Management Information Systems 1st

Edition Gray Test Bank

Visit to download the full and correct content document: https://testbankdeal.com/dow
nload/management-information-systems-1st-edition-gray-test-bank/
 Testbank
to accompany

Management Information
st
Systems 1 Australasian
Edition
by Rainer et al.

Prepared by

Indrit Troshani, The University of Adelaide

© John Wiley & Sons Australia, Ltd

 MIS – 1st Australasian Edition

Chapter 7
Information security
True or False Questions

1. The security of each computer on the internet is independent of the security of all other computers on
the internet.

a. True
*b. False

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Easy.

2. The computing skills necessary to be a hacker are decreasing.

*a. True
b. False

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Easy.

3. Human errors cause more than half of the security-related problems in many organisations.

*a. True
b. False

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Easy.

4. The higher the level of an employee in organisation, the greater the threat that he or she poses to the
organisation.

*a. True
b. False

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Easy.
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
2
 MIS – 1st Australasian Edition

5. Skip dipping is always illegal because it involves trespassing on private property.

a. True
*b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

6. Software can be copyrighted.

*a. True
b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

7. Trojan horses are software programs that hide in other computer programs and reveal their designed
behaviour only when they are activated.

*a. True
b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

8. Zero-day attacks use deceptive e-mails to acquire sensitive personal information.

a. True
*b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Medium.

9. In most cases, cookies track your path through websites and are therefore invasions of your privacy.

*a. True
b. False
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
3
 MIS – 1st Australasian Edition

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

10. Cyberterrorism and cyberwarfare can attack supervisory control and data acquisition (SCADA)
systems to cause widespread physical damage.

*a. True
b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

11. Supervisory control and data acquisition (SCADA) systems require human data input.

a. True
*b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

12. Cyberterrorism is usually carried out by nations.

a. True
*b. False

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

13. IT security is the responsibility of everyone in the organisation.

*a. True
b. False

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Easy.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
4
 MIS – 1st Australasian Edition

14. Risk analysis involves determining whether security programs are working.

a. True
*b. False

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Medium.

15. A password refers to "something the user is."

a. True
*b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

16. Organisations utilise layers of controls because they face so many diverse threats to information
security.

*a. True
b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

17. Public-key encryption uses two different keys, one public and one private.

*a. True
b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

18. Voice recognition is an example of "something a user does" authentication.

*a. True
b. False

General Feedback:
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
5
 MIS – 1st Australasian Edition

Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

19. Organisations use authentication to establish privileges to systems operations.

*a. True
b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

20. The area located between two firewalls within an organisation is called the demilitarised zone.

*a. True
b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

21. A VPN is a network within the organisation.

a. True
*b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

22. A URL that begins with https rather than http indicates that the site transmits using an extra layer of
security called transport layer security.

*a. True
b. False

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

Multiple Choice Questions

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
6
 MIS – 1st Australasian Edition

23. Which of the following factors is not increasing the threats to information security?

a. Smaller computing devices.

b. Downstream liability.
c. The internet.
*d. Limited storage capacity on portable devices.
e. Due diligence.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Medium.

24. The computing skills necessary to be a hacker are decreasing for which of the following reasons?

a. More information systems and computer science departments are teaching courses on hacking so that
their graduates can recognise attacks on information assets.
*b. Computer attack programs, called scripts, are available for download from the internet.
c. International organised crime is training hackers.
d. Cybercrime is much more lucrative than regular white-collar crime.
e. Almost anyone can buy or access a computer today.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Hard.

25. Rank the following in terms of dollar value of the crime, from highest to lowest.

a. Robbery - white collar crime - cybercrime

b. White collar crime - extortion - robbery
*c. Cybercrime - white collar crime - robbery
d. Cybercrime - robbery - white collar crime
e. White collar crime - burglary - robbery

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Medium.

