Information Systems and Design Final Exam Answer Key

ESSAY. Write your answer in the space provided or on a separate sheet of paper. 1) TRUE 2) FALSE 3) TRUE 4) TRUE 5) FALSE 6) TRUE 7) TRUE 8) TRUE 9) FALSE 10) TRUE 11) FALSE 12) TRUE 13) TRUE 14) TRUE 15) FALSE 16) TRUE 17) FALSE 18) TRUE 19) FALSE 20) TRUE 21) TRUE 22) FALSE 23) TRUE 24) TRUE 25) FALSE 26) FALSE 27) FALSE 28) TRUE 29) FALSE 30) C 31) D 32) E 33) D 34) C 35) D 36) A 37) E 38) D 39) A 40) B 41) C 42) D 43) B 44) D 45) C 46) D 47) D 48) B 49) C 50) A 51) E 52) C 53) C 54) B 55) A 56) A 57) C 58) E 59) B 60) C 61) A 62) C 63) A 64) D 65) E 66) B 67) B 68) D 69) E 70) C 71) A 72) D 73) C 74) E 75) E 76) B 77) E 78) B 79) C 80) disasters 81) spoofing 82) phishing 83) IP spoofing 84) error 85) disclosure 86) phisher 87) pretexting 88) e-mail 89) malware 90) physical 91) Sniffing 92) wireless 93) Hacking 94) denial of service 95) worm 96) program 97) smart card 98) PIN 99) biometric 100) authenticate 101) single sign-on (SSO) 102) Spyware 103) controls 104) secrecy 105) Unauthorized data disclosure can occur by human error when someone inadvertently releases data in violation of policy. An example at a university would be a new department administrator who posts student names, numbers, and grades in a public place, when the releasing of names and grades violates provincial law. Another example is employees who unknowingly or carelessly release proprietary data to competitors or to the media. 106) Pretexting occurs when someone deceives by pretending to be someone else. A common scam involves a telephone caller who pretends to be from a credit card company and claims to be checking the validity of credit card numbers: "I'm checking your MasterCard number; it begins 5181. Can you verify the rest of the number?" All MasterCard numbers start with 5181; the caller is attempting to steal a valid number. 107) Phishing is a technique for obtaining unauthorized data that uses pretexting via email. The phisher pretends to be a legitimate company and sends an email requesting confidential data, such as account numbers, social insurance numbers, account passwords, and so forth. Phishing compromises legitimate brands and trademarks. 108) Spoofing is another term for someone pretending to be someone else. If you pretend to be your professor, you are spoofing your professor. IP spoofing occurs when an intruder uses another site's IP address as if it were that other site. Email spoofing is a synonym for phishing. 109) Sniffing is a technique for intercepting computer communications. With wired networks, sniffing requires a physical connection to the network. With wireless networks, no such connection is required: drive-by sniffers simply take computers with wireless connections through an area and search for unprotected wireless networks. 110) The three sources of security threats are from human errors, malicious activities, and natural disasters. The most dangerous in terms of losses to corporations is still without a doubt, human error, though the potential cost of hackers can be significantly higher. It is easiest to plan for natural disasters because much of this involves just planning for the right location. 111) Unauthorized data disclosure can occur through human error, hacker activity, and from natural disasters. There have been a number of cases where companies have mistakenly released customer names on Web sites and through other means. More serious is the growth in the number of phishers who pretend to be someone else and send e-mail messages trying to get access to credit card and bank account data. Some versions of this are called pretexting, spoofing, e-mail spoofing, and IP spoofing. Sniffing is a technique where hackers intercept regular network and wireless network traffic. Sensitive data may also be inadvertently released during a natural disaster crisis. 112) For telecommunications applications and especially Web sites, there is a significant risk that servers are so overwhelmed with service requests, that they cannot serve legitimate requests. A denial of service can be the result of human error by inadvertently running applications that are too complicated for the network or by too many users making requests at the same time. Hackers have written programs such as network worms that are designed to exploit this flaw and shut networks down by flooding the networks with traffic. Some crime organizations have been known to try to extort money from firms by threatening to do this. Natural disasters can cause networks to go down, also resulting in a denial of service. 