DR. A.P.J.

ABDUL KALAM TECHNICAL

UNIVERSITY
Lucknow, Uttar Pradesh | Semester Examination Study Repository

AKTU OFFICIAL SYLLABUS ALIGNED STUDY GUIDE

ADVANCED JAVA PROGRAMMING &

CYBER SECURITY ESSENTIALS
Comprehensive Notes, Thread Models, Cryptographic Frameworks & University Solved
Question Bank

Course Code: BCS-501 / Academic Year: 2025 –

CS-602 2026

Program: [Link] Semester: V / VI

(Computer Semester
Science &
Engineering)

Target Audience: AKTU Passing/Target: Exam Marks

Technical Optimization
Candidates (70/70)

Module Breakdown & Weightage Distribution

Unit Module Topic Core Focus Areas Exam

No. Weightage

Unit I OOP & Core Java Architecture Inheritance, Interfaces, Abstract Classes, Packages, 15 Marks
JVM Memory

Unit II Exception Handling & Memory Exception Hierarchy, Custom Exceptions, Try-With- 12 Marks
Management Resources, GC

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 1 of 22
 Unit Module Topic Core Focus Areas Exam
No. Weightage

Unit III Multithreading & Concurrency Thread Life Cycle, Synchronization, Inter-thread 18 Marks
Control Communication, Deadlocks

Unit Java I/O, Socket Programming & Byte/Char Streams, Serialization, TCP/UDP Sockets, 15 Marks
IV Steganography LSB Steganography

Unit V Cyber Security Frameworks & CIA Triad, Botnet Architectures, Ransomware, 20 Marks
Threat Vectors Wireless Security (WPA3)

Unit AKTU Solved Question Bank 15 Short Answer Questions & 6 Long Analytical Model Test
VI University Questions

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 2 of 22
 UNIT I: OBJECT-ORIENTED TECHNOLOGIES & JAVA
FUNDAMENTALS
Classes, Abstraction, Polymorphism, Memory Model & Package Architecture

1.1 Object-Oriented Programming (OOP) Paradigm

Java is an object-oriented, class-based, concurrent, secured, and general-purpose programming language. The core objective of
OOP is to implement real-world entities such as inheritance, hiding, polymorphism, and abstraction in programming.

• Encapsulation: Wrapping code and data together into a single unit (class). It is achieved by declaring fields as private
and providing public getter and setter methods. Encapsulation ensures data hiding and security against unauthorized
direct modification.
• Abstraction: Hiding internal implementation details and highlighting operational functionality to the end user. In Java,
abstraction is achieved using abstract classes (0–100%) and interfaces (100% abstract up to Java 7).
• Inheritance: The mechanism by which one class acquires the properties and behaviors of a parent class. It promotes
reusability via the extends keyword. Java supports single, multilevel, and hierarchical inheritance, but prohibits direct
multiple inheritance for classes to eliminate the Diamond Problem.
• Polymorphism: The capability of a method to perform different tasks based on the invoking context.
◦ Compile-time Polymorphism (Method Overloading): Multiple methods in the same class sharing the same name but
possessing different parameter signatures (type, count, or order).
◦ Run-time Polymorphism (Method Overriding): Subclass providing a specific implementation of a method already
defined in its superclass. Resolved at runtime via Dynamic Method Dispatch.

1.2 Abstract Classes vs. Interfaces (Java 8+ Evolution)

Prior to Java 8, interfaces could only contain abstract methods and public static final constants. Java 8 introduced default
and static methods in interfaces, while Java 9 brought private methods to interface design.

