1) Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access,

alteration, theft, or physical damage to information systems?

1. A) Security
2. B) Controls
3. C) Benchmarking
4. D) Algorithms
5. E) Identity management
Answer: A

2) Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the
organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management
standards?
1. A) Legacy systems
2. B) SSID standards
3. C) Vulnerabilities
4. D) Security policy
5. E) Controls
Answer: E

3) Most computer viruses deliver a:

1. A) worm.
2. B) Trojan horse.
3. C) driveby download.
4. D) keylogger.
5. E) payload.
Answer: E

4) Which of the following statements about wireless security is not true?

1. A) SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs.
2. B) Radio frequency bands are easy to scan.
3. C) An intruder who has associated with an access point by using the correct SSID is capable of accessing other
resources on the network,
4. D) Intruders can force a users NIC to associate with a rogue access point.
5. E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.
Answer: E

5) All of the following are specific security challenges that threaten the communications lines in a client/server
environment except:
1. A) errors.
2. B) tapping.
3. C) theft and fraud.
4. D) radiation.
5. E) sniffing.
Answer: A

6) All of the following are specific security challenges that threaten corporate servers in a client/server environment
except:
1. A) hacking.
2. B) malware.
3. C) denial-of-service attacks.
4. D) sniffing.
5. E) vandalism.
Answer: D
7) All of the following are specific security challenges that threaten corporate systems in a client/server
environment except:
1. A) theft of data.
2. B) copying of data.
3. C) alteration of data.
4. D) radiation.
5. E) hardware failure.
Answer: D

8) CryptoLocker is an example of which of the following?

1. A) Worm
2. B) SQL injection attack
3. C) Sniffer
4. D) Evil twin
5. E) Ransomware
Answer: E

9) Which of the following statements about the Internet security is not true?
1. A) The use of P2P networks can expose a corporate computer to outsiders.
2. B) A corporate network without access to the Internet is more secure than one that provides access.
3. C) VoIP is more secure than the switched voice network.
4. D) Instant messaging can provide hackers access to an otherwise secure network.
5. E) Smartphones have the same security weaknesses as other Internet devices.
Answer: C

10) A Trojan horse:

1. A) is software that appears to be benign but does something other than expected.
2. B) is a virus that replicates quickly.
3. C) is malware named for a breed of fast-moving Near-Eastern horses.
4. D) installs spyware on users' computers.
5. E) is a type of sniffer used to infiltrate corporate networks.
Answer: A

11) A salesperson clicks repeatedly on the online ads of a competitor's in order to drive the competitor's advertising costs
up. This is an example of:
1. A) phishing.
2. B) pharming.
3. C) spoofing.
4. D) evil twins.
5. E) click fraud.
Answer: E

12) Which of the following is a virus that uses flaws in Windows software to take over a computer remotely?
1. A) Sasser
2. B) Zeus
3. C) Cryptolocker
4. D) ILOVEYOU
5. E) Conficker
Answer: E
13) ________ is malware that hijacks a user's computer and demands payment in return for giving back access.
1. A) A Trojan horse
2. B) Ransomware
3. C) Spyware
4. D) A virus
5. E) An evil twin
Answer: B
14) ________ is malware that logs and transmits everything a user types.
1. A) Spyware
2. B) A Trojan horse
3. C) A keylogger
4. D) A worm
5. E) A sniffer
Answer: C

15) Which of the following statements about botnets is not true?

1. A) Eighty percent of the worlds malware is delivered by botnets..
2. B) Botnets are often used to perpetrate DDoS attacks.
3. C) Ninety percent of the worlds spam is delivered by botnets.
4. D) Botnets are often used for click fraud.
5. E) It is not possible to make a smartphone part of a botnet.
Answer: E

16) Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n)
________ attack.
1. A) DDoS
2. B) DoS
3. C) SQL injection
4. D) phishing
5. E) botnet
Answer: A

17) Which of the following is not an example of a computer used as a target of crime?
1. A) Knowingly accessing a protected computer to commit fraud
2. B) Accessing a computer system without authority
3. C) Illegally accessing stored electronic communication
4. D) Threatening to cause damage to a protected computer
5. E) Breaching the confidentiality of protected computerized data
Answer: C

