Information Security

Displaying or sending a raw password (old or new) is insecure. The most secure design is to verify identity details and send a temporary reset link via email to the registered address. Distractors are unsafe because they expose existing passwords or generate new ones directly on screen.

Persistent cookies are stored as text files on the user's hard disk, making them readable by anyone with access to the machine or malware. This exposes session information to theft. Options A and B are incorrect - cookies are transmitted via HTTP headers and do expire based on their set expiration time, regardless of browser close. Option D is incorrect - persistent cookies do have security risks.

Audit logs must capture comprehensive event information for forensics and compliance. Option D includes all essential elements: user identity, timing, source, errors, and full HTTP request context (URL, method, protocol version, browser, referrer, response code). Options A, B, C are incomplete. Critically, passwords should NEVER be logged - options B and C incorrectly include password logging, which is a serious security violation.

Effort slippage is a general project management metric assessing schedule adherence, not a software security metric. The other options directly quantify vulnerabilities, risks, and exception issues.

OWASP stands for Open Web Application Security Project. It's a worldwide nonprofit organization focused on improving software security. Option B is correct. Options A, C, D are incorrect expansions.

Cryptographically secure PRNGs (CSPRNGs) are specifically designed to be unpredictable under cryptographic attacks. Statistical and other simple PRNGs do not offer these security guarantees.

The term is 'Cross-Site Scripting' (XSS). 'Cross Side Scripting' is a misspelling and not a standard security term, whereas Blind SQLi, RFI, and CSRF are all valid attacks.

Social engineering attacks manipulate people rather than technology. Intimidation (threatening or pressuring victims) and Impersonation (pretending to be someone else) are classic social engineering techniques. Option A is correct. Options B (SQL Injection), C (Man in the middle), D (Cookie poisoning) are technical attacks, not social engineering.

Steganography is the practice of hiding information within another file, message, image, or video to conceal the existence of the communication itself. Unlike encryption which makes data unreadable, steganography hides the fact that a message even exists. Common carrier files include images, audio files, and documents where the hidden data is embedded in ways undetectable to human perception.

Keyloggers are malicious surveillance tools that record every keystroke made by a user without their knowledge or consent. They capture sensitive information including passwords, credit card numbers, confidential messages, and other private data. Attackers deploy keyloggers to steal credentials and personal information by monitoring everything typed on the compromised system.

When symmetric encryption only protects data from being read, an attacker can still rearrange encrypted blocks without decrypting them. By moving ciphertext blocks around, fields can be swapped between records - for example, assigning someone else's encrypted account balance to your own record. This works because the encryption doesn't authenticate or preserve the structure of the data.

When transmitting sensitive data, the POST method should be used instead of GET because POST parameters are included in the request body rather than the URL. This keeps sensitive information out of server logs, browser history, and referer headers. The data should still be encrypted using HTTPS or other suitable encryption to protect it during transit over the network.

By encrypting database content, the data can be safely replicated, stored, or transported across public clouds or untrusted hosting environments. This allows authorized users to access data closer to them, improving overall availability without compromising confidentiality.

Proprietary protocols and formats are often considered unsafe because they rely on security through obscurity - the idea that keeping the system secret makes it secure. This approach fails because security should not depend on secrecy of design; truly secure systems are those that remain secure even when their inner workings are fully known and can be independently audited by security researchers.

Adding cryptography introduces complexity and potential failure points. If encryption keys are corrupted or become unavailable, the application may fail to decrypt necessary data, leading to denial of service. Cryptographic operations also consume significant computational resources and if not implemented carefully can create performance bottlenecks or timing-based attack vectors.