Information Systems Quiz 1

Quiz 1 What is the security gap? It is the missing concepts in security It is a loophole in security It is malfunctioning of security tools It is the difference in security practices and security policies Do you think you can drink water inside the lab? Why? Yes, because we need to support our learning efficiency and ready to compensate for the possible damage No, the CCTV is watching us No, because it is the policy that everyone has to follow Yes, because we are the stakeholders of CityU who has the freedom to do anything inside the campus What is the meaning of "data in motion"? The motion picture The data under transmission The data seems to have the leg that data can be deleted accidentally The data coming from the atmosphere What is social engineering? It is a hacking technique making use of human weakness It is a technique in social science for making friends with more people It is a hacking technique in modifying human social behavior It is an engineering to produce robots which mimic human beings What is a back door? A secret door inside the banks for emergency exit A secret door for the boss to come back for checking employees A secret path for the hackers to go in and out of the program without authorization A secondary door located at the back of the shop for goods transportation Which of the following is NOT an example of hoaxes? An email from a stranger selling products An email with a hyperlink to a malicious website An email with the threatening messages inside An email with a virus attached Who do we need to learn hacking techniques? For academic and curiosity use Show our ability as a signal to scare the hackers' away Know our enemies Train to be a hacker and get into hacker's society as an undercover If security is too tight, then there is no more competitive advantage there is no hacking attack any more there is less flexibility in business operations there is little rights to all employees How can malicious code be stored inside a photo? Making use of the loophole of file format difference Making use of the loophole of human curiosity in sex Making use of the loophole in data communication Making use of the loophole of unnoticeable difference in small color palette change In Lecture #2, slide #14, who is Kevin Mitnick? He is a policeman who has much experience in catching hackers He is a CEO of a stock-listed security company He is a social worker He had once been a famous hacker Which of the following is NOT correct for Wanna-Cry attack? One of its critical success factors is the use encryption It is an attack using social engineering technique The protection to this attacking method is backup periodically Usually hackers would ask for paying the ransom by bitcoins Which of the following is NOT a purpose for the hackers show their achievement inside the hacker's website? To let victims know how to pay the ransom To show off their competence To get promotion in their hacker's society To threaten the public that any public organization can be the next victim If a research report announced that 99.7% respondents declare that their computers have encountered the virus before, the possible reason for the 0.3% not having encountered the virus is: They do not understand what a virus is They have no knowledge that their computers had the virus infected already They have not used computers at all They think that the information security is not so severe nowadays What is crimeware-as-a-service (CaaS)? CaaS is a hacking technique CaaS is an anti-hacking technique CaaS is the paid hacking service CaaS is the hacking software sold by the hackers Whenever we visit the hacker's website for research purpose, which precaution should we take? Never say never, we should always try to explore the dangerous hacking world Never contact the hackers Never opening another window/session for other mission critical functions at the same time Never download the files from the hacker's website Why should the security management narrow the security gap? To make the accountability of concerned parties clearer To indicate to the management about the need to invest more in security countermeasures The difference indicates the ineffectiveness of the top management which may affect company's image To force employees follow security policies What is availability? It is about the property of information It is about the readiness of information It is about the secret level of information It is about the completeness of information What is Wanna-Cry attack? The victim's hard disk would be destroyed by the hacker The victim's hard disk files would be 'locked' by the hacker The victim's privacy would be threatened to be released by the hacker The victim's computer system would be remotely controlled by the hacker Which of the following is the correct meaning for confidentiality? No unauthorized people see the information No unauthorized people keep the information No unauthorized people modify the information You Answered No unauthorized people transmit the information What is the critical success factor of sniffer attack? have chance to meet with the victim some knowledge about the victim's business sufficient technical information about victim's network have chance to touch the victim's network Which of the following is the correct meaning for integrity? No unauthorized people modify the information No unauthorized people keep the information No unauthorized people transmit the information No unauthorized people see the information Why is the CIA triangle so important to information security? It is the origin of information security It consists the three important sequential steps in security