Feature Comparison Abstract Class Interface

Inheritance Keyword Extended using extends Implemented using implements

Multiple Inheritance Not supported (Single class inheritance only) Supported (A class can implement multiple
interfaces)

Member Variables Can have instance variables (private, Only public static final constants
protected, public)

Constructor Can have constructors Cannot have constructors

Default / Static Supported fully Supported since Java 8 (default & static)
Methods

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 3 of 22
1.3 JVM Memory Architecture & Lifecycle
When Java code executes, the Java Virtual Machine (JVM) divides memory into five primary logical runtime data areas:

1. Class (Method) Area: Stores per-class structures such as the runtime constant pool, field and method data, and the code
for methods and constructors.
2. Heap Area: The runtime data area from which memory for all class instances (objects) and arrays is allocated. Managed
automatically by Garbage Collectors.
3. Stack Area: Stores frames holding local variables, partial results, and nested method invocations. Each thread has its own
private JVM stack created simultaneously with the thread.
4. PC Register: Contains the address of the JVM instruction currently being executed by the thread.
5. Native Method Stack: Contains all the native methods used in the application written in C/C++.

// Example: Demonstrating Runtime Polymorphism & Interface Usage

interface SecurityPolicy {
void enforcePolicy(String userRole);
default void logAuditTrail(String action) {
[Link]("[AUDIT LOG] Action executed: " + action);
}
}

class NetworkSecurity implements SecurityPolicy {

@Override
public void enforcePolicy(String userRole) {
if ("ADMIN".equalsIgnoreCase(userRole)) {
[Link]("Full firewall and port modification privileges granted.");
} else {
[Link]("Restricted access: Read-only network statistics.");
}
}
}

public class MemoryDemo {

public static void main(String[] args) {
SecurityPolicy policy = new NetworkSecurity(); // Dynamic Method Dispatch
[Link]("ADMIN");
[Link]("Firewall Rule Modified");
}
}

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 4 of 22
 UNIT II: EXCEPTION HANDLING ARCHITECTURE & MEMORY
MANAGEMENT
Throwable Hierarchy, Try-Catch-Finally, Custom Exceptions & Garbage Collection

2.1 Java Exception Hierarchy

An exception is an unwanted or unexpected event that disrupts the normal flow of the program during execution. In Java, all
exception and error types are subclasses of the root class [Link].

Category Base Class Description & Examples

Checked Exception (excluding Checked at compile-time. Mandatory to handle using try-catch or declare with th
Exceptions RuntimeException) IOException, SQLException, ClassNotFoundException.

Unchecked RuntimeException Occur at runtime due to logical errors or improper API usage. Not checked by compil
Exceptions NullPointerException, ArrayIndexOutOfBoundsException, ArithmeticE

Errors Error Irrecoverable conditions caused by system environment issues. Programs should no
Examples: OutOfMemoryError, StackOverflowError.

2.2 The Mechanics of Try-Catch-Finally & Try-With-Resources

The try block contains code that might generate an exception. The catch block handles the thrown exception. The
finally block executes guaranteed code regardless of whether an exception occurred or was handled (useful for closing
database connections, sockets, and files).

AKTU Exam Tip: Try-With-Resources (Java 7+)

Introduced in Java 7, the try-with-resources statement automatically closes resources that implement
[Link] or [Link]. It eliminates boilerplate finally blocks and avoids resource
leaks.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 5 of 22
 // Example: Try-With-Resources & Custom Exception Handling
import [Link];
import [Link];
import [Link];

// Custom Checked Exception

class InvalidSecurityTokenException extends Exception {
public InvalidSecurityTokenException(String message) {
super(message);
}
}

public class ExceptionArchitecture {

public static void validateToken(String token) throws InvalidSecurityTokenException {
if (token == null || [Link]() < 16) {
throw new InvalidSecurityTokenException("Security token must be at least 16
characters.");
}
}

public static void main(String[] args) {

// Try-with-resources ensures auto-closing of BufferedReader
try (BufferedReader reader = new BufferedReader(new FileReader("[Link]"))) {
String token = [Link]();
validateToken(token);
} catch (IOException e) {
[Link]("File I/O Error: " + [Link]());
} catch (InvalidSecurityTokenException e) {
[Link]("Authentication Failed: " + [Link]());
} finally {
[Link]("Execution of security check completed.");
}
}
}

2.3 Garbage Collection & Memory Management

Java automates memory deallocation through Garbage Collection (GC). The GC daemon thread periodically identifies objects
on the Heap that are no longer reachable from any GC Root (e.g., local variables on active stack frames, static fields) and
reclaims their memory.

