Information Security

Encryption is the process of scrambling plaintext data into ciphertext so that it cannot be understood by unauthorized users. Only individuals who possess the correct decryption key can restore the data to its readable form.

Strong password security relies on multiple layers of defense, including password complexity, multi-factor authentication, and limiting login attempts to prevent brute-force attacks. Therefore, all of the listed options are valid security requirements.

A security policy is a formal document that outlines the rules, guidelines, and procedures required to protect an organization's assets and systems. It defines how security measures should be implemented and enforced.

A firewall acts as a protective barrier between a computer or local network and external networks like the internet. It monitors incoming and outgoing traffic and blocks unauthorized access based on predefined security rules.

The Computer Misuse Act 1990 is a UK law that makes unauthorized access to computer systems, including hacking and data interception, illegal. The Data Protection Act focuses on how personal data is processed, rather than unauthorized hacking.

The Investigatory Powers Act is a UK law that provides a framework for the use of investigatory powers by law enforcement and intelligence agencies, including the interception of communications. The Computer Misuse Act and Data Protection Act cover unauthorized hacking and data privacy, respectively.

Packet sniffing is a network forensic technique where data packets traveling across a network are captured and analyzed to detect suspicious activity or security breaches. Other options like running antivirus or updating software are general maintenance tasks rather than forensic investigation techniques.

A penetration tester, also known as an ethical hacker, is hired to legally probe systems and networks to find and report security vulnerabilities before malicious hackers can exploit them. Systems administrators and network managers focus on maintaining and operating systems rather than dedicated vulnerability testing.

SQL injection is an attack technique where malicious SQL statements are inserted into entry fields of a web application to manipulate the backend database. This allows attackers to bypass authentication and access, modify, or delete database records.

Installing software patches is a key way organizations protect their database management systems and web servers from known vulnerabilities that could be exploited by SQL injection. While input validation in code is the primary defense, keeping software updated with patches is a crucial administrative safeguard.

A Distributed Denial of Service (DDoS) attack involves using multiple hijacked machines (often a botnet) to send a massive volume of requests to a single target server, overwhelming its resources. Phishing is a social engineering technique, while viruses and worms are types of self-replicating malware.

Hackers use viruses for a wide variety of malicious purposes, including disrupting system functionality, stealing personal credentials, and harvesting financial information. Therefore, all of the listed options represent common ways viruses are utilized by attackers.

Malware, short for malicious software, is an umbrella term that covers various digital threats to computer systems, such as viruses, worms, and spyware. It is designed to cause harm, steal data, or gain unauthorized access, making it illegal and highly prevalent on the internet.

An Acceptable Use Policy (AUP) is a set of rules applied by a network manager or organization that restricts the ways in which the network or system may be used. Phishing, viruses, and data theft are security threats or incidents, not administrative policies.