Web Application Security Fundamentals

Data hashing creates a fixed-size signature from input data using a cryptographic hash function. Any change to the original data produces a completely different hash value, making tampering detectable. Hashing does not validate sessions or user identity - those are separate authentication mechanisms.

Forced browsing attacks occur when attackers guess or enumerate URLs to access resources without proper authorization. A successful forced browsing attack indicates that the application's authorization process is flawed - it fails to properly verify whether the authenticated user has permission to access the requested resource. This is different from configuration or session management issues, as the vulnerability specifically relates to access control decisions.

Administrative pages are high-value targets and require strong authentication. Multi-factor authentication (2FA or 3FA) is the best practice because it requires something you know (password) plus something you have (token) or something you are (biometric). Options A and B offer only single-factor protection which is insufficient for admin access. Option D (no lockout) is dangerous as it prevents protection against brute force attacks.

Stack traces and detailed error messages contain sensitive implementation information that can aid attackers. Best practice is to log this information server-side for troubleshooting while showing only generic error messages to users. Option A (hidden field) exposes data to users. Option B (destroying it) loses debugging information. Option D is incorrect because A is not recommended.

Individual user accounts provide clear accountability by linking actions to specific users. Group or business unit accounts obscure who performed specific actions, making audits and incident investigation difficult. Individual accounts are essential for maintaining an audit trail and meeting compliance requirements.

90 days is a common best practice recommendation for forced password changes, balancing security and usability. 60 days may be too frequent, leading to password fatigue. 120 and 180 days are considered too long by modern standards, increasing exposure if passwords are compromised. Note that some guidance has shifted toward longer intervals with strong password policies and breach detection.

HTML comments visible in source code can reveal sensitive information to attackers including: debug data, server-side file paths, commented-out security code, developer names, and implementation details. This reconnaissance information helps attackers craft targeted exploits. Comments should be removed before production deployment.

Web server default settings prioritize ease of use and features over security. They often include unnecessary services, default credentials, verbose error messages, and known insecure configurations. Security requires explicit hardening: disabling unused modules, applying security patches, configuring encryption, and following security benchmarks.

Client-side validation is NOT a security control because it can be easily bypassed by disabling JavaScript, modifying the request, or using tools like curl. Secure applications must validate on the server side. Options A (default-deny regex), B (least privilege), and D (stored procedures) ARE recommended practices for securing web applications.

Phishing attacks succeed when they entice or manipulate users into performing actions they wouldn't normally do - clicking malicious links, entering credentials, downloading malware, or making payments. The attack exploits human psychology rather than technical vulnerabilities. Option A refers to unpatched servers (not phishing). Option C refers to user patching (relevant but not phishing success). Option D is unrelated.

Forceful browsing (or directory traversal) attacks occur when users access unauthorized pages or resources by guessing URLs. The only effective prevention is checking authorization on every page request, ensuring users can only access resources they're permitted to see. Options B and C are security through obscurity and don't prevent access. Option D (ACLs on web root) is about file system permissions, not application-level authorization.

Extra parameters in HTTP requests can expose hidden functionality, bypass business logic validation, or trigger unintended code paths. Attackers use parameter pollution and tampering to exploit these unused parameters, potentially leading to authentication bypass, privilege escalation, or data exposure. Options A, C, and D incorrectly assume extra parameters are necessary or harmless.

The CIA triad (Confidentiality, Integrity, Availability) is the foundation of information security. A comprehensive security policy must address all three: Confidentiality ensures sensitive data is only accessible to authorized parties; Integrity guarantees data accuracy and completeness; Availability ensures systems and data are reliable and accessible when needed. 'All of the Above' is the only complete answer.

A Man-in-the-Middle (MITM) attack specifically involves an attacker secretly intercepting and possibly altering communications between two parties who believe they are directly communicating with each other. Option B describes impersonation/spoofing, not MITM. Option C is incorrect because MITM doesn't involve the attacker pretending to be an authorized user - it's about positioning between the sender and receiver.

The term 'Macro' refers to a legitimate automation feature in office applications (Excel, Word) that records sequences of commands. While macro viruses exist and are malicious, the macro feature itself is a neutral tool - not inherently malicious software. In contrast, Virus, Worm, and Rootkit are categories of malicious programs designed to cause harm or unauthorized access. This question tests understanding that 'macro' alone refers to the automation feature, not malware.