Information Security

Footprinting is indeed the reconnaissance phase where attackers gather information about a target system before attempting intrusion. This includes collecting public information, DNS records, network topology, employee details, and other intelligence. It's a critical first step in both ethical hacking and malicious attacks, forming the basis for later exploitation phases.

When a client requests SERVER_ENCRYPT authentication, the server must support password encryption. If the server is configured with SERVER authentication, it only accepts unencrypted credentials. Attempting this connection results in a security negotiation mismatch error.

The Android sandbox is a security mechanism that isolates applications from each other and from the system. Each app runs in its own sandbox with restricted permissions, preventing malicious or buggy apps from disrupting other applications or the OS. Cryptography is for encryption, wrapping is a programming concept, and coding/decoding are not security isolation mechanisms.

The correct answer is C (Both) because BlackBerry Enterprise Server uses both AES and Triple DES encryption to provide security. AES (Advanced Encryption Standard) is the newer, stronger standard, while Triple DES is an older algorithm still supported for backward compatibility. Options A and B are individually incomplete. Option D is wrong because it incorrectly excludes AES.

SQL injection protection is provided by XML Firewall protection parameters in DataPower. While unintuitive, the XML Firewall's threat protection capabilities include SQL injection detection alongside other injection attacks. Option B (Web Application Firewall) provides broader HTTP-level protection but XML threat protection specifically handles SQL injection in the XML context.

SharePoint security is managed at multiple levels: domain level (Active Directory integration for authentication), machine level (server-level permissions), and SharePoint level (site, list, and item-level permissions). Page level security is not a distinct security tier in SharePoint - pages inherit permissions from the site/library. This is an MC-2 question requiring multiple selections.

IIS supports Anonymous (no authentication), Integrated Windows Authentication (Kerberos/NTLM), Basic Authentication (base64 encoded), Digest Authentication (hash-based), and Passport Authentication (Microsoft's centralized auth). PEAP is a wireless authentication protocol not part of IIS.

Security testing is the correct answer because it explicitly validates authentication mechanisms, session management, cookie handling, and access controls. Cookie and session management are critical security features that must be tested for vulnerabilities like session hijacking, cookie tampering, and unauthorized access.

Ab Initio provides multiple methods to encrypt FTP component passwords: the epw parameter in the FTP component itself, using a .netrc file for stored credentials, or setting the AB_FTP_PASSWORD configuration variable. All three approaches are valid and serve different security and operational needs.

Encapsulation achieves information hiding by bundling data and methods within a class and controlling access through public interfaces. The other options are benefits of information hiding, not encapsulation itself. Encapsulation is the mechanism that enables information hiding, which in turn reduces interdependencies and supports implementation independence.

Android's Device Administration API supports policies including minimum password length, maximum inactivity timeout (after which the device locks), password quality requirements like alphanumeric content, and requesting/prompting the user to reset or set a new password. Thus, all listed policies are correct.

In IBM Tivoli Identity Manager (TIM) CSV feed configuration, the name attribute maps to the attribute that uniquely identifies each individual person record in the source CSV file during reconciliation.

IBM Tivoli Identity Manager provides Password Java APIs that allow developers to extend standard password rules with custom logic. This enables organizations to implement password policies beyond the built-in rules. JavaScript and PAM are not the extension mechanisms for TIM password rules.

Excluding attributes unrelated to policy evaluation reduces data transfer and processing overhead, improving reconciliation performance. Weekly reconciliation frequency is unrelated to performance optimization. Disabling policy evaluation would compromise functionality, and JVM tuning should follow proper sizing rather than arbitrary increases.

Limiting attributes returned by the adapter reduces processing overhead and improves performance. Server-side sorting is not a performance lever for reconciliation. Decreasing duration might cause incomplete reconciliations. SearchALUnusedTimeout is unrelated to this performance issue.