Cybersecurity Fundamentals

Public key algorithms involve complex mathematical computations, making them significantly slower than symmetric algorithms for encrypting large volumes of data. Symmetric algorithms do not offer better access control or nonrepudiation, and are generally simpler to implement.

Sensitive databases require high-security standard compliance, which is met by using algorithms certified under FIPS or EAL. Random numbers do not encrypt, long passwords are keys rather than algorithms, and DES is outdated and insecure.

An anonymiser is a service that hides a user’s real identity, typically by routing traffic through another server or providing temporary aliases, enabling the user to appear as a different person online. The other choices describe unrelated activities like FBI work, phishing, or vishing, which do not match the definition.

Piggybacking into unsecured wireless networks allows attackers to use someone else's internet connection, masking their real IP address and location to avoid detection. Physical masks and changing clothes do not hide network footprints, while phishing is an active attack vector.

Botnets (networks of compromised computers) are the primary mechanism used to orchestrate and execute distributed denial of service (DDoS) attacks. Distributing malware via emails spreads infections but isn't the direct DDoS method itself, while phishing steals credentials.

To answer this question, the user needs to know what cybercrime is and what activities constitute cybercrime.

Out of the given options, looting a bank is not a cybercrime. It is a traditional crime that can be committed without the use of computers or the internet.

On the other hand, looting email addresses, personal information, distributing viruses and worms are activities that can only be carried out through the use of computers and the internet, making them cybercrimes.

Stuxnet kind of attacks is a type of cybercrime which is designed to damage or destroy specific industrial equipment. Stuxnet was used to target Iran's nuclear program, and it caused physical damage to centrifuges at a uranium enrichment plant.

Therefore, the correct answer is:

The Answer is: D. Distributing virus, worms

Distributed Denial of Service (DDOS) attacks overload resource capacity or bandwidth from many sources, which firewalls cannot fully prevent on their own. Standard attacks like ping floods or specific port accesses are easily controlled via firewall rules.

Application layer firewalls inspect protocol payloads and can detect and block SQL injection attacks by analyzing database queries in HTTP traffic. They cannot prevent non-technical social engineering or physical wireless attacks like war-dialing/driving.

To answer this question, the user needs to have knowledge about different types of web attacks.

The answer is D. Path Traversal Attacks.

Option A is incorrect because Cross-site scripting (XSS) attacks allow an attacker to inject malicious scripts into a web page viewed by other users. This allows the attacker to steal user information, hijack user accounts, spread malware, and perform other malicious activities.

Option B is incorrect because Command Injection Attacks occur when an attacker sends malicious input to an application, tricking it into executing unintended commands. This can allow the attacker to run arbitrary commands on the web server, potentially compromising the server and its data.

Option C is incorrect because SQL Injection attacks occur when an attacker sends malicious SQL statements to a web application database. This can allow the attacker to view or modify data in the database, or even take control of the entire database server.

Option D is the correct answer because Path Traversal Attacks occur when an attacker manipulates a URL to access files outside of the web server's root directory. This can allow the attacker to view sensitive data or execute arbitrary code on the web server.

To solve this question, the user needs to have knowledge on securing web applications against authenticated users.

Option A: Client-side data validation is not sufficient to secure web applications against authenticated users. It can be easily bypassed by attackers, and therefore this option is not recommended.

Option B: Filtering data with a default deny regular expression can help prevent malicious input from being accepted, which is a good security practice. Therefore, this option is recommended.

Option C: Running the application under least privileges necessary is a recommended security practice because it limits the damage that can be caused by a successful attack. Therefore, this option is recommended.

Option D: Using parameterized queries to access a database can help prevent SQL injection attacks, which is a good security practice. Therefore, this option is recommended.

Therefore, the option that is NOT recommended for securing web applications against authenticated users is option A: Client-side data validation.

The Answer is: A

To solve this question, the user needs to have knowledge of the basic principles of security controls for database applications.

