E - Commerce 2014 10th Edition By Kenneth Laudon - Test Bank Instant Download - Complete Test Bank With Answers Sample Questions Are Posted Below E-Commerce 2014, 10e (Laudon/Traver) Chapter 5 E-commerce Security and Payment Systems 1) Typically, the more security measures added to an e-commerce site, the slower and …
$19.99
E – Commerce 2014 10th Edition By Kenneth Laudon – Test Bank
Instant Download – Complete Test Bank With Answers
Sample Questions Are Posted Below
E-Commerce 2014, 10e (Laudon/Traver)
Chapter 5 E-commerce Security and Payment Systems
1) Typically, the more security measures added to an e-commerce site, the slower and more difficult it becomes to use.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
2) A worm does not need to be activated by a user in order for it to replicate itself.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
3) A Trojan horse appears to be benign, but then does something other than expected.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
4) Phishing attacks rely on browser parasites.
Answer: FALSE
Difficulty: Moderate
AACSB: Information technology
5) Insiders present a greater security threat to e-commerce sites than outsiders.
Answer: TRUE
Difficulty: Moderate
AACSB: Application of knowledge
6) Spoofing involves attempting to hide a true identity by using someone else’s e-mail or IP address.
Answer: FALSE
Difficulty: Difficult
AACSB: Information technology
7) Drive-by downloads are now the most common method of infecting computers.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
8) Smishing attacks exploit SMS messages.
Answer: TRUE
Difficulty: Difficult
AACSB: Information technology
9) TLS does not guarantee server-side authentication.
Answer: FALSE
Difficulty: Difficult
AACSB: Information technology
10) The easiest and least expensive way to prevent threats to system integrity is to install anti-virus software.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
11) The U.S. federal government has historically not been in favor of the development and export of strong encryption systems.
Answer: TRUE
Difficulty: Moderate
AACSB: Application of knowledge
12) Credit cards are the dominant form of online payment throughout the world.
Answer: FALSE
Difficulty: Easy
AACSB: Application of knowledge
13) In order to accept payments by credit card, online merchants typically must have a merchant account established with a bank or financial institution.
Answer: TRUE
Difficulty: Moderate
AACSB: Application of knowledge
14) Digital cash is legal tender that is instantly convertible into other forms of value without the intermediation of any third parties.
Answer: FALSE
Difficulty: Difficult
AACSB: Information technology
15) PayPal requires the recipient of a payment to have a PayPal account to receive funds.
Answer: TRUE
Difficulty: Moderate
AACSB: Information technology
16) All of the following are factors in contributing to the increase in cybercrime except:
Answer: B
Difficulty: Moderate
AACSB: Analytical thinking
17) Bitcoins are an example of:
Answer: A
Difficulty: Moderate
AACSB: Information technology
18) The overall rate of online credit card fraud is ________ % of all online card transactions.
Answer: A
Difficulty: Difficult
AACSB: Information technology
19) In the United States, the primary form of online payment is:
Answer: B
Difficulty: Easy
AACSB: Information technology
20) The six key dimensions to e-commerce security are nonrepudiation, authenticity, availability, integrity, privacy, and:
Answer: A
Difficulty: Moderate
AACSB: Information technology
21) ________ refers to the ability to ensure that e-commerce participants do not deny their online actions.
Answer: A
Difficulty: Moderate
AACSB: Information technology
22) ________ refers to the ability to identify the person or entity with whom you are dealing on the Internet.
Answer: B
Difficulty: Moderate
AACSB: Information technology
23) Which of the following is an example of an integrity violation of e-commerce security?
Answer: D
Difficulty: Moderate
AACSB: Analytical thinking
24) ________ refers to the ability to ensure that an e-commerce site continues to function as intended.
Answer: C
Difficulty: Moderate
AACSB: Information technology
25) An example of a privacy violation of e-commerce security is:
Answer: B
Difficulty: Moderate
AACSB: Analytical thinking
26) ________ refers to the ability to ensure that messages and data are only available to those authorized to view them.
Answer: A
Difficulty: Moderate
AACSB: Information technology
27) Which of the following is not a key point of vulnerability when dealing with e-commerce?
Answer: D
Difficulty: Moderate
AACSB: Information technology
28) Which of the following did Dropbox implement after a series of security snafus in 2011 and 2012?