18) Which of the following is not an example of a computer used as an instrument of crime?
1. A) Theft of trade secrets
2. B) Intentionally attempting to intercept electronic communication
3. C) Unauthorized copying of software
4. D) Breaching the confidentiality of protected computerized data
5. E) Schemes to defraud
Answer: D

19) Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal
crime?
1. A) Computer Fraud and Abuse Act
2. B) Economic Espionage Act
3. C) Electronic Communications Privacy Act
4. D) Data Security and Breach Notification Act
5. E) National Information Infrastructure Protection Act
Answer: E
20) The intentional defacement or destruction of a website is called:
1. A) spoofing.
2. B) cybervandalism.
3. C) cyberwarfare.
4. D) phishing.
5. E) pharming.
Answer: B
21) Evil twins are:
1. A) Trojan horses that appears to the user to be a legitimate commercial software application.
2. B) e-mail messages that mimic the e-mail messages of a legitimate business.
3. C) fraudulent websites that mimic a legitimate business's website.
4. D) computers that fraudulently access a website or network using the IP address and identification of an
authorized computer.
5. E) bogus wireless network access points that look legitimate to users.
Answer: E

22) Pharming involves:

1. A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web
browser.
2. B) pretending to be a legitimate business's representative in order to garner information about a security system.
3. C) setting up fake website to ask users for confidential information.
4. D) using e-mails for threats or harassment.
5. E) setting up fake Wi-Fi access points that look as if they are legitimate public networks.
Answer: A

23) Which of the following is the single greatest cause of network security breaches?
1. A) Viruses
2. B) User lack of knowledge
3. C) Trojan horses
4. D) Cyberwarfare
5. E) Bugs
Answer: B

24) Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called:
1. A) sniffing.
2. B) social engineering.
3. C) phishing.
4. D) pharming.
5. E) snooping
Answer: B

25) According to Ponemon Institutes 2015 Annual Cost of Cyber Crime Study, the average annualized cost of
cybercrime for companies in the United States was approximately:
1. A) $1.5 million.
2. B) $15 million.
3. C) $150 million.
4. D) $1.5 billion.
5. E) $15 billion.
Answer: B

26) Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless
network traffic?
1. A) War driving
2. B) Sniffing
3. C) Cybervandalism
4. D) Drive-by tapping
5. E) Snooping
Answer: A
27) ________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.
1. A) Identity theft
2. B) Spoofing
3. C) Social engineering
4. D) Evil twins
5. E) Pharming
Answer: A

28) ________ identify the access points in a Wi-Fi network.

1. A) NICs
2. B) Mac addresses
3. C) URLs
4. D) UTMs
5. E) SSIDs
Answer: E

29) A foreign country attempting to access government networks in order to disable a national power grid is an example
of:
1. A) phishing.
2. B) denial-of-service attacks.
3. C) cyberwarfare.
4. D) cyberterrorism.
5. E) evil twins.
Answer: C

30) Smartphones have the same security flaws as other Internet-connected devices.
Answer: TRUE

31) The Apple iOS platform is mobile platform most frequently targeted by hackers..
Answer: FALSE

32) Viruses can be spread through e-mail.

Answer: TRUE

33) The term cracker is used to identify a hacker whose specialty is breaking open security systems.
Answer: FALSE

34) Wireless networks are more difficult for hackers to gain access too because radio frequency bands are difficult to
scan.
Answer: FALSE

35) A computer virus replicates more quickly than a computer worm.

Answer: FALSE

36) One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come
from someone other than the sender.
Answer: TRUE

37) Sniffers enable hackers to steal proprietary information from anywhere on a network, including e-mail messages,
company files, and confidential reports.
Answer: TRUE

38) DoS attacks are used to destroy information and access restricted areas of a company's information system.
Answer: FALSE
39) Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of
choices and millions of paths would require thousands of years.
Answer: TRUE

40) Most IoT devices support sophisticated security approaches

Answer: FALSE

41) Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and
Trojan horses.
Answer: FALSE

45) The HIPAA Act of 1996:

1. A) requires financial institutions to ensure the security of customer data.
2. B) specifies best practices in information systems security and control.
3. C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
4. D) outlines medical security and privacy rules.
5. E) identifies computer abuse as a crime and defines abusive activities.
Answer: D

46) The Gramm-Leach-Bliley Act:

