Information Security

The Key Distribution Center (KDC) is the central trusted third party in Kerberos that issues all types of tickets. The KDC consists of two components: the Authentication Server (AS) which issues the initial Ticket Granting Ticket (TGT), and the Ticket Granting Server (TGS) which issues service tickets (session tickets) for specific resources. When a user needs to access a service, the KDC validates their TGT and issues a session ticket that grants access to that service. The Security Identifier (SID) is a Windows security concept unrelated to Kerberos ticket issuance.

Kerberos uses symmetric encryption for user authentication. When a user first authenticates, their password is used to derive a symmetric key that is shared with the KDC. This symmetric key encrypts the initial authentication request and subsequent ticket exchanges. The symmetric key allows both the user and KDC to encrypt and decrypt messages, establishing trust without transmitting the password itself. Digital signatures (asymmetric encryption) are used in some PKI-based systems but not in core Kerberos authentication.

CHAP (Challenge Handshake Authentication Protocol) uses a one-way hash function to authenticate the remote client without sending the actual password across the link. The server sends a random challenge, the client computes a hash of the challenge combined with their password using a one-way algorithm like MD5, and sends back the hash value. The server performs the same calculation and compares results. This prevents plaintext password transmission and protects against replay attacks since each challenge is unique. Digital signatures require asymmetric encryption which CHAP does not use.

In a flooding DoS attack, the attacker bombards a target resource with an overwhelming volume of data or TCP/IP packets that exceeds its processing capacity. This saturates the target's bandwidth, connection tables, or processing resources, making it unable to respond to legitimate traffic. Common flooding attacks include SYN floods, ICMP floods, and UDP floods. The terms saturating, inundation, and data-surge are not standard terminology for this attack type in cybersecurity.

IP spoofing is an attack where hackers forge the source IP address in packet headers to disguise their identity or impersonate a trusted system. By using forged IP addresses, attackers can bypass IP-based authentication, launch blind attacks, or make malicious traffic appear to come from a legitimate source. Backdoor attacks involve secret access points, birthday attacks exploit hash collisions, and man-in-the-middle attacks intercept communications (none of which primarily involve forging IP addresses).

A backdoor is a deliberately placed hidden access point in software that bypasses normal authentication mechanisms. As described in the scenario, a programmer could leave an opening during the build phase that allows unauthorized entry later. Attackers can discover and exploit these backdoors to gain unauthorized access to the application or system. Birthday attacks exploit hash collisions, man-in-the-middle attacks intercept communications, and spoofing involves forging identities - none of which match the scenario of a deliberate code opening.

End user education is the most effective defense against social engineering attacks because these attacks target human psychology rather than technical vulnerabilities. Social engineering manipulates people into divulging sensitive information or performing actions through deception, often via phishing emails or phone calls. Training users to recognize manipulation tactics, verify requests, and follow security procedures is critical. Technical controls like firewalls, inbox rules, and intranets cannot prevent users from voluntarily revealing information or performing actions if they are deceived.

A hybrid attack combines dictionary attacks with brute-force techniques, making it most effective against a password like hello1. The attack starts with dictionary words (hello) and then systematically appends, prepends, or substitutes characters (1) to find the password. This is faster than pure brute-force which would try every character combination, and more effective than a pure dictionary attack which would miss simple modifications. A hash attack is not a standard password cracking term.

IP spoofing involves an attacker sending packets with forged source IP addresses to make them appear to come from a trusted source, bypassing authentication or hiding the attacker's identity. It's a network-layer attack. Options A and C describe social engineering. Option D describes phishing.

Web application security requires multiple layered approaches. Input validation prevents injection attacks, security policies provide governance, and removing hidden files reduces information disclosure. All three measures listed (1, 2, and 3) are essential security practices, making option E (all) the comprehensive correct answer.

CSRF (Cross-Site Request Forgery) requires three key conditions: the attacker must know the target website, the victim must be authenticated to that site, and the victim must be tricked into executing an unwanted action. CSRF does NOT require XSS vulnerability - it exploits the browser's automatic cookie submission mechanism. Options A, B, and C correctly describe these prerequisites, though they contain grammatical errors.

CSRF attacks are known by multiple names in security literature: 'Sea Surf' (play on CSRF), 'Session Riding' (because the attacker rides the victim's valid session), 'Hostile Linking' (malicious links that exploit authentication), and 'One-Click attack' (can be triggered with a single click). All four names refer to the same vulnerability.

Accepting only POST requests is not effective CSRF prevention because CSRF can trigger POST requests via HTML forms. Secret cookies alone don't prevent CSRF because the browser automatically sends cookies with requests. Effective CSRF prevention requires Anti-CSRF tokens (unique, unpredictable, validated by server) or SameSite cookie attributes (restrict cookie cross-site behavior).

The principle of least privilege means granting only the minimum necessary permissions to users. Defining all allowable actions for each role and denying everything else (deny-by-default) implements this principle correctly. Group-based access (A) is an implementation detail, not the principle itself. Consistent authorization checks (B) is important for security but doesn't define least privilege. Logging failed attempts (D) is an auditing practice, not authorization.

Cross-Site Scripting (XSS) attacks specifically target the client's browser by injecting malicious scripts that execute in the victim's browser context. The attack doesn't directly target the database (B), the web application server-side (C), or the web server infrastructure (D) - those are vulnerable to different types of attacks like SQL injection or server-side code execution.