Information Security

CAPTCHA challenges users to complete tasks that are easy for humans but difficult for automated scripts, effectively preventing bots from submitting forms or accessing services. Session management, whitelisting, and blacklisting are security practices but not specifically anti-automation techniques.

Secure configuration management requires disabling or removing all unnecessary elements to minimize the attack surface. This includes unused request methods, manuals, installation files, and sample applications, making 'All' the correct recommendation.

The principle of full privilege is insecure; applications must instead follow the principle of least privilege, granting users only the minimum access necessary. The other statements accurately describe application Denial of Service mechanisms and defenses.

A weak password policy allows short, simple, or common passwords, drastically increasing the probability of a successful brute-force attack. Cleartext transmission or storage vulnerabilities expose passwords to interception or theft but do not directly facilitate brute-force cracking.

To ensure secure access control, users need to follow some best practices. The answer is option D, which means that all the options mentioned are correct.

Explanation of each option:

A. Use role-based access: This option is correct because role-based access control (RBAC) is a secure practice to control access to resources based on the roles assigned to individual users within an organization. It ensures that users have the necessary access to complete their tasks and restricts access to resources that are not relevant to their role.

B. Enforce authorization on each request: This option is correct because enforcing authorization on each request helps to verify that the user has the necessary privileges to access the requested resource. Authorization ensures that users only access the resources that they need to complete their tasks and nothing more.

C. Enforce Business Workflow: This option is correct because enforcing business workflow ensures that the access granted to users is in alignment with the business processes. By enforcing business workflow, organizations can minimize the risk of unauthorized access to resources and ensure that the access granted is relevant to the user's role.

D. All: This option is correct because all the options mentioned are secure practices for access control. Using role-based access, enforcing authorization on each request, and enforcing business workflow, all contribute towards ensuring secure access control.

Therefore, the correct answer is: D. All.

Horizontal privilege escalation occurs when a user gains access to resources or functionality belonging to another user with the same role or privileges. Vertical escalation involves gaining higher privileges. Session hijacking involves stealing a session, and cross-functional escalation is not a standard security term.

Public key algorithms involve complex mathematical computations, making them significantly slower than symmetric algorithms for encrypting large volumes of data. Symmetric algorithms do not offer better access control or nonrepudiation, and are generally simpler to implement.

Sensitive databases require high-security standard compliance, which is met by using algorithms certified under FIPS or EAL. Random numbers do not encrypt, long passwords are keys rather than algorithms, and DES is outdated and insecure.

An anonymiser is a service that hides a user’s real identity, typically by routing traffic through another server or providing temporary aliases, enabling the user to appear as a different person online. The other choices describe unrelated activities like FBI work, phishing, or vishing, which do not match the definition.

Piggybacking into unsecured wireless networks allows attackers to use someone else's internet connection, masking their real IP address and location to avoid detection. Physical masks and changing clothes do not hide network footprints, while phishing is an active attack vector.

Botnets (networks of compromised computers) are the primary mechanism used to orchestrate and execute distributed denial of service (DDoS) attacks. Distributing malware via emails spreads infections but isn't the direct DDoS method itself, while phishing steals credentials.

To answer this question, the user needs to know what cybercrime is and what activities constitute cybercrime.

Out of the given options, looting a bank is not a cybercrime. It is a traditional crime that can be committed without the use of computers or the internet.

On the other hand, looting email addresses, personal information, distributing viruses and worms are activities that can only be carried out through the use of computers and the internet, making them cybercrimes.

Stuxnet kind of attacks is a type of cybercrime which is designed to damage or destroy specific industrial equipment. Stuxnet was used to target Iran's nuclear program, and it caused physical damage to centrifuges at a uranium enrichment plant.

Therefore, the correct answer is:

The Answer is: D. Distributing virus, worms

Distributed Denial of Service (DDOS) attacks overload resource capacity or bandwidth from many sources, which firewalls cannot fully prevent on their own. Standard attacks like ping floods or specific port accesses are easily controlled via firewall rules.

Application layer firewalls inspect protocol payloads and can detect and block SQL injection attacks by analyzing database queries in HTTP traffic. They cannot prevent non-technical social engineering or physical wireless attacks like war-dialing/driving.

To answer this question, the user needs to have knowledge about different types of web attacks.

The answer is D. Path Traversal Attacks.

Option A is incorrect because Cross-site scripting (XSS) attacks allow an attacker to inject malicious scripts into a web page viewed by other users. This allows the attacker to steal user information, hijack user accounts, spread malware, and perform other malicious activities.

Option B is incorrect because Command Injection Attacks occur when an attacker sends malicious input to an application, tricking it into executing unintended commands. This can allow the attacker to run arbitrary commands on the web server, potentially compromising the server and its data.

Option C is incorrect because SQL Injection attacks occur when an attacker sends malicious SQL statements to a web application database. This can allow the attacker to view or modify data in the database, or even take control of the entire database server.

Option D is the correct answer because Path Traversal Attacks occur when an attacker manipulates a URL to access files outside of the web server's root directory. This can allow the attacker to view sensitive data or execute arbitrary code on the web server.