Information Security

Identity Theft involves using someone's personal information without their permission, typically on websites they never registered with. Information stealth is not a standard security term, Sensitive Information Disclosure refers to exposing data by a system, and XSS by MIME sniffing is a specific browser vulnerability.

Cross-site Request Forgery (CSRF) tricks a user into executing unwanted actions on a website where they're authenticated. User B, already logged in, clicks the manipulated link and unknowingly places a bid using their session. Identity theft involves stealing personal information, XML Injection targets XML parsers, and reflected XSS requires script execution in the response.

Phishing is a cyber attack where victims are tricked into clicking links to fake websites that steal their credentials. Option C is correct. Keylogger (A) records keystrokes, brute force (B) tries many passwords, and email spoofing (D) forges email sender info; none of these specifically describe directing users to fake websites.

Virtual keyboards protect against keyloggers by allowing users to click on-screen keys instead of typing, making it impossible for hardware or software keyloggers to capture keystrokes. Option D is correct. Phishing (A) and pharming (B) involve fake websites, while session hijacking (C) steals user sessions; virtual keyboards don't directly defend against these.

Social engineering attacks exploit human psychology and trust, making them extremely difficult to defend against completely with technical solutions. Option C is correct. While phishing (A), trojans (B), and session hijacking (D) have technical defenses (antivirus, secure protocols, etc.), social engineering relies on manipulating people: there's no patch for human vulnerability.

Standard Access Roles provide security control by defining permissions based on user roles and class instances. Activities contain business logic, Flow Actions control user interactions, and Process Flows define workflows; none are primarily security mechanisms.

Database servers store the most sensitive data - customer records, financial information, authentication credentials, and application data. They are the primary target for attackers because compromising a database yields the highest value. While web servers, mail servers, and application servers need security, the database contains the 'crown jewels' that all other components ultimately protect.

RuleSets in PRPC are NOT designed to provide security - they are version control and packaging mechanisms for rules. Security is handled by Access Groups, Access Roles, and Privileges. Using RuleSets for security is a misunderstanding of their purpose. RuleSets organize and version rules, but don't control who can access them.

This is a dangerous security myth. Even without physical access, root passwords must be changed regularly because: (1) Remote access via SSH is possible, (2) Other users with system access could exploit it, (3) Passwords can be exposed in logs or memory dumps. Physical access is only one attack vector.

Remote access capabilities allow users to connect to a network from geographically separate locations. Option A correctly states this fundamental purpose. Option B describes network file sharing, which is different from remote access. Option C describes a security risk, not a capability. Option D refers to centralized storage, not remote connectivity.

While all options are important security practices, making frequent backups and storing them in remote locations is the most critical procedure for protecting data. Backups ensure data can be recovered after any type of failure, corruption, or security breach, making it the foundation of data protection strategy.

Options A, B, and D are classic SQL injection payloads that manipulate WHERE clauses to always evaluate true. Option C (' or 1=1 or 'user' = ') is NOT standard SQL injection syntax - the ending structure is malformed and wouldn't successfully bypass authentication.

To solve this question, the user needs to have knowledge of network security. The user must also understand the purpose of each option and how it relates to the problem of collecting information on attackers.

A. DMZ(Demilitarized zone): A DMZ is a network segment that is separated from the internal network by a firewall. It is used to host servers that need to be accessed by external users while keeping the internal network secure. While a DMZ can provide some protection for the internal network, it is not designed to collect information on attackers.

B. Firewall: Firewalls are devices that are used to control access to a network. They can be used to block incoming traffic from known attackers or to limit outgoing traffic to prevent sensitive information from leaving the network. While firewalls can provide some protection against attacks, they are not designed to collect information on attackers.

C. New subnet: A subnet is a logical division of a network. Creating a new subnet can help to isolate traffic and limit the scope of an attack. However, a new subnet does not provide any mechanism for collecting information on attackers.

D. Honeypot: A honeypot is a decoy system that is designed to attract attackers. It can be used to collect information on attackers and to study their behavior. A honeypot can be set up to look like a legitimate system or service, but it is actually designed to log all activity. This information can be used to track down and prosecute attackers.

Therefore, the correct answer is:

The Answer is: D (Honeypot)

Oracle Data Guard supports three data protection modes: Maximum Protection, Maximum Availability, and Maximum Performance. These modes allow administrators to balance data protection requirements against transactional performance. Other options include terms like scalability or generic protection, which are not official Data Guard protection modes.