• Mark-and-Sweep Algorithm: The standard GC algorithm operating in two phases:

1. Mark Phase: Traverses object graphs starting from GC Roots and marks all reachable live objects.
2. Sweep Phase: Scans the heap and frees memory occupied by unreferenced/unmarked objects.

• Generational Heap Structure:

◦ Young Generation: Divided into Eden and two Survivor spaces (S0, S1). New objects are allocated here. Minor GC
runs frequently.
◦ Old (Tenured) Generation: Holds long-surviving objects promoted from Young Generation after passing tenure
thresholds. Major (Full) GC runs here.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 6 of 22
 UNIT III: MULTITHREADING & CONCURRENCY CONTROL
Thread Lifecycle, Synchronization, Inter-Thread Communication & Deadlock Prevention

3.1 Process vs. Thread & Multithreading Model

A process is an executing program instance with its own independent memory address space. A thread is a lightweight
lightweight unit of execution within a process. Threads within the same process share heap memory, open file handles, and
static resources, enabling high-performance concurrent processing.

3.2 Detailed Thread Lifecycle (State Transitions)

A Java thread always exists in one of the six states defined in [Link] enum:

Thread State Trigger Event / Description Transition Mechanics

NEW Thread object instantiated via new Thread() Not yet started. Memory allocated on Heap.

RUNNABLE start() method invoked Ready to run or executing. Managed by OS

Thread Scheduler.

BLOCKED Waiting to acquire a monitor lock Enters when attempting to enter a

synchronized block/method held by another
thread.

WAITING Invoked wait(), join(), or Waits indefinitely until another thread calls
[Link]() notify() or notifyAll().

TIMED_WAITING Invoked sleep(ms), wait(ms), or join(ms) Waits for a specified duration or until explicit
notification/interruption.

TERMINATED run() method completes execution or throws Thread execution finished. Dead state. Cannot be
uncaught exception restarted.

3.3 Thread Creation Mechanisms: Thread Class vs. Runnable vs. Callable
Java provides three primary mechanisms for thread creation:

1. Extending [Link]: Limits inheritance because Java does not support multiple class inheritance.
2. Implementing [Link]: Recommended standard. Separates task logic from thread execution
mechanism. Cannot return values or throw checked exceptions.
3. Implementing [Link]<V>: Advanced approach. Returns a result of type V via
Future<V> and can throw checked exceptions.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 7 of 22
 // Example: Producer-Consumer Model illustrating Inter-Thread Communication
import [Link];
import [Link];

class Buffer {
private final Queue queue = new LinkedList<>();
private final int CAPACITY = 5;

public synchronized void produce(int item) throws InterruptedException {

while ([Link]() == CAPACITY) {
[Link]("Buffer FULL. Producer thread WAITING...");
wait(); // Releases monitor lock and enters WAITING state
}
[Link](item);
[Link]("Produced item: " + item);
notifyAll(); // Wakes up consumer threads
}

public synchronized int consume() throws InterruptedException {

while ([Link]()) {
[Link]("Buffer EMPTY. Consumer thread WAITING...");
wait(); // Releases monitor lock
}
int item = [Link]();
[Link]("Consumed item: " + item);
notifyAll(); // Wakes up producer threads
return item;
}
}

3.4 Deadlocks in Multithreading

A Deadlock describes a situation where two or more threads are blocked forever, each waiting for a resource held by the other.

Coffman Conditions for Deadlock (AKTU Exam Core Question)

Deadlock can occur if and only if all four of the following conditions hold simultaneously:

1. Mutual Exclusion: At least one resource must be held in a non-shareable mode.

2. Hold and Wait: A thread must hold at least one resource and wait for additional resources currently held by other threads.
3. No Preemption: Resources cannot be forcibly taken from a thread; they can only be released voluntarily.
4. Circular Wait: A closed chain of threads exists such that each thread holds resources requested by the next thread in the
chain.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 8 of 22
 UNIT IV: JAVA I/O SYSTEMS, NETWORKING &
STEGANOGRAPHY
Streams, Object Serialization, TCP Sockets & LSB Information Hiding

4.1 Stream Framework: Byte Streams vs. Character Streams

Java I/O is based on the abstraction of Streams—a continuous sequence of data.

