Information Security

A. Shell environment variables

Shell environment variables are not considered safe because they can be easily modified by the user. For example, a user could set the PATH environment variable to include a malicious directory, which would allow the application to execute arbitrary code.

B. Data received via encrypted network channels

Data received via encrypted network channels is considered more safe than other sources of external input, but it is still not completely safe. The encryption could be broken, or the data could be intercepted and modified before it is decrypted.

C. argv[0] can only have either null or program name

The argv[0] parameter is the name of the program that is being executed. It is not considered a safe source of input because it can be easily modified by the user. For example, a user could change the argv[0] parameter to a malicious program, which would then be executed instead of the intended program.

D. no external input must be trusted

The correct answer is D. No external input must be trusted, regardless of the source. Even if the input comes from a seemingly safe source, it is always possible that the input has been tampered with. Therefore, it is important to always validate and sanitize all external input before it is processed by the application.

The correct answer is therefore D.

AccessController is part of Java's security architecture for access control decisions. It can mark code as privileged (A), decide whether access should be allowed based on security policy (B), and obtain a snapshot of the calling context (C). However, computing cryptographic hashes is the domain of MessageDigest or crypto libraries, not AccessController.

To sign a document using a digital signature, the user needs to know the basic concepts of public key cryptography and digital signatures.

Now, let's go through each option and explain why it is right or wrong:

A. Create a hash of the document and encrypt the resulting hash using the signer's private key. This option is partially correct. To sign a document, the signer first creates a hash of the document to be signed. The hash is then encrypted using the signer's private key. However, the encrypted hash is not the signature itself; it is just one part of the signature. The encrypted hash, along with the signer's public key and other information, is used to create the digital signature.

B. Encrypt the document using the signer's private key. This option is incorrect. Signing a document does not involve encrypting the entire document using the signer's private key. Instead, the document is hashed and a digital signature is created using the private key.

C. Encrypt the document using the signer's private key and create a hash of the encrypted document. This option is incorrect. Signing a document does not involve encrypting the document using the signer's private key. Instead, the document is hashed and a digital signature is created using the private key.

D. Encrypt the document using the signer's public key. This option is incorrect. Signing a document does not involve encrypting the document using the signer's public key. Instead, the document is hashed and a digital signature is created using the signer's private key.

The Answer is: A

Cross-site scripting (XSS) attacks exploit insufficient output encoding and input validation. Input validation (2) helps reject malicious input patterns, and output encoding (5) ensures user-supplied data is safely rendered (e.g., escaping < to <). Least privilege (3) and releasing resources (1) are general security practices but don't specifically prevent XSS. URL-based access control (4) is for authorization, not XSS.

The code unsafely concatenates a user-controlled parameter directly into the redirect header location. This allows attackers to perform CRLF injection to inject headers, leading to HTTP response splitting, and craft arbitrary redirects, leading to content spoofing (phishing) attacks.

Managed code runs within a virtual machine or runtime environment (like JVM or CLR) that enforces type safety, memory management, and array bounds checking. This significantly reduces the attack surface by eliminating entire classes of low-level memory corruption vulnerabilities like buffer overflows.

Management is ultimately responsible for directing organization-wide security posture, policies, and legally required notifications to authorities following a security incident. Security and system administrators handle technical response and reporting to management, while users report anomalies internally.

Authorization is the correct mitigation for elevation of privilege threats because it directly controls what actions users can perform. By implementing proper authorization (such as principle of least privilege, role-based access control, and permission checks), you ensure users cannot exceed their intended access level. Authentication (A) verifies identity but doesn't prevent privilege escalation. Auditing (C) detects violations but doesn't prevent them. Confidentiality (D) protects data secrecy, not privilege levels.

