Information Security

Integrity refers to safeguarding the accuracy and completeness of assets and ensuring consistent, unaltered behavior under various conditions, including tampering or overload. Confidentiality ensures data privacy, availability ensures uptime, and accountability tracks actions; none of these directly define the requirement for consistent functionality under tampering.

SQL injection allows attackers to bypass authentication, manipulate data (insert, update, delete), and cause denial of service by executing intensive queries. Directory listing and traversal is a path-based vulnerability, not a direct outcome of SQL injection.

Cross-Site Scripting (XSS) occurs when untrusted data is executed as code. To display special characters like tags safely without execution, you must HTML-encode them - converting < to &lt;, > to &gt;, etc. This renders the characters visually but they're not parsed as HTML/JavaScript. Option A (URL/HTML encoding) is correct. Blacklisting (B) is unreliable, whitelisting (C) doesn't solve display, and parameterized SQL (D) prevents SQL injection, not XSS.

CAPTCHA is designed to differentiate humans from bots by presenting tasks easy for humans but hard for computers. This prevents automated abuse like spam, brute-force attacks, and bot registrations. Option A correctly identifies its primary purpose of access restriction based on humanity verification. The other options confuse CAPTCHA with security concepts like MFA (B), encrypted communication (C), or UX design (D).

Exposing backup files in hidden directories is a misconfiguration vulnerability. Proper configuration management should restrict access or move sensitive files outside web root. Input validation (A) checks user data, not file exposure. Error handling (C) manages exceptions, and DoS (D) concerns availability attacks. The issue stems from improper server/file system configuration.

Repudiation threats involve a user denying legitimate actions they performed. Non-repudiation mechanisms like digital signatures and audit logs provide evidence of transactions. Spoofing (A) is impersonation, tampering (B) is unauthorized modification, and DoS (D) disrupts availability. The scenario describes a classic repudiation risk where a user falsely denies executing a transaction.

Parameterized queries separate SQL logic from data, preventing injection by treating user input as literal values not executable code. SSL/TLS (A) encrypts transmission but doesnt stop injection. URL/HTML encoding (B) mitigates XSS, not SQLi. Directory restrictions (D) address information disclosure, not injection. Parameterized queries (also called prepared statements) are the primary defense.

Spiders, robots, and crawlers automate information gathering by traversing websites and cataloging content, links, and structure. This reconnaissance phase identifies targets, technologies, and potential vulnerabilities. Authentication (A) and authorization (D) testing focus on access controls. Session management (B) concerns maintaining user state. These tools primarily enable discovery and mapping.

CAPTCHAs specifically resist automated solving by design - they test humanity. Fuzzers like WebScarab send massive automated requests but cannot interpret visual/audio challenges meant for humans. Fuzzers can discover files (A), test lockout limits (B), and attempt passwords (C). CAPTCHA breaking requires human interaction or specialized AI, not simple request automation, making it unsuitable for fuzzing tools.

RSA encryption is named after its inventors: Ron Rivest, Adi Shamir, and Leonard Adleman. Option C correctly identifies these three cryptographers who developed this public-key cryptosystem.

The principle of least privilege means granting only the minimum necessary access. Option C correctly states this: define exactly what each role CAN do, deny everything else by default. Group-based access (A) is an implementation detail, not the principle itself. Consistent checking (B) is about execution, not privilege assignment. Logging failures (D) is auditing, not the principle itself.

TCS Security API is the TCS security library used for remediation of security vulnerabilities found during assessments. The other options (B, C, D) are plausible variations but not the correct product name.

Credit card numbers must NOT be logged during exceptions as it creates insecure storage of sensitive customer data, violating PCI-DSS and privacy requirements. Options B and C incorrectly suggest it's good practice or helps troubleshooting. The security risk outweighs any troubleshooting benefit.

Cross Site Scripting (XSS) attacks target the client's browser by injecting malicious scripts that execute in the victim's browser context. The attack exploits the browser's trust in content from a vulnerable website, not the server, database, or web application itself.

The Secure cookie flag ensures cookies are only transmitted over encrypted HTTPS connections, preventing their interception over insecure HTTP channels. The Domain flag specifies cookie scope, Expires sets cookie lifetime, and Static is not a valid cookie attribute.