section 4C Flashcards
A ____uniquely identifies the sender of an electronic message
A valid digital signature does not verify the identity of the private key’s owner. It only proves that the message was sent by the owner of the private key T/F
Employees are often identified by something they possess, such as an ID card. T/F
……Their disadvantage: They can be lost, stolen, or given away.
Since no single authentication method is foolproof, multi-factor authentication, such as requiring a smart card and a password, provides much stronger authentication than either method alone T/F
digital signature
true
True
True
True
Biometric devices would not able to adapt to slight personal changes, such as bloodshot eyes. T/F
They may allow access to unauthorized people. T/F
The biometric templates (the digital representation of an individual's fingerprints or voice) must be stored. Any compromise would not create an issue.
False -yes it can
True – malfunctions happen
False - Any compromise of those templates would cause serious problems for people.
Which of the following security controls would best prevent unauthorized access to sensitive data via an unattended data terminal directly connected to a mainframe?
Use of a screen saver with a password
Prevention of booting from a diskette by removing the diskette drive
Encryption of data files
Automatic log-off of inactive users
Automatic log-off of inactive users
Automatic log-off of inactive data terminals may prevent the viewing of sensitive data on an unattended data terminal.
Screen savers do not prevent the viewing of data on an unattended data terminal.
Data terminals do not have diskette drives.
Encryption of data files will not prevent the viewing of data on an unattended data terminal.
In traditional information systems, computer operators are generally responsible for backing up software and data files on a regular basis. In distributed or cooperative systems, ensuring that adequate backups are taken is the responsibility of PROGRAMMERS
RANDOM
___ means providing the ability for a firm to engage in continuous operation. A ____plan would incorporate more than a disaster recovery plan, which only deals with recovery (and continuity) of the computer processing capability of the organization.
False - it is user management
Business continuity
Backup files can be transported to the remote site in two ways
1. Physically (mail,etc)
2. Electronic Vaulting. Two ways to do this.
…..a. ___ approach - company slectronically sends items to be backed up
…..b ___ pull approach – electronic vault service installs its software on the company computers and automatically backs up the data
To protect data privacy, all data should be \_\_\_before being transmitted.
Push
Pull
encrypted
Batch processing files are backed up using the ___
When a master file is updated, a new master file is created.
A destroyed master file can be recreated using prior generations of the master file and the appropriate transaction file.
For example, if Wednesday’s master file is destroyed it could be recreated using Tuesday’s master file and Wednesday’s transaction file.
If Tuesday’s master file was also destroyed, it could be recreated using Monday’s master file and Tuesday’s transaction file.
grandfather-father-son concept.
Online databases are also backed up.
- a ___ is created when a copy of the database in the point in time is made.
- The checkpoint data is stored on a separate storage medium. T/F
- A database is re-created from the last check point t/f
check point
true
true
A critical aspect of a disaster recovery plan is to be able to regain operational capability as soon as possible. In order to accomplish this, an organization can have an arrangement with its computer hardware vendor to have a fully operational facility available that is configured to the user’s specific needs. This is best known as a cold site
false -a hot site
A hot site is a completely operational data processing facility configured to meet the user’s requirements that can be made available to a disaster-stricken organization on short notice.
A cold site is a location that provides everything necessary to quickly install computer equipment in the event of a disaster striking an organization.
A ____site is a location that provides everything necessary to quickly install computer equipment in the event of a disaster striking an organization.
A ___site is a completely operational data processing facility configured to meet the user’s requirements that can be made available to a disaster-stricken organization on short notice.
Cold
Hot
Which of the following statements does not describe how routers control the flow of information on the internet?
Data is divided into packets and transmitted to recreate the original message or data.
Every internet protocol packet contains two parts: a header and a body.
The router reads the destination address in the IP body to determine where it is to be sent.
A border router connects the information system to the internet.
The router reads the destination address in the IP body to determine where it is to be sent
A router reads the destination address in the header (not the body) to determine where the information is to be sent.
A company’s management is aware that it cannot foresee every contingency even with the best planning. Management believes, however, that a more thorough recovery plan increases the ability to resume operations quickly after an interruption and thus to:
maintain the same level of employment.
minimize the cost of facility repair.
fulfill its obligations to customers.
receive the maximum benefit from planning.
fulfill its obligations to customers.
The better the recovery plans, the more likely the company would be to resume operations quickly and fulfill its obligations to customers.
