Information Security

One-time passwords (OTP) are the most secure option listed because they are valid only for a single use or short time window. Even if intercepted, they cannot be reused. Static passwords remain the same and are vulnerable to reuse. Dynamic passwords may change but often follow predictable patterns. Hybrid passwords combine methods but still lack the fundamental security property of OTPs - single-use validity.

SHA (Secure Hash Algorithm) is better suited for password storage than AES, 3DES, or RSA because SHA is a cryptographic hash function, not an encryption algorithm. Passwords should never be stored in reversible form - if encrypted, they could potentially be decrypted. Hashing is one-way: even if the hash is compromised, the original password cannot be retrieved. SHA-256 or SHA-512 are commonly used for secure password storage (typically with salt). AES and 3DES are symmetric encryption algorithms, and RSA is asymmetric encryption - all reversible.

Separation of duties is a security principle that prevents any single user from gaining complete control of a critical process. By distributing responsibilities across multiple individuals, no one person can execute all steps of a sensitive operation without collusion. This prevents fraud, errors, and abuse of privilege. The correct option states this precisely - preventing complete control. The other options incorrectly suggest teamwork encouragement or knowledge prevention, which are not the primary goals.

An unattended session occurs when a user leaves a host during an active session. This is a security vulnerability because the session remains authenticated and accessible without the authorized user present. An intruder could then access the session or perform actions under the stolen identity. The other options describe different scenarios: improper termination, intruder session hijacking, and failed login attempts - none of which define an unattended session.

The Key Distribution Center (KDC) is the central trusted third party in Kerberos that issues all types of tickets. The KDC consists of two components: the Authentication Server (AS) which issues the initial Ticket Granting Ticket (TGT), and the Ticket Granting Server (TGS) which issues service tickets (session tickets) for specific resources. When a user needs to access a service, the KDC validates their TGT and issues a session ticket that grants access to that service. The Security Identifier (SID) is a Windows security concept unrelated to Kerberos ticket issuance.

Kerberos uses symmetric encryption for user authentication. When a user first authenticates, their password is used to derive a symmetric key that is shared with the KDC. This symmetric key encrypts the initial authentication request and subsequent ticket exchanges. The symmetric key allows both the user and KDC to encrypt and decrypt messages, establishing trust without transmitting the password itself. Digital signatures (asymmetric encryption) are used in some PKI-based systems but not in core Kerberos authentication.

CHAP (Challenge Handshake Authentication Protocol) uses a one-way hash function to authenticate the remote client without sending the actual password across the link. The server sends a random challenge, the client computes a hash of the challenge combined with their password using a one-way algorithm like MD5, and sends back the hash value. The server performs the same calculation and compares results. This prevents plaintext password transmission and protects against replay attacks since each challenge is unique. Digital signatures require asymmetric encryption which CHAP does not use.

In a flooding DoS attack, the attacker bombards a target resource with an overwhelming volume of data or TCP/IP packets that exceeds its processing capacity. This saturates the target's bandwidth, connection tables, or processing resources, making it unable to respond to legitimate traffic. Common flooding attacks include SYN floods, ICMP floods, and UDP floods. The terms saturating, inundation, and data-surge are not standard terminology for this attack type in cybersecurity.

IP spoofing is an attack where hackers forge the source IP address in packet headers to disguise their identity or impersonate a trusted system. By using forged IP addresses, attackers can bypass IP-based authentication, launch blind attacks, or make malicious traffic appear to come from a legitimate source. Backdoor attacks involve secret access points, birthday attacks exploit hash collisions, and man-in-the-middle attacks intercept communications (none of which primarily involve forging IP addresses).

A backdoor is a deliberately placed hidden access point in software that bypasses normal authentication mechanisms. As described in the scenario, a programmer could leave an opening during the build phase that allows unauthorized entry later. Attackers can discover and exploit these backdoors to gain unauthorized access to the application or system. Birthday attacks exploit hash collisions, man-in-the-middle attacks intercept communications, and spoofing involves forging identities - none of which match the scenario of a deliberate code opening.

End user education is the most effective defense against social engineering attacks because these attacks target human psychology rather than technical vulnerabilities. Social engineering manipulates people into divulging sensitive information or performing actions through deception, often via phishing emails or phone calls. Training users to recognize manipulation tactics, verify requests, and follow security procedures is critical. Technical controls like firewalls, inbox rules, and intranets cannot prevent users from voluntarily revealing information or performing actions if they are deceived.

A hybrid attack combines dictionary attacks with brute-force techniques, making it most effective against a password like hello1. The attack starts with dictionary words (hello) and then systematically appends, prepends, or substitutes characters (1) to find the password. This is faster than pure brute-force which would try every character combination, and more effective than a pure dictionary attack which would miss simple modifications. A hash attack is not a standard password cracking term.

IP spoofing involves an attacker sending packets with forged source IP addresses to make them appear to come from a trusted source, bypassing authentication or hiding the attacker's identity. It's a network-layer attack. Options A and C describe social engineering. Option D describes phishing.

Web application security requires multiple layered approaches. Input validation prevents injection attacks, security policies provide governance, and removing hidden files reduces information disclosure. All three measures listed (1, 2, and 3) are essential security practices, making option E (all) the comprehensive correct answer.