1. A) requires financial institutions to ensure the security of customer data.
2. B) specifies best practices in information systems security and control.
3. C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
4. D) outlines medical security and privacy rules.
5. E) identifies computer abuse as a crime and defines abusive activities.
Answer: A

47) The Sarbanes-Oxley Act:

1. A) requires financial institutions to ensure the security of customer data.
2. B) specifies best practices in information systems security and control.
3. C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
4. D) outlines medical security and privacy rules.
5. E) identifies computer abuse as a crime and defines abusive activities.
Answer: C

48) Which of the following is the most common type of electronic evidence?
1. A) Voice-mail
2. B) Spreadsheets
3. C) Instant messages
4. D) E-mail
5. E) VOIP data
Answer: D

49) Which of the following is a type of ambient data?

1. A) Computer log containing recent system errors
2. B) A file deleted from a hard disk
3. C) A file that contains an application's user settings
4. D) A set of raw data from an environmental sensor
5. E) Data that has been recorded over
Answer: B
50) Computer forensics tasks include all of the following except:
1. A) presenting collected evidence in a court of law.
2. B) securely storing recovered electronic data.
3. C) collecting physical evidence on the computer.
4. D) finding significant information in a large volume of electronic data.
Answer: C

53) Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours
results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the
annual expected loss from this exposure?
1. A) $500
2. B) $1,000
3. C) $1,250
4. D) $1,500
5. E) $2,500
Answer: C

54) Application controls:

1. A) can be classified as input controls, processing controls, and output controls.
2. B) govern the design, security, and use of computer programs and the security of data files in general throughout
the organization.
3. C) apply to all computerized applications and consist of a combination of hardware, software, and manual
procedures that create an overall control environment.
4. D) include software controls, computer operations controls, and implementation controls.
5. E) monitor the use of system software and prevent unauthorized access to software and programs.
Answer: A

55) ________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized
access, change, or destruction while they are in use or in storage.
1. A) Software
2. B) Administrative
3. C) Data security
4. D) Implementation
5. E) Input
Answer: C

56) An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be
included in which of the following?
1. A) Security policy
2. B) AUP
3. C) Risk assessment
4. D) Business impact analysis
5. E) Business continuity plan
Answer: C

57) A statements ranking information risks and identifying security goals would be included in which of the following?
1. A) Security policy
2. B) AUP
3. C) Risk assessment
4. D) Business impact analysis
5. E) Business continuity plan
Answer: A

58) An acceptable use policy defines the acceptable level of access to information assets for different users.
Answer: FALSE
60) Which of the following specifications replaced WEP with a stronger security standard that features changing
encryption keys?
1. A) TLS
2. B) AUP
3. C) VPN
4. D) WPA2
5. E) UTM
Answer: D

61) Which of the following statements about passwords is not true?

1. A) Authentication cannot be established by the use of a password
2. B) Password systems that are too rigorous may hinder employee productivity.
3. C) Passwords can be stolen through social engineering.
4. D) Passwords are often disregarded by employees.
5. E) Passwords can be sniffed when being transmitted over a network.
Answer: A

62) An authentication token is a(n):

1. A) device the size of a credit card that contains access permission data.
2. B) type of smart card.
3. C) gadget that displays passcodes.
4. D) electronic marker attached to a digital authorization file.
Answer: C

63) All of the following are currently being used as traits that can be profiled by biometric authentication except:
1. A) fingerprints.
2. B) facial characteristics.
3. C) body odor.
4. D) retinal images.
5. E) voice.
Answer: C

64) A firewall allows the organization to:

1. A) enforce a security policy on data exchanged between its network and the Internet.
2. B) check the accuracy of all transactions between its network and the Internet.
3. C) create an enterprise system on the Internet.
4. D) check the content of all incoming and outgoing e-mail messages.
5. E) create access rules for a network.
Answer: A

65) ________ use scanning software to look for known problems such as bad passwords, the removal of important files,
security attacks in progress, and system administration errors.
1. A) Stateful inspections
2. B) Intrusion detection systems
3. C) Application proxy filtering technologies
4. D) Packet filtering technologies
5. E) Firewalls
Answer: B

