Test 2 Flashcards
Able was chatting online with Baker. "I can't believe how lame some people are! :) I can get into any system by checking out the company website to see how user names are defined and who is on the employee directory. Then, all it takes is brute force to find the password." Able is a \_\_\_\_\_, and the fraud he is describing is \_\_\_\_\_. A. hacker; social engineering B. phreaker; dumpster diving C. hacker; password cracking D. phreaker; the salami technique
C. hacker; password cracking
Computers that are part of a botnet are controlled by a bot herder are referred to as A. posers B. zombies C. botsquats D. evil twins
B. zombies
Josie Jerkwater, a first time computer user, purchased a brand new PC two months ago and it was now operating much more slowly an sluggishly. Since purchasing the computer, she had been accessing the Internet and had installed a variety of free software. The problem is most likely to be A. a zero-day attack B. a virus C. a spoof D. bluesnarfing
B. a virus
Which of the following would b least effective to reduce exposure to a computer virus?
A. Only transfer files between employees with USB flash drives
B. Install and frequently update antivirus software
C. Install all new software on a stand-alone computer for until it is tested.
D. Do not open email attachments from unknown senders
A. Only transfer files between employees with USB flash drives
Developers of computer systems often include a sure name and password that is hidden in the system, just in case they need to get into the system and correct problems in the future. This is referred to as a A. Trojan horse B. key logger C. spoof D. back door
D. back door
Narang direct sales is a telemarketing firm that operates out of India. The turnover rate among employees is quite high. Recently, the information technology manager discovered that an unknown employee had used Bluetooth-enabled mobile phone to their credit card information. Narang Direct Sales was a victim of A. Bluesnarffing B. splogging C. vishing D. typosquatting
A. Bluesnarffing
A control procedure designed so that the employee that records cash received from customers does not have access to the cash itself is an example of a A. preventive control B. detective control C. corrective control D. authorization control
A. preventive control
Duplicate checking of calculations is an example of a \_\_\_\_\_ control, and procedures to resubmit rejected transactions are an example of a \_\_\_\_control A. corrective; detective B. detective; corrective C. preventive; corrective D. detective; preventive
B. detective; corrective
The largest differences between the COSO Integrated Control (IC) framework and the COSO Enterprise Risk Management (ERM) framework is
A) IC is controls-based, while the ERM is risk-based
B) IC is risk-based, while ERM is controls-based
C) IC is required, while ERM is optional
D) IC is more applicable to international accounting standards, while ERM is more applicable to generally accepted accounting principles
A) IC is controls-based, while the ERM is risk-based
The audit committee of the board of directors
A. is usually chaired by the CFO
B. conducts testing of controls on behalf of the external auditors
C. provides a check and balance on management
D. does all of the above.
C. provides a check and balance on management
Personnel policies such as background checks, mandatory vacations, and rotation of duties tend to deter A. unintentional errors B. employee fraud or embezzlement C. fraud by outsiders D. disgruntled employees
B. employee fraud or embezzlement
The first step of the risk assessment process is generally to
A. identify controls to reduce all risk to zero
B. estimate the exposure from negative events
C. identify the threats that the company currently faces
D. estimate the risk probability of negative events occurring
C. identify the threats that the company currently faces
According to the COSO Enterprise Risk Management Framework, the risk assessment process incorporates all of the following components except
A. reporting potential risks to auditors
B. identifying events that could impact the enterprise
C. evaluating the impact of potential events on achievement of objectives
D. establishing objectives for the enterprise
A. reporting potential risks to auditors
Upon getting into your new car, you suddenly became worried that you might become injured in an auto accident. You decided to buckle your seatbelt in response. You chose to \_\_\_\_\_\_ the risk of being injured in an auto accident A. reduce B. share C. avoid D. accept
A. reduce
Petty cash is disbursed by the Manuela Luisina in the Cashier's Office. Manuela also maintains records of disbursements, places requests to the Finance Department to replace expended funds, and periodically reconciles the petty cash balance. This represents\_\_\_\_\_\_ segregation of duties. A. ideal B. effective C. ineffective D. limited
C. ineffective
If the time an attacker takes to break through the organization's preventative controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack, then security is A. effective B. ineffective C. overdone D. undermanaged
A. effective
Identify the primary means of protecting data stored in a cloud form unauthorized access. A. authentication B. authorization C. virtualization D. securitization
A. authentication
Identify the statement below which is not a useful control procedure regarding access to system outputs
A. restricting access to rooms with printers
B. coding reports to reflect their importance
C. allowing visitors to move through the building without supervision
D. requiring employees to log out of applications when leaving their desk
C. allowing visitors to move through the building without supervision
Restricting access of users to specific portions of the system as well as specific tasks, is an example of A. authentication B. authorization C. identification D. threat monitoring
B. authorization
Multi-factor authentication
A. involves the use of two or more basic authentications methods
B. is a table specifying with portions of the systems users are permitted to access
C. provides weaker authentication than the use of effective passwords
D. requires the use of more than one effective password
A. involves the use of two or more basic authentications methods
The process that allows a firewall to be more effective by examining the data in the body of an IP packet, instead of just the header, is know as A. deep packet inspection B. stateful packet filtering C. static packet filtering D. an intrusion prevention system
A. deep packet inspection
In 2007, a major US financial institution hired a security firm to attempt to compromise its computer network. A week later, the firm reported that it had successfully entered the system without apparent detection and presented an analysis of the vulnerabilities that had been found. This is an example of a A. preventive control B. detective control C. corrective control D. standard control
B. detective control
