Information Security

Forced browsing attacks involve directly accessing restricted resources by guessing URLs or parameters. If successful, this means the application failed to properly authorize the request; users can access resources they shouldn't. This reveals authorization flaws, not configuration or session management issues.

Administrative pages are high-value targets for attackers and require stronger authentication than standard username/password. Basic auth and single-factor passwords are vulnerable to compromise. Multi-factor authentication (2/3 factors) provides defense-in-depth by requiring something you know plus something you have or are. No lockout would actually increase vulnerability.

Detailed error messages with stack traces can reveal sensitive information about application internals, database structure, or security weaknesses. Sending this to users (even in hidden fields) risks exposure. Logging errors server-side preserves debugging information for technical support while preventing information disclosure to attackers. The user should see generic, safe error messages.

HTML comments visible in source code can reveal internal application structure, debugging information, file paths, or sensitive implementation details to attackers. Code comments are useful during development but should be removed or minimized in production to prevent information disclosure vulnerabilities.

Web servers ship with default configurations designed for ease of setup and broad compatibility, not security. These out-of-box settings typically enable unnecessary services, use default credentials, and expose verbose error messages, creating vulnerabilities that administrators must explicitly address.

Client-side validation can be easily bypassed by attackers using browser developer tools, proxy tools, or direct API calls. Security controls must be implemented on the server side where they cannot be manipulated by the client.

Phishing is a social engineering attack that tricks users into performing actions like clicking malicious links, entering credentials, or downloading malware. The attack succeeds when users are deceived, not because of technical vulnerabilities in systems.

The only reliable way to prevent forceful browsing is checking authorization on every requested page before serving it. Naming schemes (B), directory organization (C), and ACLs (D) are all bypassable and do not enforce access control at the application level.

BlackBerry's default encryption method for data transmission and storage was 3DES (Triple DES). This symmetric encryption standard provided strong security for enterprise data while balancing performance on mobile devices of that era. Option B 'AED' appears to be a typo for AES.

BlackBerry Dispatcher is responsible for compressing and encrypting all data traffic between BES and handheld devices. It ensures data security and optimizes bandwidth usage through compression before transmission.

The BlackBerry Dispatcher handles the encryption, compression, and routing of data packets between the BlackBerry Enterprise Server and the BlackBerry Router. The Messaging Agent handles email synchronization, the Controller monitors services, and the Router manages external connections.

3DES (Triple DES) is correct because it was the default encryption method used in BlackBerry encryption for securing data transmission between the BlackBerry Enterprise Server and handheld devices. 3DES was the industry standard at that time, providing strong encryption for enterprise messaging. The other options (AED, 4DES, 3AED) are not standard encryption algorithms.

Provisioning services automate the account lifecycle management: creating accounts when users join, modifying them as roles change, disabling/deleting when users leave. This automation across multiple backend systems reduces manual overhead and errors, directly matching the description.

Directory services (such as LDAP or Active Directory) serve as the central repository storing user IDs, profiles, and authentication data. When users authenticate, the system queries the directory to verify their credentials, making it fundamental to authentication processes.

Password synchronization ensures that when a user changes their password on one system, the change propagates to all other systems where they have accounts. This maintains consistent passwords across LDAP, Active Directory, RADIUS, and other connected systems, unlike SSO which uses one credential for multiple systems without synchronizing passwords.