26. A _____ is any danger to which an information resource may be exposed.

a. vulnerability
b. risk
c. control
*d. threat
e. compromise
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
7
 MIS – 1st Australasian Edition

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Easy.

27. An information system's _____ is the possibility that the system will be harmed by a threat.

*a. vulnerability
b. risk
c. control
d. danger
e. compromise

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Easy.

28. The most overlooked people in information security are:

a. consultants and temporary hires.

b. secretaries and consultants.
c. contract labourers and executive assistants.
*d. janitors and guards.
e. executives and executive secretaries.

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Easy.

29. Employees in which functional areas of the organisation pose particularly grave threats to
information security?

a. Human resources, finance.

*b. Human resources, management information systems.
c. Finance, marketing.
d. Operations management, management information systems.
e. Finance, management information systems.

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Easy.

30. Unintentional threats to information systems include all of the following except:
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
8
 MIS – 1st Australasian Edition

*a. malicious software.

b. tailgating.
c. power outage.
d. lack of user experience.
e. tornados.

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Medium.

31. _____ involves building an inappropriate trust relationship with employees for the purpose of
gaining sensitive information or unauthorised access privileges.

a. Tailgating
b. Hacking
c. Spoofing
*d. Social engineering
e. Spamming

General Feedback:
Chapter 7: LO 2: Compare and contrast human mistakes and social engineering by way of specific
examples. Difficulty: Easy.

32. The cost of a stolen laptop includes all of the following except:

a. loss of intellectual property.

b. loss of data.
*c. backup costs.
d. loss of productivity.
e. replacement cost.

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

33. Skip dipping is:

a. always illegal because it is considered trespassing.

b. never illegal because it is not considered trespassing.
*c. typically committed for the purpose of identity theft.
d. always illegal because individuals own the material in the skip.
e. always legal because the dumpster is not owned by private citizens.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
9
 MIS – 1st Australasian Edition

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Medium.

34. Cybercriminals can obtain the information they need in order to assume another person's identity by:

a. infiltrating an organisation that stores large amounts of personal information.

b. phishing.
c. hacking into a corporate database.
d. stealing mail.
*e. All of the above are strategies to obtain information to assume another person's identity.

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

35. A _____ is intellectual work that is known only to a company and is not based on public information.

a. copyright
b. patent
*c. trade secret
d. knowledge base
e. private property

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

36. A pharmaceutical company's research and development plan for a new class of drugs would be best
described as which of the following?

a. Copyrighted material.
b. Patented material.
*c. A trade secret.
d. A knowledge base.
e. Public property.

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

37. A _____ is a document that grants the holder exclusive rights on an invention for 20 years.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
10
 MIS – 1st Australasian Edition

a. copyright
*b. patent
c. trade secret
d. knowledge base
e. private property notice

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

38. An organisation's e-mail policy has the least impact on which of the following software attacks?

a. virus
b. worm
c. phishing
*d. zero-day
e. spear phishing

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Hard.

39. _____ are segments of computer code that attach to existing computer programs and perform
malicious acts.

*a. Viruses
b. Worms
c. Trojan horses
d. Back doors
e. Logic bombs

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

40. _____ are software programs that hide in other computer programs and reveal their designed
behaviour only when they are activated.

a. Viruses
b. Worms
*c. Trojan horses
d. Back doors
e. Logic bombs

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
11
 MIS – 1st Australasian Edition

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

41. _____ are segments of computer code embedded within an organisation's existing computer
programs that activate and perform a destructive action at a certain time or date.

a. Viruses
b. Worms
c. Trojan horses
d. Back doors
*e. Logic bombs

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

42. A _____ attack uses deception to fraudulently acquire sensitive personal information by
masquerading as an official e-mail.

a. Zero-day
b. Denial-of-service
c. Distributed denial-of-service
*d. Phishing
e. Brute force dictionary

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

43. In a _____ attack, a coordinated stream of requests is launched against a target system from many
compromised computers at the same time.

a. phishing
b. zero-day
c. worm
d. back door
*e. distributed denial-of-service

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
12
 MIS – 1st Australasian Edition

44. The term _____ refers to clandestine software that is installed on your PC through duplicitous
channels but is not particularly malicious.

