Protecting Information Resources Part 1

Protecting Information Resources True / False 1. In contrast to pharming, phishing involves hijacking an official Web site address by hacking a Domain Name System server. a. True b. Fals e ANSWER: False RATIONALE: Correct The difference between phishing and pharming is that pharming involves hijacking an official Web site address by hacking a Domain Name System server and then altering the legitimate Web site IP address so that users who enter the correct Web address are directed to the pharmers’ fraudulent Web site. See 5-1: Risks Associated with Information Technologies 2. Auction fraud is sending fraudulent e-mails that seem to come from legitimate sources, such as a bank or university. a. True b. Fals e ANSWER: False RATIONALE: Correct Phishing is sending fraudulent e-mails that seem to come from legitimate sources, such as a bank or university. The e-mails usually direct recipients to false Web sites that look like the real thing for the purpose of capturing personal information. See 5-1: Risks Associated with Information Technologies 3. The three important aspects of computer and network security, confidentiality, integrity, and availability, are collectively referred to as the CIA triangle. a. True b. Fals e ANSWER: True RATIONALE: Correct There are three important aspects of computer and network security: confidentiality, integrity, and availability, collectively referred to as the CIA triangle. See 5-2: Computer and Network Security: Basic Safeguards 4. In the context of the CIA triangle, confidentiality means that computers and networks are operating and authorized users can access the information they need. a. True b. Fals e ANSWER: False RATIONALE: Correct Confidentiality means that a system must not allow the disclosing of information by anyone who is not authorized to access it. Availability means that computers and networks are operating and authorized users can access the information they need. See 5-2: Computer and Network Security: Basic Safeguards 5. Level 1 security protects back-end systems to ensure confidentiality, accuracy, and integrity of data. a. True b. Fals e ANSWER: False RATIONALE: Correct Level 2 security protects back-end systems to ensure confidentiality, accuracy, and integrity of data. Level 1 security protects front-end servers. See 5-2: Computer and Network Security: Basic Safeguards 6. If a drive in a redundant array of independent disks (RAID) system fails, data stored on it can be reconstructed from data stored on the remaining drives. a. True b. Fals e ANSWER: True RATIONALE: Correct A RAID system is a collection of disk drives used to store data in multiple places. If a drive in a RAID system fails, data stored on it can be reconstructed from data stored on the remaining drives. RAID systems vary in cost, performance, and reliability. See 5-2: Computer and Network Security: Basic Safeguards 7. When using mirror disks, if one of the two disks containing the same data fails, the other disk also fails. a. True b. Fals e ANSWER: False RATIONALE: Correct When using mirror disks, if one of the two disks containing the same data fails, the other is available, allowing operations to continue. Mirror disks are usually a less expensive, level-1 redundant array of independent disks system and can be a suitable solution for small organizations. See 5-2: Computer and Network Security: Basic Safeguards 8. When a program containing a virus is used, the virus attaches itself to other files, and the cycle continues. a. True b. Fals e ANSWER: True RATIONALE: Correct When a program or operating system containing a virus is used, the virus attaches itself to other files, and the cycle continues. See 5-3: Security Threats: An Overview 9. Viruses can be transmitted through a network or through e-mail attachments. a. True b. Fals e ANSWER: True RATIONALE: Correct Viruses can be transmitted through a network or through e-mail attachments. Some of the most dangerous ones come through bulletin boards or message boards because they can infect any system using the board. See 5-3: Security Threats: An Overview 10. Social engineering is an attack that takes advantage of the backdoors in security systems. a. True b. Fals e ANSWER: False RATIONALE: Correct In the context of intentional computer and network threats, social engineering means using “people skills”-such as being a good listener and assuming a friendly, unthreatening air-to trick others into revealing private information. This is an attack that takes advantage of the human element of security systems. See 5-3: Security Threats: An Overview 11. In the context of intentional computer and network threats, social engineers protects the integrity of information resources. a. True b. Fals e ANSWER: False RATIONALE: Correct Social engineers use the private information they have gathered to break into servers and networks and steal data, thus compromising the integrity of information resources. They use a variety of tools and techniques to gather private information, including publicly available sources of information. See 53: Security Threats: An Overview 12. In some instances, after examining an incoming packet, a firewall can send a message to the packet’s sender that the attempt to transmit the packet has failed. a. True b. Fals e ANSWER: True RATIONALE: Correct After examining an incoming packet, a firewall can send a message to the packet’s sender that the attempt failed. A firewall can examine data passing into or out of a private network and decide whether to allow the transmission based on users’ IDs, the transmission’s origin and destination, and the transmission’s contents. See 5-4: Security Measures and Enforcement: An Overview 13. Application-filtering firewalls are less expensive than packet-filtering firewalls. a. True b. Fals e ANSWER: False RATIONALE: Correct Application-filtering firewalls are generally more secure and flexible than packet-filtering firewalls, but they are also more expensive. They also filter viruses and log actions more effectively than packet-filtering firewalls, which helps network administrators spot potential security breaches. See 5-4: Security Measures and Enforcement: An Overview 14. An intrusion detection system (IDS) can protect networks against both external and internal access. a. True b. Fals e ANSWER: True RATIONALE: Correct An IDS can protect networks against both external and internal access. It is usually placed in front of a firewall and can identify attack signatures, trace patterns, generate alarms for a network administrator, and cause routers to terminate connections with suspicious sources. See 5-4: Security Measures and Enforcement: An Overview 15. The main drawback of an intrusion detection system (IDS) is its inability to prevent denial-of-service (DoS) attacks. a. True b. Fals e ANSWER: False RATIONALE: Correct An IDS can prevent DoS attacks. It monitors network traffic and uses the “prevent, detect, and react” approach to security. See 5-4: Security Measures and Enforcement: An Overview 16. Terminal resource security is a software feature that erases the screen and signs a user off automatically after a specified length of inactivity. a. True b. Fals e ANSWER: True RATIONALE: Correct Terminal resource security is a software feature that erases the screen and signs a user off automatically after a specified length of inactivity. This method of access control prevents unauthorized users from using an unattended computer to access the network and data. See 5-4: Security Measures and Enforcement: An Overview 17. The cost of setting up a virtual private network (VPN) is usually high. a. True b. Fals e ANSWER: False RATIONALE: Correct The cost of setting up a VPN is usually low, but transmission speeds can be slow, and lack of standardization can be a problem. See 5-4: Security Measures and Enforcement: An Overview