MIS Module 7 Quiz

A hospital is hit by ransomware, and for two days nurses cannot open any patient charts. Which part of the CIA Triad is hit most directly?

A. Confidentiality

B. Integrity

C. Availability

D. Accountability

C. Availability

Which type of malware spreads by itself across a network, with no one needing to click or open anything?

A. Virus

B. Worm

C. Trojan horse

D. Spyware

B. Worm

In the 2023 MGM Resorts attack, the attacker called the IT help desk pretending to be a locked-out employee and got the password reset. What kind of attack is this?

A. Worm

B. Social engineering

C. Insider threat

D. Data scraping

B. Social engineering

Which of the following are parts of security governance? (Select all that apply)

A. Written policies on what data employees may share

B. Required cybersecurity training

C. Clear ownership, such as a CISO and department data owners

D. Ransomware

E. Data scraping

A. Written policies on what data employees may share

B. Required cybersecurity training

C. Clear ownership, such as a CISO and department data owners

True or False: Insider threats can be harder to catch than outside attacks because insiders are already allowed into the systems.

TRUE

True or False: The attackers in the 2021 Colonial Pipeline ransomware attack got in through one compromised password on an account without multi-factor authentication (MFA).

TRUE

After entering a password, an employee must also scan a fingerprint to log in

MFA (multi-factor authentication)

After a ransomware attack, the company restores its systems from tested copies stored separately

Backups

Customer files on a lost USB drive are scrambled and unreadable to whoever finds it

Encryption

Warehouse staff cannot view employee salary data

Least privilege

Financial reporting of public companies

SOX

Data of EU residents, wherever the company is

GDPR

Healthcare data

HIPAA

Payment card data

PCI-DSS

In the CISA 911 center case, what kept part of the center running after a worm infected 33+ computers?

A. Daily data backups

B. A second, separate network (subnet) the worm never found

C. Paying the attackers a ransom

D. Disabling all email accounts

B. A second, separate network (subnet) the worm never found

A food truck decides not to encrypt its menu tablet because it holds no customer data; it chooses to _____ the risk. A company that requires MFA and phishing training chooses to ______ the risk. A company that buys cyber insurance chooses to _____ the risk.

1. Accept

2. Mitigate

3. Transfer