*a. Alien software

b. Virus
c. Worm
d. Back door
e. Logic bomb

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

45. Which of the following is (are) designed to use your computer as a launch pad for sending
unsolicited e-mail to other computers?

a. Spyware
*b. Spamware
c. Adware
d. Viruses
e. Worms

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Easy.

46. When companies attempt to counter _____ by requiring users to accurately select characters in turn
from a series of boxes, attackers respond by using _____.

*a. keyloggers, screen scrapers

b. screen scrapers, uninstallers
c. keyloggers, spam
d. screen scrapers, keyloggers
e. spam, keyloggers

General Feedback:
Chapter 7: LO 3: Describe negative consequences that might result from at least three different kinds of
deliberate attacks on information systems. Difficulty: Medium.

47. _____ is the process in which an organisation assesses the value of each asset being protected,
estimates the probability that it will be compromised, and compares the probable costs of an attack with
the costs of protecting the asset.

a. Risk management
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
13
 MIS – 1st Australasian Edition

*b. Risk analysis

c. Risk mitigation
d. Risk acceptance
e. Risk transference

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Easy.

48. Which of the following statements is false?

a. Credit card companies usually block stolen credit cards rather than prosecute.
b. People tend to shortcut security procedures because the procedures are inconvenient.
*c. It is easy to assess the value of a hypothetical attack.
d. The online commerce industry isn't willing to install safeguards on credit card transactions.
e. The cost of preventing computer crimes can be very high.

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Medium.

49. In _____, the organisation takes concrete actions against risks.

a. risk management
b. risk analysis
*c. risk mitigation
d. risk acceptance
e. risk transference

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Medium.

50. Which of the following is not a strategy for mitigating the risk of threats against information?

a. Continue operating with no controls and absorb any damages that occur.
b. Transfer the risk by purchasing insurance.
c. Implement controls that minimise the impact of the threat.
d. Install controls that block the risk.
*e. Installing an updated operating system.

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Easy.
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
14
 MIS – 1st Australasian Edition

51. In _____, the organisation purchases insurance as a means to compensate for any loss.

a. risk management
b. risk analysis
c. risk mitigation
d. risk acceptance
*e. risk transference

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Easy.

52. Which of the following statements concerning the difficulties in protecting information resources is
not correct?

a. Computing resources are typically decentralised.

b. Computer crimes often remain undetected for a long period of time.
*c. Rapid technological changes ensure that controls are effective for years.
d. Employees typically do not follow security procedures when the procedures are inconvenient.
e. Computer networks can be located outside the organisation.

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Medium.

53. _____ controls are concerned with user identification, and they restrict unauthorised individuals
from using information resources.

*a. Access
b. Physical
c. Data security
d. Administrative
e. Input

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

54. Access controls involve _____ before _____.

a. biometrics, signature recognition

*b. authentication, authorisation
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
15
 MIS – 1st Australasian Edition

c. iris scanning, voice recognition

d. strong passwords, biometrics
e. authorisation, authentication

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

55. Biometrics are an example of:

*a. something the user is.

b. something the user wants.
c. something the user has.
d. something the user knows.
e. something the user does.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

56. Voice and signature recognition are examples of:

a. something the user is.

b. something the user wants.
c. something the user has.
d. something the user knows.
*e. something the user does.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

57. Passwords and passphrases are examples of:

a. something the user is.

b. something the user wants.
c. something the user has.
*d. something the user knows.
e. something the user does.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
16
 MIS – 1st Australasian Edition

58. Which of the following is not a characteristic of strong passwords?

a. They are difficult to guess.

