Chapter 17
1. Which of the following is described as the viewing of information that passes along a network line?
a.
Sniffing
b.
Spoofing
c.
Hijacking
d.
Impersonation
a
a.
1
2. The threat of falsified identity is less of a concern in the case of:
a.
virtual private networks.
b.
traditional EDI settings.
c.
e-business.
d.
unsecured online transactions.
b
a.
c.
d.
1
3. What is the most important aspect of internal control?
a.
Audit committee
b.
Control policies
c.
Control system
d.
Personnel
d
a.
b.
c.
d.
1
4. What is biometrics?
a.
A vital part of the security of any electronic system.
b.
The use of unique features of the human body to create secure access controls.
c.
The most important aspect of internal control in an organization.
d.
An authorization that reassures users that transactions are valid.
Chapter 17
b
a.
b.
c.
d.
1
5. What is spoofing?
a.
Using a subtly different Internet host name to mimic another business.
b.
Changing the information in e-mail headers or IP addresses.
c.
Extracting personal or corporate computer information from employees.
d.
Viewing the information that passes along a network line.
b
a.
b.
c.
d.
1
6. Which of the following can be defined as the use of unique features of the human body to create secure access controls?
a.
Digital Signatures
b.
Passwords
c.
Biometrics
d.
Firewalls
c
a.
b.
c.
d.
1
7. What is the term for when a hacker calls a targeted user posing as technical support and asks the victim to divulge the
account information so that immediate steps can be taken to prevent data loss from the account?
a.
social engineering
b.
spoofing
c.
data theft
d.
customer impersonation
a
a.
b.
c.
d.
1
8. Which element of the fraud triangle can companies reduce in order to prevent fraud in e-business?
a.
Pressure
b.
Opportunity
c.
Rationalization
d.
Interaction
b
a.
c.
d.
1
9. Generally, the best way to prevent fraud in e-business settings is to focus on:
a.
reducing pressures.
b.
buying and implementing anti-virus software.
c.
reducing fraud opportunities.
d.
hiring security experts.
c
a.
b.
1
10. In an electronic environment, no other control can better prevent fraud than the wise use of _________.
a.
digital certificates
b.
biometrics
c.
anti-virus software
d.
passwords
d
a.
b.
c.
d.
1
11. Why are passwords often considered the “Achilles’ heel” of electronic systems?
a.
Password selection is left to the end user and cannot be fully controlled.
b.
Systems cannot handle complex passwords.
c.
Any password can be easily hacked.
d.
No other control can better prevent fraud than the wise use of passwords.
a
12. Which of the following is NOT a general type of control activity?
a.
Adequate separation of duties
b.
Independent checks on performance
c.
Proper authorization of transactions and activities
d.
Use of internal auditors
d
b.
Incorrect. The need for independent checks arises because internal controls change over time.
d.
1
13. Which of the following are self-contained programs that represent one of the biggest threats in e-commerce fraud?
a.
P2P programs
b.
Internet worms
c.
Trojan Horses
d.
Spyware
b
a.
b.
c.
d.
1
14. One of the greatest fallacies of e-commerce security is depending on which of the following?
a.
risk-assessment
b.
security through obscurity
c.
digital signature
d.
biometrics
b
a.
c.
d.
b.
c.
d.
1
15. Which of the following refers to the tactic of keeping security holes, encryption algorithms, and processes secret in an
effort to confuse attackers?
a.
Authorization control
b.
Secure socket layer
c.
Security through obscurity
d.
Biometrics
c
a.
b.
c.
d.
1
16. Passwords, biometrics, and digital signatures are examples of which of the following?
a.
physical controls
b.
segregation of duties
c.
authorization controls
d.
checks on performance
c
a.
Incorrect. Physical controls relate to the security of the system.
c.
Correct. Passwords, biometrics, and digital signatures are examples of authorization controls.
1
17. Which of the following installs monitoring software in addition to the regular software that a user downloads or buys?
a.
Internet worm
b.
Bot
c.
Middleware
d.
Spyware
d
a.
b.
c.
d.
1
18. Why is it that internet user information can be hijacked when they conduct web visits?
a.
social engineering has made it easy to do so.
b.
many managers lack the technical expertise to prevent and detect data theft.
c.
data can be transferred easily and quickly to any location in the world.
1
Chapter 17
d.
subtle differences in Internet host names often go unnoticed by Internet users.
d
a.
b.
c.
1
19. What is usually the primary goal in traditional fraud?
a.
Financial statement fraud
b.
Identity theft
c.
Theft of money
d.
Information theft
c
a.
b.
c.
d.
1
20. What is normally the primary concern in an electronic environment?
a.
Financial statement fraud
b.
Data theft
c.
Theft of money
d.
Asset misappropriation
b
a.
b.
c.
d.
1
21. What is the term that describes the act of trying to gain access to networks and secure information?
a.
troubleshooting
b.
intrusion detection
c.
encryption
d.
security audit
b
a.
b.
c.
d.
22. What is the primary electronic transaction and document control used in e-commerce?
a.
Encryption
b.
Spoofing
c.
Physical control
d.
Biometric control
a
a.
b.
c.
d.
1
23. What is the term for a method of injecting Javascript and other browser commands into the Web site data.
a.
Database query injection
b.
HTML
c.
Cross-site scripting
d.
Java
c
a.
b.
d.
1
24. A hacker sends a database command after regular data in an online submission form. This
command inserts an unauthorized record giving access to the hacker. Which risk is being discussed here?
a.
