Information Security

When transmitting sensitive data, the POST method should be used instead of GET because POST parameters are included in the request body rather than the URL. This keeps sensitive information out of server logs, browser history, and referer headers. The data should still be encrypted using HTTPS or other suitable encryption to protect it during transit over the network.

By encrypting database content, the data can be safely replicated, stored, or transported across public clouds or untrusted hosting environments. This allows authorized users to access data closer to them, improving overall availability without compromising confidentiality.

Proprietary protocols and formats are often considered unsafe because they rely on security through obscurity - the idea that keeping the system secret makes it secure. This approach fails because security should not depend on secrecy of design; truly secure systems are those that remain secure even when their inner workings are fully known and can be independently audited by security researchers.

Adding cryptography introduces complexity and potential failure points. If encryption keys are corrupted or become unavailable, the application may fail to decrypt necessary data, leading to denial of service. Cryptographic operations also consume significant computational resources and if not implemented carefully can create performance bottlenecks or timing-based attack vectors.

To solve this question, the user needs to know the different flags that can be set when creating a cookie and their purposes.

Now, let's go through each option and explain why it is right or wrong:

A. Safe: This flag indicates that the cookie should only be sent over an encrypted channel. It does not protect against other types of attacks such as cross-site scripting (XSS) or cross-site request forgery (CSRF). Therefore, this option is not correct for this question.

B. Protected: This flag is not a standard cookie flag. Therefore, this option is not correct for this question.

C. Locked: This flag is not a standard cookie flag. Therefore, this option is not correct for this question.

D. Secure: This flag indicates that the cookie should only be sent over an encrypted channel and helps protect against attacks such as XSS and CSRF. This is a good programming practice to ensure that sensitive information transmitted over cookies is secure. Therefore, the correct answer is:

The Answer is: D

A server-side repository (like a database or session store) keeps the actual sensitive data secure on the server, only transmitting a reference key. This is safer than cookies, URL parameters, or hidden inputs, which are exposed to client-side risks and logs.

Stored procedures parameterize queries, separating input data from the SQL command structure. This prevents untrusted user authentication payloads from executing arbitrary SQL commands, effectively mitigating SQL injection attacks, whereas it does not directly address session fixation or hijacking.

SQLiX is an automated SQL injection scanner and exploitation tool that detects vulnerability entry points, SQL dialect types, and potential database takeover options. General tools like NMAP are for network scanning, and Paros or WebScarab act as intercepting proxies.

SQUARE (Security Quality Requirements Engineering) is a structured, nine-step methodology developed by Carnegie Mellon University specifically designed to help organizations identify and prioritize software security requirements during early development phases, unlike general consulting or data masking tools.

CAPTCHAs verify that an agent attempting an action is human. This blocks automated bots, preventing them from performing automated credential stuffing or brute force login attempts. However, it does not directly prevent input injection or buffer exploits.

LOIC (Low Orbit Ion Cannon) is a network stress testing and DoS attack tool that floods a target with TCP, UDP, or HTTP packets. It overwhelms the target's resources by sending massive volumes of traffic from multiple sources, making the service unavailable to legitimate users. It has been used in various high-profile DDoS attacks by hacktivist groups.

ASLR randomizes memory address locations to make it harder for attackers to predict where code and data are stored, while DEP prevents code execution from certain memory regions like the stack and heap. Together they effectively mitigate buffer overflow attacks by making it difficult for attackers to predict where to jump to execute their shellcode and preventing execution in writable memory regions.

Stored Cross-Site Scripting (XSS) occurs when an attacker uploads or injects a malicious script onto a target server (such as in a comment section). The script then executes inside the browser of any user who retrieves and reads that content, attacking the client side.

To solve this question, the user needs to know about caching and how to prevent sensitive data from being cached on clients or proxies.

Option A: "Cache-Control: do not-cache, do not save" - This option is not entirely correct. Although the "do not-cache" directive will prevent the client or proxy from caching the data, there is no "do not save" directive in the Cache-Control header field.

Option B: "Cache-Control: do not-save, do not store" - This option is incorrect. There is no "do not-save" or "do not store" directive in the Cache-Control header field.

Option C: "Cache-Control: no-cache, no store" - This option is correct. The "no-cache" directive indicates that the client or proxy should not use a cached copy of the data for subsequent requests, but it should revalidate the data with the origin server. The "no-store" directive indicates that the client or proxy should not store the data in any form of cache. Together, these directives ensure that sensitive data is not cached on the client or proxy.

Option D: "Cache-Control: do not cache" - This option is not entirely correct. The "do not cache" directive will prevent the client or proxy from caching the data, but it does not prevent the data from being stored in other forms of cache.

Therefore, the correct answer is:

The Answer is: C

Services represent functional interface endpoints where clients interact with the application. Unlike error messages or response codes (which are outputs) or packaging (which is a deployment structure), services are direct entry channels through which external systems input data, making them key entry points.