b. They contain special characters.
c. They are not a recognisable word.
d. They are not a recognisable string of numbers.
*e. They tend to be short so they are easy to remember.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

59. Which of the following is not a strong password?

a. IloveIT
b. 08141990
c. 9AmGt/*
*d. Rainer
e. Information Security

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

60. Bob is using public key encryption to send a message to Ted. Bob encrypts the message with Ted's
_____ key, and Ted decrypts the message using his _____ key.

a. public, public
*b. public, private
c. private, private
d. private, public
e. none of these

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

61. Which of the following statements concerning firewalls is false?

a. Firewalls prevent unauthorised internet users from accessing private networks.

b. Firewalls examine every message that enters or leaves an organisation's network.
c. Firewalls filter network traffic according to categories of activities that are likely to cause problems.
*d. Firewalls filter messages the same way as anti-malware systems do.
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
17
 MIS – 1st Australasian Edition

e. Firewalls are sometimes located inside an organisation's private network.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

62. In a process called _____, a company allows nothing to run unless it is approved, whereas in a
process called _____, the company allows everything to run unless it is not approved.

*a. whitelisting, blacklisting

b. whitelisting, encryption
c. encryption, whitelisting
d. encryption, blacklisting
e. blacklisting, whitelisting

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

63. Organisations use hot sites, warm sites, and cold sites to insure business continuity. Which of the
following statements is false?

a. A cold site has no equipment.

b. A warm site has no user workstations.
*c. A hot site needs to be located close to the organisation's offices.
d. A hot site duplicates all of the organisation's resources.
e. A warm site does not include actual applications.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

64. Your company's headquarters was just hit head on by a cyclone, and the building has lost power. The
company sends you to their hot site to minimise downtime from the disaster. Which of the following
statements is true?

a. The site will not have any servers.

b. The site will not have any workstations, so you need to bring your laptop.
c. The site is probably in the next town.
*d. The site should be an almost exact replica of the IT configuration at headquarters.
e. The site will not have up-to-date data.

General Feedback:

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
18
 MIS – 1st Australasian Edition

Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

65. The forecast for your company's headquarters predicts the area hit head on by a cyclone. The
company sends you to their warm site to minimise downtime should such a disaster hit. Which of the
following statements is true?

a. The site will not have any servers.

b. The site will not have any workstations, so you need to bring your laptop.
c. The site is probably in the next town.
*d. The site will not have any of the company's applications.
e. The site will not have up-to-date data.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

66. The forecast for your company's headquarters predicts the area hit head on by a cyclone. The
company sends you to their cold site to minimise downtime should such a disaster hit. Which of the
following statements is false?

a. The site will not have any servers.

b. The site will not have any workstations, so you need to bring your laptop.
c. The site is probably in the next town.
*d. The site will have all of the company's applications.
e. The site will not have up-to-date data.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

67. You receive an e-mail from your bank informing you that they are updating their records and need
your password. Which of the following statements is true?

a. The message could be an industrial espionage attack.

*b. The message could be a phishing attack.
c. The message could be a denial of service attack.
d. The message could be a back door attack.
e. The message could be a Trojan horse attack.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
19
 MIS – 1st Australasian Edition

68. You start a new job, and the first thing your new company wants you to do is create a user ID and a
password. Which of the following would be a strong password?

a. The name of the company.

b. Your last name.
c. Your birthdate.
d. Your initials (capitalised) and the number of the floor you are on.
*e. The name of the company spelled backward.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

69. You start a new job, and the first thing your new company wants you to do is create a user ID and a
password. To remember your password, you write it on a PostIt note and put it on your laptop screen.
This is an example of:

a. Social engineering.
b. Tailgating.
*c. Poor security.
d. Skip dipping.
e. Phishing.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that contributing to the increasing
vulnerability of information resources. Difficulty: Medium.