Answer: B
Difficulty: Difficult
AACSB: Information technology
29) Which of the following is a prominent hacktivist group?
Answer: A
Difficulty: Easy
AACSB: Information technology
30) Most of the world’s spam is delivered via which of the following?
Answer: D
Difficulty: Moderate
AACSB: Information technology
31) Botnets are typically used for all of the following except:
Answer: B
Difficulty: Moderate
AACSB: Information technology
32) Software that is used to obtain private user information such as a user’s keystrokes or copies of e-mail is referred to as:
Answer: A
Difficulty: Moderate
AACSB: Information technology
33) Online bill payments are believed to cost ________ to process compared to ________ for paper bills.
Answer: A
Difficulty: Difficult
AACSB: Information technology
34) Reventon is an example of:
Answer: B
Difficulty: Difficult
AACSB: Information technology
35) What is the most frequent cause of stolen credit cards and card information today?
Answer: B
Difficulty: Moderate
AACSB: Information technology
36) Which dimension(s) of security is spoofing a threat to?
Answer: C
Difficulty: Difficult
AACSB: Analytical thinking
37) All of the following are examples of malicious code except:
Answer: D
Difficulty: Moderate
AACSB: Information technology
38) Symmetric key encryption is also known as:
Answer: B
Difficulty: Moderate
AACSB: Information technology
39) All the following statements about symmetric key encryption are true except:
Answer: C
Difficulty: Difficult
AACSB: Information technology
40) The Data Encryption Standard uses a(n) ________-bit key.
Answer: B
Difficulty: Difficult
AACSB: Information technology
41) All of the following statements about public key encryption are true except:
Answer: B
Difficulty: Difficult
AACSB: Information technology
42) Which of the following is the current standard used to protect Wi-Fi networks?
Answer: C
Difficulty: Moderate
AACSB: Information technology
43) All of the following statements about PKI are true except:
Answer: C
Difficulty: Difficult
AACSB: Information technology
44) A digital certificate contains all of the following except the:
Answer: A
Difficulty: Difficult
AACSB: Information technology
45) Which of the following dimensions of e-commerce security is not provided for by encryption?
Answer: B
Difficulty: Difficult
AACSB: Information technology
46) All of the following are methods of securing channels of communication except:
Answer: D
Difficulty: Moderate
AACSB: Information technology
47) A ________ is hardware or software that acts as a filter to prevent unwanted packets from entering a network.
Answer: A
Difficulty: Easy
AACSB: Information technology
48) Proxy servers are also known as:
Answer: C
Difficulty: Moderate
AACSB: Information technology
49) All of the following are used for authentication except:
Answer: D
Difficulty: Moderate
AACSB: Information technology
50) What is the first step in developing an e-commerce security plan?
Answer: C
Difficulty: Moderate
AACSB: Information technology
51) An intrusion detection system can perform all of the following functions except:
Answer: D
Difficulty: Moderate
AACSB: Information technology
52) Which of the following is not an example of an access control?
Answer: C
Difficulty: Moderate
AACSB: Information technology
53) Online bill payment now accounts for ________ of all bill payments.
Answer: C
Difficulty: Moderate
AACSB: Information technology
54) To allow lower-level employees access to the corporate network while preventing them from accessing private human resources documents, you would use:
Answer: B
Difficulty: Easy
AACSB: Information technology
55) Which of the following left the WikiLeaks Web site effectively inoperable in August 2012?
Answer: C
Difficulty: Moderate
AACSB: Information technology
56) The research firm Cybersource estimated that online credit card fraud in the United States amounted to about ________ in 2012.
Answer: C
Difficulty: Moderate
AACSB: Information technology
57) P2P payment systems are a variation on what type of payment system?
Answer: A
Difficulty: Moderate
AACSB: Information technology
58) Which of the following countries has been found to have engaged in cyberespionage against Google?
Answer: B
Difficulty: Easy
AACSB: Application of knowledge
59) Rustock is an example of which of the following?
Answer: B
Difficulty: Moderate
AACSB: Information technology
60) None of the following payment systems offers immediate monetary value except:
Answer: C
Difficulty: Moderate
AACSB: Application of knowledge
61) Malware that comes with a downloaded file that a user requests is called a:
Answer: C
Difficulty: Moderate
AACSB: Information technology
62) Which of the following is not an example of a PUP?
