Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
Chapter 8 Securing Information Systems
1) A drive-by download is a technique used by hackers to enable accessing files on a wireless
network.
2) Computers using cable modems to connect to the Internet are more open to penetration than
those connecting via dial-up.
3) Wireless networks are vulnerable to penetration because radio frequency bands are easy to
scan.
4) Mobile devices are not targeted as extensively by malware as traditional computers.
5) A Trojan horse is a software program that appears to be benign but then does something
other than expected.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
6) Viruses can be spread through e-mail.
7) Computer worms spread much more rapidly than computer viruses.
8) One form of spoofing involves forging the return address on an e-mail so that the e-mail
message appears to come from someone other than the sender.
9) Sniffers enable hackers to steal proprietary information from anywhere on a network,
including e-mail messages, company files, and confidential reports.
10) DoS attacks are used to destroy information and access restricted areas of a company’s
information system.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
11) In a walkthrough, hackers are able to bypass security controls of a system with little
opposition.
12) Zero defects cannot be achieved in larger software programs because fully testing programs
that contain thousands of choices and millions of paths would require thousands of years.
13) An acceptable use policy defines the acceptable level of access to information assets for
different users.
14) Biometric authentication is the use of physical characteristics such as retinal images to
provide identification.
15) Packet filtering catches most types of network attacks.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
16) NAT conceals the IP addresses of the organization’s internal host computers to deter sniffer
programs.
17) SSL is a protocol used to establish a secure connection between two computers.
18) Public key encryption uses two keys.
19) High-availability computing is also referred to as fault tolerance.
20) Unauthorized access is a security challenge that is most likely to occur in a network at the
point of client computers.
21) Controls refers to the policies, procedures, and technical measures used to prevent
unauthorized access, alteration, theft, or physical damage to information systems.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
22) Security are methods, policies, and organizational procedures that ensure the safety of the
organization’s assets, the accuracy and reliability of its records, and operational adherence
to management standards.
23) Wireless networks in many locations do not have basic protections against war driving in
which eavesdroppers drive by buildings or park outside and try to intercept wireless
network traffic.
24) A computer virus is a rogue software program that attaches itself to other software programs
or data files in order to be executed, usually without user knowledge or permission.
25) A hacker is an individual who intends to gain unauthorized access to a computer system.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
26) Cyber vandalism is the intentional disruption, defacement, or even destruction of a Web site
or corporate information system.
27) Pharming redirects users to a bogus Web page, even when the individual types the correct
Web page address into his or her browser.
28) Cyber vandalism occurs when an individual or computer program fraudulently clicks on an
online ad without any intention of learning more about the advertiser or making a purchase.
29) Digital Warfare is a state-sponsored activity designed to cripple and defeat another state or
nation by penetrating its computers or networks for the purposes of causing damage and
disruption
30) ________ refers to policies, procedures, and technical measures used to prevent
unauthorized access, alternation, theft, or physical damage to information systems.
A) “Security”
B) “Controls”
C) “Benchmarking”
D) “Algorithms”
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
31) ________ refers to all of the methods, policies, and organizational procedures that ensure
the safety of the organization’s assets, the accuracy and reliability of its accounting records,
and operational adherence to management standards.
A) “Legacy systems”
B) “SSID standards”
C) “Vulnerabilities”
D) “Controls”
32) Which of the following is not one of the challenges in securing wireless networks?
A) broadcasted SSIDs
B) scannability of radio frequency bands
C) SQL injection attacks
D) geographic range of wireless signals
33) Electronic data are more susceptible to destruction, fraud, error, and misuse because
information systems concentrate data in computer files that
A) are usually bound up in legacy systems that are difficult to access and difficult to correct
in case of error.
B) are not secure because the technology to secure them did not exist at the time the files
were created.
C) have the potential to be accessed by large numbers of people and by groups outside of
the organization.
D) are frequently available on the Internet.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
34) All of the following are methods of ensuring software quality except for
A) systems analysis.
B) walkthroughs.
C) software testing.
D) internal corporate back-end system.
35) Sniffing is a security challenge that is most likely to occur in which of the following points
of a corporate network?
A) client computer
B) communications lines
C) corporate servers
D) internal corporate back-end system
36) Inputting data into a poorly programmed Web form in order to disrupt a company’s systems
and networks is called
A) a Trojan horse.
B) an SQL injection attack.
C) key logging.
D) a DDoS attack.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
37) The Internet poses specific security problems because
A) it was designed to be easily accessible.
B) Internet data is not run over secure lines.
C) Internet standards are universal.
D) it changes so rapidly.
38) Which of the following statements about the Internet security is not true?
A) The use of P2P networks can expose a corporate computer to outsiders.
B) A corporate network without access to the Internet is more secure than one provides
access.
C) VoIP is more secure than the switched voice network.
D) Instant messaging can provide hackers access to an otherwise secure network.
39) An independent computer program that copies itself from one computer to another over a
network is called a
A) worm.
B) Trojan horse.
C) bug.
D) pest.
40) A salesperson clicks repeatedly on the online ads of a competitor’s in order to drive the
competitor’s advertising costs up. This is an example of
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
A) phishing.
