WorksheetsCHAP5
Total questions: 76
Worksheet time: 38mins
Confidentiality is sometimes confused with:
privacy.
authenticity.
integrity.
nonrepudiation.
________ is the ability to ensure that e-commerce participants do
not deny their online actions.
Nonrepudiation
Authenticity
Availability
Integrity
________ is the ability to identify the person or entity with whom
you are dealing on the Internet.
Nonrepudiation
Authenticity
Availability
Integrity
Which of the following is an example of an integrity violation of e-
commerce security?
A website is not actually operated by the entity the customer
believes it to be.
A merchant uses customer information in a manner not intended by
the customer.
A customer denies that he is the person who placed the order.
An unauthorized person intercepts an online communication
and changes its contents.
________ is the ability to ensure that an e-commerce site continues
to function as intended.
Nonrepudiation
Authenticity
Availability
Integrity
Which of the following is an example of an online privacy
violation?
your e-mail being read by a hacker
your online purchasing history being sold to other merchants
without your consent
your computer being used as part of a botnet
your e-mail being altered by a hacker
________ is the ability to ensure that messages and data are only
available to those authorized to view them.
Confidentiality
Integrity
Privacy
Availability
Which of the following is NOT a key factor for establishing e-
commerce security?
data integrity
technology
organizational policies
laws and industry standards
According to Ponemon Institute's 2019 survey, which of the
following was NOT among the causes of the costliest cybercrimes?
malicious insiders
web-based attacks
denial of service
botnets
Typically, the more security measures added to an e-commerce
site, the slower and more difficult it becomes to use.
TRUE
FALSE
Which of the following statements about data breaches in 2019 is
NOT true?
According to the Identity Theft Resource Center, the number of
breaches in 2019 increased by 17% from 2018.
According to the Identity Theft Resource Center, the breaches
exposed almost 165 million sensitive records, such as social security
numbers and financial account data.
According to the Identity Theft Resource Center, employee error
was the leading cause of data breaches.
According to the Identity Theft Resource Center, data breaches
involving the business sector represented about 44% of all breaches.
Which of the following is a brute force attack which hackers
launch via botnets and automated tools using known user name and
password combinations?
credential stuffing
phishing
pharming
MitM attack
Which of the following did the Internet Advertising Bureau urge
advertisers to abandon?
HTML
HTML5
Adobe Flash
Adobe Acrobat
Accessing data without authorization on Dropbox is an example
of a:
social network security issue.
cloud security issue.
mobile platform security issue.
sniffing issue.
All of the following can be considered a direct or indirect competitor of Amazon EXCEPT:
eBay.
Target.
Walmart
Priceline.
Conficker is an example of a:
virus.
worm.
Trojan horse.
botnet.
Which of the following is the leading cause of data breaches?
theft of a computer
accidental disclosures
hackers
DDoS attacks
Software that is used to obtain private user information such as a
user's keystrokes or copies of e-mail is referred to as:
spyware.
a backdoor.
a browser parasite.
adware.
Which of the following technologies is aimed at reducing e-mail
address spoofing and phishing?
TLS
WPA
DMARC
MFA
What is the most frequent cause of stolen credit cards and card
information today?
lost cards
the hacking and looting of corporate servers storing credit card
information
sniffing programs
phishing attacks
Which dimensions of security is spoofing a threat to?
integrity and confidentiality
availability and authenticity
integrity and authenticity
availability and integrity
Which of the following is NOT an example of malicious code?
scareware
Trojan horse
bot
sniffer
The attack against Dyn servers is an example of a(n):
scareware
Trojan horse
bot
sniffer
Beebone is an example of which of the following?
worm
botnet
phishing
hacktivism
Malware that comes with a downloaded file requested by a user is
called a:
Trojan horse.
backdoor.
drive-by download.
PUP.
Which of the following is not an example of a potentially
unwanted program (PUP)?
adware
browser parasite
drive-by download
spyware
Which of the following was designed to cripple Iranian nuclear
centrifuges?