Thorough planning may or may not minimize the cost of facility repair, i.e., the best approach may be to undergo more expensive repair sooner in order to resume operations sooner.
Which of the following risks is more likely to be encountered in an end-user computing (EUC) environment as compared to a mainframe computer system?
Inability to afford adequate uninterruptible power supply systems
User input screens without a graphical user interface (GUI)
Applications that are difficult to integrate with other information systems
Lack of adequate utility programs
Applications that are difficult to integrate with other information systems
Applications that are difficult to integrate with other information systems are a risk that is considered unique to end-user computer (EUC) system development.
Which of the following describes the primary purpose of a disaster recovery plan?
To document how data will be backed up to expedite recovery
To document the location of off-site replacement facilities
To test how well prepared the company is to recover data
To specify the steps required to resume operations
To specify the steps required to resume operations
The primary purpose of a disaster recovery plan is to specify the steps required to efficiently and effectively restore/resume data processing operations when there is a disaster
PC hard drives can be backed up on CDs, diskettes, and tape files. T/F
The company should periodically practice restoring a system from the backup data so employees know how to quickly restart the system if a failure occurs. T/F
True
true
The performance audit report of an information technology department indicated that the department lacked a disaster recovery plan. Which of the following steps should management take first to correct this condition?
Bulletproof the information security architecture
Designate a hot site
Designate a cold site
Prepare a statement of responsibilities for tasks included in a disaster recovery plan
Prepare a statement of responsibilities for tasks included in a disaster recovery plan
Disaster Recovery Plans Include
Setting ___priorities
Providing the necessary ___
Providing for backup computer and telecommunications facilities T/F
Having procedures for periodic ___ and ___
Complete ___of the process
recovery insurances true testing and revision documentation
Greater reliance of management on information systems increases the exposure to:
unauthorized third-party access to systems.
systematic programming errors.
inadequate knowledge bases.
business interruption.
Biz interruption
Greater reliance of management on information systems increases the exposure to business interruption. As management relies more on information systems for crucial functions, system failures have the potential to interrupt business.
A company has a significant e-commerce presence and self-hosts its website. To assure continuity in the event of a natural disaster, the firm should adopt which of the following strategies?
Back up the server database daily
Store records off-site
Purchase and implement RAID technology
Establish an off-site mirrored web server
Establish an off-site mirrored web server
A natural disaster could destroy the onsite web server as well as any backup server at the same location. A disaster could also destroy communications channels to that site. A second identical server (a mirror) with separate communications channels located remotely would facilitate continuity in a disaster.
A new accounts receivable clerk, working for a wholesaler, noticed that a customer had apparently changed addresses. The clerk had accessed the customer’s computer file and revised all addresses. One week later the customer complained that goods were being sent to the wrong address. The primary control to prevent this occurrence is TRAINING ON DATA ENTRY
False - It is database security
The primary control to prevent someone from accessing the customer’s computer file and revising all addresses is database security. Proper security would prevent changes by an accounts receivable clerk.
All of the following are classifications of controls used to make systems more secure except:
nonphysical access controls.
segregation of system duties.
logical access controls.
internet and telecommunications controls.
nonphysical access controls.
Nonphysical access controls are not one of the five classifications of controls used to make systems more secure.
The five classifications of controls used to make systems more secure are:
segregation of duties
, physical access controls,
logical access controls,
personal computers and client/server network protection,
internet and telecommunications controls.
During the process of electronically transmitting data, which of the following IT controls would provide the most assurance that unauthorized disclosure of sensitive information would be prevented?
Encryption
Restricted access
A strongly worded confidentiality warning
Separate transmission of the data file and its password
encryption
Encryption provides the most assurance that unauthorized disclosure of sensitive information is prevented. Encryption is transforming data, called plaintext, into unreadable gibberish, called ciphertext. Decryption reverses this process, transforming ciphertext back into plaintext.
A digital signature is used primarily to determine that a message is:
unaltered in transmission.
not intercepted en route.
received by the intended recipient.
sent to the correct address.
unaltered
A digital signature allows the creator of a message to digitally “sign” the data and provides proof of authorization. Because a digital signature cannot be altered, it allows the recipient to determine that a message has been unaltered in transmission.