Integrity is the correct mitigation for tampering threats because it ensures data and system state remain unmodified. Tampering attacks attempt to modify data or code in unauthorized ways, so integrity mechanisms like digital signatures, hash verification, checksums, and write protections directly counter this threat. Availability (B) ensures system uptime, not data authenticity. Auditing (C) tracks changes but doesn't prevent them. Confidentiality (D) protects secrecy, not modification.

Encryption is the correct answer because it directly preserves confidentiality by making data unreadable to unauthorized parties. Encryption transforms plaintext into ciphertext that can only be read by parties with the decryption key. Hashing (B) provides integrity verification, not confidentiality. Recovery (C) is about restoring data after loss, not protecting secrecy. Redundancy (D) ensures availability through duplication, not confidentiality.

To solve this question, the user needs to know about the advantages and disadvantages of integrating cryptography into applications.

Option A is incorrect because it states cryptography brings increased stability as the programs are protected against viral attack. Cryptography can help protect against viral attacks to some extent, but it does not guarantee increased stability.

Option B is incorrect because it states that cryptography enhances reliability since users can no longer modify source code. This is not true as cryptography does not prevent users from modifying source code, but rather it helps protect sensitive data.

Option C is also incorrect because it states that cryptography reduces breaches of policy due to disclosure of information. Cryptography can help protect against data breaches but does not prevent them entirely.

Option D is the correct answer because possible denial of service (DoS) attacks can occur if the keys used for cryptography are corrupted. Once the keys are corrupted, the system will be unable to decrypt messages, which can lead to a DoS attack.

Therefore, the correct answer is:

The Answer is: D. Possible denial of service if the keys are corrupted

Phishing is a type of social engineering attack. Social engineering attacks exploit human psychology to trick people into revealing sensitive information or clicking on malicious links. Phishing attacks typically involve sending emails or text messages that appear to be from a legitimate source, such as a bank or credit card company. The emails or text messages will often contain a link that, when clicked, will take the victim to a fake website that looks like the real website. Once the victim enters their personal information on the fake website, the attacker can steal it.

Malware, spyware, and denial of service attacks are all different types of cybersecurity attacks. Malware is software that is designed to harm a computer system. Spyware is software that is designed to collect information about a user's computer activities. Denial of service attacks are designed to make a computer system unavailable to its intended users.

Therefore, the correct answer is B. Social engineering.

Here is a table that summarizes the differences between phishing and the other three options:

Intrusion detection systems (IDS) analyze traffic and host behavior to identify malicious activity like system misuse, unauthorized file changes, and physical break-ins (via host sensors). They are not designed to filter unsolicited bulk email (SPAM), which is handled by email gateways.

To answer this question, the user needs to know what vulnerability is. In the context of cybersecurity, vulnerability refers to a weakness in a system that can be exploited by attackers to gain unauthorized access, cause damage, steal data, or disrupt services.

Now, let's go through each option and explain whether it gives rise to a vulnerability:

A. Hackers: This option is correct. Hackers are not a vulnerability themselves but rather a threat that can exploit vulnerabilities. They are individuals or groups who attempt to gain unauthorized access to systems or networks for malicious purposes. While hackers can cause damage if they successfully exploit a vulnerability, they are not the source of the vulnerability itself.

B. Flaws: This option is incorrect. Flaws, such as coding errors or design weaknesses, can create vulnerabilities in systems that can be exploited by attackers. Flaws are one of the primary sources of vulnerabilities and are often exploited by hackers to gain access to systems or data.

C. Policy failures: This option is incorrect. Policy failures, such as weak passwords or lack of access controls, can create vulnerabilities in systems that can be exploited by attackers. Policy failures are another source of vulnerabilities and are often exploited by hackers to gain access to systems or data.

D. Weaknesses: This option is incorrect. Weaknesses, such as outdated software or unpatched vulnerabilities, can create vulnerabilities in systems that can be exploited by attackers. Weaknesses are yet another source of vulnerabilities and are often exploited by hackers to gain access to systems or data.

Therefore, the correct answer is:

The Answer is: A. Hackers