Condition testing is a white-box technique that specifically targets logical conditions (compound boolean expressions, if statements, loops) within program code. It ensures all possible combinations of conditions in decision points are tested to reveal potential logic flaws in conditional statements.

Data flow testing selects test paths based on how variables are defined, used, and killed throughout the program. It tracks the flow of data from assignment points to usage points, ensuring that all definition-use pairs are tested and uncovering errors in how data propagates through the code.

Black-box testing can detect incorrect or missing functions by comparing actual behavior against requirements. It reveals interface errors through invalid input/output testing and can identify performance errors by testing system response times and resource usage under various conditions.

Fault-based testing (also called mutation testing) deliberately introduces small faults to test effectiveness of test cases. Since it's computationally expensive, it's strategically reserved for critical operations where failures are costly or for suspect code sections that have had defects or complex logic requiring extra scrutiny.

Equivalence partitioning reduces test cases by grouping input data into classes that should be processed similarly. The technique divides test data into valid and invalid equivalence classes, then tests representative values from each class rather than every possible input, making testing more efficient while maintaining coverage.

Testable software exhibits observability (you can see what's happening internally), simplicity (clear, understandable design), and stability (consistent behavior). These characteristics make it easier to design effective test cases, identify failures, and maintain test suites over time.

Statement coverage is a white-box testing metric that ensures every executable statement in the code is executed at least once during testing. It's the most basic form of code coverage, measuring what percentage of statements have been executed by the test suite.

These five elements form the core security framework for applications. Authentication and Authorization (the first two As of AAA) control who can access and what they can do. Confidentiality, Integrity, and Availability (the CIA triad) are the fundamental goals of information security. Together, these ensure only authorized users can access data, data remains accurate and unaltered, and systems are accessible when needed. All five are essential for comprehensive application security.

Custom error messages should be turned 'Off' (False) because detailed error messages leak information that helps attackers. Verbose errors can reveal file paths, database schema, server versions, and implementation details that attackers use to plan attacks. Generic error messages give users enough information without exposing system internals. This is a standard hardening practice called 'information disclosure prevention.'

SQL injection attacks manipulate SQL queries by injecting malicious code. UNION is a key SQL operator used to combine results from injected queries with original results, allowing data extraction. OR is used to manipulate WHERE clause logic - a classic technique like 'OR 1=1' bypasses authentication by making conditions always true. CREATE is a DDL statement rarely used in injection. WHERE is a clause marker, not typically used alone for injection exploits. UNION and OR are fundamental to SQL injection techniques.

Security threats can affect ANY application type. HTTPS websites (Option A) are still vulnerable to application-level attacks like XSS or injection - HTTPS only encrypts transport. HTTP websites (Option B) are even more vulnerable. Windows/desktop applications (Option C) have their own vulnerabilities (buffer overflows, etc.). Option D is incorrect because it's not just 'http' and Windows apps - all application types face security threats. Protocol doesn't eliminate application-level vulnerabilities.

Buffer overflows, SQL injection, and Cross-site scripting (XSS) are all attacks that exploit insufficient input validation. Buffer overflows occur when unchecked input exceeds memory boundaries. SQL injection happens when unvalidated input is concatenated into SQL queries. XSS results when unsanitized input is rendered in web pages. Authentication and Authorization (Options D, E) are security CONTROLS, not threat categories - they help prevent attacks but aren't attack types themselves. The claimed answer correctly identifies the three input validation threats.

Client-side validation can be easily bypassed by disabling JavaScript, modifying browser requests, or using tools like curl. For security enforcement, server-side validation is mandatory as it cannot be circumvented by users.

File type validation ensures only allowed formats are uploaded. Size limits prevent storage exhaustion and DoS attacks. Virus scanning detects malware. File name validation is less critical since the real security concern is file content and type.

Cross-Site Scripting (XSS) occurs when an application includes untrusted user input in a web page without proper validation or escaping. If the user input is directly echoed back in the response, malicious scripts contained within the input can execute in the victim browser. This makes echoing unvalidated input a primary vector for reflected XSS.

Denial of service attacks disrupt availability by overwhelming resources. Executing malicious content includes threats like SQL injection and XSS. Information disclosure exposes sensitive data. All three are common security threats.

Windows, Form-based, Basic, and Passport are standard web application authentication modes, particularly in ASP.NET. SQL authentication is used to authenticate to database management systems rather than directly to web applications, making it and "All of the above" incorrect.

String concatenation with user input (A) allows attackers to inject malicious SQL by crafting input like ' OR 1=1--. Options B and C use parameterized queries, which separate SQL code from data, making injection impossible.

Encoding client data prevents XSS. Parameterized stored procedures help prevent SQL injection. Detailed error messages aid debugging but can leak sensitive information. Providing highest privilege (A) violates the principle of least privilege.

The response contains an HTML h1 element with the title parameter from the URL echoed directly into the page. This unencoded reflection allows script injection, which is a reflected XSS vulnerability.