113) Technical safeguards involve the hardware and software components of an information system and how they can be used to prevent security problems. Smart cards are like credit cards but they have chips on them that hold a lot more data than the magnetic strips. This data is used to identify the user who is required to enter a PIN in order to be authenticated. Biometric authentication is similar except that it uses unique personal characteristics such as fingerprints, retinal scans, or facial features that can be scanned by a computer and matched in a database. This technology is still in the early stages of adoption, but holds a lot of promise for the future. 114) Some advanced operating systems and applications such as enterprise portals, require users to login once and then have the ability to store this information and login the user into any other servers or applications that are part of the allowed network of servers. Users like this because it reduces the time and annoyance of having to remember a whole bunch of different passwords for each server and application. It also reduces the amount of time the password is traveling the network and so reduces the probability that it will be intercepted. The only bad thing is when a hacker does get in, the damage can be much more severe since there are no safeguards in place once the hacker is into the system. 115) Short for malicious software, malware is software designed specifically to damage or disrupt a system. Malware can be a virus, spyware, adware, or a Trojan horse. Sometimes you don't even know you have it on your machine. If your machine gets really slow and has an inordinate number of pop-ups and suspicious changes to the browser homepage or taskbar, then you probably have some form of malware. The most obvious safeguard is to install antivirus and anti-spyware programs. Be careful to get one from a reputable vendor, since malware has been disguised as antivirus programs that you can get for free. Once installed you should set it to scan your computer frequently, at least once a week. To keep it current you must frequently update your malware definitions. Be sure that you don't open any e-mail attachments from unknown e-mail addresses, since this is the most common way to get malware on your computer. TRUE/FALSE. Write 'T' if the statement is true and 'F' if the statement is false. 1) Phishing is when someone sends an e-mail pretending to be a legitimate company and asking for confidential data, such as account numbers. 1) _______ 2) Spoofing is a technique for intercepting computer communications. 2) _______ 3) People who intentionally gain unauthorized access to computer systems are called hackers. 3) _______ 4) Drive-by spoofers take computers with wireless connections through an area and search for unprotected wireless networks. 4) _______ 5) Denial of service always occurs because of malicious attacks on the system. 5) _______ 6) When a hacker floods a web server with millions of bogus service requests so that it cannot service legitimate requests, this is called a denial of service attack. 6) _______ 7) Any action, device, procedure, technique, or other measure that reduces a system's vulnerability to a threat is a safeguard. 7) _______ 8) Despite warnings, users have a tendency to write their passwords on sticky notes next to the computer. 8) _______ 9) Smart cards are convenient and easy to use since they don't require any PIN numbers for authentication. 9) _______ 10) A retinal scan would be considered a biometric authentication technique. 10) ______ 11) Biometric authentication has been around for some time, and because of weaknesses is not likely to see much usage in the future. 11) ______ 12) Technical safeguards involve the hardware and software components of an information system. 12) ______ 13) Malware protection is an example of a technical safeguard. 13) ______ 14) Encryption is one of several technical safeguards. 14) ______ 15) Malware is used in denial of service attacks. 15) ______ 16) Most anti-malware programs check e-mail attachments for malware code. 16) ______ 17) Data safeguards are designed to protect computer networks. 17) ______ 18) To protect against lost or sabotaged encryption keys, a trusted party should keep a copy of the key. 18) ______ 19) Even if a potential new hire will not have access to sensitive data and systems, they should be extensively screened for security purposes. 19) ______ 20) Care must be taken when terminating employees because they may take harmful and malicious actions. 20) ______ 21) Hardened web sites use special versions of the operating systems and functions that are not required by the application. 21) ______ 22) Help desks have not been the source of many security problems in the past. 22) ______ 23) If you ever receive notification that your password has been reset when you did not request a reset, immediately contact your IS department. 23) ______ 24) The best safeguard against a natural disaster is to have a safe location. 