Information Security

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a methodology developed by Microsoft specifically for Threat Modelling to identify potential security threats during the design phase. Other options do not represent threat modeling frameworks.

Displaying or sending a raw password (old or new) is insecure. The most secure design is to verify identity details and send a temporary reset link via email to the registered address. Distractors are unsafe because they expose existing passwords or generate new ones directly on screen.

Persistent cookies are stored as text files on the user's hard disk, making them readable by anyone with access to the machine or malware. This exposes session information to theft. Options A and B are incorrect - cookies are transmitted via HTTP headers and do expire based on their set expiration time, regardless of browser close. Option D is incorrect - persistent cookies do have security risks.

Audit logs must capture comprehensive event information for forensics and compliance. Option D includes all essential elements: user identity, timing, source, errors, and full HTTP request context (URL, method, protocol version, browser, referrer, response code). Options A, B, C are incomplete. Critically, passwords should NEVER be logged - options B and C incorrectly include password logging, which is a serious security violation.

Effort slippage is a general project management metric assessing schedule adherence, not a software security metric. The other options directly quantify vulnerabilities, risks, and exception issues.

OWASP stands for Open Web Application Security Project. It's a worldwide nonprofit organization focused on improving software security. Option B is correct. Options A, C, D are incorrect expansions.

Cryptographically secure PRNGs (CSPRNGs) are specifically designed to be unpredictable under cryptographic attacks. Statistical and other simple PRNGs do not offer these security guarantees.

The term is 'Cross-Site Scripting' (XSS). 'Cross Side Scripting' is a misspelling and not a standard security term, whereas Blind SQLi, RFI, and CSRF are all valid attacks.

The code directly executes a command with user input: cmd.exe /K \c:\util\rmanDB.bat . When user input is concatenated into a command string without validation or sanitization, attackers can inject additional commands. This is the classic Command Injection vulnerability. The privileged context (running as privileged user) makes this even more dangerous. Options B, C, D are incorrect - this is not buffer overflow, XSS, or CSRF.

OWASP (Open Web Application Security Project) is an open community dedicated to improving the security of software, particularly web applications. Option C is correct. They produce resources like the OWASP Top 10, testing guides, and security standards. Options A (performance), B (SEO), D (GUI) are incorrect - these are not OWASP's focus.

Social engineering attacks manipulate people rather than technology. Intimidation (threatening or pressuring victims) and Impersonation (pretending to be someone else) are classic social engineering techniques. Option A is correct. Options B (SQL Injection), C (Man in the middle), D (Cookie poisoning) are technical attacks, not social engineering.

Steganography is the practice of hiding information within another file, message, image, or video to conceal the existence of the communication itself. Unlike encryption which makes data unreadable, steganography hides the fact that a message even exists. Common carrier files include images, audio files, and documents where the hidden data is embedded in ways undetectable to human perception.

Keyloggers are malicious surveillance tools that record every keystroke made by a user without their knowledge or consent. They capture sensitive information including passwords, credit card numbers, confidential messages, and other private data. Attackers deploy keyloggers to steal credentials and personal information by monitoring everything typed on the compromised system.

When symmetric encryption only protects data from being read, an attacker can still rearrange encrypted blocks without decrypting them. By moving ciphertext blocks around, fields can be swapped between records - for example, assigning someone else's encrypted account balance to your own record. This works because the encryption doesn't authenticate or preserve the structure of the data.