File: 6e chapter7TextBank.

docx, Chapter 7, Security

Multiple Choice

1. In the Office of Personnel Management’s case, the security breach made many people
vulnerable to this.
a) Loss of personal property
b) Inaccurate personal data
c) Identity theft
d) Loss of access to personal data
e) Credit card fees

Ans: c (Hard)

2. When the Office of Personnel Management was hacked, all of the following are true
EXCEPT:
a) The hackers gained access to the building to steal the records
b) It took the Office of Personnel Management many months to detect the break-in
c) The hackers likely exploited a stolen password
d) The hackers did not need to escape in the blue turbocharged vehicle
e) None of the above (indicating that all are true)

Ans: a (Medium)
Response: See page 148

3. Many organizations and even consumers use what to control access to a network like
the Internet, allowing only authorized traffic to pass?
a) Encryption
b) VPN
c) Firewall
d) Anonymizing tools
e) Filtering

Ans: c (Medium)

4. If you receive an email that says it is from Sam Johnson, your boss, with an odd EXE
file as an attachment, it could be dangerous for all of the following reasons EXCEPT:
a) The email might not really be from Sam.
b) The email might be from Sam’s computer without his or her knowledge.
c) It could be dangerous even if it was sent knowingly because Sam didn’t know a
virus might be attached.
 d) It could be dangerous because Sam gave someone his password once a long time
ago
e) None of the above (indicating that all are true).

Ans: e (Medium)

5. It is estimated that ___ % of all firms have been breached.

a) 5% or less
b) 10% to 20%
c) 40% to 60%
d) 70% to 90%
e) Over 95%

Ans: e (Medium)

6. Who is responsible for decisions about security strategy?

a) IT people
b) Shared: IT leaders and business leaders
c) Business leaders
d) Consultants
e) Team of consultants and IT people

Ans: c (Medium)

7. Who is responsible for developing a cybersecurity culture?

a) IT people
b) IT leaders and business leaders share responsibility
c) Business leaders
d) Consultants
e) Team of consultants and IT people

Ans: b (Medium)

8. In the Anthem Blue Cross breach, where 80 million names, birthdays, social security
numbers, etc., were stolen, the hackers got in by:
a) Breaking into the building where they were stored
b) Obtaining passwords of five or more high-level employees
c) Making phone calls to insiders posing as IT people needing to log into their
accounts
d) Emailing each of the 80 million patients asking for their private information
e) Recovering patient records from a large recycling bin
Ans: b (Medium)

9. Quantify breaches that are caused by stealing a password

a) A very low percentage (somewhere around 1%)
b) A low percentage (around 10%)
c) A moderate percentage (around 25%)
d) A high percentage (around 50%)
e) A very high percentage (around 80%)

Ans: e (Medium)

10. The two most common passwords of all in 2018 were:

a) Your birth date and anniversary date
b) None at all—they most commonly skip passwords and just press ENTER to
continue
c) “password” and “123456”
d) Spouse’s name and oldest child’s name
e) “Rihanna” and “Lizzo”

Ans: d (Medium)

11. An “evil twin” in the context of computer security is:

a) A virus-laden attachment that looks just like a sincere attachment
b) A duplicate badge that allows a nasty person entry into a data center
c) Someone who looks just like the Chief Information Officer, but steals data
d) An operating system that is not genuine
e) A counterfeit wifi connection in a hotel or coffee shop that appears to be genuine

Ans: e (Medium)

12. The cost of a data breach in 2018 is estimated to be:

a) between $13 and $18 per record
b) between $43 and 65 per record
c) between $148 and $408 per record
d) between $100 and $1,000 per record
e) between $4,520 and $4,580 per record

Ans: c (Medium)

13. On the black market, stolen data in a “kit” that contains credit card information plus
social security number and medical information is worth:
 a) between $13 and $18 per record
b) between $43 and 65 per record
c) between $148 and $408 per record
d) between $100 and $1,000 per record
e) between $4,520 and $4,580 per record

Ans: d (Medium)

14. It usually takes ____ for someone in a firm to discover a security compromise in a
system, after the evidence shows up in logs or alerts
a) Several seconds
b) Several minutes
c) Several hours
d) Several days
e) Several months

Ans: e (Medium)

15. Included in the five critical elements that are used to raise security in a firm are all of
the following EXCEPT:
a) Infrastructure
b) Law enforcement
c) Policies
d) Training
e) Investments

Ans: b (Hard)

16. Examples of multi-factor authentication are:

a) passwords and text messages.
b) passwords longer than one character.
c) a human will chat with you to see who you are.
d) using two badges to allow you into a building.
e) none of the above.

