mis12-信息系统复习参考8

Management Information Systems, 12e (Laudon)Chapter 8 Securing Information Systems1) In addition to e-mail, instant messages and P2P file-sharing can also pose security threats to computer systems and networks.Answer: TRUEDiff: 1Page Ref: 294AACSB: Use of ITCASE: ComprehensionObjective: 8.12) Computers using cable modems to connect to the Internet are more open to penetration than those connecting via dial-up. Answer: TRUEDiff: 2Page Ref: 294AACSB: Use of ITCASE: ComprehensionObjective: 8.13) Wireless networks are vulnerable to penetration because radio frequency bands are easy to scan.Answer: TRUEDiff: 2Page Ref: 295AACSB: Use of ITCASE: ComprehensionObjective: 8.14) The range of Wi-Fi networks can be extended up to two miles by using external antennae.Answer: FALSEDiff: 3Page Ref: 295AACSB: Use of ITCASE: ComprehensionObjective: 8.15) The WEP specification calls for an access point and its users to share the same 40-bit encrypted password.Answer: TRUEDiff: 3Page Ref: 296AACSB: Use of ITCASE: ComprehensionObjective: 8.16) Viruses can be spread through e-mail.Answer: TRUEDiff: 1Page Ref: 296AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.17) Computer worms spread much more rapidly than computer viruses. Answer: TRUEDiff: 2Page Ref: 296AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.18) One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender. Answer: TRUEDiff: 2Page Ref: 299AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.19) Sniffers enable hackers to steal proprietary information from anywhere on a network, including e-mail messages, company files, and confidential reports. Answer: TRUEDiff: 2Page Ref: 299AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.210) DoS attacks are used to destroy information and access restricted areas of a companys information system.Answer: FALSEDiff: 2Page Ref: 299AACSB: Use of ITCASE: ComprehensionObjective: 8.211) DoS attacks are one of the most economically damaging kinds of computer crime.Answer: TRUEDiff: 3Page Ref: 300-301AACSB: Use of ITCASE: ComprehensionObjective: 8.212) Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.Answer: TRUEDiff: 2Page Ref: 303AACSB: Use of ITCASE: ComprehensionObjective: 8.213) An acceptable use policy defines the acceptable level of access to information assets for different users.Answer: FALSEDiff: 2Page Ref: 310AACSB: Use of ITCASE: ComprehensionObjective: 8.314) Biometric authentication is the use of physical characteristics such as retinal images to provide identification. Answer: TRUEDiff: 1Page Ref: 313AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.415) Packet filtering catches most types of network attacks. Answer: FALSEDiff: 2Page Ref: 315AACSB: Use of ITCASE: ComprehensionObjective: 8.416) NAT conceals the IP addresses of the organizations internal host computers to deter sniffer programs.Answer: TRUEDiff: 2Page Ref: 315AACSB: Use of ITCASE: ComprehensionObjective: 8.417) SSL is a protocol used to establish a secure connection between two computers. Answer: TRUEDiff: 2Page Ref: 317AACSB: Use of ITCASE: ComprehensionObjective: 8.418) Public key encryption uses two keys. Answer: TRUEDiff: 2Page Ref: 3127AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.419) High-availability computing is also referred to as fault tolerance.Answer: FALSEDiff: 2Page Ref: 319AACSB: Use of ITCASE: ComprehensionObjective: 8.220) Both software metrics and software testing are techniques used to improve software quality.Answer: TRUEDiff: 2Page Ref: 320AACSB: Use of ITCASE: ComprehensionObjective: 8.421) _ refers to policies, procedures, and technical measures used to prevent unauthorized access, alternation, theft, or physical damage to information systems. A) SecurityB) ControlsC) BenchmarkingD) AlgorithmsAnswer: ADiff: 2Page Ref: 293AACSB: Use of ITCASE: ComprehensionObjective: 8.322) _ refers to all of the methods, policies, and organizational procedures that ensure the safety of the organizations assets, the accuracy and reliability of its accounting records, and operational adherence to management standards.A) Legacy systemsB) SSID standardsC) VulnerabilitiesD) ControlsAnswer: DDiff: 2Page Ref: 293AACSB: Use of ITCASE: ComprehensionObjective: 8.323) Which of the following does not pose a security threat to wireless networks?A) broadcasted SSIDsB) scannability of radio frequency bandsC) SQL injection attacksD) geographic range of wireless signalsAnswer: CDiff: 1Page Ref: 295-296AACSB: Analytic SkillsCASE: Evaluation in terms of assessObjective: 8.124) Electronic data are more susceptible to destruction, fraud, error, and misuse because information systems concentrate data in computer files thatA) are usually bound up in legacy systems that are difficult to access and difficult to correct in case of error. B) are not secure because the technology to secure them did not exist at the time the files were created.C) have the potential to be accessed by large numbers of people and by groups outside of the organization. D) are frequently