Java Core Classes and Threads

Encode only the user input parameter, not the entire URL. Option C correctly encodes just the dangerous input. Option A uses JavaScript encoding (wrong context). Option B encodes the entire URL including the path, which breaks it.

SecurityException is the most common exception thrown by validation methods in the security API when validation fails. ValidationException (A) is not the standard exception name, and Encoding/Encryption exceptions (C, D) are for different operations.

In exception hierarchies, a base exception class provides common properties and methods for all related exceptions. EnterpriseSecurityException serves as the parent class for specific security exceptions, allowing consistent error handling across different security failure scenarios.

Path Traversal attacks attempt to access files outside the intended directory using sequences like '../'. isSafeDirectoryPath and isSafeFileName validate that paths don't escape allowed directories and filenames don't contain dangerous sequences, preventing unauthorized file system access.

Secure password hashing requires both the password and a unique salt per user. The hashPassword method takes both password and accountName parameters, where accountName serves as the salt, ensuring that even identical passwords produce different hashes for different accounts.

The verifyPasswordStrength() method performs validation checks on password strength requirements (length, complexity, etc.). Being a void method means it doesn't return a value - it either completes successfully if the password is strong enough, or throws an exception if it fails validation checks.

Authorization checks determine whether a user has permission to access specific data. The isAuthorizedForData() method returns a boolean - true if the user has permission, false otherwise. This simple yes/no result is sufficient for authorization decisions in access control systems.

CSRF tokens are random, unique strings generated by the server and embedded in forms or AJAX requests. The getCSRFToken() method returns this token as a String, allowing it to be included in requests and validated server-side to ensure requests originate from the legitimate application, not a malicious site.

The sign method in the security API throws SecurityException to handle cryptographic failures gracefully. Option B lacks exception handling, A throws the wrong exception type, and C is missing the key parameter. Security operations must declare appropriate exceptions for failure scenarios.

The seal method signature includes a timestamp parameter and throws SecurityException for error handling. Option B uses the wrong exception type (EncryptionException), while options C and D are missing the timestamp parameter which is typically required for temporal validation in sealing operations.

The correct approach encodes only the dangerous user input parameter using encodeForURL, not the entire URL. Option A uses JavaScript encoding which is wrong for URL parameters. Option B encodes the entire URL which would break the URL structure. Only the user input needs encoding.

SecurityException is the common exception thrown by validation methods in security APIs. It serves as the base class for security-related failures, including validation errors. While the option lists specific validation exceptions, SecurityException is the standard runtime exception for such cases.

EnterpriseSecurityException is the base class for all security-related exceptions in this API. While SecurityException might seem logical, this specific API hierarchy uses EnterpriseSecurityException as the root. EnterpriseException is likely a broader base for all enterprise exceptions.

To prevent path traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName(). Both methods take a context, input string, and allowNull flag. The 'isSafe' prefix methods (option C) are the correct API methods for validating path safety.

The correct signature is String hashPassword(String password, String accountName). The accountName is used as the salt, so it's required. Option A is missing the salt parameter, and option C has incorrect case (hashpassword instead of hashPassword).