Ans: a (Medium)

17. All of the following are classic signs of a phishing message EXCEPT:
a) Your email in-box is full and you must click on a link to increase storage
b) You just won a lottery or contest, and you need to click on a link to claim your
prize
c) Poor grammar or spelling in a note that purports to be from a large company
 d) Goods or services are offered at an impossibly low price
e) An emailed ad that oddly does not provide any active links

Ans: e (Hard)

18. Spoofing is:

a) When someone makes fun of you for falling for a phishing scam
b) When the “from” address says the name/email address of a person different from
who really sent it
c) When hackers snoop around in a system
d) When a person from IT unlocks your email account
e) When you receive a notice of an inheritance

Ans: b (Medium)

19. Which of the following are the five functions of the NIST Cybersecurity Framework?
a) Identify, communicate, detect, recover, prosecute
b) Communicate, detect, engage, respond, recover
c) Protect, identify, communicate, recover, prosecute
d) Identify, protect, detect, respond, recover
e) Detect, recover, communicate, respond, engage

Ans: d (Medium)

20. Which of the following are popular types of multifactor authentication?

a) Knowledge, ownership, biometric
b) VPN, biometric, text message
c) Encryption, ownership, WEP/WPA
d) Firewall, antispy/virus software, knowledge
e) Biometric, system logs, transmission tools

Ans: a (Medium)

21. The concept of having multiple layers of security policies and practices is known as:
a) Cybersecurity culture
b) Multifactor authentication
c) Defense in depth
d) Biometrics
e) Zero-day threat

Ans: c (Medium)
22. All of the following are part of cybersecurity balanced scorecard EXCEPT:
a) Risk measures
b) People measures
c) Supply chain measures
d) Threat measures
e) Technology measures

Ans: d (Medium)

True/False

23. Over time, attackers have not become more sophisticated to be able to attack systems
or create viruses.

Ans: False

24. If you receive an email from your son, and the body of the email tells you to open an
attachment because it is funny, the risk is pretty close to zero because it came from
your son.

Ans: False

25. In the Target breach, the HVAC systems were actually attached to the retail sales
system.

Ans: True

26. In the Target breach, the IT department was warned on or about the time the files
were transferred.

Ans: True

27. According to the late L. Dain Gary, “You cannot make a computer secure.”

Ans: True

28. A hacker who buys credit card information from hackers receives a short-term
 guarantee in case the card is declined.

Ans: True

29. The Dark Web offers “as-a-service” with the technologies and tools cybercriminals
purchasing, which can include help desk service.

Ans: True

30. The deep web is a part of the internet that includes unindexed websites offering both
legal and illegal items, such as passports, citizenship, and even murders for hire.

Ans: True

31. The Deep Web is reputed to be 400 times larger than the public web.

Ans: True

32. A challenge question is when you are stopped at the gate and the guard asks who you
are.

Ans: False

33. Two factor authentication is when you use two different methods for people trying to
use the system. For instance, you can use a password and a challenge question

Ans: True

34. Cybersecurity is more about management actions than technology decisions.

Ans: True

35. Cyberinsurance can be one way a company manages its technology measure on the
cybersecurity balanced scorecard.

Ans: False

36. Firewalls can be either in hardware or software form.

Ans: True

Short Answer

37. Taking action on a detected cybersecurity breach is part of the

function of the NIST Cybersecurity Framework.

Ans: respond

38. Continuous monitoring for anomalies and unplanned events is part of the
function of the NIST CSF.

Ans: detect

39. is a situation in which the thief counterfeits a different person’s address

Ans: spoofing

40. is a piece of software that traps keystrokes and stores them for
hackers to inspect later?

Ans: Key logger

41. System updates and patches provided by system vendors is a best practice known as
.

Ans: cybersecurity hygiene

42. is a highly targeted cyber attack that usually mimics a

familiar relationship to the user.

Ans: Spear phishing

43. Cyber culture and behavior are defined by attitudes, beliefs, and .
Ans: values

44. What is Poulsen’s Law?

Ans: Information is secure when it costs more to get to it than it is worth.

Essay

45. What security and controls should a company use to protect its computer
infrastructure? Why do managers need to be involved in the governance of security
and control measures?

46. Internal threats are considered the most lethal threat. What are they, why are they so
lethal, and what can a company do to protect against them?

47. What are the shortcomings of passwords?

48. What is a challenge question?

49. Of the seven security policies noted in the (Figure 7.7), name and describe at least
three.

50. Explain the importance of creating a cybersecurity culture and give examples of
major symptoms of improper decisions.

51. Why is it important to measure how cybersecure we are and describe the purpose of
the cybersecurity balanced scorecard?

Matching

52. Match the security tool to its security category.

Hardware system security and control Firewalls used to control access to
a network
Hardware system security and control Encryption techniques to protect
the content of transmitted
messages
Network and software security control Server software to protect Web
sites
Network and software security control Security information management
schemes to protect against
unauthorized access to computers
and the network
Broadcast medium security and Filtering software that keeps
controls “black listed” sites from
displaying