Information Security

The aspnet_regiis.exe tool is used to encrypt configuration sections in web.config, including connection strings. The other tools serve different purposes: aspnet_wp.exe is the worker process and svcutil.exe is for Windows Communication Foundation.

To prevent password reuse, set PASSWORD_REUSE_TIME to UNLIMITED and PASSWORD_REUSE_MAX to 1. This combination ensures a password can never be reused. Setting both to UNLIMITED allows immediate reuse. Option A mentions a non-existent parameter. Password verify functions validate complexity, not reuse history.

Oracle profiles don't have a PASSWORD_COMPLEXITY parameter. To enforce password rules like preventing all-numeric passwords, you must create a password verification function (PL/SQL) that uses REGEX to validate password format. This function is then assigned to the user's profile.

SOAP body elements can be encrypted using WS-Security (Web Services Security) specification, which supports XML Encryption and XML Signature standards. These allow selective encryption of specific SOAP elements using digital signatures. SSL only encrypts the entire transport/channel. WS-Security provides end-to-end, element-level security that persists through intermediaries.

Phishing is exactly this scenario - deceptive emails (or messages) appearing trustworthy to trick recipients into revealing sensitive information like bank details, passwords, or payment info. Spam is unsolicited bulk email, hacking is unauthorized access, vishing is phone-based, and simulation is not a standard security term.

Virtual keyboards display an on-screen keyboard that users click with a mouse, making keystroke logging ineffective since no physical keys are pressed. Keystroke loggers record hardware keystrokes, but virtual keyboards bypass this by accepting mouse input. Touchscreen and finger touching alone don't prevent logging - the virtual keyboard is the specific security feature.

The ATM SafetyPIN system was a proposed safety feature where entering a PIN in reverse would silently alert police while dispensing cash normally. This would allow victims of forced withdrawals to signal for help without alerting their attackers. The concept was widely discussed but never widely implemented due to technical and procedural challenges.

Finding a developer's name in source code is not inherently a vulnerability - it's information disclosure. However, this information could potentially be used in social engineering attacks (e.g., impersonating the developer, crafting targeted phishing). Option D correctly identifies this as POSSIBLE social engineering, not a direct attack or guaranteed exploit.

A malicious proxy server can intercept all traffic between the user and the email service, capturing login credentials in transit (Man in the Middle attack). Phishing tricks users into revealing credentials, eavesdropping is passive listening, and keyloggers capture keystrokes locally.

The scenario describes an email that pretends to be from a bank and asks the recipient to click a link to verify a prize, aiming to steal login credentials; this is classic phishing.

Browser cache poisoning involves injecting malicious content into the browser's cache. When the victim revisits the site, the browser loads the poisoned cached content instead of fresh content from the server. Clearing browser cache removes the poisoned content, restoring normal display. Reflected XSS doesn't persist across sessions, persistent XSS requires server-side storage, and link injection doesn't affect cache.

Identity Theft involves using someone's personal information without their permission, typically on websites they never registered with. Information stealth is not a standard security term, Sensitive Information Disclosure refers to exposing data by a system, and XSS by MIME sniffing is a specific browser vulnerability.

Cross-site Request Forgery (CSRF) tricks a user into executing unwanted actions on a website where they're authenticated. User B, already logged in, clicks the manipulated link and unknowingly places a bid using their session. Identity theft involves stealing personal information, XML Injection targets XML parsers, and reflected XSS requires script execution in the response.