Option A: This option is incorrect because securing a database application with username/password access controls alone is not sufficient to fully secure the application. Although username/password access control is an essential security measure, it is not sufficient in isolation.

Option B: This option is correct because username/password access controls are necessary but not sufficient to fully secure a database application. Other controls such as encryption, access control lists, monitoring, and auditing should be combined with username/password access controls for a complete security solution.

Option C: This option is incorrect because the length of the password alone does not guarantee the security of the database application. There are other factors to consider such as password complexity, password rotation, and password storage.

Option D: This option is incorrect because even if none of the users have administrative access, username/password access controls alone are still not sufficient to fully secure a database application.

Therefore, the correct answer is:

The Answer is: B. Sufficient only when combined with other controls

Spyware typically performs all these behaviors: blocking access to updates to protect itself, aggregating surfing habits for advertisers, and customizing search results. Thus, 'All of the above' is the correct description of its characteristics.

To improve the overall quality of web applications, developers should abide by the following rule:

B. Clean and validate all user input.

Explanation:

Option A: Trusting user-supplied data is not a good practice, as it can lead to security vulnerabilities such as injection attacks, cross-site scripting (XSS), and cross-site request forgery (CSRF).

Option B: Clean and validate all user input is a good practice that can help prevent security vulnerabilities. Input validation can help ensure that the data is in the correct format and meets the expected criteria, while input cleaning can help remove any malicious content from the user input.

Option C: Using GET instead of POST is not a rule for improving the overall quality of web applications. GET and POST are different HTTP methods used in web applications, and each has its own advantages and disadvantages. Choosing the right method depends on the requirements of the application.

Option D: Allowing the use of HIDDEN form fields is not a rule for improving the overall quality of web applications. HIDDEN form fields can be used to store data that the user cannot see or modify, but they do not provide any security benefits.

Therefore, the correct answer is:

The Answer is: B. Clean and validate all user input.

Improper error handling enables multiple attack vectors: verbose error messages leak system details that help attackers map vulnerabilities (information disclosure), unexpected errors can crash applications creating DoS conditions, and revealed error paths guide attackers toward more sophisticated exploits. All three risks are real and commonly exploited.

Cross-site scripting (XSS) involves injecting malicious code into links or websites that appear trustworthy to execute in the user's browser. Command injection, path traversal, and buffer overflow target back-end weaknesses directly, not client-side link trustworthiness.

Browsers automatically include cookies for the domain in HTTP requests, including POST form submissions. This is how session state is maintained - the session ID cookie travels with the form POST to the server, allowing the server to associate the submission with the authenticated session.

From an application security perspective, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is commonly used for preventing scripted attacks. These attacks involve automated bots or scripts that try to exploit vulnerabilities in web applications. By using CAPTCHA, it becomes harder for automated bots to bypass security measures and perform malicious activities like spamming, credential stuffing, or brute-forcing.

So, the correct answer is A. To prevent scripted attacks.

Option B, "to provide biometric authentication," is not the primary purpose of CAPTCHA. Biometric authentication typically involves using unique physical or behavioral characteristics of an individual, such as fingerprints or facial recognition, to verify their identity.

Option C, "to check the color blindness of the user," is not the primary purpose of CAPTCHA either. CAPTCHA primarily focuses on distinguishing between humans and bots, and while it may include visual challenges, it is not specifically designed to check for color blindness.

Option D, "more security," is a vague statement and doesn't provide a specific reason for using CAPTCHA. While CAPTCHA does enhance security by preventing automated attacks, it is more accurate to say that it specifically targets preventing scripted attacks.

Therefore, the correct answer is A. To prevent scripted attacks.

IQA (Independent Quality Assurance) or peer review of code by another team member is a form of unit testing verification - checking individual code units for correctness before integration. Functional testing validates features work as specified, compliance testing checks standards adherence, and black box tests external behavior without seeing code.

Performance testing should occur after security testing but before user acceptance testing. This order ensures security vulnerabilities are identified first, then performance is validated under realistic load conditions, and finally business functionality is verified with end users before production deployment.