It is one of the standards in security implementation It stands for Central Information Agency which controls all security issues Why should we need to visit the hacker's website? To download the hacking tools for your won future hacking use To get some updated information about current environment in security to get some alert of the severity level To catch the hackers To learn from and make friends with the hackers Which of the following is NOT the element of IT infrastructure? Document People Finance planning Procedure Which of the following statement is true? We can use as much controls as possible to protect our organization There is no panacea in security management Security concerns about just management and technical issues There is always an ultimate solution to our security dilemma What are the full names for C, I and A inside the CIA triangle? Central, Information, Association Confidentiality, Integrity,Availability Critical, Integrity, All-perfect Critical, Important, Availability If someone sends you an email and claim he is your headmaster, you should not believe in this email is real without hesitation because: Your computer can detect the ingenuity of all incoming email itself You are not sure whether the sender is the person who claims to be our headmaster Your headmaster would not do so University email system would filter such unsolicited email automatically If security is too loose, then there is higher risks of security breaches organizations can have more earnings hacking attack will be more more employees can follow security policies Which of the following statement is true? Access level is more important than security level because it would slow down our business function Security level is more important than access level because security would affect our survival If security is too loose, then we have more freedom to have some innovation Security level and access level have to be in balance What is the major difference between DoS and DDoS attack? None is correct DoS is one-to-one attack while DDoS is many attackers to one victim at the same time DoS is one-to-one attack while DDoS is one attacker to many victims at the same time DoS makes use of zombies while DDoS makes use of botnets Which of the following tools is not used in security? Awareness Technology Severe penalty imposed Security policy What is obfuscation service? A kind of software reverse engineering A hacking technique to modify the software A hacking service used to change the software behavior A hacking technique to delete the software The major difference between viruses and worms is: Virus is infected through internet connection while worm is infected through contact Virus is infected through contact while worm is infected through the internet connection Virus is infected through contact while worm is infected through the air Virus is infected through internet connection while worm is infected through the air Which of the following is NOT an appropriate method used in narrowing the security gap? Providing more training and awareness to boost up the good sense of security practices Have severe punishment to those who infringes the security policy Relaxing the security requirements (policies) Have a realistic consideration between the impact of security practices and policies so that the two can shift towards each other According to the definition of information security by Anderson, why shouldn't we try every possibility to reduce the risk? Too much risk avoidance may mean we need to quit business Risks are unlimited that there is no way to get rid of them entirely No answer text provided. Expensive cost should also be considered in business environment If a person claims to be our Headmaster Professor Guo Way and invites you for lunch, what should you do? Call his office and ask his subordinates to confirm this appointment Neglects the invitation by not replying the email Politely reply his email Blacklist his email Why does the hacker usually ask for Bitcoin as the method of paying ransom? Bitcoin payment is easy and quick to be handled Bitcoin payment is anonymous Bitcoin price is expected to increase Bitcoin is the most trustworthy currency Why should we need to reboot our computer after we have visited the hacker's website? To reset all RAM memory which may have the cookies or traces sent to us during the visit To clear the computer screen so that others cannot see our visit To express our hostility or say no to the hackers It is a culture or usual habit in every website visit Which of the following is an issue of confidentiality? An unauthorized person steal the confidential information An authorized person reads a public newspaper confidently An unauthorized person reads the confidential information An unauthorized person destroys the confidential information Which of the following shows the correct sequence of importance of the four functions for an organization? Protects ability to function > Enables safe operation of applications implemented on its IT systems > Protects data the organization collects and uses > Safeguards technology assets in use Safeguards technology assets in use > Enables safe operation of applications implemented on its IT systems > Protects ability to function > Protects data the organization collects and uses Enables safe operation of applications implemented on its IT systems > Safeguards technology assets in use > Protects data the organization collects and uses > Protects ability to function Protects data the organization collects and uses > Protects ability to function > Safeguards technology assets in use > Enables safe operation of applications implemented on its IT systems