Wireless network security requires layered protection. Encryption (WPA or WEP) protects network traffic from eavesdropping, while MAC address filtering restricts which devices can connect to the network. Using both provides defense-in-depth - if one protection fails, the other may still stop unauthorized access. Note that WEP is now considered weak and should be replaced with WPA2/WPA3 in practice, but both are encryption methods.

Standard Diffie-Hellman key exchange without authentication is vulnerable to man-in-the-middle attacks because the parties cannot verify they're communicating directly with each other. An attacker can intercept the exchange and establish separate keys with both parties, then relay (and potentially modify) communications between them. This is why authenticated Diffie-Hellman or protocols like TLS are used in practice.

Penetration testing (often called pen testing) is a simulated cyberattack launched against your computer system to identify exploitable security vulnerabilities. It is a software-based simulation of hacking, rather than a physical vibration or a tool that physically penetrates hardware.

A zero-day attack exploits a security vulnerability that is unknown to the software vendor and for which no patch exists yet - hence 'zero days' of protection available. The term refers to the amount of time the vendor has had to fix it (zero), not the timing of the attack. Options B and C incorrectly interpret it as referring to specific times or dates. Zero-day vulnerabilities are particularly dangerous because no defense exists until the vendor becomes aware and releases a patch.

In security terminology, a threat is anything that can exploit a vulnerability to cause harm - whether intentional (attackers) or accidental (natural disasters, mistakes). Option A describes 'vulnerability' (weakness), not threat. Option B describes 'risk' (the potential for loss from threat+ vulnerability). Option C correctly defines threat as the agent that could exploit vulnerabilities. These terms are often confused - remember: threat=what could attack, vulnerability=how it could succeed, risk=the likelihood and impact.

These five elements form the core security framework for applications. Authentication and Authorization (the first two As of AAA) control who can access and what they can do. Confidentiality, Integrity, and Availability (the CIA triad) are the fundamental goals of information security. Together, these ensure only authorized users can access data, data remains accurate and unaltered, and systems are accessible when needed. All five are essential for comprehensive application security.

Security threats can affect ANY application type. HTTPS websites (Option A) are still vulnerable to application-level attacks like XSS or injection - HTTPS only encrypts transport. HTTP websites (Option B) are even more vulnerable. Windows/desktop applications (Option C) have their own vulnerabilities (buffer overflows, etc.). Option D is incorrect because it's not just 'http' and Windows apps - all application types face security threats. Protocol doesn't eliminate application-level vulnerabilities.

Denial of service attacks disrupt availability by overwhelming resources. Executing malicious content includes threats like SQL injection and XSS. Information disclosure exposes sensitive data. All three are common security threats.

Windows, Form-based, Basic, and Passport are standard web application authentication modes, particularly in ASP.NET. SQL authentication is used to authenticate to database management systems rather than directly to web applications, making it and "All of the above" incorrect.

Encoding client data prevents XSS. Parameterized stored procedures help prevent SQL injection. Detailed error messages aid debugging but can leak sensitive information. Providing highest privilege (A) violates the principle of least privilege.

The response contains an HTML h1 element with the title parameter from the URL echoed directly into the page. This unencoded reflection allows script injection, which is a reflected XSS vulnerability.

Cross Site Scripting (XSS) attacks allow malicious scripts to be injected into web pages viewed by other users. These scripts can access cookies (enabling session theft), hijack user accounts by stealing authentication credentials, execute malicious ActiveX or Flash content (in legacy systems), and force downloads of malicious software. All listed outcomes are possible XSS attack vectors.

Crypters use stubs - small code sections that handle payload decryption and execution. To bypass antivirus detection, stubs are frequently changed or updated since antivirus signatures are often based on stub patterns. RunPE (Run Portable Executable) is a technique used by crypters but not what's updated; encryption algorithms and keys can be part of detection signatures but stub modification is the primary evasion method.

Zeus botnet was one of the most widespread and notorious malware networks, infecting millions of computers worldwide. It was particularly famous for stealing banking credentials and had the highest infection rate among major botnets during its peak. SpyEye and BlackShades were significant but didn't achieve Zeus's global scale.