SOC 2: Report on Controls at a Service Organization Relevant to: CAPS ….CAPS SOC (Suck)
Confidentiality
Availability
Processing Integrity
Security
SOC REPORTS
In a ____ report, the service auditor provides an opinion as to whether the service organization’s description “fairly presents” the system that was designed and implemented, and whether the controls were suitably designed to meet the criteria as of a specified date.
In a ____report, the service auditor provides an opinion on whether the service organization’s description “fairly presents” the system that was designed and implemented; the controls were suitably designed to meet the criteria; the controls operated effectively during the specified period of time; and the service organization is in compliance with the commitments in its statement of privacy practices, if the report covers the privacy principle.
Type 1 report
Type 2
Which of the following is an objective of logical security controls for information systems?
To ensure complete and accurate recording of data
To ensure complete and accurate processing of data
To restrict access to specific data and resources
To provide an audit trail of the results of processing
To restrict access to specific data and resources
Logical security controls for information systems are used to restrict access to specific data and resources.
Input controls ensure complete and accurate recording of data.
Processing controls ensure complete and accurate processing of data.
Output controls provide an audit trail of results of processing.
LOGICAL CONTROLS
Several levels of logical access are needed:
____which ensures that unauthorized users and devices are not allowed to access any part of the system
___, which makes sure the system can recognize authorized users, but restrict their access to:
a. ) Data they’re Not allowed to use
b. ) the functions they’re authorized to perform.
Authentication,
Authorization
Unauthorized alteration of online records can be prevented by employing:
key verification.
computer sequence checks.
computer matching.
database access controls.
Database access controls
Users can gain access to databases from terminals only through established recognition and authorization procedures; thus, unauthorized access is prevented.
In spite of management’s insistence on following procedures, there have been occasions, usually associated with emergencies, in which a program in the test library was used for the company’s operations. A risk of using test library programs in emergency situations is that:
the personnel preparing the programs may not be authorized to write or modify them.
the programs may not be further tested before being placed into production permanently.
the integrity of the production library is threatened under such circumstances.
operational personnel may not be fully satisfied with the output of the programs.
the programs may not be further tested before being placed into production permanently.
A risk associated with such programs is that the programs may not be tested further before being placed into production permanently. The temptation is to place the test library program into production if it appeared to run satisfactorily.
A controller is developing a disaster recovery plan for a corporation’s computer systems. In the event of a disaster that makes the company’s facilities unusable, the controller has arranged for the use of an alternate location and the delivery of duplicate computer hardware to this alternate location. Which of the following recovery plans would best describe this arrangement?
Cold Site
A checkpoint/restart procedure is primarily designed to recover from:
programming errors.
data input errors.
computer operator errors.
hardware failures.
hardware failures.
The term “____” refers to the periodic copying of the results of a program prior to its actual completion. The copy is written to secondary storage for use in restarting a program, should there be an interruption in the operation of the hardware devices. Restart is initiated from the most current (recent) checkpoint, rather than at the beginning of the program.
checkpoint-restart procedure
Which of the following statements presents an example of a general control for a computerized system?
Limiting entry of sales transactions to only valid credit customers
Creating hash totals from Social Security numbers for the weekly payroll
Restricting entry of accounts payable transactions to only authorized users
Restricting access to the computer center by use of biometric devices
Restricting access to the computer center by use of biometric devices
____ controls apply to all applications processed by the computerized system.
General controls
Many organizations are critically dependent on information systems to support daily business operations. Consequently, an organization may incur significant loss of revenues or incur significant expenses if a disaster such as a hurricane or power outage causes information systems processing to be delayed or interrupted. A bank, for example, may incur significant penalties as a result of missed payments.
Which of the following management activities is essential to ensure continuity of operations in the event a disaster or catastrophe impairs information systems processing?
Review of insurance coverage
Electronic vaulting
Change control procedures
Contingency planning
Contingency planning
Contingency planning is a management activity which is essential to ensure continuity of operations in the event a disaster impairs information systems processing.
____is a management activity which is essential to ensure continuity of operations in the event a disaster impairs information systems processing.
Contingency planning
Which of the following risks can be minimized by requiring all employees accessing the information system to use passwords?
Collusion
Data entry errors
Failure of server duplicating function
Firewall vulnerability
Firewall vulnerability
Passwords are used to prevent unauthorized access to an information system. If passwords are required, it minimizes the chance of an intruder accessing sensitive data since the firewall will prevent such acces
A ____prevents outsiders and employees from gaining unauthorized access to a system.
