Information Security

Security level 2 is the standard implementation that supports both session-based and PIN-based authentication mechanisms in the PS Framework. Level 0 typically means no security, level 1 provides basic authentication, and level 3 might be overly restrictive for PIN login scenarios.

Access Control Lists (ACLs) are the standard mechanism servers use to enforce object-level permissions. An ACL specifies which users or groups can perform what actions (read, write, execute, delete) on specific objects like files, directories, or database records. Users, groups, and roles are entities that receive permissions, but ACL is the mechanism that enforces them at the object level.

Phishing is a social engineering attack where attackers disguise themselves as trustworthy entities to steal sensitive information like passwords or credit card details. It typically involves fraudulent emails or websites that appear legitimate. The key is the deception of posing as something the victim trusts.

Denial of Service (DoS) is an attack where perpetrators flood a target system with requests to overwhelm its resources and make it unavailable to legitimate users. It is not related to Disk Operating System or Domain. The goal is to disrupt service, not to gain unauthorized access.

Public key cryptography uses asymmetric key pairs - a public key for encryption and a private key for decryption (or vice versa for digital signatures). This eliminates the need for parties to exchange secret keys before communicating securely. Option B incorrectly suggests the same key is used for both encryption and decryption, which would be symmetric cryptography.

DataPower supports WS-Policy for defining security requirements, provides protection against DOS attacks through rate limiting and throttling, and helps prevent SQL injection through input validation and parameter filtering. All three security capabilities are part of DataPower's security gateway functionality.

Hackers, viruses, and identity theft represent direct security and privacy threats that can compromise systems and personal information. While spam can be annoying and potentially deliver phishing attempts, it's primarily considered a nuisance rather than a fundamental security vulnerability itself.

Edit Input rules are primarily used for CONVERSION of data from one format to another. They transform input values before they are stored or processed, such as converting text to uppercase, formatting dates, or transforming numeric values. Validation is handled by Validate rules, Authorization by Authorization rules, and Authentication by Authentication rules.

The Clipboard is an internal debugging and development tool in Pega that should not be accessible to application users in production environments. It is intended for developers and administrators to troubleshoot and inspect clipboard pages during development and testing.

To determine which Algorithm/Encryption method is safest for use, we need to evaluate each option and determine its level of security.

A. DES (Data Encryption Standard) is an encryption method that uses a symmetric key algorithm. It was widely used in the 1970s and 1980s but has since been replaced by more secure encryption methods. DES is vulnerable to brute-force attacks, which can decrypt the encrypted message by trying all possible keys.

B. RC4 (Rivest Cipher 4) is a symmetric key stream cipher that was widely used in the past but is now considered insecure. It has been found to have many vulnerabilities, including biases in the key-scheduling algorithm and statistical weaknesses in the keystream.

C. Block ciphers using Electronic Code Book (ECB) mode is a method of encrypting data in blocks using a symmetric key algorithm. However, it is not considered secure because it is vulnerable to certain attacks, such as pattern attacks, where the same plaintext block is encrypted to the same ciphertext block.

D. AES (Advanced Encryption Standard) is a symmetric key algorithm that is widely used and considered to be secure. It has a key size of 128, 192, or 256 bits and uses a block cipher to encrypt data. AES has been extensively tested and is currently used by many organizations, including the US government, for encryption.

Therefore, the safest Algorithm/Encryption method for use is:

The Answer is: D. AES

Security must be integrated throughout the entire Software Development Life Cycle (SDLC). Addressing security early in design and continuing through deployment is more cost-effective and results in more secure applications than late-stage fixes.

Trusted websites face multiple attack vectors including exploiting software vulnerabilities, uploading malware through user-generated content features, and internal threats. Each method represents a different approach to compromising trusted systems.

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a methodology developed by Microsoft specifically for Threat Modelling to identify potential security threats during the design phase. Other options do not represent threat modeling frameworks.