66) Currently, the protocols used for secure information transfer over the Internet are:
1. A) TCP/IP and SSL.
2. B) S-HTTP and CA.
3. C) HTTP and TCP/IP.
4. D) S-HTTP and SHTML.
5. E) SSL, TLS, and S-HTTP.
Answer: E
67) According to the 2016 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity
fraud in 2015?
1. A) $1.5 million
2. B) $15 million
3. C) $150 million
4. D) $1.5 billion
5. E) $15 billion
Answer: E

68) In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the
same key?
1. A) SSL/TLS
2. B) Symmetric key encryption
3. C) Public key encryption
4. D) Private key encryption
5. E) Distributed encryption
Answer: B

69) A digital certificate system:

1. A) uses third-party CAs to validate a user's identity.
2. B) uses digital signatures to validate a user's identity.
3. C) uses tokens to validate a user's identity.
4. D) is used primarily by individuals for personal correspondence.
5. E) protects a user's identity by substituting a certificate in place of identifiable traits.
Answer: A

70) All of the following are types of information systems general controls except:
1. A) application controls.
2. B) computer operations controls.
3. C) physical hardware controls.
4. D) software controls.
5. E) administrative controls
Answer: A

71) For 100-percent availability, online transaction processing requires:

1. A) high-capacity storage.
2. B) a multi-tier server network.
3. C) fault-tolerant computer systems.
4. D) dedicated phone lines.
5. E) a digital certificate system.
Answer: C

72) In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files
and sort low-priority data from high-priority data.
1. A) high availability computing
2. B) deep-packet inspection
3. C) application proxy filtering
4. D) stateful inspection
5. E) unified threat management
Answer: B
73) An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is
called:
1. A) smart card authentication.
2. B) biometric authentication.
3. C) two-factor authentication.
4. D) symmetric key authorization.
5. E) token authentication.
Answer: C

74) Which of the following provides additional security by determining whether packets are part of an ongoing dialogue
between a sender and receiver?
1. A) NAT
2. B) Packet filtering
3. C) Deep packet inspection
4. D) Stateful inspection
5. E) Application proxy filtering
Answer: D

75) Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more,
are called ________ systems.
1. A) DPI
2. B) MSSP
3. C) NSP
4. D) PKI
5. E) UTM
Answer: E

76) Organizations can use existing network security software to secure mobile devices.
Answer: FALSE

77) The dispersed nature of cloud computing makes it difficult to track unauthorized access.
Answer: TRUE

78) Biometric authentication is the use of personal, biographic details such as the high school you attended and the first
street you lived on to provide identification.
Answer: FALSE

79) Packet filtering catches most types of network attacks.

Answer: FALSE

80) NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs.
Answer: TRUE

81) SSL is a protocol used to establish a secure connection between two computers.
Answer: TRUE

82) Public key encryption uses two keys.

Answer: TRUE

83) Smartphones typically feature state-of-the-art encryption and security features, making them highly secure tools for
businesses.
Answer: FALSE

84) Authentication refers to verifying that a person is who he or she claims to be.
Answer: TRUE
85) You can test software before it is even written by conducting a walkthrough.
Answer: TRUE

86) When errors are discovered in software programs, the sources of the errors are found and eliminated through a process
called debugging.
Answer: TRUE

96) All of the following have contributed to an increase in software flaws except:
1. A) the growing complexity of software programs.
2. B) the growing size of software programs.
3. C) demands for timely delivery to markets,
4. D) the inability to fully test programs.
5. E) the increase in malicious intruders seeking system access.
Answer: E

97) Which of the following defines acceptable uses of a firms information resources and computing equipment?
1. A) An information systems audit policy
2. B) A CA policy
3. C) A MSSP
4. D) A UTM system
5. E) An AUP
Answer: E

98) Which of the following focuses primarily on the technical issues of keeping systems up and running?
1. A) Business continuity planning
2. B) Security policies
3. C) Disaster recovery planning
4. D) An AUP
5. E) An information systems audit
Answer: C

99) Which of the following is an example of a keylogger?

1. A) Zeus
2. B) Conficker
3. C) Sasser
4. D) ILOVEYOU
5. E) Cryptolocker
Answer: A

100) Target has had to pay out over $100 million to U.S. banks, credit card companies and consumers as a result of a data
breach in 2013.
Answer: TRUE