B) pharming.
C) spoofing.
D) click fraud.
41) In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On
the vendor’s site, a small program called Mitglieder was downloaded to the user’s machine.
The program enabled outsiders to infiltrate the user’s machine. What type of malware is this
an example of?
A) Trojan horse
B) virus
C) worm
D) spyware
42) Redirecting a Web link to a different address is a form of
A) snooping.
B) spoofing.
C) sniffing.
D) war driving.
43) A keylogger is a type of
A) worm.
B) Trojan horse.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
C) virus.
D) spyware.
44) Hackers create a botnet by
A) infecting Web search bots with malware.
B) using Web search bots to infect other computers.
C) causing other people’s computers to become “zombie” PCs following a master
computer.
D) infecting corporate servers with “zombie” Trojan horses that allow undetected access
through a back door.
45) Using numerous computers to inundate and overwhelm the network from numerous launch
points is called a(n) ________ attack.
A) DDoS
B) DoS
C) SQL injection
D) phishing
46) Which of the following is not an example of a computer used as a target of crime?
A) knowingly accessing a protected computer to commit fraud
B) accessing a computer system without authority
C) illegally accessing stored electronic communication
D) threatening to cause damage to a protected computer
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
47) Which of the following is not an example of a computer used as an instrument of crime?
A) theft of trade secrets
B) intentionally attempting to intercept electronic communication
C) unauthorized copying of software
D) breaching the confidentiality of protected computerized data
48) An example of phishing is
A) setting up bogus Wi-Fi hot spots.
B) setting up a fake medical Web site that asks users for confidential information.
C) pretending to be a utility company’s employee in order to garner information from that
company about their security system.
D) sending bulk e-mail that asks for financial aid under a false pretext.
49) Evil twins are
A) Trojan horses that appears to the user to be a legitimate commercial software application.
B) e-mail messages that mimic the e-mail messages of a legitimate business.
C) fraudulent Web sites that mimic a legitimate business’s Web site.
D) bogus wireless network access points that look legitimate to users.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
50) Pharming involves
A) redirecting users to a fraudulent Web site even when the user has typed in the correct
address in the Web browser.
B) pretending to be a legitimate business’s representative in order to garner information
about a security system.
C) setting up fake Web sites to ask users for confidential information.
D) using e-mails for threats or harassment.
51) You have been hired as a security consultant for a law firm. Which of the following
constitutes the greatest source of security threats to the firm?
A) wireless network
B) employees
C) authentication procedures
D) lack of data encryption
52) Tricking employees to reveal their passwords by pretending to be a legitimate member of a
company is called
A) sniffing.
B) social engineering.
C) phishing.
D) pharming.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
53) How do software vendors correct flaws in their software after it has been distributed?
A) issue bug fixes
B) issue patches
C) re-release software
D) issue updated versions
54) The Sarbanes-Oxley Act
A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of
financial information.
D) outlines medical security and privacy rules.
55) The most common type of electronic evidence is
A) voice-mail.
B) spreadsheets.
C) instant messages.
D) e-mail.
56) Electronic evidence on computer storage media that is not visible to the average user is
called ________ data.
A) defragmented
B) ambient
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
C) forensic
D) fragmented
57) Application controls
A) can be classified as input controls, processing controls, and output controls.
B) govern the design, security, and use of computer programs and the security of data files
in general throughout the organization.
C) apply to all computerized applications and consist of a combination of hardware,
software, and manual procedures that create an overall control environment.
D) include software controls, computer operations controls, and implementation controls.
58) ________ controls ensure that valuable business data files on either disk or tape are not
subject to unauthorized access, change, or destruction while they are in use or in storage.
A) Software
B) Administrative
C) Data security
D) Implementation
59) Analysis of an information system that rates the likelihood of a security incident occurring
and its cost is included in a(n)
A) security policy.
B) AUP.
C) risk assessment.
D) business impact analysis.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
60) A(n) ________ system is used to identify and authorize different categories of system users
and specify which portions of the organization’s systems each user can access.
A) identity management
B) AUP
C) authentication
D) firewall
61) Which of the following is not one of the main firewall screening techniques?
A) application proxy filtering
B) static packet filtering
C) NAT
D) secure socket filtering
62) Rigorous password systems
A) are one of the most effective security tools.
B) may hinder employee productivity.
C) are costly to implement.
D) are often disregarded by employees.
Laudon/Laudon/Brabston, Management Information Systems, Seventh Canadian Edition
63) An authentication token is a(n)
A) device the size of a credit card that contains access permission data.
B) type of smart card.
C) gadget that displays passcodes.
D) electronic marker attached to a digital authorization file.
64) Which of the following is not a trait used for identification in biometric systems?
A) retinal image
B) voice
C) hair color
D) face
65) A firewall allows the organization to
A) prevent unauthorized communication both into and out of the network.
B) monitor network hot spots for signs of intruders.
C) prevent known spyware and malware from entering the system.
D) all of the above.
66) In which technique are network communications analyzed to see whether packets are part of
an ongoing dialogue between a sender and a receiver?
A) stateful inspection
B) intrusion detection system