Which type of attack is used to directly modify protection policies, delete existing policies, add new policies, and modify applications, system data, and resources?

Which type of attack is used to directly modify protection policies, delete existing policies, add new policies, and modify applications, system data, and resources?

• A. Cookies
• B. CAPTCHA
• C. Session Fixation Attack
• D. Security Management Exploits

Answer: (D)

The key idea here is attacks that target the management and enforcement controls of a system. This type of attack aims to break into the security governance layer so an attacker can directly alter how protection is applied: modify protection policies, delete existing ones, add new policies, and change how applications, system data, and resources are handled. That’s what “security management exploits” cover—exploiting weaknesses in the management interfaces or configuration processes to rewrite policy and enforcement rules. Cookies are just data stored in a browser to maintain state; they don’t modify security policies or resources. CAPTCHA is a defense mechanism to tell humans from bots and isn’t about changing policy. Session fixation attacks focus on taking control of a user session by setting or predicting a session identifier, not on altering security policies or configurations.

The key idea here is attacks that target the management and enforcement controls of a system. This type of attack aims to break into the security governance layer so an attacker can directly alter how protection is applied: modify protection policies, delete existing ones, add new policies, and change how applications, system data, and resources are handled. That’s what “security management exploits” cover—exploiting weaknesses in the management interfaces or configuration processes to rewrite policy and enforcement rules.

Cookies are just data stored in a browser to maintain state; they don’t modify security policies or resources. CAPTCHA is a defense mechanism to tell humans from bots and isn’t about changing policy. Session fixation attacks focus on taking control of a user session by setting or predicting a session identifier, not on altering security policies or configurations.