Software Security and Secure Design Principles

Lack of physical access control is the principal security risk of wireless LANs because wireless signals extend beyond physical boundaries, making it impossible to control who can physically access the network medium. Unlike wired networks where an attacker needs physical access to a port or cable, wireless networks are accessible to anyone within signal range. War driving (D) is a technique that exploits this vulnerability, not a root cause. While weak standards (B) and implementation flaws (C) are real risks, the fundamental issue is the inability to enforce physical boundaries.

Virtualization introduces security considerations because the hypervisor (VM layer) becomes a critical security-relevant component that must be properly configured. If the VM layer is misconfigured or compromised, it can expose all guest VMs to risk. Options B and C describe advantages (introspection for detection, defense-in-depth layer), while D is not a standard security disadvantage of virtualization - VM isolation actually makes some kernel-level attacks more contained.

Static analysis and antivirus scanners cannot achieve 100% accuracy because whether a code string is malicious depends entirely on how it's interpreted in a specific runtime context. The same sequence of bytes could be harmless data in one context but executable malicious code in another. Polymorphic malware and code obfuscation techniques exploit this fundamental limitation - scanners examine static patterns but cannot predict all possible runtime interpretations without executing the code (which is unsafe). Options A and B describe practical limitations, while D is irrelevant to the core theoretical problem.

Format string vulnerabilities occur when user input is passed as the format argument to printf-style functions without proper validation. Attackers discover these flaws by embedding format specifiers like %x, %s, %n in their input and observing unexpected output or program behavior. If the application blindly uses the input as a format string, these specifiers leak memory contents or enable arbitrary writes. Buffer overflows (A) and underflows (C) are different vulnerability classes, while random long strings (B) might trigger crashes but won't specifically expose format string issues.

UDP lacks TCP's handshake and sequence number mechanisms, making source IP spoofing trivial for attackers. In TCP, the three-way handshake with SYN/SYN-ACK/ACK and sequence numbers makes it difficult to successfully spoof a source address and complete a connection. UDP's connectionless, fire-and-forget design (C) means there's no handshake to validate the source - any packet is accepted regardless of its claimed origin. While worm propagation (A) can use UDP, it's a consequence rather than the root cause of the larger attack surface. Option B is incorrect because UDP is connectionless.

Threat modeling is the structured process of identifying potential threats, documenting security weaknesses, and assessing risks to an application or system. It involves enumerating assets, mapping attack surfaces, identifying threat agents, and documenting countermeasures. Control identification and prioritization (A, C) are subprocesses, while attack surface evaluation (D) is a component - threat modeling encompasses the entire risk assessment methodology. Frameworks like STRIDE, PASTA, or Microsoft's threat modeling approach provide systematic ways to document and analyze security risks.

To solve this question, the user needs to be familiar with common cybersecurity threats.

Now, let's go through each option and explain why it is right or wrong:

A. Repudiation: This option refers to an attacker's attempt to deny that they have performed an action. It does not involve impersonating another user or using a false identity to gain access to a system.

B. Eavesdropping: This option refers to an attacker's attempt to intercept and listen to communications between two parties. It does not involve using a false identity to gain access to a system.

C. Spoofing: This option is correct. Spoofing involves an attacker using a false identity to gain access to a system. This can be accomplished through a variety of means, such as email spoofing or IP address spoofing.

D. Hijacking: This option refers to an attacker's attempt to take control of a system or communication channel. It does not necessarily involve using a false identity, although it can be a means to that end.

The Answer is: C

To answer this question, the user needs to be familiar with the basic security concepts.

The ability of users to deny that they performed specific actions or transactions is known as repudiation. This can occur when a user denies that they have performed an action such as sending an email or making a purchase.

