Information Security

Web server default settings prioritize ease of use and features over security. They often include unnecessary services, default credentials, verbose error messages, and known insecure configurations. Security requires explicit hardening: disabling unused modules, applying security patches, configuring encryption, and following security benchmarks.

Client-side validation is NOT a security control because it can be easily bypassed by disabling JavaScript, modifying the request, or using tools like curl. Secure applications must validate on the server side. Options A (default-deny regex), B (least privilege), and D (stored procedures) ARE recommended practices for securing web applications.

Phishing attacks succeed when they entice or manipulate users into performing actions they wouldn't normally do - clicking malicious links, entering credentials, downloading malware, or making payments. The attack exploits human psychology rather than technical vulnerabilities. Option A refers to unpatched servers (not phishing). Option C refers to user patching (relevant but not phishing success). Option D is unrelated.

Forceful browsing (or directory traversal) attacks occur when users access unauthorized pages or resources by guessing URLs. The only effective prevention is checking authorization on every page request, ensuring users can only access resources they're permitted to see. Options B and C are security through obscurity and don't prevent access. Option D (ACLs on web root) is about file system permissions, not application-level authorization.

Frameworks operate at the Application layer (C) to provide reusable infrastructure for business logic, security, data access, and presentation. They abstract complex tasks like database connections, authentication, and request handling. Hardware (A) and Operating System (B) are lower layers, while Web/Application Server (D) is a runtime container that hosts framework-based applications but isn't the framework itself.

The CIA triad (Confidentiality, Integrity, Availability) is the foundation of information security. A comprehensive security policy must address all three: Confidentiality ensures sensitive data is only accessible to authorized parties; Integrity guarantees data accuracy and completeness; Availability ensures systems and data are reliable and accessible when needed. 'All of the Above' is the only complete answer.

A Man-in-the-Middle (MITM) attack specifically involves an attacker secretly intercepting and possibly altering communications between two parties who believe they are directly communicating with each other. Option B describes impersonation/spoofing, not MITM. Option C is incorrect because MITM doesn't involve the attacker pretending to be an authorized user - it's about positioning between the sender and receiver.

Online banking users face multiple threats: Phishing attacks trick users into revealing credentials on fake sites; Key Loggers maliciously record keystrokes to capture passwords; HTTPS indicates secure encrypted connections that users should verify before entering sensitive data. All three are essential security awareness topics for online banking users, making 'All of the Above' the correct answer.

To solve this question, the user needs to understand the concept of security in database applications and the limitations of username/password access controls.

Option A: Sufficient to secure the application

This option is incorrect because relying solely on username/password access controls is not sufficient to secure a database application. While these controls can provide a basic level of security, they can be easily bypassed by attackers using techniques like brute force attacks or social engineering. Therefore, additional security measures are needed to ensure the safety of the application.

Option B: Sufficient only when combined with other controls

This option is correct. Username/password access controls can be an effective security measure when combined with other controls such as data encryption, firewalls, and intrusion detection systems. By layering multiple security measures, the application becomes more difficult to compromise and provides a higher level of protection against unauthorized access.

Option C: Sufficient if the passwords are longer than six characters

This option is incorrect. While longer passwords are generally more secure than shorter ones, the length of a password alone is not sufficient to secure a database application. Passwords can still be guessed or cracked using other techniques, and therefore additional security measures are needed to provide adequate protection.

Option D: Sufficient if none of the users have administrative access

This option is incorrect. Even if none of the users have administrative access, the application can still be compromised through other means such as SQL injection attacks or phishing scams. Therefore, additional security measures are needed to ensure the safety of the database application.

The Answer is: B

Digital certificates (X.509) contain the certificate expiry date, subject identity, issuer information, and the subject's PUBLIC KEY - but NEVER the private key. The private key must remain secret and is stored separately by the certificate holder. Option B and C are wrong because certificates don't contain private keys. Option A is correct as expiry date is a standard certificate field.

Computer Viruses, Loss of data, and Unauthorized access are all fundamental security threats that organizations must protect against. Viruses are malicious code that can damage systems; data loss can occur from deletion, corruption, or disaster; unauthorized access violates security principles. 'All the above' is the only correct answer as all three represent significant security threats.

RSA is the most widely used digital signature algorithm, providing both authentication and non-repudiation through asymmetric cryptography. DES is a symmetric encryption algorithm, not a signature algorithm. DSA (Digital Signature Algorithm) is specifically designed for digital signatures, but RSA is more common in practice. HMAC is a message authentication code using hash functions, not a digital signature algorithm. RSA is the correct answer based on widespread adoption.

A Denial of Service (DoS) attack aims to overwhelm a network resource, server, or service with excessive traffic or requests, making it unavailable to legitimate users. Option A correctly describes this. Option B incorrectly suggests DoS attacks don't cause permanent damage - some DoS attacks can cause data corruption or system damage. Option C describes malware or Trojan attacks, not DoS. Option A is the accurate definition.

Cryptography provides four fundamental security functions: Authenticity (verifying the origin of data), Confidentiality (keeping data secret), Integrity (ensuring data is unaltered), and Non-repudiation (preventing denial of actions). Option A correctly lists all four. Options B, C, and D describe other security processes (incident response, basic operations, audit procedures) but not the core functions of cryptography itself.

Integrity is the cryptography security function that ensures encrypted data cannot be altered without detection. It verifies that data has not been modified in transit. Confidentiality ensures secrecy, authenticity verifies the sender's identity, and nonrepudiation prevents a sender from denying their actions.