Information Security

Keeping applications and operating systems up to date is a fundamental security practice, as updates patch known vulnerabilities. Using the system as standalone does not prevent attacks, security utilities are helpful but not sufficient alone, and shutdown only protects when off. The question phrasing is awkward but the core concept is valid.

Online banking security requires awareness of multiple threat vectors. Phishing steals credentials through fake websites, keyloggers capture keystrokes to steal passwords, and HTTPS ensures encrypted communication with legitimate banking sites.

Phishing attacks work by tricking users into clicking malicious links that appear legitimate. Avoiding direct clicks on email/chat links prevents attackers from redirecting you to fake websites designed to steal credentials.

Fake antivirus scams are social engineering attacks that use multiple tactics: fake security alerts to scare users, and then attempt to monetize through fraudulent software sales or installing malicious code like keyloggers to steal financial information.

Bare metal recovery in DPM requires the DPM System Recovery Tool (SRT) to be installed on each protected server. The SRT creates a recovery environment that can boot a server and restore it from bare metal backups. Adding system state to protection groups (option B) is good practice but does not enable bare metal recovery by itself.

XML Signature provides comprehensive security capabilities for XML documents. It enables digital signatures that authenticate the source and integrity of documents, uses the sender's private key for signing, and provides non-repudiation by ensuring the signer cannot later deny having signed the document. All these security features work together to secure XML-based transactions.

XML Encryption provides fine-grained security for XML documents. It can encrypt entire documents or specific elements within them, and supports both symmetric and asymmetric encryption. When using public key cryptography, data encrypted with a public key can only be decrypted with the corresponding private key, ensuring confidentiality.

The CIA triad consists of Confidentiality, Integrity, and Availability - the three core principles of information security. Confidentiality ensures authorized access only, Integrity maintains data accuracy, and Availability ensures reliable access. Option A and C incorrectly use 'Control' and 'Information' instead of Confidentiality. Option D uses 'Information' instead of Integrity.

In the OWASP Top 10 (2013 update), Security Misconfiguration and Unvalidated Redirects were newly added entries. Security Misconfiguration (A2013:6) addresses improper security settings. Unvalidated Redirects (A2013:10) covers unsafe URL forwards. Insecure Direct Object References and CSRF were in previous versions but not new additions.

Android's security architecture is primarily inherited from the underlying Linux Kernel, which provides process isolation, user permissions, and the foundational security model. The Linux kernel is the core security foundation.

Declarative security uses attributes (like [PrincipalPermission]) embedded in code metadata to declare security requirements at compile time. This contrasts with imperative security, which uses runtime code to perform security checks. Declarative security is more maintainable and can be inspected via tools.

Declarative security uses attributes to declare security requirements directly in code metadata, without writing imperative security checks. Options B through C are actual .NET security mechanisms but require imperative code logic - they don't rely solely on attributes. Declarative security is the ONLY approach where adding attributes alone provides security functionality.

Remote access capabilities allow users to connect to their network from locations outside the office, such as from home or while traveling. This is typically accomplished through VPNs or dial-up connections. While remote access does enable working with network files (option B), that's a consequence of the primary capability. The other options either state the obvious incorrectly (C is a security risk, not a feature) or confuse remote access with local server storage (D).

CLIENT authentication means the server trusts the client to authenticate users. In this mode, the client operating system verifies passwords, not DB2. The server accepts whatever user identity the client claims after the OS has authenticated them. Options A, B, and C imply mechanisms that would bypass or duplicate the OS authentication.

In client-server authentication, password verification happens at two points: the Client Operating System (when using CLIENT authentication type, the client OS validates credentials) and the Application Server (when using SERVER authentication, the DB2 server verifies passwords). System Catalog stores user definitions but doesn't verify passwords. Client Applications initiate authentication but don't perform the verification themselves.