Information Security

Public Key Cryptography (PKC) uses a key pair - a public key for encryption and a private key for decryption. The public key can be freely shared, while the private key must be kept secret. This eliminates the need for parties to exchange a secret key beforehand, solving the key distribution problem in symmetric cryptography.

Identity Management (IdM) involves creating digital identities for users and provisioning appropriate access rights to resources. It encompasses the entire lifecycle of identity creation, modification, and de-provisioning. Option C correctly captures both aspects: creating the identity and provisioning resource access, which is more comprehensive than just identification or authorization alone.

Phishing is a social engineering attack where attackers pose as trustworthy entities (banks, companies, colleagues) to acquire sensitive information like passwords, credit card details, or personal data. It typically involves fraudulent emails or websites that appear legitimate but are designed to deceive victims into revealing confidential information.

DoS (Denial of Service) attack is a cyber attack where the perpetrator seeks to make a machine or network resource unavailable to its intended users. This is typically accomplished by flooding the target with excessive requests or traffic, overwhelming its capacity and preventing legitimate users from accessing the service.

Cross-Site Scripting (XSS) is a security vulnerability where attackers inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when a web application accepts and displays user input without proper sanitization, allowing scripts to execute in victims' browsers. Option A 'JavaScript' is merely the language used, not the vulnerability itself. Options B and D are fabricated meanings unrelated to actual security terminology.

SYN Flooding is a classic Denial of Service (DoS) attack that exhausts a server's resources by flooding it with TCP SYN requests without completing the handshake. It does not involve cryptanalysis, social engineering, or repudiation.

The TEAR DROP attack exploits a vulnerability in IP fragment reassembly. It sends overlapping or malformed IP fragments that crash or hang systems when they attempt to reassemble the packet.

Kerberos authentication relies heavily on timestamps to prevent replay attacks. If the clocks on the KDC, client, and server are not synchronized, tickets will be rejected because they appear to be expired or issued in the future.

Cryptanalysis is the science and practice of analyzing information systems to discover hidden aspects of the system, specifically studying methods for breaking encryption algorithms and ciphers. It is the counterpart to cryptography, which focuses on creating secure communication methods. Cryptogram refers to the encrypted text itself, steganography involves hiding messages within other content, and 'crptology' appears to be a typo.

SYN flooding attacks exploit the TCP three-way handshake mechanism where a client sends SYN, server responds with SYN-ACK, and client completes with ACK. The attacker sends many SYN packets but never completes the handshake, exhausting server resources. This attack does not target IIS or Netscape vulnerabilities specifically, and SCTP uses a four-way handshake which is not the target of SYN flooding.

Passwords should be stored in hashed form using a slow, salted hash function like bcrypt, Argon2, or PBKDF2. Hashing is one-way, so even if the password database is compromised, attackers cannot easily recover the original passwords. Encryption is reversible and less secure for password storage, and plaintext storage is a critical security failure. Modern systems never store passwords in plaintext.

Steganography is the practice of concealing messages within other messages, images, or objects so that the very existence of the hidden message is not apparent to casual inspection. Unlike cryptography which hides the content of a message, steganography hides the existence of the message itself. The word derives from Greek meaning 'covered writing'. Cryptography is about encrypting messages, not hiding their existence.

Buffer overflows in programs running with administrator/root privileges are most dangerous because they can lead to complete system compromise. When an administrator-level process is exploited, the attacker gains the same high privileges as that process, allowing full control over the system. Overflowing a normal user program limits the attacker's scope, and programs 'run by the attacker' or 'run by the remote user' are nonsensical distractors in this context.