24) ______ 25) Following a disaster, hot sites provide office space, but customers themselves must come and provide and install the equipment needed to continue operations. 25) ______ 26) Viruses and worms don't spread very quickly so it is not essential to move cautiously when one is discovered by someone in your organization. 26) ______ 27) System administrators should store account and password data in plain text files. 27) ______ 28) According to Harry Dent, new technology development occurs in paired waves. 28) ______ 29) Bloggers have not yet had much of an impact on the main stream media. 29) ______ MULTIPLE CHOICE. Choose the one alternative that best completes the statement or answers the question. 30) About ninety percent of all viruses are spread via 30) ______ A) network worms. B) technology. C) e-mail. D) spreadsheets. E) AOL. 31) Since most organizations are protected by a(n) ________, it is not surprising that most viruses spread via e-mail. 31) ______ A) data dictionary B) white-hat hacker C) biometric authentication device D) firewall E) antivirus program 32) Be sure and purchase your antispyware program from a(n) ________ vendor, because some free programs in the past were actually malware programs in disguise. 32) ______ A) inexpensive B) illegitimate C) entrepreneurial D) reasonable E) reputable 33) Users should scan their computers with anti-malware programs at least 33) ______ A) daily. B) once a year. C) biannually. D) once a week. E) once a month. 34) ________, which are the patterns that exist in malware code, should be downloaded and updated frequently. 34) ______ A) Network patches B) Malware patterns C) Malware definitions D) Software updates E) Service packs 35) It is possible for some malware to install itself on your computer by you doing nothing more than opening a(n) 35) ______ A) e-mail B) computer. C) account. D) web page. E) file. 36) Organizations should protect sensitive data by storing it in ________ form. 36) ______ A) encrypted B) secure C) standardized D) digital E) compressed 37) Because encryption keys can be lost or destroyed, a copy of the key should stored with a trusted third party called a(n) 37) ______ A) key account. B) white-hat hacker. C) control account. D) authentication certifier. E) key escrow. 38) The purpose of a(n) ________ is to protect databases and other organizational data. 38) ______ A) data warehouse B) data security group C) steering committee D) data safeguard E) operations group 39) Organizations should store at least some of the backups of the database contents ________, possibly in a remote location. 39) ______ A) off site B) in situ C) on hard drives D) on site 40) ________ to (for) the physical computers that run the DBMS and all devices that store database data should be carefully controlled. 40) ______ A) Design plans B) Access C) Documentation D) References E) Connections 41) ________ safeguards involve the people and procedure components of information systems. 41) ______ A) Technical B) Malware C) Human D) Data E) Firewall 42) In order to prioritize their activities and protect an organization from risk and loss, security personnel must document the position ________ of all employees. 42) ______ A) data access B) level C) controls D) sensitivity E) riskiness 43) ________ considerations should be part of the hiring process. 43) ______ A) Age B) Security C) Gender D) Weight E) Position 44) A company should clearly define the security ________ for each position. 44) ______ A) backups B) safeguards C) levels D) responsibilities E) accounts 45) When an employee is terminated, system administrators should receive advance notice so they can 45) ______ A) plan for security changes. B) fight over the person's office. C) remove accounts and passwords. D) plan a termination party. E) get the employees computer. 46) The best way to safeguard a web site from public users is to ________ the web site against an attack. 46) ______ A) prepare B) update C) defend D) harden E) secure 47) Some of the biggest security threats are from ________ employees. 47) ______ A) happy B) disinterested C) self-motivated D) disgruntled E) contrarian 48) The existence of ________ accounts is a serious security threat. 48) ______ A) network B) unused C) old D) modified E) employee 49) ________ are the primary means of authentication. 49) ______ A) Single sign-on B) Network administrators C) Passwords D) Encrypted keys E) Facial scans 50) Because they kept giving out passwords to users who claimed to have forgotten them, ________ were a serious security risk in the organization. 50) ______ A) help desks B) developers C) interns D) data administrators E) executives 51) Firewalls produce ________ of their activities, which include lists of all dropped packets, and attempts to gain unauthorized access. 