available on the Internet. Answer: CDiff: 2Page Ref: 293-294AACSB: Analytic SkillsCASE: Analysis in terms of compareObjective: 8.125) Unauthorized access is a security challenge that is most likely to occur in which of the following points of a corporate network?A) client computer B) communications linesC) corporate serverD) internal corporate back-end systemAnswer: ADiff: 3Page Ref: 293AACSB: Analytic SkillsCASE: Analysis in terms of examineObjective: 8.126) Sniffing is a security challenge that is most likely to occur in which of the following points of a corporate network?A) client computer B) communications linesC) corporate servers D) internal corporate back-end systemAnswer: BDiff: 2Page Ref: 293AACSB: Analytic SkillsCASE: Analysis in terms of examineObjective: 8.127) Inputting data into a poorly programmed Web form in order to disrupt a companys systems and networks is calledA) a Trojan horse.B) an SQL injection attack.C) key logging.D) a DDoS attack.Answer: BDiff: 2Page Ref: 298AACSB: Analytic SkillsCASE: Analysis in terms of examineObjective: 8.128) The Internet poses specific security problems becauseA) it was designed to be easily accessible. B) Internet data is not run over secure lines. C) Internet standards are universal. D) it changes so rapidly.Answer: ADiff: 2Page Ref: 294AACSB: Use of ITCASE: ComprehensionObjective: 8.129) Which of the following statements about the Internet security is not true?A) The use of P2P networks can expose a corporate computer to outsiders.B) A corporate network without access to the Internet is more secure than one provides access.C) VoIP is more secure than the switched voice network.D) Instant messaging can provide hackers access to an otherwise secure network.Answer: CDiff: 2Page Ref: 294-295AACSB: Analytic SkillsCASE: Analysis in terms of appraiseObjective: 8.130) An independent computer program that copies itself from one computer to another over a network is called aA) worm.B) Trojan horse.C) bug.D) pest.Answer: ADiff: 2Page Ref: 296AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.131) A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitors advertising costs up. This is an example of A) phishing.B) pharming.C) spoofing.D) click fraud.Answer: DDiff: 2Page Ref: 302AACSB: Analytic SkillsCASE: Analysis in terms of categorizeObjective: 8.232) In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On the vendors site, a small program called Mitglieder was downloaded to the users machine. The program enabled outsiders to infiltrate the users machine. What type of malware is this an example of?A) Trojan horseB) virusC) wormD) spywareAnswer: ADiff: 2Page Ref: 298AACSB: Analytic SkillsCASE: Analysis in terms of categorizeObjective: 8.133) Redirecting a Web link to a different address is a form ofA) snooping.B) spoofing.C) sniffing.D) war driving.Answer: BDiff: 2Page Ref: 299AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.134) A keylogger is a type ofA) worm.B) Trojan horse.C) virus.D) spyware.Answer: DDiff: 1Page Ref: 298AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.135) Hackers create a botnet byA) infecting Web search bots with malware.B) by using Web search bots to infect other computers.C) by causing other peoples computers to become zombie PCs following a master computer.D) by infecting corporate servers with zombie Trojan horses that allow undetected access through a back door.Answer: CDiff: 2Page Ref: 299AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.136) Using numerous computers to inundate and overwhelm the network from numerous launch points is called a _ attack.A) DDoSB) DoSC) SQL injectionD) phishingAnswer: ADiff: 2Page Ref: 299AACSB: Use of ITCASE: ComprehensionObjective: 8.137) Which of the following is not an example of a computer used as a target of crime?A) knowingly accessing a protected computer to commit fraudB) accessing a computer system without authorityC) illegally accessing stored electronic communicationD) threatening to cause damage to a protected computerAnswer: CDiff: 2Page Ref: 300AACSB: Analytic SkillsCASE: Analysis in terms of categorizeObjective: 8.138) Which of the following is not an example of a computer used as an instrument of crime? A) theft of trade secretsB) intentionally attempting to intercept electronic communicationC) unauthorized copying of softwareD) breaching the confidentiality of protected computerized dataAnswer: DDiff: 2Page Ref: 300AACSB: Analytic SkillsCASE: Analysis in terms of categorizeObjective: 8.139) Phishing is a form ofA) spoofing.B) logging.C) sniffing.D) driving.Answer: ADiff: 2Page Ref: 301AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.140) An example of phishing isA) setting up a bogus Wi-Fi hot spot. B) setting up a fake medical Web site that asks users for confidential information. C) pretending to be a utility companys employee in order to garner information from that company about their security system. D) sending bulk e-mail that asks for financial aid under a false pretext. Answer: BDiff: 2Page