Information Security

Multi-factor authentication uses two or more independent categories: something you know (password), something you have (token), something you are (biometric). This question describes the combination of knowledge and possession factors. Passwords (A) are one factor, credentials (C) are the authentication data itself, and identities (D) are who is being authenticated.

Web application firewalls require careful configuration to balance security coverage with performance impact, and improper rules can degrade application performance. They can detect attacks (A), enforce policies (C), and require security knowledge (D), but configuration complexity and performance overhead are the primary drawbacks.

When a virus saturates network capacity, the network itself is the victim (congested bandwidth), not the target. The actual target is the infected endpoint systems. In contrast, DoS attacks on servers (A), router hacking (B), and man-in-the-middle attacks (D) directly target network infrastructure or use it as the attack surface.

NIDS should be placed on segments with business-critical systems to detect attacks targeting high-value assets. Perimeter placement (A) generates too many alerts and may miss internal threats. The NOC (C) is a location, not a network segment, and external provider placement (D) delays detection of internal attacks.

The primary risk is that home broadband provides always-on connectivity to systems that users often lack expertise to secure properly. This creates a large pool of vulnerable machines that attackers can exploit as bots or entry points. The other options describe secondary risks (spam, file-sharing issues) or incorrect scenarios (dialers on DSL).

DNS was originally designed without authentication mechanisms, making it vulnerable to cache poisoning and spoofing attacks where malicious actors can inject false DNS records. DNSSEC was later developed to address this weakness by adding digital signatures to verify record authenticity. Options B and C describe characteristics that are not security weaknesses, while D confuses email spoofing with DNS vulnerabilities.

Configuration decisions directly impact security posture - incorrect settings can introduce vulnerabilities, weak controls, or exposure of sensitive data. While documentation (A) and version control (D) are good practices, they are not the primary reason for creating detailed security configuration instructions. Option B is incorrect because end users should be involved in security configuration processes.

Social engineering involves manipulating people to gain confidential information, such as tricking employees into revealing passwords through phone calls or impersonation. This attack targets human psychology rather than technical controls. Options B, C, and D refer to technical security mechanisms, not psychological manipulation techniques used in social engineering attacks.

Change management and security both focus on managing risk, controlling modifications, and preventing unauthorized changes to systems. Both functions require documentation, approval processes, and monitoring to ensure stability and security. Data entry, database administration, and network management are operational functions that don't share the same risk management philosophy as security.

The Kerberos Key Distribution Center (KDC) is a single point of failure - if it fails, no authentication can occur, potentially disrupting entire network services. Kerberos uses symmetric cryptography (not asymmetric), and dynamic passwords with limited lifetimes are actually security strengths, not vulnerabilities. The single point of failure is why production environments typically deploy multiple KDCs for redundancy.

In Mandatory Access Control (MAC), the system enforces access based on security labels and clearances, while data owners determine who has a legitimate need to know the information. The system controls technical access validation, but need-to-know is a business decision made by owners. Validation, consensus, and verification are system functions, not owner determinations in MAC models.

Biometric characteristics cannot be revoked or changed - if your fingerprint data is compromised, you cannot get a new fingerprint like you can change a password. This creates a permanent security risk. Encryption, communications, and sensor placement are practical challenges but not fundamental disadvantages. The revocation problem is considered the most significant limitation of biometric authentication.

Single sign-on creates a single point of failure - if a user's password is compromised, the attacker gains access to all systems and resources that SSO covers, amplifying the damage. Options A and D describe advantages or features, while C is incorrect because SSO actually reduces the number of passwords users need to remember. The security trade-off is convenience versus centralized risk.

Availability ensures information is accessible when needed by protecting against disruptions like DoS attacks, natural disasters, and data loss from unreadable backups. Unauthorized transactions (D) are a confidentiality and integrity issue, not an availability issue - they can occur even when systems are fully available. The CIA triad treats availability, confidentiality, and integrity as separate security goals.

Asymmetric cryptography is used for encryption (A), access control through digital signatures and certificates (B), and nonrepudiation via digital signatures that prove origin (C). Steganography (D) is about hiding the existence of a message itself, not encrypting it - it's a different field entirely. Steganography can be combined with encryption but is not a use case for asymmetric cryptography itself.