70. You start a new job. You know that logging in with your password authenticates who you are. What
actions, rights, or privileges you have based on your identity is called:

a. biometrics.
b. authorisation.
*c. passphrase.
d. encryption.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

71. You start a new job. You want to install some fun software on your laptop and get an error message
which indicates that the software is not on the ________________ list so it cannot be installed.

*a. white
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
20
 MIS – 1st Australasian Edition

b. black
c. yellow
d. blue

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

72. You start a new job. You want to install some fun software on your laptop and get an error message
which indicates that the software is on the ________________ list so it cannot be installed.

a. white
*b. black
c. yellow
d. blue

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Medium.

73. Your friend works in the risk management department for a mid-size financial institution. She said
it's an interesting job - she has to put a value on each asset (information included), determine a
probability that it would get compromised, and compare that to the cost of protecting that asset. This
process is called:

a. risk acceptance.
b. risk limitation.
c. risk transference.
*d. risk analysis.

General Feedback:
Chapter 7: LO 4: Assess how you might employ each of the three risk mitigation strategies in the
context of owning your home. Difficulty: Easy.

74. You start a new job, and human resources give you a ten-page document that outlines the employee
responsibilities for information security. Which of the following statements is most likely to be true?

a. The document recommends that login passwords be left on a piece of paper in the centre desk drawer
so that others can use the laptop if necessary.
*b. You are expected to read the document, and you could be reprimanded if you don't follow its
guidelines.
c. You can back up sensitive data to a thumb drive so you can take them home to work with.
d. The document indicates that you can leave your laptop unlocked if you leave your desk for less than
an hour.
© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
21
 MIS – 1st Australasian Edition

e. The document permits you to lend your laptop to your brother for the weekend.

General Feedback:
Chapter 7: LO 5: Identify the three major types of controls that organisations can use to protect their
information resources. Difficulty: Easy.

75. As part of Australia's national security strategy, the Cyber Security Operations Centre (CSOC)
within the Australian Signals Directory (ASD) agency is charged with providing the government with a
better understanding of sophisticated cyber threats against Australian cyber accessible assets. What is the
other objective for which the CSOC is responsible?

*a. To assist and coordinate operational responses that inform and mitigate against a conflation of cyber-
based threats.
b. To identify the causes and symptoms of cyber threats.
c. To educate individual Australian citizens about cyber-based threats.
d. None of the above.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

76. Which of the following statements concerning intellectual property protection is correct?

*a. Copyright is free and automatically granted in Australia with no registration required.
b. A registered patent document grants the inventor exclusive rights to exploit and develop the invention
for the life of the patent document, which is 10 years.
c. The intellectual property of trademarks is covered by the Trade Marks Act 1995. The initial
registration is for 20 years with further renewals possible while the trademark remains in use.
d. Each type of intellectual property is protected by a specific Act of the Australian Commonwealth
Parliament, which is completely unrelated to Australia's obligations under international treaties.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

77. Which of the following statements concerning intellectual property protection is incorrect?

*a. There is no distinction between the copyright of the created work and ownership of the physical form
in which the work exists.
b. An author may own the copyright of the text expressed in a book even though the physical book can
be purchased and owned by another person.
c. Copyright protects the form or way an idea or information is expressed and is extended to works and
other subject matter covered under the Copyright Act 1968.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
22
 MIS – 1st Australasian Edition

d. The Trade Marks Act 1995 affords protection relating to a letter, word, phrase, sound, smell, shape,
logo, picture, aspect of packaging or combination of these used by traders as a means of distinguishing
the origin of their specific products or goods from other traders.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

78. Which of the following statements concerning intellectual property protection is incorrect?

a. In Australia, software is regarded as a 'literary work' and therefore protected by copyright.

b. The Copyright Act 1968 uses the term 'computer program' to refer to software and
defines it as 'a set of statements or instructions to be used directly or indirectly in a computer
in order to bring about a certain result'.
c. The Design Act 2003 grants protection of the visual appearance or design of a new or original
manufactured item.
*d. The 2003 Design Act protection is based on a registration system that can last up to 20 years and
relates to the features of shape, pattern or ornamentation as applied to the item.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