Stuxnet
Shamoon
Snake
Storm
Automatically redirecting a web link to a different address is an
example of which of the following?
sniffing
social engineering
pharming
DDoS attack
Which of the following types of attacks enabled hackers to take
control of the Twitter accounts of dozens of America’s most
prominent political, entertainment and technology leaders?
DDoS attack
ransomware
social engineering
sniffing
________ typically attack governments, organizations, and
sometimes individuals for political purposes.
Crackers
Tiger teams
Bounty hunters
Hacktivists
A Trojan horse appears to be benign, but then does something
other than expected.
TRUE
FALSE
Phishing attacks rely on browser parasites.
TRUE
FALSE
WannaCry is an example of ransomware.
TRUE
FALSE
Spoofing is the attempt to hide a hacker's true identity by using
someone else's e-mail or IP address.
TRUE
FALSE
Exploit kits can be purchased by users to protect their computers
from malware.
TRUE
FALSE
A drive-by download is malware that comes with a downloaded
file that a user intentionally or unintentionally requests.
TRUE
FALSE
FREAK is an example of a software vulnerability.
TRUE
FALSE
Next generation firewalls provide all of the following EXCEPT:
an application-centric approach to firewall control.
the ability to identify applications regardless of the port, protocol,
or security evasion tools used.
the ability to automatically update applications on a client
computer with security patches.
the ability to identify users regardless of the device or IP address.
Asymmetric key cryptography is also known as:
public key cryptography.
secret key cryptography.
PGP.
PKI.
All the following statements about symmetric key cryptography
are true EXCEPT:
in symmetric key cryptography, both the sender and the receiver
use the same key to encrypt and decrypt a message.
the Data Encryption Standard is a symmetric key encryption
system.
symmetric key cryptography is computationally slower.
symmetric key cryptography is a key element in digital envelopes.
The Data Encryption Standard uses a(n) ________-bit key.
8
56
256
512
All of the following statements about public key cryptography are
true EXCEPT:
public key cryptography uses two mathematically related digital
keys.
public key cryptography ensures authentication of the sender.
public key cryptography does not ensure message integrity.
public key cryptography is based on the idea of irreversible
mathematical functions.
All of the following are features of WPA3 EXCEPT:
it implements a more robust key exchange protocol.
it enables the creation of a VPN.
it provides a more secure way to connect IoT devices.
it features expanded encryption for public networks.
All of the following statements about PKI are true EXCEPT:
the term PKI refers to the certification authorities and digital
certificate procedures that are accepted by all parties.
PKI is not effective against insiders who have a legitimate access
to corporate systems including customer information.
PKI guarantees that the verifying computer of the merchant is
secure.
the acronym PKI stands for public key infrastructure.
A digital certificate contains all of the following EXCEPT the:
subject's private key.
subject's public key.
digital signature of the certification authority.
digital certificate serial number.
Which of the following dimensions of e-commerce security is
NOT provided for by encryption?
confidentiality
availability
message integrity
nonrepudiation
All of the following are methods of securing channels of
communication EXCEPT:
TLS.
digital certificates.
VPN.
FTP.
A ________ is hardware or software that acts as a filter to prevent
unwanted packets from entering a network.
firewall
virtual private network
proxy server
PPTP
Proxy servers are also known as __________ because they have
two network interfaces.
firewalls
application gateways
dual home systems
packet filters
All of the following are used for authentication EXCEPT:
digital signatures.
certificates of authority.
biometric devices.
packet filters.
An intrusion detection system can perform all of the following
functions EXCEPT:
examining network traffic.
setting off an alarm when suspicious activity is detected.
checking network traffic to see if it matches certain patterns or
preconfigured rules.
blocking suspicious activity.
Which of the following is not an example of an access control?
firewalls
proxy servers
digital signatures
login passwords
Which of the following statements is NOT true?