• Byte Streams (8-bit bytes): Abstract superclasses are InputStream and OutputStream. Used for reading/writing
binary data (images, compiled audio, executable files). Primary concrete classes: FileInputStream,
FileOutputStream, BufferedInputStream.
• Character Streams (16-bit Unicode characters): Abstract superclasses are Reader and Writer. Designed specifically
for text processing, supporting automatic character encoding conversion (e.g., UTF-8, UTF-16). Primary classes:
FileReader, FileWriter, BufferedReader, PrintWriter.

4.2 Object Serialization & The transient Keyword

Serialization is the process of converting the state of an object into a byte stream, which can then be persisted to disk or
transmitted across a network. Deserialization is the reverse process.

• To render an object serializable, its class must implement the marker interface [Link].
• serialVersionUID: A unique identifier used during deserialization to verify that the sender and receiver of a
serialized object have loaded classes for that object that are compatible.
• transient Keyword: Variables marked as transient are excluded from the serialization process. Used for sensitive
data (e.g., passwords, secret keys) or non-serializable fields (e.g., thread handles, socket instances).

4.3 Socket Programming Architecture

Java provides network socket programming through the [Link] package:

• TCP Socket (Connection-Oriented): Uses ServerSocket on the server side and Socket on the client side.
Guarantees reliable, ordered byte delivery.
• UDP Datagram (Connectionless): Uses DatagramSocket and DatagramPacket. Faster transmission with no
packet delivery guarantees.

4.4 Steganography & LSB Information Concealment

Steganography is the practice of concealing a secret message within an ordinary, non-secret file or medium (cover object) to
avoid detection. Unlike cryptography, which masks message content, steganography conceals the very existence of the
communication.

Least Significant Bit (LSB) Algorithm Mechanics

In 24-bit RGB digital images, each pixel consists of Red, Green, and Blue color bytes (0–255). Replacing the least significant
bit (bit 0) of each color byte with a binary payload bit changes the byte value by at most ±1 (e.g., 204 to 205). This minute
variation is imperceptible to the human visual system (HVS).

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 9 of 22
 // Conceptual Java Code: LSB Image Steganography Embedding Routine
import [Link];

public class SteganographyEngine {

public static BufferedImage embedMessage(BufferedImage coverImage, String message) {
byte[] msgBytes = [Link]();
int msgIndex = 0;
int bitIndex = 0;

int width = [Link]();

int height = [Link]();

for (int y = 0; y < height && msgIndex < [Link]; y++) {

for (int x = 0; x < width && msgIndex < [Link]; x++) {
int rgb = [Link](x, y);
int red = (rgb >> 16) & 0xFF;

// Extract current secret bit

int currentBit = (msgBytes[msgIndex] >> (7 - bitIndex)) & 1;

// Modify Least Significant Bit of Red Channel

red = (red & 0xFE) | currentBit;

// Reconstruct RGB pixel

int newRgb = (rgb & 0xFF00FFFF) | (red << 16);
[Link](x, y, newRgb);

bitIndex++;
if (bitIndex == 8) {
bitIndex = 0;
msgIndex++;
}
}
}
return coverImage;
}
}

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 10 of 22
 UNIT V: FUNDAMENTALS OF CYBER SECURITY & THREAT
VECTORS
CIA Triad, Criminal Profiles, Malware Taxonomy & Botnet Detection

5.1 The CIA Triad & Fundamental Security Goals

Information Security operates on three core pillars known as the CIA Triad:

1. Confidentiality: Ensuring that sensitive data is accessible only to authorized entities. Enforced via encryption, access
control lists (ACLs), and multi-factor authentication.
2. Integrity: Safeguarding the accuracy, completeness, and immutability of information against unauthorized modification or
tampering. Enforced via cryptographic hash functions (SHA-256) and digital signatures.
3. Availability: Ensuring that network services and data remain accessible to authorized users when required. Protected via
redundant systems, load balancers, and DDoS mitigation frameworks.
4. Non-Repudiation: Ensuring that a sender cannot deny having sent a message or initiated an action. Enforced using public-
key cryptography and digital signatures.

