ITPEC FE Morning October 2023 Question 41
As shown in the figure below, an application on a client accesses the data in the database on a server via database connection programs. Which of the following is a measure for preventing the leakage of the commands and execution results transmitted between the application and database?
Explanation
Encrypt the communication between the database connection programs — the threat in the figure is tapping of the network line, so the data itself must be made unreadable.
The attacker taps the network between the client's and the server's database connection programs. Whatever travels on that line (SQL commands and their result sets) can be captured. The only measure that stops the captured traffic from leaking its content is encryption of the channel, for example TLS between the database client and server. An eavesdropper then sees ciphertext only.
Answer (b)
Why not others:
- •(a) — changing the port number is obscurity; a tapper sees the packets on whatever port they use, still in plaintext
- •(c) — restricting client IP addresses controls who may connect, not whether a passive listener can read the traffic of legitimate clients
- •(d) — a start/stop password protects administration of the program, not the confidentiality of the data it sends
Key rule: Match the countermeasure to the threat: eavesdropping on a line is countered by encrypting data in transit; access control and obscurity do not hide content.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.