IT 238 Final Exam - Short Answer Questions

This part of the exam consists of 16 short questions worth a total of 50 points. Questions 1 through 12 are worth 3 points each, the other questions are worth 4 or 6 points as noted.

Your answers to the questions may be as short as a few words or as long as a couple of sentences. If you are writing more than that, you are working too hard!

Everything you need to answer these questions can be found in the textbook or other reading and videos assigned during the course. You may search the internet for relevant information, but be aware as always that the internet is an unreliable source of information and terminology varies, so this is a risky approach.

All work on the exam must be your own. Any students found to be working together or sharing answers will each receive a zero on the entire final exam. Plagiarism from any source will also result in a zero.

Question 1. In what cyberattack that we read about this quarter did the attackers use multiple zero-day exploits?

Question 2. Name and briefly describe the first element of deterrence.

Question 3. Name and briefly describe the second element of deterrence.

Question 4. Name and briefly describe the third element of deterrence.

Question 5. For each of the following three activities, name the element of deterrence that the activity represents:

A. Having backup non-networked communications systems

B. Using a network firewall

C. Hackback

Question 6. A Rubber Ducky looks like a typical thumb drive, but when plugged into a computer it acts as what other type of common device?

Question 7. Cyberattacks stealing what kind of property have been referred to as an "unprecedented transfer of wealth"?

Question 8. The cyberattack against Target stores is best described as an attack against which one of the three elements of the CIA triad?

Question 9. A DDOS attack is best described as an attack against which one of the three elements of the CIA triad?

Question 10. Why is the failure to provide of an organization to adequately protect data sometimes referred to as a negative externality?

Question 11. We learned of a cyberattack where a country attacked a private company in order to punish the company for something it did that offended the country. What was the country, and what was the company?

Question 12. Describe an example of social engineering used in a specific attack we learned about this quarter.

Question 13. What four countries are considered by the DoD to be the most significant threats to the United States in cyberspace?

Question 14. Would the attack on the Office of Personnel Management be considered a targeted or an opportunistic attack? Why? (no credit for an answer without an explanation of your answer)

Question 15. Describe the difference between a cyber espionage attack and a disruptive cyberattack. Provide an example of one attack of each type that we learned about this quarter. (4 points for describing the differences, 1 point for each example)