Answer: C
Difficulty: Difficult
AACSB: Information technology
63) All of the following are limitations of the existing online credit card payment system except:
Answer: B
Difficulty: Moderate
AACSB: Application of knowledge
64) Linden Dollars, created for use in Second Life, are an example of:
Answer: B
Difficulty: Moderate
AACSB: Information technology
65) Which of the following is a set of short-range wireless technologies used to share information among devices within about 2 inches of each other?
Answer: B
Difficulty: Difficult
AACSB: Information technology
66) The ________ worm was designed to disarm computers that control the centrifuges in Iran’s uranium enrichment process.
Answer: Stuxnet
Difficulty: Moderate
AACSB: Information technology
67) To allow employees to connect securely over the Internet to their corporate network, you would use a(n) ________.
Answer: VPN, virtual private network
Difficulty: Moderate
AACSB: Information technology
68) The exploitation of human fallibility and gullibility to distribute malware is known as ________.
Answer: social engineering
Difficulty: Moderate
AACSB: Information technology
69) A(n) ________ is a hacker that believes he or she is pursing some greater good by breaking in and revealing system flaws.
Answer: grey hat
Difficulty: Easy
AACSB: Information technology
70) Automatically redirecting a Web link to a different address is called ________.
Answer: pharming
Difficulty: Moderate
AACSB: Information technology
71) A(n) ________ vulnerability involves a vulnerability unknown to security experts that is actively exploited before there is a patch available.
Answer: zero-day
Difficulty: Moderate
AACSB: Information technology
72) The study of measurable biological or physical characteristics is called ________.
Answer: biometrics
Difficulty: Moderate
AACSB: Information technology
73) In encryption, the method used to transform plain text to encrypted text is called a(n) ________.
Answer: key, cipher
Difficulty: Moderate
AACSB: Information technology
74) ________ involves cybervandalism and data theft for political purposes.
Answer: Hacktivism
Difficulty: Moderate
AACSB: Information technology
75) The most common form of securing a digital channel of communication is ________.
Answer: SSL/TLS, Secure Sockets Layer/Transport Layer Security
Difficulty: Difficult
AACSB: Information technology
76) A(n) ________ is a feature of viruses, worms, and Trojans that allows an attacker to remotely access a compromised computer.
Answer: backdoor
Difficulty: Moderate
AACSB: Information technology
77) To internal computers, a proxy server is known as the ________.
Answer: gateway
Difficulty: Difficult
AACSB: Information technology
78) ________ typically handle verification of accounts and balances in the credit card system.
Answer: Processing centers, Clearinghouses
Difficulty: Difficult
AACSB: Information technology
79) Malicious code that is designed to take advantage of a security hole in computer software or operating system is called a(n) ________.
Answer: exploit
Difficulty: Moderate
AACSB: Information technology
80) ________ is a form of online payment system for monthly bills.
Answer: EBPP, Electronic billing presentment and payment
Difficulty: Moderate
AACSB: Information technology
81) Discuss and explain the various types of malicious code and how they work. Include the different types of viruses.
Answer: Malicious code includes a variety of threats such as viruses, worms, Trojan horses, ransomware, and bot programs. A virus is a computer program that can replicate or make copies of itself and spread to other files. Viruses can range in severity from simple programs that display a message or graphic as a “joke” to more malevolent code that will destroy files or reformat the hard drive of a computer, causing programs to run incorrectly. Worms are designed to spread not only from file to file but from computer to computer and do not necessarily need to be activated in order to replicate. A Trojan horse is not itself a virus because it does not replicate but it is a method by which viruses or other malicious code can be introduced into a computer system. It appears benign and then suddenly does something harmful. For example, it may appear to be only a game and then it will steal passwords and mail them to another person. A backdoor is a feature of worms, viruses, and Trojans that allow attackers to remotely access compromised computers. Ransomware (or also known as scareware) is a type of malware (often a worm) that locks your computer or files to stop you from accessing them. Bot programs are a type of malicious code that can be covertly installed on a computer when it is attached to the Internet. Once installed, the bot responds to external commands sent by the attacker, and many bots can be coordinated by a hacker into a botnet.