79. According to Australia's Copyright Act 1968 the owners of software are granted a number of
exclusive rights. Select what best applies in relation to the software owners' rights in Australia.

a. Owners have the right to reproduce the software in a material form.

b. Owners have the right to publish the software.
c. Owners have the right to make an adaptation of the software.
d. Owners have the right to communicate the software to the public.
*e. All of the above.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

80. Refer to the It's about business case - Hacktivists 'Anonymous' attack Australian government
websites - Which of the following best describes hactivism?

*a. Hacktivism is a combination of political activism and computer hacking.

b. Hacktivism is political activism on the internet.
c. Hacktivism is a combination of political activism and computer hacking that is endorsed by the
Australian Government or local states.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
23
 MIS – 1st Australasian Edition

d. Hacktivism is a legitimate activity that is becoming increasingly popular since it promotes social
causes using social media.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Easy.

81. Refer to the It's about business case - Hacktivists 'Anonymous' attack Australian government
websites - The Anonymous group has become increasingly renowned for acts of collaborative and
international hacktivism. What does Anonymous try to achieve by using individual and social hacking
skills?

a. Effect social change.

b. Protest in relation to particular causes.
c. Spread awareness or ideas relating to a particular cause.
*d. All of the above.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Easy.

82. Refer to the It's about business case - Hacktivists 'Anonymous' attack Australian government
websites - In 2012 Anonymous activists took customer records and data belonging to a business
telecommunications company (AAPT) and posted the information on a public website. What were they
trying to achieve with this act?

*a. Anonymous were trying to highlight concerns regarding the then Federal Government's draft internet
surveillance and security legislative proposal to force Australian telecommunications companies to store
and retain every Australian's web history data for two years.
b. Anonymous were trying to extort illegitimate payments from the telecommunications company
(AAPT).
c. Anonymous were trying to extort illegitimate payments from Australian Government.
d. Anonymous were trying to promote social justice and freedom of information.
e. Anonymous were trying to highlight concerns regarding the then Federal Government's draft internet
surveillance and security legislative proposal to force Australian telecommunications companies to store
and retain every Australian's web history data for seven years.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

83. Refer to the It's about business case - Melbourne IT: an Australian internet success -Melbourne IT
has diversified since its creation. What is the history of Melbourne IT linked with?

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
24
 MIS – 1st Australasian Edition

*a. Domain name registration.

b. E-procurement.
c. Internet security.
d. Cloud computing.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Medium.

84. Refer to the It's about business case - Melbourne IT: an Australian internet success -
The New York Times website was unavailable to readers on Tuesday afternoon, 13 August 2013
following an attack on the company's domain name registrar. In addition, the attack temporarily caused a
number of emails that had been sent to the company to be returned to senders as undeliverable.
Management at the New York Times issued a statement that afternoon that the disruption was the result
of a malicious external attack carried out by a group known as the Syrian Electronic Army (SEA). The
subsequent investigation of this incident pinpointed Melbourne IT as the focus for the security attack. In
what way had SEA breached Melbourne IT's security?

*a. The SEA used phishing tactics to obtain an appropriate username and password from
a Melbourne IT affiliate company and subsequently used these credentials to enter the Melbourne IT
system.
b. The SEA used distributed denial-of-service (DDOS) attacks to perpetrate the Melbourne IT system.
c. The SEA used tailgating to perpetrate the Melbourne IT system.
d. The SEA used a combination of cookies, keystroke loggers, and adware to perpetrate the Melbourne
IT system.

General Feedback:
Chapter 7: LO 1: Give one specific example of each of the five factors that are contributing to the
increasing vulnerability of information resources. Difficulty: Difficult.

© John Wiley & Sons Australia, Ltd 2015 Chapter 7 Information security
25