Information Security

Cross Site Scripting (XSS) is a vulnerability where attackers inject malicious scripts into web pages viewed by other users. It exploits insufficient input validation or output encoding. Option B describes SQL injection (database layer), while option A and D are incorrect characterizations.

CSRF is an attack that tricks a user's browser into making unwanted requests to a website where the user is already authenticated. The website trusts the request because it comes from a legitimate user's session, even though the user didn't intend to make that request. Unlike XSS which injects scripts, CSRF exploits the trust relationship between user and site.

Denial of Service attacks aim to make a computer resource unavailable to its intended users by overwhelming it with traffic or requests. This exhausts system resources like memory, CPU, or network bandwidth. DoS doesn't necessarily break security controls - it simply makes the service too slow or completely unavailable.

Social Engineering manipulates people into divulging confidential information or performing actions through psychological tactics rather than technical exploits. Attackers use deception, authority impersonation, or creating false urgency to trick victims. It exploits human trust and helpfulness rather than software vulnerabilities.

SSL/TLS encryption protects credentials during transmission by encrypting the entire communication channel between client and server. This prevents attackers from intercepting sensitive data even if they can monitor network traffic. POST alone doesn't encrypt data, and complex passwords only protect against guessing, not interception.

Hidden form fields are visible in page source and can be manipulated by attackers. Sensitive data should never be stored in hidden fields, as they provide no real security and can lead to data exposure or parameter tampering attacks.

Path traversal attacks involve manipulating file paths in URLs (using sequences like '../') to access files outside the web root. Unlike SQL injection (targets databases), cross-site scripting (injects scripts), or command injection (executes commands), path traversal specifically targets file system access.

Keyloggers capture keystrokes before encryption occurs. When you type encrypted data, the keylogger records the plaintext input, not the encrypted output. Encryption protects data in transit, not from input capture malware.

Client-side validation is NOT security - users can bypass it using browser tools or by sending direct requests. Real security requires server-side validation, least-privilege execution, proper filtering, and parameterized queries to prevent injection attacks.

Reliability refers to a system's ability to perform its intended functions correctly and consistently over time without unexpected failures. Random application termination represents a complete loss of service availability, which is a fundamental reliability issue. The other options represent different concerns: performance (slow response), resource management (memory consumption), and security (encryption).

Integrity refers to safeguarding the accuracy and completeness of assets and ensuring consistent, unaltered behavior under various conditions, including tampering or overload. Confidentiality ensures data privacy, availability ensures uptime, and accountability tracks actions; none of these directly define the requirement for consistent functionality under tampering.

SQL injection allows attackers to bypass authentication, manipulate data (insert, update, delete), and cause denial of service by executing intensive queries. Directory listing and traversal is a path-based vulnerability, not a direct outcome of SQL injection.

CAPTCHA is designed to differentiate humans from bots by presenting tasks easy for humans but hard for computers. This prevents automated abuse like spam, brute-force attacks, and bot registrations. Option A correctly identifies its primary purpose of access restriction based on humanity verification. The other options confuse CAPTCHA with security concepts like MFA (B), encrypted communication (C), or UX design (D).

Exposing backup files in hidden directories is a misconfiguration vulnerability. Proper configuration management should restrict access or move sensitive files outside web root. Input validation (A) checks user data, not file exposure. Error handling (C) manages exceptions, and DoS (D) concerns availability attacks. The issue stems from improper server/file system configuration.

Repudiation threats involve a user denying legitimate actions they performed. Non-repudiation mechanisms like digital signatures and audit logs provide evidence of transactions. Spoofing (A) is impersonation, tampering (B) is unauthorized modification, and DoS (D) disrupts availability. The scenario describes a classic repudiation risk where a user falsely denies executing a transaction.