Information Systems Quiz 2

Quiz 2 Which of the following is NOT the consideration during threat assessment? Which threat requires least expenditure to prevent? Which threats represent the most danger to information? Which threats present danger to assets? How much would it cost to recover from attack? Which of the following is NOT a method/strategy used by the hackers to bypass controls of the computer system? fraud guile theft skill The major difference between viruses and worms is: Virus is infected through internet connection while worm is infected through the air Virus is infected through contact while worm is infected through the air Virus is infected through internet connection while worm is infected through contact Virus is infected through contact while worm is infected through the internet connection Which of the following is NOT the main step in risk management? risk control risk training risk identification risk analysis Which of the following is NOT true for DDoS attack? DDoS is done by one hacker to one victim DDoS has the same concept as DoS except DDoS is done via Internet while DoS is done via internal network DDoS is based on the loophole in three-way handshake One solution to counteract with DDoS is to shut down the victim's computer What is the usage of Weighted Score inside the Weighted Factor Analysis Worksheet? It is the other name for risk figure None is correct To indicate which threats we should put more attention to? It is the figure for the actuary to investigate the impact of that threat Why is it a cyclic (not linear) function during the risk identification process? To allow errors occur during the steps To rectify the errors for management consideration It has many branches of logic It is iterative in nature Which of the following is NOT a rule of thumb for selection of risk control strategy? When potential loss is substantial When a vulnerability can be exploited When attacker’s cost is more than potential gain When a vulnerability exists Which of the following is NOT the criteria to valuate the asset? Would be most expensive to replace or protect? Is most critical to organization’s success? Generates the most severe overburden problem that slow down the whole network Would be the most embarrassing or cause greatest liability if revealed? In normal situation, which of the following control strategy is most preferable/profitable? Transfer Terminate Defend Accept Which of the following is NOT true for crimeware-as-a-service? It is a platform where hackers are paid to do hacking The clients are no need to be technical in hacking It is a special hacking technique making use of advanced tools It has a list of hacking services posted in internet Which of the following is NOT true for Vulnerability? It is about the hacking technique Identification of it should be done by experienced people It is the known weakness Identification of it should be done iteratively with series of brainstorming sessions What is data classification scheme? It is a procedure to put data into different subject folders It is a system to determine whether the specific outdated data should be destroyed It is a software to classify data according to their monetary value It is a categorization method to classify company data into different security levels From a survey research done by a very famous university professor, it stated that 99.7% of respondents discovered that they have encountered viruses before. How about the remaining 0.3% of respondents? Try to guess with common sense. These 0.3% were the hackers These 0.3% were the non-cooperative persons These 0.3% did not know what is a virus These 0.3% did not use computers at all What is inherent risk? It is a vulnerability likelihood It is a technology risk which exists inside any computer system It is a residual risk that can be controlled It is the risk related to the nature of business "inventory" during asset identification means: A checking point when there is new asset coming into the company Company's existing assets An action to find out the existing asset and then count them The number of total assets Which of the following is NOT a plan under mitigate control strategy? risk management plan Business continuity plan Incident response plan Disaster recovery plan In slide #8 of session #3, using CityU as example, one possible example of 'people at trusted organizations' is: part-time staff student full-time staff freelance news reporter Which of the following is NOT true for Social Engineering? It is an engineering discipline to help solving social problems It shows the weakest link in human beings It makes use of social skills to gain trust from victims It would not delete files directly Which of the following is NOT a cause of human error or failure? too high self confidence inexperience lack of self confidence improper training Which of the following is NOT a category of threat? Software failure Hardware failure Bankruptcy of organization Technological obsolescence Back door is: A method or feature that does not require official login credential to access the system A concept for someone to escape from the disaster in case of danger. A secret physical entrance for someone to come into a confidential area. A trap to catch the bad insiders. Which of the following is NOT the step in asset prioritization? Spend more efforts on items which has lower weighted score List the assets in order of importance using a weighted factor analysis worksheet Create weighting for each category based on the answers to questions Calculate relative importance of each asset using weighted factor analysis Which of the following is NOT an effect to the users due to the deviation of quality of service of power supply? Spikes Blackouts Lags Sags Which of the following is NOT true for conceptual modeling? The outcome of the conceptual modeling activity is usually a diagram or model that can then be translated into a relational or some other logical model The adequacy of a conceptual model is based on how well it is able to promote a common understanding among human users it focuses on “capturing and representing human perceptions of the real world” in such a manner that they can be included in an information system it involves capturing various aspects of the real world, and representing them in the form of a model that can be used for checking Which of the following is NOT true for sniffer? It is program which can monitor the traveling over the network It can trouble-shoot the network problem It can steal information It is a program which can creep into the system and delete files What is the usage of exposure factor under cost-benefit analysis (CBA)? It is an estimate of inaccuracy in the CBA calculation It is the probability of exposing the secrets to outsiders It measures how likely the threat may affect the controls It is used in assessing how likely the risk cannot be controlled Which of the following is NOT a risk control strategy transfer defend terminate attack Which of the following is NOT a kind of software attacks threat mentioned by Michael Whitman? Logic bombs Polymorphic threats Outdated software Back door Which of the following is NOT a general category of controls? series of alert activities computer programming technologies policies Which of the following is NOT true for forces of nature is: Arson is one of the examples Flooding is one of the examples Earthquake is one of the examples Lightning is one of the examples Which of the following statement is NOT true? Brute force attack is the infinite trial of different combinations of numbers and characters as the target password Dictionary attack consumes more computing resources than brute force attack Dictionary attack is used together with a physical dictionary beside the hacking computer There is no countermeasure available against dictionary attack Steganography is: A kind of attacking method which is about hiding information inside a digital file A kind of phishing attack A virus which is in a form of picture format About the use of color to display detail information Which of the following is TRUE to cost-benefit analysis (CBA)? If CBA of control A and control B is 10 and 5 respectively, then we should select control A If CBA of control A and control B is 10 and 15 respectively, then we should select control A If CBA of control A and control B is -10 and -15 respectively, then we should select control A If CBA of control A and control B is -10 and -5 respectively, then we should select control A In what area of CIA triangle does the deviation in quality of service of ISP affect the users? Availability Confidentiality None is correct Integrity Which of the following is NOT the component of risk identification Customer relationship management software Selling procedure Accounts figures Vendor's customer list Which of the following is NOT true for SQL Injection: It makes use of the loophole inside SQL statement structure A hacking technique to gain access into a system without official login credential It is a technique to inject wrong command into the SQL statement which can damage the whole SQL database directly It uses the logical construct to enforce validity of the SQL statement Man-in-the-middle (MITM) attack is more severe than DoS attack because: MITM requires more powerful hacker to perform MITM affects both confidentiality and integrity MITM can lead to the destruction of whole computer system MITM requires a large community of computers to help Which of the following is NOT a category of threat? Sabotage or vandalism Employee's strike Deviation in quality of service Carelessness How can the hacker control the zombies in DDoS attack? Buy all zombies' computers Social engineering to convince zombies for cooperation Use trojan horse to attack the zombies first Create a virtual network which can contain millions of virtual machines as zombies