Web Application Security and Security API Fundamentals

Client-side validation can be bypassed by manipulating requests or disabling JavaScript. Security controls must enforce rules on the server where attackers cannot tamper with them. Options A (default-deny filtering), B (least privilege), and D (stored procedures) are valid security practices.

Phishing is social engineering that tricks users into performing actions like clicking malicious links or entering credentials. It targets human behavior, not technical vulnerabilities. Options A and C describe technical exploitation, while D is unrelated to phishing success.

Authorization checks prevent unauthorized access by verifying permissions for each request. Obscurity (B) is not real security since attackers can discover file names through other means. File organization (C) and ACLs (D) don't stop direct URL manipulation attacks.

Unused parameters can be exploited via parameter pollution or mass assignment attacks. Attackers manipulate them to trigger unintended behavior or bypass security logic. Even if they seem harmless now, they expand the attack surface and may be abused.

Request scope exists only for the duration of processing a single HTTP request/response cycle. Variables in request scope are created when the request arrives and destroyed after the response is sent. This is shorter than session scope (A) and application scope (D).

White-box testers see source code and can design tests targeting specific internal logic paths. Black-box testers only see inputs and outputs like external users. Options A, B, and C are incorrect - tester independence, approach strategy, and business unit involvement don't define the difference.

White-box testing involves analyzing source code directly to find vulnerabilities. Regex-based scanning is a static white-box technique that examines code patterns. Black-box (B) tests without code access, and grey-box (A) combines limited internal knowledge with external testing.

Penetration testing is an active simulation of an attack to exploit vulnerabilities and determine actual risk, while vulnerability assessment is a broader process of identifying and classifying security weaknesses without exploiting them. Option A is wrong because both can enumerate resources and vulnerabilities. Option C is incorrect because penetration testing goes beyond identifying services to actually exploiting weaknesses.

The hashPassword method requiring both password and accountName parameters allows for account-specific salting, which improves security by preventing the same password from hashing identically across different accounts. The single-parameter versions would be less secure. Option C is incorrect due to incorrect method naming convention (lowercase 'p').

The verifyPasswordStrength() method is a void method, meaning it performs validation and likely throws an exception or sets internal state rather than returning a value. This is common for validation methods that enforce security policies by throwing exceptions when requirements aren't met.

The isAuthorizedForData() method checks whether the current user is authorized to access or modify a specific data object. It returns a boolean value (true if authorized, false otherwise). It does not return text, numeric identifiers, or a void type, as authorization is a binary status check.

CSRF tokens are typically generated as random strings that can be embedded in forms or HTTP headers. The getCSRFToken() method returns a String token value, not numeric types like Integer or BigInteger, which would be unsuitable for token representation.

The login method throws EnterpriseSecurityException, which is a custom exception specific to the security framework being used. Standard Java exceptions like LoginException, SecurityException, or IntrusionException are not the correct custom exception for this API.

The security API provides default codecs for both JavaScript and VBScript to protect against cross-site scripting (XSS) attacks. These are the two most common client-side scripting languages that require encoding to prevent injection vulnerabilities.

Command injection protection requires encoding for both Unix and Windows command shells, which have different meta-characters and quoting rules. A Linux codec would be redundant with Unix codec. Both major operating systems need protection.

The security API supports Oracle and MySQL database codecs for SQL injection protection. Option D incorrectly includes Sybase and DB2, which are not among the default supported databases in this particular API.

The seal() method creates a cryptographic seal that binds data together with an expiration timestamp, providing tamper evidence and time-based validity. Unlike simple encoding, hashing, or scrambling, sealing provides integrity protection with temporal constraints.

The setNoCacheHeaders() method takes an HttpServletResponse parameter and sets cache-control headers to prevent browsers and proxies from caching sensitive content. It doesn't need HttpServletRequest, doesn't return a boolean, and doesn't throw ServletException.

The addCSRFToken() method is specifically designed to add CSRF protection tokens to links, which is the primary defense against cross-site request forgery attacks. The other methods serve different purposes: encryption, secure communication verification, and content type setting.

Cross Site Scripting (XSS) attacks inject malicious scripts into web pages viewed by other users. The most effective defense combines input validation (rejecting malicious input) and output encoding (converting special characters to HTML entities). Authentication and cryptography protect against different threats, not XSS.