….It only consists of software T/f
Firewalls also unifies internal networks to protect sensitive data from unauthorized internal use. T/F
Firewalls often use ___hardware, software, and other information technology to reduce outages and failures.
Firewalls act as filters and only permit packets that meet specific conditions to pass. t/F
firewall
False -both software & hardware
False - it separates internal networks
redundant
True
Firewalls can be penetrated or bypassed, so:
all communication network links should be periodically monitored to determine whether a firewall was bypassed by wireless communications links
\_\_ and \_\_\_ systems should be used to detect any penetrations.
false -continuously
intrusion detection and prevention
Which of the following classifications of security controls includes smoke detectors, generators, security guards, and ID badges?
Technical
Physical
Administrative
Logical
Physical
A routine part of an organization’s disaster recovery plan should require the ongoing preparation of backup files … t/f
true
Company A has numerous personal computers (PCs) with full processing capabilities linked into an integrated local area network with a file server which in turn is fully connected to the central mainframe computer. Data entry, comprehensive processing, and inquiry routines are possible at all nodes in the network.
A control feature designed to negate the use of utility programs to read files which contain all authorized access user codes for the network are LOG-ON PASSWORDS
FALSE - internally encrypted passwords
Internally encrypted passwords are a form of access control designed to prevent unauthorized access by use of a utility program to identify passwords.
Encryption protection is least likely to be used in which of the following situations?
When transactions are transmitted over local area networks
When wire transfers are made between banks
When confidential data are sent by satellite transmission
When financial data are sent over dedicated, leased lines
When transactions are transmitted over local area networks
Encryption protection is least likely to be used when transactions are transmitted over local area networks. Such protection makes it difficult for intercepted transmissions to be understood or modified.
Encoding is important when confidential data are transmitted between geographically separated locations that can be electronically monitored.
Encryption is often used when wire transfers are made between banks, confidential data are sent by satellite transmission, and financial data are sent over dedicated leased lines.
A company’s web server has been overwhelmed with a sudden surge of false requests that caused the server to crash. The company has most likely been the target of:
Denial of Service Attack
Which of the following would normally be the functions of security software?
Authenticates user identification and controls access to information resources
Logs the activity of the computer system including the time each program is started and when each file is accessed
Displays the data typed into a terminal keyboard
Records and monitors changes to program source code and object code files
Authenticates user identification and controls access to information resources
Authentication and subsequent access to computer resources are the primary functions of security software.
Authentication and subsequent access to computer resources are the primary functions of ___
security software.
An entity doing business on the Internet most likely could use any of the following methods to prevent unauthorized intruders from accessing proprietary information except:
password management.
data encryption.
digital certificates.
batch processing.
Batch Processing
In batch processing, items to be processed are collected in groups to permit fast and convenient processing (processed as a group). atch processing does not prevent unauthorized intruders from accessing information on the Internet.
The other answer choices are incorrect because passwords, encryption, and digital certificates are all methods commonly used to restrict unauthorized access to data.
What is a major disadvantage to using a private key to encrypt data?
Both sender and receiver must have the private key before this encryption method will work.
The private key cannot be broken into fragments and distributed to the receiver.
The private key is used by the sender for encryption but not by the receiver for decryption.
The private key is used by the receiver for decryption but not by the sender for encryption.
Both sender and receiver must have the private key before this encryption method will work.
A major disadvantage of private key encryption is that both the sender and receiver must have the same (private) key, and this must be securely transmitted to avoid interception and decryption of the message by others.
A SOC 1 reports on the:
controls at a service organization relevant to policies and procedures, communications, and monitoring.
controls at a service organization relevant to user entities’ internal control over financial reporting (ICFR).
controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.
controls at a service organization relevant to access controls, system operations, change management, and risk mitigation.
controls at a service organization relevant to user entities’ internal control over financial reporting (ICFR).
A Service Organization Control (SOC) 1 report is on the controls at a service organization relevant to user entities’ internal control over financial reporting (ICFR). SOC 1 reports are based on Statement on Standards for Attestation Engagements (SSAE) 16
SOC 2 and SOC 3 reports are on the controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.
In general, mainframe computer production programs and data are adequately protected against unauthorized access. Certain utility software may, however, have privileged access to software and data. To compensate for the risk of unauthorized use of privileged software, Information Systems (IS) management can RESTRICT THE PRIVILEGED ACCESS.
False - it can only limit the access
