Which of the following events demonstrates an example of information leakage vulnerability? a. An attacker was able to bypass the login mechanism via a password guessing attack. b. An attacker could access sensitive data belonging to the HR department of his/her workplace. c. An attacker was able to retrieve arbitrary data from the database using crafted input. d. An attacker was able to get sensitive information about the target system from an error message.

Which of the following events demonstrates an example of information leakage vulnerability? a. An attacker was able to bypass the login mechanism via a password guessing attack. b. An attacker could access sensitive data belonging to the HR department of his/her workplace. c. An attacker was able to retrieve arbitrary data from the database using crafted input. d. An attacker was able to get sensitive information about the target system from an error message.

A+ Guide To It Technical Support

10th Edition

ISBN:9780357108291

Author:ANDREWS, Jean.

Publisher:ANDREWS, Jean.

Chapter16: Securing And Sharing Windows Resources

Section: Chapter Questions

Problem 4TC

See similar textbooks

Similar questions

Classify each of the following vulnerabilities using the Protection Analysis Mode( PA) model. Assume that the classification isfor the implementation level. Remember to justify your answers.(a) The presence of the “wiz” command in the sendmail program (b) The failure to handle the IFS shell variable by loadmodule (c) The failure to select an Administrator password that was difficult to guess (d) The failure of the Burroughs system to detect offline changes to files Protection Analysis Mode( PA) model: Improper protection domain initialization and enforcementa. Improper choice of initial protection domainb. Improper isolation of implementation detailc. Improper change, consistency of data over timed. Improper naminge. Improper deallocation or deletion2. Improper validation, validation of operands, queue management3. Improper synchronizationa. Improper indivisibility, interrupted atomic operationsb. Improper sequencing, serialization4. Improper choice of operand or operation
Which encryption benchmark ensures data is not modified after it’s transmitted and before it’s received? a. Confidentiality b. Integrity c. Availability d. Symmetric
Which of the following is not a step of Attacker's methodology? 1 point Performing reconnaissance Escalation of privilege Fixing Vulnerabilities Gaining access
Which of these can be used to improve defenses against host attacks on a password system in which the passwords are stored in plain text (note: the system must remain a user-knowledge-based authentication system)? Select one: a. Hash the passwords and store the hashes, rather than the plaintext passwords b. Store the password on a physical object instead c. Use one-time passcodes instead d. Limit the number of attempts allowed
Classify each of the following vulnerabilities using the PA model. Assume that the classification isfor the implementation level. Remember to justify your answers.(a) The presence of the “wiz” command in the sendmail program (see Section 24.2.9).(b) The failure to handle the IFS shell variable by loadmodule (see Section 24.2.9).(c) The failure to select an Administrator password that was difficult to guess (see Section 24.2.10).(d) The failure of the Burroughs system to detect offline changes to files (see Section 24.2.7) PA : Improper protection domain initialization and enforcement Improper choice of initial protection domain (domain) Improper isolation of implementation detail (exposed representations) Improper change (consistency of data over time) Improper naming (naming) Improper deallocation or deletion (residuals) Improper validation (validation of operands, queue management dependencies) Improper synchronization Improper indivisibility (interrupted atomic…
Create a fictitious scenario to demonstrate how the login procedure works. It is probable that you have experienced a number of authentication techniques. Any time soon? I do not believe that passwords will ever become obsolete.
A small insurance company has an online application system that allows its customers to interactwith the business (e.g., log claims). Backups of the customers’ details are done on a spreadsheetdocument stored on Google drive. However, anyone who has access to the Google drive link ofthe file can view and modify all the customer details. On the backup, the system administratordoes not have visibility of the modifications made on the file. By analysing the scenario above, use the security design principles to criticise theoperations of the small insurance company and propose any two simple controlsthat could influence a good security program.
Salt enhances the difficulty of guessing in the UNIX login authentication procedure by a factor of ten. The salt, on the other hand, is saved in the same file as plaintext, in the same entry as the hashed password. As a result, if an attacker has knowledge of the salt and hashed password from the password file, the password does not need to be guessed. Why is it claimed that salt boosts security?
Create a scenario in which you are in charge of user logins. Keep track of the various means by which you have established your identity. What are your thoughts on the future of passwords?
XACMLThe following represent two examples of XACML 2.0 policies. Which single one of these statements is false:a) An access request from Alice Samson at 14:00 on 01 January 2018 according to the first policy, will failComputer Security Coursework, 2020/2021 Page 11b) Purpose of the last rule in each of the two policies is to deny any requests that are not covered by the previous permitting rules in each of the two policiesc) If the two policies above were combined into one policy set in the order they appear with a policy-combining algorithm “first-applicable”, then the outcome of the request by Alice Samson be at 14:00 on 01 January 2018 to access the “server.acme.co.uk/docsserver” would be accepted when evaluated against the new policy setd) Adding to the AND of the condition a third part with a “anyURI-equal” function applied to an attribute “machine.alice.come” will strengthen the condition by also requiring that Alice’s request arrives from a particular URI address equal to…
QUESTION 14 Which security process records the occurrence of specific operating system events in the Security log? a. Encrypting b. Auditing c. Filtering d. Hashing
Classify each of the following vulnerabilities using the PA model. Assume that the classification isfor the implementation level. Remember to justify your answers.(a) The presence of the “wiz” command in the sendmail program (b) The failure to handle the IFS shell variable by loadmodule (c) The failure to select an Administrator password that was difficult to guess (d) The failure of the Burroughs system to detect offline changes to files