Information Security

To solve this question, the user needs to have knowledge on securing web applications against authenticated users.

Option A: Client-side data validation is not sufficient to secure web applications against authenticated users. It can be easily bypassed by attackers, and therefore this option is not recommended.

Option B: Filtering data with a default deny regular expression can help prevent malicious input from being accepted, which is a good security practice. Therefore, this option is recommended.

Option C: Running the application under least privileges necessary is a recommended security practice because it limits the damage that can be caused by a successful attack. Therefore, this option is recommended.

Option D: Using parameterized queries to access a database can help prevent SQL injection attacks, which is a good security practice. Therefore, this option is recommended.

Therefore, the option that is NOT recommended for securing web applications against authenticated users is option A: Client-side data validation.

The Answer is: A

To solve this question, the user needs to have knowledge of the basic principles of security controls for database applications.

Option A: This option is incorrect because securing a database application with username/password access controls alone is not sufficient to fully secure the application. Although username/password access control is an essential security measure, it is not sufficient in isolation.

Option B: This option is correct because username/password access controls are necessary but not sufficient to fully secure a database application. Other controls such as encryption, access control lists, monitoring, and auditing should be combined with username/password access controls for a complete security solution.

Option C: This option is incorrect because the length of the password alone does not guarantee the security of the database application. There are other factors to consider such as password complexity, password rotation, and password storage.

Option D: This option is incorrect because even if none of the users have administrative access, username/password access controls alone are still not sufficient to fully secure a database application.

Therefore, the correct answer is:

The Answer is: B. Sufficient only when combined with other controls

Spyware typically performs all these behaviors: blocking access to updates to protect itself, aggregating surfing habits for advertisers, and customizing search results. Thus, 'All of the above' is the correct description of its characteristics.

Improper error handling enables multiple attack vectors: verbose error messages leak system details that help attackers map vulnerabilities (information disclosure), unexpected errors can crash applications creating DoS conditions, and revealed error paths guide attackers toward more sophisticated exploits. All three risks are real and commonly exploited.

Cross-site scripting (XSS) involves injecting malicious code into links or websites that appear trustworthy to execute in the user's browser. Command injection, path traversal, and buffer overflow target back-end weaknesses directly, not client-side link trustworthiness.

Path traversal (also called directory traversal) attacks exploit insufficient input validation to access files and directories outside the web root using sequences like '../'. Unlike brute forcing or insecure upload, this specifically targets the file system path resolution mechanism.

From an application security perspective, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is commonly used for preventing scripted attacks. These attacks involve automated bots or scripts that try to exploit vulnerabilities in web applications. By using CAPTCHA, it becomes harder for automated bots to bypass security measures and perform malicious activities like spamming, credential stuffing, or brute-forcing.

So, the correct answer is A. To prevent scripted attacks.

Option B, "to provide biometric authentication," is not the primary purpose of CAPTCHA. Biometric authentication typically involves using unique physical or behavioral characteristics of an individual, such as fingerprints or facial recognition, to verify their identity.

Option C, "to check the color blindness of the user," is not the primary purpose of CAPTCHA either. CAPTCHA primarily focuses on distinguishing between humans and bots, and while it may include visual challenges, it is not specifically designed to check for color blindness.

Option D, "more security," is a vague statement and doesn't provide a specific reason for using CAPTCHA. While CAPTCHA does enhance security by preventing automated attacks, it is more accurate to say that it specifically targets preventing scripted attacks.

Therefore, the correct answer is A. To prevent scripted attacks.

To select the correct choice for "Security Design Principle," the user needs to have knowledge about security design principles and their components.

Now, let's go through each option and explain why it is right or wrong:

A. 1) Keep it easy to understand 2) Secure default access 3) Defense in Depth 4) encapsulation 5) Highest privilege

This option is incorrect because it includes "highest privilege," which means giving users the maximum level of access, which is not a good security practice as it can lead to data breaches or unauthorized access. The other principles listed are correct.

B. 1) Keep it easy to understand 2) Secure access 3) Defense in Depth 4) encapsulation 5) Highest privilege

This option is incorrect because it lacks the principle of "least privilege," which is a fundamental security principle that means providing users with the minimum level of access they need to perform their tasks. This principle helps reduce the attack surface and minimize the damage in case of a breach.

C. 1) Keep it simple and secure 2) Secure default access 3) Defense in Depth 4) Compartmentalization 5) Least privilege

This option is correct. It includes all the essential security design principles, such as secure default access, defense in depth, compartmentalization, and least privilege. Moreover, it emphasizes keeping the design simple, which is always a good practice.

D. 1) Keep it easy to understand 2) Secure access 3) DMZ 4) encapsulation 5) Highest privilege

This option is incorrect because it includes "DMZ," which is not a design principle but a network architecture that separates the internal network from the external network. Also, it includes "highest privilege," which is not a good security practice.

Therefore, the correct answer is:

The Answer is: C

To answer this question, the user needs to understand the different types of access control mechanisms that can be used to provide access to an SSO application in a portal.

A. Mandatory access control: This access control mechanism is typically used in secure environments such as military or government settings. It is a strict access control mechanism that assigns access levels to users based on their security clearance level. This approach is not suitable for providing access to SSO applications in a portal.

B. Role Based Access Control: This access control mechanism assigns roles to users based on their job functions and responsibilities. The roles are used to determine what type of access a user has to an SSO application. This approach is suitable for providing access to SSO applications in a portal.

C. Discretionary Access Control: This access control mechanism allows users to determine who has access to their resources. This approach is not suitable for providing access to SSO applications in a portal.

D. Biometric access control: This access control mechanism uses biometric data such as fingerprints or facial recognition to authenticate users. This approach is not suitable for providing access to SSO applications in a portal.

Therefore, the best approach to be used while providing access to SSO application in a portal is Role Based Access Control.

The Answer is: B

Cookie Poisoning involves modifying the contents of a cookie to bypass authentication or access unauthorized data. While related to web cache poisoning or eavesdropping in general web security, the specific act of manipulating cookie parameters is cookie poisoning.

Allowing the System Administrator full read/write privileges over logs is not a countermeasure for log tampering; if an administrator's account is compromised, logs can easily be tampered with. Digital signatures, separate logs, and write-once logs are effective countermeasures.

A Demilitarized Zone (DMZ) is a subnetwork that exposes an organization's external-facing services to the untrusted internet while separating them from the trusted internal network. It is not a place where all protocols are permitted, nor is it strictly cyber warfare terminology.

To solve this question, the user needs to know about common web application vulnerabilities and their characteristics.

The correct answer is: C. Session fixation

Option A, SQL Injection, is incorrect because it is a type of attack that targets the database layer of a web application, not the HTTP protocol layer that handles form submissions.

Option B, Cross Site Request Forgery (CSRF), is incorrect because it involves tricking a user into submitting a form on a different website that performs an action on the user's behalf on a target website, not manipulating the values submitted within a form on the same website.

Option D, Session Hijacking, is incorrect because it involves stealing or guessing a user's session ID to impersonate them on a web application, not manipulating the values submitted within a form.

Option C, Session Fixation, is the correct answer. Session fixation is a type of attack where an attacker sets a user's session ID before the user logs in, then waits for the user to authenticate with that ID. Once the user logs in, the attacker can use the known session ID to access the user's session and perform actions on their behalf. In this case, the attacker could set a cookie value in the HTML form submission and then use that value to access the user's session.

Before sending a recovery link or running CPU-intensive operations like CAPTCHA validation, the application must verify the basic status of the account, specifically whether it is already disabled, to prevent abuse. Other checks can follow or are irrelevant if the account cannot be recovered.