A. 보안 관리자는 관리 액세스 권한을 얻기 위해 사용되는 인쇄할 수 없는 문자에 대해 우려하고 있으며 개발자는 인쇄할 수 없는 모든 문자를 제거해야 합니다.

B. 보안 관리자는 XSS에 관심이 있으며 개발자는 브라우저 측에서 유니코드 문자를 정규화해야 합니다.

C. 보안 관리자는 SQL 인젝션에 관심이 있으며 개발자는 서버 측 입력 유효성 검사를 구현해야 합니다.

D. 보안 관리자는 누군가가 관리자로 로그온할 수 있다는 점을 우려하고 있으며 개발자는 강력한 암호가 적용되도록 해야 합니다.

A. The company does not allow an SMS authentication method

B. The WAYF method requires a third factor before the authentication process can complete

C. OpenID Connect requires at least one factor to be a biometric

D. These are symptoms of known compatibility issues with OAuth 1 0

E. The company is using a claims-based authentication system for MFA

F. A vendor-specific authenticator application is needed for push notifications

A. After successfully using a watering hole attack to deliver an exploit to a machine, which belongs to an employee of the contractor, an attacker gained access to a corporate laptop. With this access, the attacker then established a remote session over a VPN connection with the server hosting the database of sensitive information.

B. A shared workstation was physically accessible in a common area of the contractor's office space and was compromised by an attacker using a USB exploit, which resulted in gaining a local administrator account.
Using the local administrator credentials, the attacker was able to move laterally to the server hosting the database with sensitive information.

C. The attacker harvested the hashed credentials of an account within the database administrators group after dumping the memory of a compromised machine. With these credentials, the attacker was able to access the database containing sensitive information directly.

D. An account, which belongs to an administrator of virtualization infrastructure, was compromised with a successful phishing attack. The attacker used these credentials to access the virtual machine manager and made a copy of the target virtual machine image. The attacker later accessed the image offline to obtain sensitive information.

A. 안티바이러스

B. 패치 관리

C. 로그 모니터링

D. 애플리케이션 허용 목록

E. 인식 교육

A. Cookies should be marked as "secure" and "HttpOnly"

B. Client-side cookies should be replaced by server-side mechanisms

C. SessionStorage should be used so authorized cookies expire after the session ends

D. Cookies should be scoped to a relevant domain/path