51) ______ A) lists B) accounts C) calls D) programs E) logs 52) Computing infrastructure should be located in ________ buildings designed to house expensive and critical equipment. 52) ______ A) remote B) easily accessible C) fire-resistant D) high-tech E) hot-site 53) A ________ is a remote processing centre run by a commercial disaster-recovery service that provides all the equipment needed to continue operations after a disaster. 53) ______ A) cold site B) disaster site C) hot site D) development site E) web farm 54) When an employee notices a virus on his machine, the ________ plan should specify what to do. 54) ______ A) company B) incident response C) antivirus D) security E) technology 55) A(n) ________ is someone who pretends to be a legitimate company and sends e-mail requesting confidential data. 55) ______ A) phisher B) spoofer C) employee D) hacker E) hawker 56) ________ is a technique for intercepting computer communications. 56) ______ A) Sniffing B) Spoofing C) Phishing D) Pretexting E) Hacking 57) In order to intercept communications on ________ networks, drive-by sniffers simply drive or walk around with computers with wireless connections. 57) ______ A) ISP B) WAN C) wireless D) LAN E) commercial 58) With information from an identity theft incident the thieve could ________. 58) ______ A) apply for credit cards in the victim's name B) open new bank accounts in the victim's name C) transfer the victim's bank balances to their own accounts D) take over the victim's financial accounts E) all of the above 59) A hacker can launch a denial of service attack against a web server by ________ it with millions of bogus service requests. 59) ______ A) denying B) flooding C) probing D) programming E) hacking 60) Passwords have weaknesses because users often choose simple passwords, which ________ systems can easily guess. 60) ______ A) security B) malware C) intrusion D) antivirus E) biometric 61) A(n) ________ card has a microchip on it that is loaded with identifying data. 61) ______ A) smart B) identity C) debit D) ATM E) credit 62) Users often resist biometric identification because they feel it is 62) ______ A) ineffective. B) hard to use. C) invasive. D) expensive. E) too technical. 63) Because Microsoft employs hundreds of programmers from around the world in writing its operating systems, they must have careful procedures for ________ what code gets in. 63) ______ A) controlling B) describing C) publishing D) searching E) programming 64) It is sometimes said that waves of important new technologies occur as 64) ______ A) phases. B) rolling cycles. C) flows. D) pairs. E) streams. 65) PIPEDA stands for 65) ______ A) Personal Information Protection and Electronic Disclosure Actions. B) Personal Information Protection and Electronic Disclosure Act. C) Personal Information Protection and Effective Disclosures Act. D) Personal Information Protection and Electronic Disclosures Act. E) Personal Information Protection and Electronic Documents Act. 66) PIPEDA gives individuals the right to know why an organization is ________ their personal information. 66) ______ A) using and disclosing B) collecting, using and disclosing C) collecting and disclosing D) collecting and changing E) changing 67) According to PIPEDA every organization needs to assign the responsibility of ________ to an individual in that organization. 67) ______ A) using personal information B) keeping personal information private C) maintaining personal information D) disclosing personal information E) collecting personal information 68) The popularity and efficacy of search engines like Google have created a source of 68) ______ A) pretexting. B) inadvertent information disclosure. C) phishing. D) entertainment. E) sniffing. 69) To protect yourself from identity theft you can 69) ______ A) ask people why they need to see your identification and what they will use it for. B) use complex passwords. C) carry only the identification and credit cards you need. D) destroy old vehicle registration certificates. E) all of the above 70) Security policy establishment is the responsibility of 70) ______ A) the CEO. B) corporate lawyers. C) senior management. D) middle managers. E) the IT department. 71) Adware is ________ than spyware. 71) ______ A) more benign B) less annoying C) more malicious D) harder to get rid of E) more serious 72) Which is not a way to avoid malware? 72) ______ A) Open email attachments only from known sources. B) Promptly install patches and service packs. C) Update malware definitions. D) Open emails from unknown sources. E) Install anti-virus and antispyware programs. 73) ________ is an organization-wide function that is in charge of developing data policies and enforcing data standards. 