Cybersecurity and Cryptography Fundamentals

Blowfish is NOT patented. Bruce Schneier deliberately placed Blowfish in the public domain, making it freely available for anyone to use without licensing restrictions. This was a deliberate design choice to encourage widespread adoption.

AES (Advanced Encryption Standard) is indeed based on the Rijndael algorithm. Rijndael, designed by Joan Daemen and Vincent Rijmen, won the NIST competition in 2000 to become the AES standard. The terms are often used interchangeably, though technically AES is a subset of Rijndael with fixed block sizes.

AES does NOT use P-Box and D-Box. AES (Rijndael) uses SubBytes (S-Box), ShiftRows (permutation), MixColumns (diffusion), and AddRoundKey (key addition). The 'P-Box, D-Box' terminology belongs to other algorithms, not AES. Also, AES has multiple transformation types, not just three.

Side-channel attacks (often called 'plaintext attacks' in some contexts) exploit implementation weaknesses like timing, power consumption, or electromagnetic leakage rather than mathematical weaknesses in AES itself. These are the most practical successful attacks against AES implementations when not properly protected.

Serpent is famous for its conservative security design with 32 rounds, providing a very high security margin. It was a finalist in the AES competition and is known for being one of the most secure algorithms, though slower than AES. Option C 'Data security mechanism' is the closest match to its security reputation, though the wording is imprecise.

AES uses a Round Key mechanism where a single key is expanded into multiple round keys through key expansion, then each round uses a different round key derived from the original key. This is not variable key (different keys per session) or public key (asymmetric).

White box testing examines the internal structures, design, and code of the software, requiring access to the source code. Black box testing focuses on inputs and outputs without seeing internal code. Smoke testing and sanity checks are preliminary testing types that don't specifically require source code access.

Clear role definition and communication is foundational because it establishes accountability and ownership. Without knowing who is responsible for what, other security measures (audits, training, technical knowledge) cannot be effectively implemented.

Standard backup types are: full (complete backup), incremental (changes since last backup), and differential (changes since last full backup). Sequential backup is not a recognized standard backup methodology.

A trap door is a hidden entry point in software that bypasses normal authentication, often intentionally or accidentally left by developers. Flap Jack (A) is food, Unicode (C) is a character encoding standard, and Stealth code (D) is not standard terminology.

From a physical security perspective, any individual who is not a regular employee of the organization—including vendors, maintenance personnel, contract workers, and auditors—is classified as a visitor and must be escorted.

Finding a developer's name in source code is not inherently a vulnerability - it's information disclosure. However, this information could potentially be used in social engineering attacks (e.g., impersonating the developer, crafting targeted phishing). Option D correctly identifies this as POSSIBLE social engineering, not a direct attack or guaranteed exploit.

Persistent (or Stored) Cross-Site Scripting occurs when malicious input, such as a malicious link or script, is stored on the target server and then executed when other users view the compromised page. Since the link is saved and affects other users who click it, it is persistent rather than reflected.

SQL Injection involves inserting malicious SQL code into input fields like search boxes. The 'crafted code' causes the database to execute unintended queries, returning excessive data ('massive amount of result') and slowing response time. Social engineering tricks people, log injection targets logs, and reflected XSS requires script execution in responses.

Displaying unrelated content after a successful login, while the URL is correct, indicates that malicious script stored on the server is executed for the user’s session, which is characteristic of a persistent XSS attack.

DNS poisoning corrupts the DNS resolution process, causing the correct URL to resolve to a malicious server's IP address instead of the legitimate one. Phishing tricks users into visiting fake sites, social engineering manipulates people, and eavesdropping involves passive listening.

A malicious proxy server can intercept all traffic between the user and the email service, capturing login credentials in transit (Man in the Middle attack). Phishing tricks users into revealing credentials, eavesdropping is passive listening, and keyloggers capture keystrokes locally.

Log injection involves inserting malicious entries into log files. A non-working link could be crafted to add fake entries (like 'downloaded whole website') to server logs, framing the user. MITM attacks intercept traffic, persistent XSS stores malicious scripts, phishing tricks users, and the scenario specifically mentions being accused based on logs.