Ref: 301AACSB: Analytic SkillsCASE: Analysis in terms of categorizeObjective: 8.141) Evil twins areA) Trojan horses that appears to the user to be a legitimate commercial software application.B) e-mail messages that mimic the e-mail messages of a legitimate business. C) fraudulent Web sites that mimic a legitimate businesss Web site. D) bogus wireless network access points that look legitimate to users.Answer: DDiff: 1Page Ref: 301AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.142) Pharming involvesA) redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser. B) pretending to be a legitimate businesss representative in order to garner information about a security system. C) setting up fake Web sites to ask users for confidential information. D) using e-mails for threats or harassment. Answer: ADiff: 2Page Ref: 301AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.143) You have been hired as a security consultant for a law firm. Which of the following constitutes the greatest source of security threats to the firm? A) wireless networkB) employeesC) authentication proceduresD) lack of data encryptionAnswer: BDiff: 2Page Ref: 302AACSB: Analytic SkillsCASE: Evaluation in terms of assessObjective: 8.144) Tricking employees to reveal their passwords by pretending to be a legitimate member of a company is calledA) sniffing.B) social engineering.C) phishing.D) pharming.Answer: BDiff: 1Page Ref: 302AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.145) How do software vendors correct flaws in their software after it has been distributed?A) issue bug fixesB) issue patchesC) re-release softwareD) issue updated versionsAnswer: BDiff: 2Page Ref: 303AACSB: Use of ITCASE: ComprehensionObjective: 8.446) The HIPAA Act of 1997A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. Answer: DDiff: 2Page Ref: 306AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.247) The Gramm-Leach-Bliley ActA) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. Answer: ADiff: 3Page Ref: 306AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.248) The Sarbanes-Oxley ActA) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules.Answer: CDiff: 2Page Ref: 306AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.249) The most common type of electronic evidence isA) voice mail.B) spreadsheets.C) instant messages.D) e-mail.Answer: DDiff: 2Page Ref: 307AACSB: Use of ITCASE: ComprehensionObjective: 8.250) Electronic evidence on computer storage media that is not visible to the average user is called _ data. A) defragmentedB) ambientC) forensicD) fragmentedAnswer: BDiff: 2Page Ref: 307AACSB: Use of ITCASE: ComprehensionObjective: 8.251) Application controlsA) can be classified as input controls, processing controls, and output controls. B) govern the design, security, and use of computer programs and the security of data files in general throughout the organization. C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.D) include software controls, computer operations controls, and implementation controls. Answer: ADiff: 2Page Ref: 308AACSB: Use of ITCASE: ComprehensionObjective: 8.352) _ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.A) Software B) Administrative C) Data security D) Implementation Answer: CDiff: 3Page Ref: 308AACSB: Use of ITCASE: ComprehensionObjective: 8.353) Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)A) security policy.B) AUP.C) risk assessment.D) business impact analysis.Answer: CDiff: 2Page Ref: 309AACSB: Use of ITCASE: ComprehensionObjective: 8.354) A(n) _ system is used to identify and authorize different categories of system users and specify which portions of the organizations systems each user can access.A) identity managementB) AUPC) authenticationD) firewallAnswer: ADiff: 1Page Ref: 310AACSB: Use of ITCASE: ComprehensionObjective: 8.455) Which of the following is not one of the main firewall screening techniques?A) application proxy filteringB) static packet filteringC) NATD) secure socket filteringAnswer: DDiff: 2Page Ref: 314-315AACSB: Use of ITCASE: ComprehensionObjective: 8.456) Rigorous password systemsA) are one of the most effective security tools.B) may hinder employee productivity.C) are costly to implement.D) are often disregarded by employees.Answer: BDiff: 2Page Ref: 314AACSB: Use of ITCASE: ComprehensionObjective: 8.457) An authentication token is a(n)A) device the size of a credit card that contains access permission data. B) type of smart card. C) gadget that displays passcodes. D) electronic marker attached to a digital authorization file. Answer: CDiff: 2Page Ref: 313AACSB: Use of ITCASE: ComprehensionObjective: 8.458) Which of the following is not a trait used for identification in biometric systems?A) retinal imageB) voiceC) hair colorD) faceAnswer: CDiff: 1Page Ref: 313AACSB: Reflective ThinkingCASE: ComprehensionObjective: 8.459) A firewall allows the organization toA) prevent unauthorized communication both into and out of the network.B) monitor network hot spots for signs of intruders.C) prev