Information Security

The hashPassword method requiring both password and accountName parameters allows for account-specific salting, which improves security by preventing the same password from hashing identically across different accounts. The single-parameter versions would be less secure. Option C is incorrect due to incorrect method naming convention (lowercase 'p').

The verifyPasswordStrength() method is a void method, meaning it performs validation and likely throws an exception or sets internal state rather than returning a value. This is common for validation methods that enforce security policies by throwing exceptions when requirements aren't met.

The isAuthorizedForData() method checks whether the current user is authorized to access or modify a specific data object. It returns a boolean value (true if authorized, false otherwise). It does not return text, numeric identifiers, or a void type, as authorization is a binary status check.

CSRF tokens are typically generated as random strings that can be embedded in forms or HTTP headers. The getCSRFToken() method returns a String token value, not numeric types like Integer or BigInteger, which would be unsuitable for token representation.

The security API supports Oracle and MySQL database codecs for SQL injection protection. Option D incorrectly includes Sybase and DB2, which are not among the default supported databases in this particular API.

The seal() method creates a cryptographic seal that binds data together with an expiration timestamp, providing tamper evidence and time-based validity. Unlike simple encoding, hashing, or scrambling, sealing provides integrity protection with temporal constraints.

Cross Site Scripting (XSS) attacks inject malicious scripts into web pages viewed by other users. The most effective defense combines input validation (rejecting malicious input) and output encoding (converting special characters to HTML entities). Authentication and cryptography protect against different threats, not XSS.

The sign method in the security API accepts a single String parameter (data) and throws SecurityException. Options A and B incorrectly include a key parameter, while option C is missing the required exception declaration that security operations typically need.

The seal method requires both data and timestamp parameters and throws SecurityException. Options C and D are missing the required timestamp parameter that seal operations need, while option B throws the wrong exception type.

Encode only the user input parameter, not the entire URL. Option C correctly encodes just the dangerous input. Option A uses JavaScript encoding (wrong context). Option B encodes the entire URL including the path, which breaks it.

When users attempt unauthorized access, the security API throws SecurityException. AccessException (B) is not the standard exception here. AuthenticationException (C) would be for identity verification failures, not authorization.

SecurityException is the most common exception thrown by validation methods in the security API when validation fails. ValidationException (A) is not the standard exception name, and Encoding/Encryption exceptions (C, D) are for different operations.

In exception hierarchies, a base exception class provides common properties and methods for all related exceptions. EnterpriseSecurityException serves as the parent class for specific security exceptions, allowing consistent error handling across different security failure scenarios.

Canonicalization is the process of converting data to a standard or canonical form. For security, it means reducing encoded strings (like %3C for <) to their simplest representation before validation. This prevents attackers from bypassing validation using double-encoding or alternate encoding schemes.

Digital signatures provide authentication, integrity, and non-reputation for digital data. The sign() method creates a cryptographic signature using a private key, allowing recipients to verify the data originated from the claimed source and hasn't been tampered with using the corresponding public key.