Information Security

Adaptive Strong Authenticator is the user-facing component of Oracle Adaptive Access Manager that provides multi-factor authentication and fraud protection mechanisms directly to end users, guarding against identity theft during online sessions.

Oracle Adaptive Access Manager supports multiple integration patterns: Native (direct SDK integration), Universal Installation Option (drop-in authentication), Access Management Integration (with Oracle Access Manager), and SAML Integration (federated identity).

Oracle Adaptive Access Manager serves as the authentication service in SAML integrations, handling user authentication and risk-based fraud detection. Authorization decisions are typically made by the service provider after authentication succeeds.

Oracle Adaptive Access Manager supports database schemas for both Oracle Database and Microsoft SQL Server, allowing organizations to choose their preferred database platform for deployment.

DoS (Denial-of-Service) is a type of cyber attack where an attacker overwhelms a target system with excessive requests or traffic, making the service unavailable to legitimate users. It's not related to debugging or denial of security - those are incorrect distractors. The attack exploits resource limitations to disrupt normal service operations.

TFS provides a multi-layered security model that includes its own security system for project-level permissions, integration with SharePoint security for portal access, and Reporting Services security for report access. This layered approach allows fine-grained control over different aspects of the TFS environment.

TFS security operates on both individual users and groups. You can assign permissions directly to specific users or to Windows/Active Directory groups and TFS groups. This dual approach provides flexibility - use users for specific permissions and groups for role-based access control.

Risk is the potential for loss, damage, or destruction when a threat exploits a vulnerability. Option B describes threat, Option C describes vulnerability - these are distinct but related security concepts.

A vulnerability is a weakness or gap in security that can be exploited. Option B describes risk (potential for loss), Option C describes threat (what exploits vulnerabilities). Understanding these distinctions is fundamental to security analysis.

RSA provides encryption and digital signatures (statement ii is true), but is not primarily a key exchange protocol (statement i is false). Diffie-Hellman is exclusively a key exchange protocol (statement iv is true), not an encryption protocol (statement iii is false).

A firewall is software or hardware that protects against malicious attacks by filtering network traffic. Options A, B, and D are incorrect - A is nonsensical (firewalls aren't literal fire protection), B is authentication, and D is physical security.

Phishing is a social engineering attack where attackers impersonate legitimate entities to trick victims into revealing sensitive information. The term comes from 'fishing' - attackers cast out many fraudulent emails hoping victims will 'bite' and provide their data. Option A correctly describes this as using spoofed emails and fake websites. Option B is incorrect because phishing is not a virus - it's a deception technique. Option C describes a security practice, not an attack.

Wireless network security requires layered protection. Encryption (WPA or WEP) protects network traffic from eavesdropping, while MAC address filtering restricts which devices can connect to the network. Using both provides defense-in-depth - if one protection fails, the other may still stop unauthorized access. Note that WEP is now considered weak and should be replaced with WPA2/WPA3 in practice, but both are encryption methods.

Standard Diffie-Hellman key exchange without authentication is vulnerable to man-in-the-middle attacks because the parties cannot verify they're communicating directly with each other. An attacker can intercept the exchange and establish separate keys with both parties, then relay (and potentially modify) communications between them. This is why authenticated Diffie-Hellman or protocols like TLS are used in practice.

Penetration testing (often called pen testing) is a simulated cyberattack launched against your computer system to identify exploitable security vulnerabilities. It is a software-based simulation of hacking, rather than a physical vibration or a tool that physically penetrates hardware.