A VPN provides both confidentiality and integrity.
A VPN uses both authentication and encryption.
A VPN uses a dedicated secure line.
The primary use of VPNs is to establish secure communications
among business partners.
Which of the following statements is NOT true?
Apple's Touch ID stores a digital replica of a user's actual
fingerprint in Apple's iCloud
Biometric devices reduce the opportunity for spoofing.
A retina scan is an example of a biometric device.
Biometric data stored on an iPhone is encrypted.
Face ID is an example of which of the following?
biometrics
encryption
IDS
firewall
Which of the following is the most common protocol for securing
a digital channel of communication?
DES
TLS
VPN
HTTP
Most computers and mobile devices today have built-in
encryption software that users can enable.
TRUE
FALSE
The easiest and least expensive way to prevent threats to system
integrity is to install anti-virus software.
TRUE
FALSE
What is the first step in developing an e-commerce security plan?
Create a security organization.
Develop a security policy.
Perform a risk assessment.
Perform a security audit.
To allow lower-level employees access to the corporate network
while preventing them from accessing private human resources
documents, you would use:
a firewall.
an authorization management system.
security tokens.
an authorization policy.
Which of the following statements is NOT true?
A majority of states require companies that maintain personal data
on their residents to publicly disclose when a security breach affecting
those residents has occurred.
The USA Patriot Act broadly expanded law enforcement's
investigative and surveillance powers.
The Cybersecurity Information Sharing Act was strongly
supported by most large technology companies and privacy
advocates.
The Federal Trade Commission has asserted that it has authority
over corporations' data security practices.
Zero trust is a cybersecurity framework based on the principle of
maintaining strict access controls and not trusting anyone or anything
by default, even those behind a corporate firewall.
TRUE
FALSE
Which of the following statements about blockchain is not true?
A blockchain system is composed of a distributed network of
computers.
A blockchain system is inherently centralized.
A blockchain system is a transaction processing system.
Cryptocurrencies are based on blockchain technology.
All of the following statements about Apple Pay are true EXCEPT
which of the following?
Apple Pay is the most popular alternative payment method in the
United States.
Apple Pay is an example of a universal proximity mobile wallet.
Apple Pay can be used for mobile payments at the point of sale at a
physical store.
Apple Pay has more users than either Google Pay or Samsung Pay.
PayPal is an example of which of the following types of payment
system?
online stored value payment system
digital checking system
accumulating balance system
digital credit card system
PCI-DSS is a standard established by which of the following?
the banking industry
the credit card industry
the federal government
the retail industry
Which of the following is NOT a major trend in e-commerce
payments in 2020-2021?
Online payment volume decreases due to the Covid-19 pandemic.
PayPal remains the most popular alternative payment method.
Large banks enter the mobile wallet and P2P payments market.
Payment by credit and/or debit card remains the dominant form of
online payment.
All of the following are limitations of the existing online credit
card payment system EXCEPT:
poor security.
cost to consumers.
cost to merchant.
social equity.
Which of the following statements about Bitcoin is NOT true?
The computational power required to mine Bitcoins has increased
over time.
Bitcoins are completely secure.
Bitcoins are illegal in some countries.
Bitcoin mining uses more energy than the entire amount consumed
by Switzerland.
Which of the following is a set of short-range wireless
technologies used to share information among devices within about
two inches of each other?
DES
NFC
IM
text messaging
All of the following are examples of cryptocurrencies EXCEPT:
Ethereum.
Ripple.
Zelle.
Monero.
Zelle is an example of a P2P mobile payment app.
TRUE
FALSE
Bluetooth is the primary enabling technology for mobile wallets.
TRUE
FALSE
There is a finite number of Bitcoins that can be created.
TRUE
FALSE
Mint Bills is an example of which of the following EBPP business
models?
biller-direct
online banking
consolidator
mobile
According to the most recent Fiserv survey, 65% of consumers in
the United States have used online bill payment.
TRUE
FALSE