73) ______ A) Data adminstration B) Data contents protection C) Data integrity D) Data rights administration E) Data safeguarding 74) Users should be given (the) ________ to perform their jobs 74) ______ A) most possible privileges needed B) administrator privileges C) user privileges D) company standard privileges E) least possible privileges needed 75) Enforcement consists of ________ interdependent factors. 75) ______ A) 2 B) 4 C) 6 D) 5 E) 3 76) Hardening is actually a(n) ________ safeguard. 76) ______ A) data B) technical C) accountability D) security E) human 77) Google’s Street View allows you to click on streets in a Google Maps and get street view images of the location including people on the street at the time of the photograph. Google has brought street view to Canada. When Google said thy were bringing street view to Canada, privacy advocates were concerned that this program may violate PIPEDA because 77) ______ A) Google has failed to gain the consent of people before collecting the images in the photographs. B) Google places the images on a server governed by the Homeland Security Act. C) Google does not have a mechanism to give Canadians whose images are retained in the database to correct inaccuracies. D) A and B only E) A and C only 78) A security incident reporting plan should ________ all incident reports. 78) ______ A) standardize B) centralize C) decentralize D) prioritize E) generalize 79) When an incident is reported ________ is (are) of the essence. 79) ______ A) preparation B) the response C) speed D) a systematic approach E) actions SHORT ANSWER. Write the word or phrase that best completes each statement or answers the question. 80) The sources of security problems are human error, malicious activity, and ________. 80) _____________ 81) Pretexting is the same as ________ in the world of malicious computer activities. 81) _____________ 82) E-mail spoofing, where a hacker uses e-mail to pretend to be someone else, is another name for ________. 82) _____________ 83) ________ occurs when an intruder uses another site's IP address as if it were their own. 83) _____________ 84) Unauthorized data disclosure can occur by simple human ________ when someone inadvertently releases data in violation of a policy. 84) _____________ 85) Phishing is an example of unauthorized data ________. 85) _____________ 86) A(n) ________ is an operation or person that spoofs legitimate companies in an attempt to illegally capture credit card or bank account numbers. 86) _____________ 87) When someone calls and pretends to be from a credit card company in order to check the validity of your credit card number, they are most likely engaging in ________. 87) _____________ 88) Phishing is usually initiated via a(n) ________. 88) _____________ 89) In addition to capturing credit card numbers, phishing schemes sometimes install ________ on your computer. 89) _____________ 90) With wired networks, sniffing requires a(n) ________ connection to the network. 90) _____________ 91) ________ is a technique for intercepting computer communications. 91) _____________ 92) Drive-by sniffers simply take computers with ________ connections through an area and search for unprotected networks. 92) _____________ 93) ________ occurs when a person gains unauthorized access to a computer system. 93) _____________ 94) By starting a computationally intense application at the wrong time, users can inadvertently shut down a network or web server resulting in a(n) ________. 94) _____________ 95) A computer ________ is a program that infiltrates networks and generates so much artificial traffic that it virtually shuts down the network for legitimate traffic. 95) _____________ 96) An organization's security ________ has three components: senior management involvement, safeguards, and a planned incident response. 96) _____________ 97) A(n) ________ has a microchip, which is loaded with authenticating data. 97) _____________ 98) A(n) ________ must be entered when using a smart card in order to provide authentication. 98) _____________ 99) Fingerprints and facial features are used to provide authentication for ________ security devices. 99) _____________ 100) Operating systems today have the capability to ________ users to multiple networks and servers. 100) ____________ 101) Some new operating systems offer a feature called ________, which remembers your data once you enter it the first time and authenticates you to other machines in the network. 101) ____________ 102) ________ programs can be installed on the user's computer without the user's knowledge or permission. 102) ____________ 103) One aspect of security programs is how an organization establishes ________ that provide checks and balances for the people in charge of sensitive data and applications. 103) ____________ 104) Encryption experts generally agree that any encryption algorithm that relies on ________ is ultimately doomed. 104) ____________