5.2 Cyber Criminal Classifications

Threat Actor Primary Motivation Operational Capabilities & Attack Vectors

Class

Black-Hat Financial gain, extortion, cyber Exploits zero-day vulnerabilities, deploys ransomware,
Hackers espionage compromises databases.

White-Hat Ethical testing, defense, vulnerability Authorized penetration testing, bug bounties, security audit
Hackers patch compliance.

Hacktivists Political, ideological, or social activism Website defacement, Distributed Denial of Service (DDoS),
leaking sensitive documents.

Nation-State Geopolitical advantage, warfare, Advanced Persistent Threats (APTs), industrial cyber
Actors infrastructure sabotage sabotage (e.g., Stuxnet).

Insider Threats Revenge, financial bribery, negligence Privileged user abuse, unauthorized data exfiltration, logic
bomb planting.

5.3 Botnet Architectures & Command-and-Control (C2) Mechanics

A Botnet (Robot Network) is a collection of internet-connected compromised machines ("bots" or "zombies") controlled
remotely by a malicious actor known as a "Botmaster".

• Centralized C2 Topology (IRC / HTTP): All bots connect directly to a central Command & Control server. Easy to set
up, but creates a Single Point of Failure (SPOF). Defended by shutting down the central IP/domain.
• Peer-to-Peer (P2P) Topology: Bots communicate with each other using decentralized P2P protocols (e.g., Kademlia).
Commands propagate neighbor-to-neighbor, making structural disruption significantly more difficult for law enforcement.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 11 of 22
5.4 Botnet Detection Strategies
1. Signature-Based Detection: Inspects known network signatures, payload patterns, or file hashes. Ineffective against
encrypted traffic or zero-day command structures.
2. Anomaly-Based / Flow Monitoring: Analyzes netflow metrics (packet rates, unusual periodic outbound heartbeats, DNS
query spikes for Fast-Flux domains). Employs Machine Learning algorithms (Random Forest, SVM) to detect deviations
from baseline network traffic.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 12 of 22
 UNIT VI: NETWORK, WIRELESS & DEVICE PROTECTION
MECHANISMS
Firewalls, IDS/IPS, Wi-Fi Security Protocols (WPA2/WPA3) & Rogue AP Mitigation

6.1 Perimeter Protection: Firewalls and IDS/IPS

Defending enterprise networks requires multi-layered perimeter security devices:

• Packet Filtering Firewall (Stateless): Operates at OSI Layer 3/4. Inspects packet headers (source/destination IP, ports,
protocol) against static rules. Fast but lacks context awareness.
• Stateful Inspection Firewall: Tracks active TCP connection states in a state table. Verifies that incoming packets
correspond to legitimate, established outbound sessions.
• Next-Generation Firewall (NGFW) / Application Layer: Operates at OSI Layer 7. Performs Deep Packet Inspection
(DPI), user identification, and integrated intrusion prevention.
• IDS (Intrusion Detection System) vs. IPS (Intrusion Prevention System): IDS passively monitors network traffic and
alerts administrators upon detecting suspicious signatures. IPS is placed inline and actively blocks or drops malicious
traffic streams in real time.

6.2 Wireless Network Vulnerabilities & Defense Mechanisms

Wireless networks broadcast data over electromagnetic waves, making physical perimeter controls obsolete and exposing
networks to eavesdropping, rogue access points, and packet injection.

Protocol Encryption Integrity Known Vulnerabilities & Status

Mechanism Check

WEP RC4 (Stream CRC-32 Obsolete / Broken. Weak 24-bit IV reuse allows key recovery in
Cipher) minutes.

WPA2- AES-CCMP (Block CBC-MAC Vulnerable to offline dictionary attacks on 4-way handshake and
Personal Cipher) KRACK retransmission exploits.

