Information Security

Frameworks operate at the Application layer (C) to provide reusable infrastructure for business logic, security, data access, and presentation. They abstract complex tasks like database connections, authentication, and request handling. Hardware (A) and Operating System (B) are lower layers, while Web/Application Server (D) is a runtime container that hosts framework-based applications but isn't the framework itself.

The CIA triad (Confidentiality, Integrity, Availability) is the foundation of information security. A comprehensive security policy must address all three: Confidentiality ensures sensitive data is only accessible to authorized parties; Integrity guarantees data accuracy and completeness; Availability ensures systems and data are reliable and accessible when needed. 'All of the Above' is the only complete answer.

A Man-in-the-Middle (MITM) attack specifically involves an attacker secretly intercepting and possibly altering communications between two parties who believe they are directly communicating with each other. Option B describes impersonation/spoofing, not MITM. Option C is incorrect because MITM doesn't involve the attacker pretending to be an authorized user - it's about positioning between the sender and receiver.

Online banking users face multiple threats: Phishing attacks trick users into revealing credentials on fake sites; Key Loggers maliciously record keystrokes to capture passwords; HTTPS indicates secure encrypted connections that users should verify before entering sensitive data. All three are essential security awareness topics for online banking users, making 'All of the Above' the correct answer.

To solve this question, the user needs to understand the concept of security in database applications and the limitations of username/password access controls.

Option A: Sufficient to secure the application

This option is incorrect because relying solely on username/password access controls is not sufficient to secure a database application. While these controls can provide a basic level of security, they can be easily bypassed by attackers using techniques like brute force attacks or social engineering. Therefore, additional security measures are needed to ensure the safety of the application.

Option B: Sufficient only when combined with other controls

This option is correct. Username/password access controls can be an effective security measure when combined with other controls such as data encryption, firewalls, and intrusion detection systems. By layering multiple security measures, the application becomes more difficult to compromise and provides a higher level of protection against unauthorized access.

Option C: Sufficient if the passwords are longer than six characters

This option is incorrect. While longer passwords are generally more secure than shorter ones, the length of a password alone is not sufficient to secure a database application. Passwords can still be guessed or cracked using other techniques, and therefore additional security measures are needed to provide adequate protection.

Option D: Sufficient if none of the users have administrative access

This option is incorrect. Even if none of the users have administrative access, the application can still be compromised through other means such as SQL injection attacks or phishing scams. Therefore, additional security measures are needed to ensure the safety of the database application.

The Answer is: B

Digital certificates (X.509) contain the certificate expiry date, subject identity, issuer information, and the subject's PUBLIC KEY - but NEVER the private key. The private key must remain secret and is stored separately by the certificate holder. Option B and C are wrong because certificates don't contain private keys. Option A is correct as expiry date is a standard certificate field.

Computer Viruses, Loss of data, and Unauthorized access are all fundamental security threats that organizations must protect against. Viruses are malicious code that can damage systems; data loss can occur from deletion, corruption, or disaster; unauthorized access violates security principles. 'All the above' is the only correct answer as all three represent significant security threats.

RSA is the most widely used digital signature algorithm, providing both authentication and non-repudiation through asymmetric cryptography. DES is a symmetric encryption algorithm, not a signature algorithm. DSA (Digital Signature Algorithm) is specifically designed for digital signatures, but RSA is more common in practice. HMAC is a message authentication code using hash functions, not a digital signature algorithm. RSA is the correct answer based on widespread adoption.

A Denial of Service (DoS) attack aims to overwhelm a network resource, server, or service with excessive traffic or requests, making it unavailable to legitimate users. Option A correctly describes this. Option B incorrectly suggests DoS attacks don't cause permanent damage - some DoS attacks can cause data corruption or system damage. Option C describes malware or Trojan attacks, not DoS. Option A is the accurate definition.

Cryptography provides four fundamental security functions: Authenticity (verifying the origin of data), Confidentiality (keeping data secret), Integrity (ensuring data is unaltered), and Non-repudiation (preventing denial of actions). Option A correctly lists all four. Options B, C, and D describe other security processes (incident response, basic operations, audit procedures) but not the core functions of cryptography itself.

Integrity is the cryptography security function that ensures encrypted data cannot be altered without detection. It verifies that data has not been modified in transit. Confidentiality ensures secrecy, authenticity verifies the sender's identity, and nonrepudiation prevents a sender from denying their actions.

Symmetric encryption uses the same secret key for both encryption and decryption, which is why it's called private key or secret key encryption. Public key encryption (asymmetric) uses different keys for encryption and decryption. Option A correctly identifies symmetric encryption.

AES (Advanced Encryption Standard) is the strongest encryption algorithm listed and is currently the standard adopted by the US Government. DES and Triple DES are older, less secure algorithms that have been largely replaced by AES due to vulnerabilities and insufficient key lengths.

A public key server (or Certificate Authority) is needed to support encryption on a server by providing public keys and certificates to clients. This enables asymmetric encryption and secure key exchange. Firewalls filter traffic, and private keys must be kept secret on the server itself, not exposed.

Unsecured LANs pose a threat to data confidentiality because data is accessible at each network node as packets travel through switches and routers. Any device on the network can potentially capture traffic using packet sniffing tools. This is different from spoofing or authentication issues.