Information Security

Privilege escalation cannot be handled by input validation alone. It's a logic flaw where users can access functions or data beyond their intended permissions. It requires proper authorization checks, access controls, and session management, not just input validation.

HTTP uses port 80 while HTTPS uses port 443. HTTPS provides security through SSL/TLS encryption. The question wording is vague - option C lacks context about which attacks, and option B has a typo ('insure' instead of 'insecure').

A Zero Day vulnerability is a security flaw unknown to the software vendor, for which no patch exists. Attackers exploit these vulnerabilities before developers become aware and can release fixes, making them particularly dangerous.

To solve this question, the user needs to be familiar with different hacking techniques. The user must identify the technique used by the hacker to obtain sensitive information from a victim.

The correct answer is:

C. Phishing

Explanation:

Phishing is a technique used by hackers to create a fake website or email to look like an original one to trick the victims into providing sensitive information, such as passwords, credit card numbers, or social security numbers. The fake website or email will usually contain a link to the original website, but when the victim clicks on the link, they will be directed to the fake website where the hacker can obtain their sensitive information.

Option A, Keylogging, is a technique used to record the keystrokes of a victim to obtain their login credentials.

Option B, Backdoor, is a technique used to create a hidden entry point to a computer system to gain access to it later.

Option D, Masquerading, is a general term that refers to any technique used to disguise oneself or one's activities.

Therefore, the correct answer is C. Phishing.

The 'passwd' command is the standard Unix utility for changing user passwords and related finger information. chpasswd exists but is for batch password changes by root, chpass is BSD-specific, and 'password' is not a valid command.

In secure programming, a fundamental principle is that NO external input should be blindly trusted. Even encrypted network data can be malicious or corrupted. Shell environment variables can be manipulated by attackers. argv[0] is not guaranteed to be just the program name - it can be set to arbitrary values by the calling process. Only option D correctly states that no external input must be trusted without validation.

This question is poorly worded and incomplete - it references code that isn't shown. However, the intended answer appears to be that certain code vulnerabilities can lead to multiple attack types. Buffer overflows can enable command injection (by overwriting return addresses to inject shellcode) and path traversal (by manipulating string parameters). The question asks what else can go wrong given buffer overflow vulnerability.

Line 6 directly outputs the 'searchID' parameter from the request without HTML encoding, allowing XSS injection (attacker can craft malicious searchID). The commented text also leaks implementation details (developer name, date, logic flow) which is information leakage. Both vulnerabilities coexist.

The code exhibits multiple security issues: sensitive credentials are left in developer comments, the form uses the GET method (exposing passwords in the URL), and autocomplete is not disabled on password fields.

Unvalidated user input in a redirect allows Content Spoofing by manipulating the redirect location to arbitrary URLs, and HTTP Response Splitting by injecting CRLF characters (%0d%0a) to craft arbitrary response headers or body content.

Digital signatures work by creating a hash of the original document, then encrypting that hash with the signer's private key. This creates a fixed-size signature that can be verified by decrypting with the public key and comparing against a newly computed hash. The document itself isn't encrypted (options B, C, D) - digital signatures provide authenticity and integrity, not confidentiality.

XSS prevention requires two complementary approaches: Input Validation (whitelist allowed characters/patterns) and Output Encoding (escape dynamic output based on context). These neutralize malicious scripts. Releasing resources, least privilege, and URL access control address different security concerns (resource leaks, privilege escalation, authorization).

To retrieve the current security level in a PS (PeopleSoft) application, the getSecurityLevel() method is the appropriate API call. The other options are incorrect: getApplicationId() retrieves app identifier, getAuthenticationLevel() is not the standard method, and getApplicationSecurityLevel() is not the correct method name.