishing.
The act of phishing is the act of collecting personal information, and a number of creative methods have been devised to direct traffic to the phony website and fool people into complying by crafting official-sounding messages from reputable institutions.
Why is spyware usually not considered a virus?
a) It does not have a payload
b) It does not do anything other than
watch what the user does
c) It does not self-replicate
d) It only show advertisements
e) None of the above. They are
always viruses
It does not self-replicate
Chapter 13 (page 357)
Spyware is software that, unbeknownst to the owner of the computer, monitors behavior, collects information, and either transfer this information to a third party via the Internet or performs unwanted operations.
While spyware differs from viruses, in that it cannot self-replicate, it can create significant problems for an organization. . Beyond the malicious and often fraudulent effects of spyware, these programs divert resources and often slow down the user’s legitimate work.
Why is a trojan horse not a virus?
a) It does not have a payload
b) It does not have a trigger event
c) It does not self-replicate
d) It is a legitimate form of security
protection
e) It does not do anything harmful
It does not self-replicate
Chapter 13 (page 356)
A computer program that claims to, and sometimes does, delivers some useful functionality. But the Trojan horse hides a dark side and, like a virus, delivers a malicious payload.
Which of the following refers to code built into a program to allow the programmer a way to bypass password protection?
a) Password Spoofing
b) Bugs
c) Viruses
d) Phishing
e) Backdoors
Backdoors
Chapter 13 (page 353)
Code built into software programs to allow access to an application by circumventing password protection
Function creep is the situation where data collected for a stated or implied purpose is later on reused for the same purpose. True or false?
False
Chapter 13 (page 371)
Function creep occurs when data collected for a stated or implied purpose are then reused for other, unrelated objectives.
Malicious cyberactivity is decreasing due to improvements in software protection systems. True or False?
False
Chapter 13
Creating security policies that spell out the behaviors that should be followed in order to minimize security risks and auditing the policies to ensure compliance will mitigate security risks. True or False>
True
Chapter 13
Audit the current resources, technological, and human, provides the basis for:
a) Risk Reduction
b) Risk Transference
c) Risk Assessment
d) Risk Increase
e) Reward Mechanism
Risk Assessment
Chapter 13 (page 349)
The risk assessment process consists of auditing the current resources, technological as well as human, in an effort to map the current state of the art of information systems security in the organization.
Why is security considered a negative deliverable?
a) It costs money
b) It is largely ignored
c) It does not affect profits whether it is done well or poorly
d) It produces no revenue or efficiency
e) It produces only tangible benefits
It produces no revenue or efficiency
Chapter 13
Which of the following is a viable method of dealing with internal security threats?
a) Antivirus software
b) Firewalls
c) Policies regarding what computing resources are accessible to whom
d) Policies that mandate frequent updates to program and such
e) Not immediately deleting terminated employees
Policies regarding what computing resources are accessible to whom
Chapter 13 (page 351)
Which of the following risk strategies is associated with increased potential for failure?
a) Avoidance
b) Acceptance
c) Analysis
d) Transference
e) Reduction
Acceptance
Chapter 13 (page 350)
Risk acceptance
This strategy consists of not investing in countermeasures and not reducing the security risk. The more an organization gravitates toward this strategy, the higher the potential failure cost it faces while minimizing anticipation costs.
Which of the following is an example of an internal threat?
a) Backdoors
b) Viruses
c) Social Engineering
d) External Intrusions
e) Employee’s careless behavior
Employee’s careless behavior
Chapter 13 (page 351)
Internal threats are those posed by individuals who have direct, on-premises access to the firm’s technology infrastructure or those who have legitimate reasons t be using the firm’s assets.
When addressing internal security threats, we can separate them into two categories:
Intentional Malicious Behavior and
Careless Behavior
Risk mitigation allows the organization to do what?
a) Devise optimal strategies given the security risk the organization faces
b) Prevent security issues from ever happening in the first place
c) Keep both costs and risks at minimum levels
d) Minimize failure costs
e) Reward IT workers when no issues arise
Devise optimal strategies given the security risk the organization faces
Chapter 13 (page 349)
Risk mitigation is the process of matching the appropriate response to the cybersecurity threats your firm has identified.
Function Creep, when used in terms of privacy risks, refers to new technological advances and devices that generate more data than ever. True or False?
False
Chapter 13 (page 371)
Function creep occurs when data collected for a stated or implied purpose are then reused for other, unrelated objectives.
Risk audit provides the basis for:
a) Risk Reduction
b) Risk Transference
c) Risk Analysis
d) Risk Increase
e) Reward Mechanism
Risk Analysis
Chapter 13 (page 349)
Risk analysis is the process by which the firm attempts to quantify the hazards identified in the audit.
When a company is faced with a security threat, they have which three strategies available to them?
a) Acceptance, avoidance, and transference
b) Acceptance, reduction, and transference
c) Avoidance, reduction, and transference
d) Acceptance, avoidance, and reduction
e) All of the above
Acceptance, reduction , and transference
Chapter 13 (page 350)
Increased anticipation costs are most directly associated with which risk strategy?
a) Acceptance
b) Avoidance
c) Analysis
d) Reduction
e) Transference
Reduction
Chapter 13 (page 350)
Risk Reduction
This strategy consists of actively investing in the safeguards designed to mitigate security threats. The more an organization gravitates toward this strategy, the higher the anticipation cost if faces while actively reducing failure costs.
Insurance costs are most directly associated with which risk strategy?
a) Acceptance
b) Avoidance
c) Analysis
d) Reduction
e) Transference
Transference
Chapter 13 (page 350)
Risk transference
This strategy consists of passing a portion (or all) of the risks associated with cybersecurity to a third party (e.g., by outsourcing security or buying insurance).
IT Risk Management is the process of identifying and measuring information systems security risks to devise the optimal mitigation strategy. True or False?
True
Chapter 13
Which of the following is not a form of malware?
a) Viruses
b) Spyware
c) Sniffers
d) Keyloggers
e) Worms
Sniffers
Chapter 13 (page 356)
Malicious code also known as malware refers to software programs that are designed to cause damage to individuals’ and/or organizations’ IT assets.
1-2
a)
b)
c)
d)
e)
1-2
1-3
1-3
1-4
1-4
1-5
1-5
1-6
1-6
1-7
1-7
1-8
1-8
1-9
1-9
1-10
1-10
1-11
1-11
1-12
1-12
1-13
1-13