Difficulty: Moderate
AACSB: Analytical thinking; Information technology; Written and oral communication
82) Explain the difference between symmetric key encryption and public key encryption. Which dimensions of e-commerce security does encryption address?
Answer: Symmetric key encryption involves the use of a secret cipher that transforms plain text into cipher text. Both the sender and the receiver use the same key to encrypt and decrypt the message. The possibilities for simple substitution and transposition ciphers are endless, but there are several flaws in these types of systems that make them inadequate for use today. First, in order for the sender and the receiver to have the same key, it must be sent over a communication medium that is insecure or they must meet in person to exchange the key. If the secret key is lost or stolen, the encryption system fails. This method can be used effectively for data storage protection, but is less convenient for e-mail since the correspondents have to pass the secret key to one another over another secure medium prior to commencing the communication. Second, in the digital age, computers are so fast and powerful that these ancient encryption techniques can be quickly and easily broken. Modern digital encryption systems must use keys with between 56 and 512 binary digits in order to ensure that decryption would be unlikely. Third, for commercial use on an e-commerce site each of the parties in a transaction would need a secret key. In a population of millions of Internet users, thousands of millions of keys would be needed to accommodate all e-commerce customers.
Public key encryption solves the problem of exchanging keys. In this method every user has a pair of numeric keys: private and public. The public key is not secret; on the contrary, it is supposed to be disseminated widely. Public keys may be published in company catalogs or on the World Wide Web. The public key is used by outside parties to encrypt the messages addressed to you. The private or secret key is used by the recipient to decipher incoming messages. The main advantage of a public key cryptographic system is its ability to begin secure correspondence over the Internet without prior exchanging of the keys and, therefore, without the need for a meeting in person or using conventional carriers for key exchange.
Encryption can provide four of the six key dimensions of e-commerce security. It can provide assurance that the message has not been altered (integrity), prevent the user from denying that he/she has sent the message (nonrepudiation), provide verification of the identity of the message (authentication), and give assurance that the message has not been read by others (confidentiality).
Difficulty: Moderate
AACSB: Analytical thinking; Information technology; Written and oral communication
83) What dimensions do digital signatures and hash digests add to public key encryption and how do they work?
Answer: Digital signatures and hash digests can add authentication, nonrepudiation, and integrity when used with public key encryption. Encryption technology also allows for digital signatures and authentication. The sender encrypts the message yet again using their private key to produce a digital signature.
To check the confidentiality of a message and ensure it has not been altered in transit, a hash function is used first to create a digest of the message. A hash function is an algorithm that produces a fixed-length number called a hash or message digest. To ensure the authenticity of the message and to ensure nonrepudiation, the sender encrypts the entire block of cipher text one more time using the sender’s private key. This produces a digital signature or “signed” cipher text. The result of this double encryption is sent over the Internet to the recipient. Then, the recipient first uses the sender’s public key to authenticate the message. Once authenticated, the recipient uses his or her private key to obtain the hash result and original message. As a final step, the recipient applies the same hash function to the original text and compares the result with the result sent by the sender. If the results are the same, the recipient now knows the message has not been changed during transmission. The message has integrity.
Difficulty: Difficult
AACSB: Analytical thinking; Information technology; Written and oral communication
84) Discuss the security of communications channels. Include definitions and explanations for the terms Secure Sockets Layer/Transport Layer Security (SSL/TLS), secure negotiated session, session key, and VPN.
Answer: The Secure Sockets Layer of the Transmission Control Protocol/Internet Protocol (TCP/IP) communications protocol is the main method for securing communications channels on the Web. When you receive a message from a Web server that you will be communicating through a secure channel, this means that SSL/TLS will be used to establish a secure negotiated session. A secure negotiated session is a client-server session in which the URL of the requested document, its contents, and the contents of the forms filled out by the user on the page, as well as the cookies that are exchanged, are all encrypted. The browser and the server exchange digital certificates with one another, determine the strongest shared form of encryption, and begin communicating using a unique symmetric encryption key, agreed upon for just this encounter. This is called a session key. SSL/TLS provides data encryption, server authentication, optional client authentication (as yet still rare for individual users), and message integrity for the TCP/IP connections between two computers.
