Cybersecurity Fundamentals

A Smurf attack sends spoofed ping requests (ICMP echo requests) to a broadcast address, causing all hosts on the network to reply to the victim, flooding them with ping replies. Ping of death uses oversized packets, Teardrop uses malformed fragment offsets, and Ping broadcast is the mechanism Smurf exploits but not the attack name itself.

Keeping applications and operating systems up to date is a fundamental security practice, as updates patch known vulnerabilities. Using the system as standalone does not prevent attacks, security utilities are helpful but not sufficient alone, and shutdown only protects when off. The question phrasing is awkward but the core concept is valid.

Online banking security requires awareness of multiple threat vectors. Phishing steals credentials through fake websites, keyloggers capture keystrokes to steal passwords, and HTTPS ensures encrypted communication with legitimate banking sites.

Phishing attacks work by tricking users into clicking malicious links that appear legitimate. Avoiding direct clicks on email/chat links prevents attackers from redirecting you to fake websites designed to steal credentials.

Viruses, worms, and rootkits are inherently malicious software types. Macros are actually legitimate automation tools for office applications that can be abused but are not malicious by design.

Fake antivirus scams are social engineering attacks that use multiple tactics: fake security alerts to scare users, and then attempt to monetize through fraudulent software sales or installing malicious code like keyloggers to steal financial information.

WPA (Wi-Fi Protected Access) and SSH (Secure Shell) are security protocols used to encrypt communications. WP likely refers to WPA. HTTPD is a web server software, not a security mechanism.

C is most susceptible to buffer overflow because it allows direct memory manipulation through pointers, lacks automatic bounds checking on array access, and requires manual memory management. Java has built-in bounds checking and garbage collection that prevent buffer overflows. COBOL has stronger memory safety features. ColdC is not a mainstream language with known buffer overflow issues.

OWASP stands for Open Web Application Security Project. It's a nonprofit foundation dedicated to improving software security. Option B incorrectly uses 'server' instead of 'security'. Option C and D use incorrect words ('purpose' and 'provider') in place of 'project'.

The CIA triad consists of Confidentiality, Integrity, and Availability - the three core principles of information security. Confidentiality ensures authorized access only, Integrity maintains data accuracy, and Availability ensures reliable access. Option A and C incorrectly use 'Control' and 'Information' instead of Confidentiality. Option D uses 'Information' instead of Integrity.

CIS (Center for Internet Security) provides widely-recognized benchmark standards for securing databases, operating systems, and other IT systems. These are configuration best practices used globally. Option A refers to the CIA triad (security principles), not benchmarks. Option C and D are not recognized standards organizations.

In the OWASP Top 10 (2013 update), Security Misconfiguration and Unvalidated Redirects were newly added entries. Security Misconfiguration (A2013:6) addresses improper security settings. Unvalidated Redirects (A2013:10) covers unsafe URL forwards. Insecure Direct Object References and CSRF were in previous versions but not new additions.

Footprinting is indeed the reconnaissance phase where attackers gather information about a target system before attempting intrusion. This includes collecting public information, DNS records, network topology, employee details, and other intelligence. It's a critical first step in both ethical hacking and malicious attacks, forming the basis for later exploitation phases.

A Policy Server in an IAM (Identity and Access Management) system provides the core AAAA services: Policy Management (defining access rules), Authentication (verifying identity), Authorization (determining permissions), and Accounting (auditing and logging access). These are the four fundamental functions of access control and security management systems.

The Policy Server Management Console provides comprehensive administrative control over the policy server. This includes operational controls (starting/stopping processes, cache management), configuration (executives, key management, global settings), and administrative functions (user management). All these functions are standard management console capabilities for policy server administration.

An Access Control List (ACL) is exactly what the statement describes: a security mechanism attached to a resource that specifies which users or groups have what permissions. ACLs provide fine-grained access control by listing individual permissions per user/group.

Session management DOES allow controlling access duration - through timeouts, explicit termination, and session policies. The statement claims you 'can't control' access time, which is false. Sessions are a primary mechanism for limiting authenticated user access.

This is a vendor-specific requirement for Policy Server installation (likely Netegrity/SiteMinder). The minimum memory requirement is 512 MB RAM. Below this, the Policy Server may not function properly or may experience performance issues.

In the AAA security framework (Authentication, Authorization, Accounting), a user session begins after successful authentication. Once authenticated, the user's identity is established and a session can be tracked. Authorization determines what the authenticated user can access.

User sessions terminate through valid mechanisms: user logout (explicit termination), session expiration (timeout), or administrative action (disabling user account). Hitting another URL is just session activity, not termination. All three listed scenarios are correct.