SQL injection
b.
HTML
c.
Cross-site scripting
d.
Java
a
a.
b.
c.
d.
1
25. Which of the following examples illustrates sniffing?
a.
A fraudster impersonating a customer and buying equipment on the customer’s account.
b.
A fraudster viewing design data of a special project that is being transferred over a network.
c.
A fraudster using another employee’s passwords to access sensitive information.
1
Chapter 17
d.
An Internet site mimicking another site by using .org instead of .com.
b
a.
b.
c.
d.
1
26. A hacker sends an e-mail impersonating technical support to two hundred employees of a company. Four employees
respond with their password, thereby allowing the hacker to access the company’s internal networks.Which technique is
being discussed here?
a.
Sniffing
b.
Crawling
c.
Phishing
d.
Wartrapping
c
a.
b.
c.
d.
1
27. What is the term for a technique in which hackers go to known business traveler locations like airports and set up
access points (look like regular wireless networks) through their laptops to the Internet?
a.
social engineering
b.
spoofing
c.
phishing
d.
wartrapping
d
a.
b.
c.
d.
1
28. The advantage of e-business transactions is:
a.
the use of encryption which protects confidential and sensitive information from being stolen.
b.
that information about the transactions is captured in databases that can be analyzed in numerous ways.
c.
the absence of hard-copy documentation, the very essence of e-commerce.
d.
that they not only make fraud easier to commit, but also make it much easier to detect.
b
a.
b.
Correct. These data make fraud detection much easier than ever before.
c.
29. What is a person who sends e-mail or pop–up messages to users asking for personal information in inventive ways
called?
a.
trojan
b.
sniffer
c.
spoofer
d.
phisher
d
a.
b.
c.
d.
1
30. Which of the following human features is generally used in biometrics?
a.
Height
b.
Fingerprints
c.
Complexion
d.
Weight
b
a.
b.
c.
d.
1
31. What allows information to be sent in encoded format over unsecured networks like the Internet and is widely used to
protect data and ensure privacy?
a.
Virtual private network
b.
Public-key encryption
c.
Cross-site scripting
d.
SQL injection
b
a.
b.
c.
d.
1
32. The most difficult aspect of detecting e-business fraud is:
a.
information about the transactions is captured in databases that are impossible to analyze.
b.
correctly specifying the types of frauds that can occur and the symptoms they will generate.
d.
1
Chapter 17
c.
the lack of hard-copy documentation, the very essence of e-business.
d.
to use technology to catch technology fraud.
b
a.
b.
c.
d.
1
33. Which of the terms below best describe the act of employees using sophisticated denial-of-service attempts on local
machines?
a.
phishing
b.
sniffing
c.
vandalism
d.
wartrapping
c
a.
b.
c.
d.
1
34. Which of these is a program that claims to do something useful, but also contains hidden behavior?
a.
A trojan horse
b.
A normal computer virus
c.
An adware
d.
An Internet worm
a
a.
b.
c.
d.
1
35. Which of the following e-commerce threats spreads via direct transfer or email?
a.
internet worms
b.
a Trojan horse
c.
wartrapping
d.
phishing
a
a.
b.
c.
36. Which of the following is NOT an act of vandalism?
a.
deleting a customer data file
b.
pouring hot coffee on a company keyboard
c.
stealing company data lists
d.
throwing a computer monitor
c
a.
Incorrect, deleting files is an example of vandalism.
b.
Incorrect, detroying equpment is an example of vandalism.
c.
Correct, this is legal and fraud or harm may be the intent, but it is not an example of vandalism.
d.
Incorrect, destroying equipment is an example of vandalism.
1
37. Which of the following is the first step in looking for e-business fraud?
a.
Identify the frauds that can occur in the type of business being investigated.
b.
Determine the symptoms of e-business fraud within the business being investigated.
c.
Gain an understanding of the business being investigated.
d.
Investigate any anomalies observed within the business being investigated.
c
a.
Incorrect; this is step 2.
b.
Incorrect; this is step 3.
c.
d.
Incorrect; this is not a step listed, investigating symptoms observed is step 6, the last step.
1
38. Which of the following is NOT a means of using technology to spot technology fraud?
a.
Routinely search databases for symptom.s
b.
Utilize intrusion detective programs.
c.
Secure company systems.
d.
Train employees to recognize probable fraud.
d
a.
Incorrect, this is a means.
b.
Incorrect, this is a means.
c.
Incorrect, this is a means.
d.
Correct, this my help detect fraud, but it is not a means of using technology.
1
39. Which of the following is the last step taken by fraud examiners during an examination of a business when looking for
e-business fraud?
a.
Investigate all symptoms of e-fraud found.
b.
Use information systems to highlight possible fraud activity.
c.
Analyze the results of database searches.
d.
1
Chapter 17
d.
Determine if the activity noted is an anomaly or usual business activity.
a.
b.
c.
d.
1
40. Which of the following activities would be the least practical for a fraud examiner?
a.
gaining an understanding of the tools and methods perpetrators use in e-business fraud
b.
gaining a working knowledge of computer networking systems
c.
learning the strengths and weaknesses of Windows
d.
getting to know each company employee’s interactions with the systems
d
a.
Incorrect, this is very useful and necessary.
b.
Incorrect, this knowledge is very useful and necessary.
d.
Correct, to accomplish this in a business of any size would be too time-consuming.
1