Information Security

To answer this question, the user needs to have knowledge about cookie flags and their purposes.

The Secure flag is used to ensure that cookies are only transmitted over an encrypted (HTTPS) connection. So, it is the flag that will prevent cookies from being transmitted over a non-secure channel.

Option A: Secure is correct.

Option B: Domain is used to specify the domain name to which the cookie should be sent. This flag is not related to preventing transmission over non-secure channels.

Option C: Expires is used to set an expiration time for the cookie. This flag is not related to preventing transmission over non-secure channels.

Option D: Static is not a valid cookie flag.

Therefore, the answer is:

The Answer is: A. Secure.

To solve this question, the user needs to know about cross-site scripting (XSS) attacks and their impact on web applications.

Cross-site scripting (XSS) attacks occur when an attacker injects malicious code into a web page viewed by other users. The attack allows the attacker to steal user data, such as passwords or session tokens, or to manipulate the content of the web page in a way that is harmful to users.

Now, let's go through each option and explain why it is right or wrong:

A. Compromise of users: This option is correct. One of the main risks of a cross-site scripting attack is that it can compromise the security of users. An attacker can use the attack to steal user data, such as login credentials or session tokens, and use that data to gain unauthorized access to other parts of the application or other applications entirely.

B. Loss of data integrity: This option is incorrect. While cross-site scripting attacks can result in the loss of data, the greater risk is the compromise of user security.

C. Destruction of data: This option is incorrect. Cross-site scripting attacks are not typically used to destroy data. Instead, they are used to steal data or manipulate web content.

D. None of the above: This option is incorrect. As explained above, option A is the correct answer.

The Answer is: A

To answer this question, the user needs to have knowledge about different types of cyber attacks and their characteristics.

The correct answer is:

A. Cross-Site Scripting (XSS): In this type of attack, the attacker injects malicious code (usually in the form of a script) into a link that appears to be from a trustworthy source, such as a website or an email. When a user clicks on the link, the malicious code is executed in the user's web browser, allowing the attacker to steal sensitive information or perform other malicious actions.

B. Buffer overflows: In this type of attack, the attacker sends more data to a program than it can handle, causing it to crash or allowing the attacker to execute arbitrary code.

C. Command injection: In this type of attack, the attacker injects malicious code into a system command that is executed by the target system, allowing the attacker to gain unauthorized access or perform other malicious actions.

D. Path traversal attack: In this type of attack, the attacker exploits a vulnerability in a web application to access files or directories that are outside the web root directory.

Therefore, the correct answer is:

The Answer is: A. Cross-Site Scripting.

A session identifier is the only appropriate data to store in a cookie. Sensitive data like passwords should never be stored in cookies as they can be intercepted or stolen. Account privileges and usernames should be retrieved from the server using the session ID.

Data classification primarily considers the CIA triad: Availability, Integrity, and Confidentiality. These three principles determine how data should be protected and accessed. While user types and access controls are relevant, the core classification framework is built around these security principles.

Administrator accounts have elevated privileges that can cause catastrophic damage if compromised. They require stronger authentication than normal users - this includes longer passwords, multi-factor authentication, and more frequent password changes. Trusting all administrators is not a valid security control.

Hard-coded credentials in source code are visible to anyone with access to the codebase, including insiders after deployment and attackers if the code is leaked. This applies to both internal and external applications. Secure practice requires using environment variables, secure vaults, or configuration management systems.

Configuration management security applies universally - commercial software has default settings that must be secured, custom-built applications need proper configuration, and in-house applications require the same security rigor. Security through proper configuration is vendor-agnostic.

Data hashing creates a fixed-size signature from input data using a cryptographic hash function. Any change to the original data produces a completely different hash value, making tampering detectable. Hashing does not validate sessions or user identity - those are separate authentication mechanisms.

Forced browsing attacks occur when attackers guess or enumerate URLs to access resources without proper authorization. A successful forced browsing attack indicates that the application's authorization process is flawed - it fails to properly verify whether the authenticated user has permission to access the requested resource. This is different from configuration or session management issues, as the vulnerability specifically relates to access control decisions.

Administrative pages are high-value targets and require strong authentication. Multi-factor authentication (2FA or 3FA) is the best practice because it requires something you know (password) plus something you have (token) or something you are (biometric). Options A and B offer only single-factor protection which is insufficient for admin access. Option D (no lockout) is dangerous as it prevents protection against brute force attacks.

Stack traces and detailed error messages contain sensitive implementation information that can aid attackers. Best practice is to log this information server-side for troubleshooting while showing only generic error messages to users. Option A (hidden field) exposes data to users. Option B (destroying it) loses debugging information. Option D is incorrect because A is not recommended.

Web server default settings prioritize ease of use and features over security. They often include unnecessary services, default credentials, verbose error messages, and known insecure configurations. Security requires explicit hardening: disabling unused modules, applying security patches, configuring encryption, and following security benchmarks.

Client-side validation is NOT a security control because it can be easily bypassed by disabling JavaScript, modifying the request, or using tools like curl. Secure applications must validate on the server side. Options A (default-deny regex), B (least privilege), and D (stored procedures) ARE recommended practices for securing web applications.

Phishing attacks succeed when they entice or manipulate users into performing actions they wouldn't normally do - clicking malicious links, entering credentials, downloading malware, or making payments. The attack exploits human psychology rather than technical vulnerabilities. Option A refers to unpatched servers (not phishing). Option C refers to user patching (relevant but not phishing success). Option D is unrelated.