WPA3- AES-128 BIP / GMAC Current Standard. Replaces 4-way handshake with SAE
Personal (GCMP-128) (Simultaneous Authentication of Equals) to stop offline dictionary
attacks.

6.3 Rogue Access Points & Evil Twin Attacks

A Rogue Access Point (RAP) is an unauthorized wireless access point connected to an enterprise network without
administrator consent. An Evil Twin is a rogue AP configured to spoof the exact SSID and MAC address of a legitimate
corporate wireless network.

• Mitigation Strategy: Deploying Wireless Intrusion Detection Systems (WIDS) with distributed sensor probes, enforcing
802.1X Extensible Authentication Protocol (EAP-TLS), and implementing Port Security (MAC limiting) on switch
interfaces.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 13 of 22
 UNIT VII: CRYPTOGRAPHIC FOUNDATIONS & DIGITAL
SIGNATURES
Symmetric vs Asymmetric Encryption, SHA-256 Hashing, PKI & Digital Signatures

7.1 Symmetric vs. Asymmetric Encryption

Cryptography provides confidentiality and authenticity through encryption algorithms:

Dimension Symmetric Cryptography Asymmetric Cryptography

Key Management Single Shared Secret Key for both Key Pair: Public Key (Encryption) + Private Key
encryption and decryption (Decryption)

Computational Extremely fast, low CPU overhead Slow (~1000x slower than symmetric due to
Speed modular exponentiation)

Key Exchange Requires secure out-of-band channel to Public key can be freely distributed over
Problem exchange shared key untrusted networks

Standard AES-128, AES-256, 3DES, ChaCha20 RSA-2048/4096, ECC (Elliptic Curve

Algorithms Cryptography), Diffie-Hellman

7.2 Cryptographic Hash Functions & Message Digest

A Cryptographic Hash Function takes an arbitrary length input message and produces a fixed-size mathematical digest (e.g.,
SHA-256 outputs a 256-bit digest).

• Pre-image Resistance (One-Way): Computationally infeasible to derive input M from given hash H(M).
• Second Pre-image Resistance: Given M_1, it is infeasible to find M_2 such that H(M_1) = H(M_2).
• Collision Resistance: Infeasible to find any two distinct inputs M_1 eq M_2 such that H(M_1) = H(M_2).

7.3 Digital Signatures & Public Key Infrastructure (PKI)

A Digital Signature ensures message authenticity, integrity, and non-repudiation.

Digital Signature Mathematical Workflow

1. Signing Phase: Sender computes hash h = H(Message). Encrypts h using Sender's Private Key K_{pr} to produce
Signature S = E(h, K_{pr}).
2. Verification Phase: Recipient decrypts S using Sender's Public Key K_{pu} to retrieve h'. Recipient independently
computes h'' = H(Message). If h' == h'', signature is valid.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 14 of 22
 UNIT VIII: AKTU MODEL EXAM PAPER - PART A (2-MARK
SHORT QUESTIONS)
15 Model Short Questions with Precise Model Solutions

Q1. State two differences between Abstract Class and Interface in Java. 2 Marks

Answer: (1) An abstract class can hold instance fields and non-final fields, whereas interface fields are implicitly
public static final. (2) A class can extend only one abstract class, but can implement multiple interfaces.

Q2. What is dynamic method dispatch? 2 Marks

Answer: Dynamic Method Dispatch is the mechanism by which a call to an overridden method is resolved at runtime
rather than at compile time. It is used to implement runtime polymorphism via superclass reference variables pointing to
subclass objects.

Q3. Differentiate between throw and throws keywords. 2 Marks

Answer: throw is used to explicitly throw an exception object inside a method body (e.g., throw new
IOException()). throws is used in the method signature to declare exceptions that the method might propagate.

Q4. What is the role of the transient keyword in Java serialization? 2 Marks

Answer: The transient modifier prevents specific class variables from being written to the byte stream during
serialization, protecting sensitive data such as passwords.

