Information Security

Authorization is the process of determining what permissions and access rights an authenticated subject has. It comes AFTER authentication (proving identity) and answers the question 'what is this user allowed to do?' Option B describes authentication, not authorization. Option A describes credential validation, which is part of authentication.

The hashPassword method requires both the password and accountName parameters. The accountName is typically used as a salt or to ensure uniqueness of hashes across accounts. Option A only takes the password, which would result in identical passwords producing identical hashes - a security vulnerability. Option C has incorrect capitalization.

The verifyPasswordStrength() method returns void because it likely throws an exception if the password doesn't meet strength requirements rather than returning a boolean. This pattern is common in security APIs where failure should halt execution. However, this is a specific API design choice that depends on the actual framework being referenced.

The isAuthorizedForData() method returns a boolean because authorization checks result in a yes/no decision - either the subject has permission to access the data or they don't. This is the standard return type for authorization methods across security frameworks.

CSRF tokens are typically generated as random strings that are included in forms or requests and validated on the server. String is the standard return type for token generation methods because tokens need to be transportable in HTTP headers, form fields, or URLs. Numeric types would not serve this purpose.

Input Validation ensures data meets expected criteria before processing, while Output Encoding converts special characters to safe representations, preventing malicious scripts from executing. These two practices directly combat XSS by controlling what enters the system and how it's rendered. Authentication/Authorization and Cryptography address access control and data protection, not script injection prevention.

The sign() method takes only the data parameter and throws SecurityException because signing operations are critical security operations that can fail for various reasons (invalid key format, cryptographic errors, etc.). Unlike method A which incorrectly requires a key parameter, the signature method implies the key is managed internally. Option C is incorrect because signing can fail and should signal errors.

The seal() method signature includes both the data and timestamp parameters, throwing SecurityException because cryptographic sealing operations can fail. The timestamp is essential for implementing expiration, as described in the seal() functionality. Option B incorrectly specifies EncryptionException - security API methods throw SecurityException to signal security-related failures.

When encoding user input for URLs, you must encode only the parameter value, not the entire URL string. encodeForURL applied to the whole URL (option B) would break the URL structure. encodeForJavaScript (option A) is for JavaScript context, not URLs. Option C correctly encodes only the dangerous user input portion before concatenating it with the safe URL structure.

SecurityException is the most common exception thrown by validation methods in the security API because it serves as the base class for security-related failures. When validation fails due to security violations (invalid input, malicious patterns, policy violations), the API throws SecurityException or its subclasses. Validation, Encoding, and Encryption exceptions are not standard exception types in this API.

EnterpriseSecurityException is the base class for all security-related exceptions in the TCS security API. It provides a common ancestor for specific security exceptions like authorization failures, validation errors, and authentication issues. SecurityException alone might not capture the enterprise context, and EnterpriseException is too broad for security-specific failures.

Canonicalization is the process of reducing an encoded string to its simplest, unambiguous form by decoding all encoding layers. For security, this is crucial because attackers can use multiple encoding schemes (URL encoding, double encoding, mixed encoding) to hide malicious input. By canonicalizing input first, security checks can detect attacks regardless of the encoding used.

To prevent Path Traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName() which validate that paths don't contain dangerous patterns like '../' or absolute paths. These methods check if the input is safe for the given context before allowing file system access. Path traversal attacks attempt to access files outside the intended directory, so validating both directory paths and filenames is essential defense.

Ounce (Ounce Labs) is a commercial static code analyzer that identifies security vulnerabilities in source code before deployment. It analyzes code paths to find potential security issues. WebInspect is a dynamic analysis tool, IBM RAD is an IDE, making Ounce the correct static analyzer choice.

The principle of least privilege means users should have only the minimum permissions necessary to perform their job functions. Option C correctly implements this by defining allowable actions for each role and denying everything else. Group-based access (A) is a method but doesn't define the principle, consistent checking (B) is about authorization implementation, and logging (D) is about audit trails.