Information Security

XML Encryption provides fine-grained security for XML documents. It can encrypt entire documents or specific elements within them, and supports both symmetric and asymmetric encryption. When using public key cryptography, data encrypted with a public key can only be decrypted with the corresponding private key, ensuring confidentiality.

The CIA triad consists of Confidentiality, Integrity, and Availability - the three core principles of information security. Confidentiality ensures authorized access only, Integrity maintains data accuracy, and Availability ensures reliable access. Option A and C incorrectly use 'Control' and 'Information' instead of Confidentiality. Option D uses 'Information' instead of Integrity.

In the OWASP Top 10 (2013 update), Security Misconfiguration and Unvalidated Redirects were newly added entries. Security Misconfiguration (A2013:6) addresses improper security settings. Unvalidated Redirects (A2013:10) covers unsafe URL forwards. Insecure Direct Object References and CSRF were in previous versions but not new additions.

Android's security architecture is primarily inherited from the underlying Linux Kernel, which provides process isolation, user permissions, and the foundational security model. The Linux kernel is the core security foundation.

Declarative security uses attributes (like [PrincipalPermission]) embedded in code metadata to declare security requirements at compile time. This contrasts with imperative security, which uses runtime code to perform security checks. Declarative security is more maintainable and can be inspected via tools.

Declarative security uses attributes to declare security requirements directly in code metadata, without writing imperative security checks. Options B through C are actual .NET security mechanisms but require imperative code logic - they don't rely solely on attributes. Declarative security is the ONLY approach where adding attributes alone provides security functionality.

Remote access capabilities allow users to connect to their network from locations outside the office, such as from home or while traveling. This is typically accomplished through VPNs or dial-up connections. While remote access does enable working with network files (option B), that's a consequence of the primary capability. The other options either state the obvious incorrectly (C is a security risk, not a feature) or confuse remote access with local server storage (D).

A LOGON trigger in Oracle database can only be defined at the SCHEMA or DATABASE level. Specifying 'ON EMP' (a table name) for a BEFORE LOGON event is syntactically invalid, which makes it an invalid trigger.

CLIENT authentication means the server trusts the client to authenticate users. In this mode, the client operating system verifies passwords, not DB2. The server accepts whatever user identity the client claims after the OS has authenticated them. Options A, B, and C imply mechanisms that would bypass or duplicate the OS authentication.

In client-server authentication, password verification happens at two points: the Client Operating System (when using CLIENT authentication type, the client OS validates credentials) and the Application Server (when using SERVER authentication, the DB2 server verifies passwords). System Catalog stores user definitions but doesn't verify passwords. Client Applications initiate authentication but don't perform the verification themselves.

When a client requests SERVER_ENCRYPT authentication, the server must support password encryption. If the server is configured with SERVER authentication, it only accepts unencrypted credentials. Attempting this connection results in a security negotiation mismatch error.

The Android sandbox is a security mechanism that isolates applications from each other and from the system. Each app runs in its own sandbox with restricted permissions, preventing malicious or buggy apps from disrupting other applications or the OS. Cryptography is for encryption, wrapping is a programming concept, and coding/decoding are not security isolation mechanisms.

The correct answer is C (Both) because BlackBerry Enterprise Server uses both AES and Triple DES encryption to provide security. AES (Advanced Encryption Standard) is the newer, stronger standard, while Triple DES is an older algorithm still supported for backward compatibility. Options A and B are individually incomplete. Option D is wrong because it incorrectly excludes AES.

SQL injection protection is provided by XML Firewall protection parameters in DataPower. While unintuitive, the XML Firewall's threat protection capabilities include SQL injection detection alongside other injection attacks. Option B (Web Application Firewall) provides broader HTTP-level protection but XML threat protection specifically handles SQL injection in the XML context.

SharePoint security is managed at multiple levels: domain level (Active Directory integration for authentication), machine level (server-level permissions), and SharePoint level (site, list, and item-level permissions). Page level security is not a distinct security tier in SharePoint - pages inherit permissions from the site/library. This is an MC-2 question requiring multiple selections.