Therefore, the correct answer is: A. Repudiation

Prioritizing threats requires quantifying risk as a function of likelihood, impact, and existing safeguards. Without quantitative or semi-quantitative risk assessment (using scales like DREAD, CVSS, or custom likelihood/impact matrices), prioritization is arbitrary and might focus on low-risk, high-visibility threats while missing critical ones. Measuring attack surface area (A) and enumerating entry/exit points (C) are data-gathering activities that feed into risk calculation, while accessibility identification (D) is one factor among many. Risk quantification provides the comparative framework to rank threats and allocate limited mitigation resources effectively.

Host-based firewalls should be part of a defense-in-depth strategy but never the sole control because they can be disabled by malware, compromised users, or attackers who gain system access. Once a host is compromised, the firewall process itself can be terminated or its rules modified. Unlike network firewalls that enforce policy at a perimeter, host-based firewalls run on the endpoint and are subject to the same compromise risks as other local software. Option D is incorrect because host firewalls can and are regularly turned off by attackers.

Mitigation technology choices should follow established security best practices and frameworks rather than being ad hoc decisions based on the number of sources consulted. Best practices provide vetted patterns for secure design (e.g., OWASP Top 10, NIST guidelines, secure coding standards). Mitigation should directly address the application's technology stack (C is wrong), and should comprehensively address relevant threat types (D is wrong - you want to cover as many applicable threats as possible). The number of sources (B) is less important than their quality and alignment with standards.

Elevation of privilege occurs when an attacker with limited permissions gains higher-level access, such as a normal user obtaining administrator rights. This is a core security violation because it breaks the principle of least privilege. Denial of service (B) disrupts availability but doesn't involve privilege escalation. Spoofing (C) involves faking identity rather than gaining privileges. Repudiation (D) refers to the inability to prove a user performed an action - a different security property (non-repudiation) altogether.

A hardened operating system has a reduced attack surface achieved by removing or disabling unnecessary services, closing unused ports, eliminating non-essential packages, and restricting default permissions. This makes it inherently more secure than an unhardened OS (C is wrong). While some hardened OSes implement mandatory access control (B), that's a specific mechanism not the defining characteristic. The hallmark is having fewer entry and exit points for attackers (contradicting D), reducing the number of potential vulnerabilities and attack vectors.

Hashing generates a unique cryptographic checksum of software files to verify they have not been altered, directly preserving data integrity. Encryption preserves confidentiality, recovery restores data after loss, and redundancy ensures availability rather than validating file integrity.

Redundancy - including backup systems, duplicate hardware, failover clusters, and replicated data - is the primary method for ensuring availability in software systems. When one component fails, redundant components take over seamlessly. Encryption (A) protects confidentiality, not availability. Hashing (B) ensures integrity. Recovery (C) is reactive, restoring after failure, whereas redundancy is proactive and maintains availability during failures. High-availability architectures explicitly design redundancy at all layers: network, server, database, and geographic.

Graceful degradation under DoS means the system continues providing partial service rather than failing completely. By varying response times or prioritizing certain requests, the software maintains availability for legitimate users while managing the attack load. Fail-over to standby systems (A and D) addresses high availability, not graceful degradation, and disconnecting connectivity (C) is an abrupt failure, not degradation.

The open design principle states that security should not rely on secrecy of design or implementation (Kerckhoffs's principle). Security mechanisms should remain secure even if all details are known to the attacker. Defense-in-depth (A) uses layered security, complete mediation (C) means verifying every access, and analyzability (D) relates to audit capabilities.

Design for survivability means systems can quickly recover and continue operating despite attacks or failures. This principle emphasizes rapid recovery features at the system level, ensuring essential services are maintained. Secure failure (B) focuses on failing safely, controllability (C) on maintaining control, and redundancy (D) on backup components.

Security management interfaces provide administrative control over trust features, policies, and security settings in applications. They allow administrators to configure, manage, and monitor security mechanisms. Secure configuration management (B) is a process, not an interface. Application containers (C) provide isolation, and security managers (D) are enforcement mechanisms, not control interfaces.