Information Security and Web Vulnerabilities

The Java code uses Runtime.exec() to execute 'cmd.exe /C' without proper input validation. If user input were concatenated into this command string, an attacker could inject arbitrary system commands after the /C flag. This is a classic Command Injection vulnerability where the application passes unsanitized data directly to a system shell. Buffer Overflow (A) would require memory corruption, CSRF (C) requires cross-site request forgery context, XSS (D) needs web page output rendering, and XST (E) relates to cross-site tracing.

In J2EE web applications, the web.xml deployment descriptor file defines application-wide configurations including error pages. You specify error pages using elements that map exception types or HTTP error codes to custom display pages. Server.xml (A) is for server-level configuration in Tomcat, config.xml (B) is not a standard J2EE config file, and application.properties (D) is typically used for application-specific settings, not servlet container configurations.

The element in web.xml specifies session timeout in MINUTES, not smaller time units. This is defined in the servlet specification - the value represents the integer number of minutes before an inactive session is invalidated. Using milliseconds (A) or seconds (B) would make timeouts impractically large, and hours (D) is not the standard unit defined in the spec.

The POST method should be used to accept form data, especially when it contains sensitive information, as it sends data in the request body rather than exposing it in the URL query string.

To comply with security standards like PCI-DSS, applications should avoid storing credit card numbers unless absolutely necessary. If storage is required, they must never be stored in plain text and must be encrypted.

A brute force attack is a trial-and-error method used to obtain information, such as user passwords or personal identification numbers, by systematically trying all possible combinations until the correct one is found.

Rootkits typically hide processes by modifying system structures, such as altering the active process list, replacing system files, or hooking APIs to filter out specific process IDs from being displayed in system tools.

It is possible to combine or bind an executable (.exe) file with an image file (such as .jpg or .png) using binders or steganography techniques so that the executable runs when the file is opened or extracted.

Process Explorer, Autoruns, and Rootkit Revealer are specialized system utility tools from Sysinternals/Microsoft used to detect, analyze, and help remove malware and rootkits. MS Office is an office productivity suite, not a security tool.

VB scripts, batch file scripts, and AutoIt scripts can all be used to create viruses or malware due to their ability to execute system commands and automate tasks. These scripting languages have the necessary capabilities for malicious code execution, though their use for such purposes is unethical and illegal.

Batch files, VBScript, and AutoIt scripts are all lightweight, interpreted scripting languages with direct access to system resources, file systems, and execution commands, making them highly effective and commonly used tools for creating simple viruses or malware.

VBScript can control the mouse pointer and simulate clicks by utilizing the Windows Script Host Shell object to run PowerShell commands or by calling Windows API functions via external COM objects. Therefore, the statement that we cannot control the mouse using VBScript is false.

3DES (Triple DES) is a symmetric encryption algorithm that applies the Data Encryption Standard (DES) cipher three times to each data block. It was developed to address weaknesses in the original DES by using multiple encryption rounds with different keys.

In computer security, AV stands for Anti-Virus, which is software designed to detect and destroy computer viruses. The other options are incorrect fabrications.

BCP stands for Business Continuity Plan, which is a document that outlines how a business will continue operating during an unplanned disruption in service. The other options are incorrect or use incorrect spelling.

In the context of security and access control, 'Bio' is commonly used as an abbreviation for Biometrics, which refers to body measurements and calculations related to human characteristics. The other options are incorrect.

DES stands for Data Encryption Standard, a symmetric-key algorithm for the encryption of digital data. Although superseded by AES, it remains a landmark standard in cryptography. The other options are incorrect.

DHA stands for Directory Harvest Attacks, a technique used by spammers to find valid email addresses at a destination domain by sending brute-force emails to many generated usernames. The other options are incorrect.

DNS stands for Domain Name System, a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. The other options are incorrect.

In IT and business continuity contexts, DR stands for Disaster Recovery, which involves a set of policies, tools, and procedures to enable the recovery or continuation of vital technology infrastructure and systems following a disaster.