Question 1:

You were asked to investigate extremely high, unexplained merchandise shortages at a department store chain. You found the following:

1. The receiving department supervisor owns and operates a boutique carrying many of the same labels as the chain store. The general manager is unaware of the ownership interest.
2. The receiving supervisor signs receiving reports showing that the total quantity shipped by a supplier was received and then diverts 5% to 10 % of each shipment to the boutique.
3. The store is unaware of the short shipments because the receiving report accompanying the merchandise to the sales areas shows that everything was received.
4. Accounts Payable paid vendors for the total quantity shown on the receiving report.
5. Based on the receiving department supervisors instructions, quantities on the receiving reports were not counted by sales personnel.

Required:

Classify each of the five situations as a fraudulent act, a fraud symptom, an internal control weakness, or an event unrelated to the investigation (2 points). Justify your answers (3 points). (CIA Examination, adapted)

Question 2:

Network access control is very important for information security. The Internet uses mostly TCP/IP to deliver data/messages between individuals and businesses. What is TCP/IP (0.5 point)? How does TCP guarantee the delivery of data/messages through Internet? Please draw a diagram to show your answer (3.5 points). You need to make brief explanation of what you have drawn (1 point).

Question 3:

Nowadays many business transactions occur digitally using the Internet. Businesses must obtain the same level of assurance about the enforceability of a digital transaction that a signed document provides for a paper-based transaction. Digital signature is used to accomplish this by using hashing and asymmetric encryption.

Please use a diagram to explain the mechanism of asymmetric encryption through the use of public key and private key. You explanation is required. (4 points)

Also, in Digital Signature, the private key is used to encrypt the documents. Please explain why (1 point).

Question 4:

Draw an ERD with the scenario given below. Identify the maximum and minimum cardinalities. Include any assumptions if necessary. (5 points)

Ebony and Ivory, a piano manufacturer, wants to keep track of all the piano it makes individually. Each piano has an identifying serial number and a manufacturing completion date. Each instrument represents exactly one piano model, all of which have an identification number and a name. in addition, Ebony and Ivory wants to maintain information about the designer of the model. Over time, the company often manufactures thousands of the pianos of a certain model, and the model design is specified before any single piano exists.

Ebony and Ivory employs piano technicians who are responsible for inspecting the instruments before they are shipped to the customers. Each piano is inspected by at least two technicians (identified by their employee number). For each separate inspection, the company needs to record its date and quality evaluation grade.

Question 5:

Use your own words, please explain the mechanism of Denial of Service (DoS) attack. A digram may be very useful but not required (5 points).