SSL/TLS addresses the threat of authenticity by allowing users to verify another user’s identity or the identity of a server. It also protects the integrity of the messages exchanged. However, once the merchant receives the encrypted credit and order information, that information is typically stored in unencrypted format on the merchant’s servers. While SSL/TLS provides secure transactions between merchant and consumer, it only guarantees server-side authentication. Client authentication is optional. In addition, SSL/TLS cannot provide irrefutability—consumers can order goods or download information products and then claim the transaction never occurred.
Virtual private networks (VPNs) enable remote users to access an internal network from the Internet. They use protocols to create a private connection between a user on a local ISP and a private network. This process is called tunneling because it creates a private connection by adding an encrypted wrapper around the message to hide its content. It is called virtual because it appears to be a dedicated secure line when in fact it is a temporary secure line. VPNs are used primarily for transactions between business partners because dedicated connections can be very expensive. The Internet and VPNs can be used to significantly reduce the costs of secure communications.
Difficulty: Moderate
AACSB: Analytical thinking; Information technology; Written and oral communication
85) Explain how an online credit card transaction works, identifying the parties involved and describing how SSL/TLS is involved. What are the limitations of online credit card payment systems?
Answer: The five parties involved in a credit card transaction are the consumer, the merchant, the clearinghouse, the merchant bank (acquiring bank), and the consumer’s card issuing bank. The basic payment transaction process works like this: The consumer first makes an online payment by sending his or her credit card information via an online form at the merchant’s Web site. Once this information is received by the merchant, the merchant software contacts a clearinghouse (a financial intermediary that authenticates credit cards and verifies account balances). The clearinghouse contacts the card issuing bank to verify the account information. Once verified, the issuing bank credits the account of the merchant at the merchant’s bank. The debit to the consumer account is transmitted to the consumer in a monthly statement. SSL is involved in sending the consumer’s credit card information safe at the merchant’s Web site. When the consumer checks out using the merchant’s shopping cart software, a secure tunnel through the Internet is created using SSL/TLS. Using encryption, SSL/TSL secures the session during which credit card information will be sent to the merchant and protects the information from interlopers on the Internet.
There are a number of limitations to the existing credit card payment system, most importantly involving security, merchant risk, cost, and social equity. The security of the transaction is considered to be very poor because neither the merchant nor the consumer can be fully authenticated. The risk merchants face is high. Banks think of Internet credit card orders as the same type of transactions as mail orders or telephone orders. In these transactions, the credit card is not present. There is no way for the merchant to verify the legitimacy of the customer’s card or identity before confirming the order. In these transactions, the merchant carries all the risk for fraudulent credit card use. Consumers can disclaim charges even though the items have already been shipped. Merchants also must pay significant charges. These high costs make it unprofitable to sell small items such as individual articles or music tracks over the Internet. Furthermore, credit cards are not very democratic. Millions of young adults and almost 100 million other adult Americans who cannot afford credit cards or who have low incomes and are, therefore, considered poor credit risks cannot participate in e-commerce as it is presently structured in the United States.
Difficulty: Moderate
AACSB: Analytical thinking; Information technology; Written and oral communication
86) Define and explain how EBPP systems work. Describe each of the main EBPP business models.
Answer: EBPP refers to electronic billing presentment and payment systems, which are forms of online payment systems for monthly bills. Analysts expect electronic bill presentment and payment to become one of the fastest growing e-commerce businesses in the United States over the next several years because everyone involved stands to benefit from the process. Billers will cut costs by eliminating printing, paper, envelopes, postage, and the processing of paper checks and payments. Furthermore, EBPP will offer billers an opportunity to enhance customer service and target market. Customers will save time and eliminate checks and postage. Companies can use EBPP to present bills to individual customers electronically or they can contract with a service to handle all billing and payment collection for them. There are two main types of EBPP business models: biller-direct and consolidator. In biller-direct systems, a biller delivers the bill to customers via its own Web site or via a third-party’s site. A service bureau is often used to provide the necessary infrastructure. The second major type of EBPP business model is the consolidator model. In this model, a third party, such as a financial institution or portal, aggregates all bills for consumers and ideally permits one-stop bill payment (pay anyone).
Difficulty: Moderate
AACSB: Analytical thinking; Information technology; Written and oral communication
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