Q5. Why is thread synchronization required? 2 Marks

Answer: Synchronization prevents race conditions when multiple concurrent threads attempt to read and write to shared
mutable resources simultaneously, ensuring thread safety and data consistency.

Q6. Define the CIA Triad in Cyber Security. 2 Marks

Answer: The CIA Triad comprises Confidentiality (restricting data access to authorized entities), Integrity (protecting
data from unauthorized alteration), and Availability (ensuring timely, reliable access to services).

Q7. What is a Botnet and what is a Command & Control (C2) server? 2 Marks

Answer: A Botnet is a network of compromised machines infected with malware. A C2 server is the centralized or P2P
infrastructure used by the botmaster to issue commands to all bots.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 15 of 22
 Q8. Explain LSB Steganography in digital image files. 2 Marks

Answer: LSB Steganography replaces the least significant bit of pixel color bytes with secret message bits, concealing
the hidden data with imperceptible impact on visual appearance.

Q9. Compare WPA2 and WPA3 security protocols. 2 Marks

Answer: WPA2 uses a 4-way handshake vulnerable to offline dictionary attacks. WPA3 replaces it with SAE
(Simultaneous Authentication of Equals) protocol, offering stronger protection against dictionary attacks even with weak
passwords.

Q10. What is a Rogue Access Point? 2 Marks

Answer: A Rogue Access Point is an unauthorized wireless access point installed on a secure network without
administrator knowledge, creating a backdoor into the private network.

Q11. Explain the concept of Non-Repudiation. 2 Marks

Answer: Non-repudiation ensures that a transacting party cannot deny the authenticity of their signature on a document
or the sending of a message, typically proven using public key digital signatures.

Q12. What is the difference between Stateful and Stateless Firewalls? 2 Marks

Answer: Stateless firewalls inspect individual packets independently based on static rules. Stateful firewalls track TCP
connection states in a state table to validate whether incoming packets belong to active established streams.

Q13. Differentiate between Symmetric and Asymmetric Encryption. 2 Marks

Answer: Symmetric encryption uses a single shared secret key for both encryption and decryption. Asymmetric
encryption uses a mathematically linked key pair: a public key for encryption and a private key for decryption.

Q14. What is a Garbage Collection Root (GC Root) in Java? 2 Marks

Answer: A GC Root is an anchor object accessible from outside the heap (e.g., active thread local variables, static
variables, active JNI handles) from which GC object reachability graphs originate.

Q15. Explain the purpose of `wait()` and `notify()` methods in Java. 2 Marks

Answer: `wait()` causes the executing thread to release its monitor lock and wait until another thread calls `notify()` or
`notifyAll()` on the same object monitor.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 16 of 22
 UNIT IX: AKTU MODEL EXAM PAPER - PART B & C (10-MARK
LONG QUESTIONS)
Long Analytical Questions with Complete Structural Solutions & Code

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 17 of 22
 Q16. [10 Marks] Explain the Java Thread Life Cycle in detail with a state transition diagram. Write a
complete multi-threaded program demonstrating thread synchronization using synchronized blocks.

Detailed Explanation & State Transitions:

A Java thread undergoes state transitions during its lifecycle. The [Link] enum defines six
distinct states:

1. NEW: The thread instance is created but start() has not been called.
2. RUNNABLE: Executing in the JVM or waiting for OS CPU scheduling allocation.
3. BLOCKED: Waiting to acquire a monitor lock held by another thread.
4. WAITING: Indefinitely waiting for another thread to perform an action (via wait() or join()).
5. TIMED_WAITING: Waiting for a specified timeout period (via sleep(ms) or wait(ms)).
6. TERMINATED: Standard completion of run() method or exit due to unhandled exception.

// Synchronized Bank Account Transaction Example

class BankAccount {
private double balance = 1000.0;

// Synchronized method ensuring atomic withdrawal

public synchronized void withdraw(String threadName, double amount) {
[Link](threadName + " attempting to withdraw: $" + amount);
if (balance >= amount) {
try {
[Link](100); // Simulating processing latency
} catch (InterruptedException e) {
[Link]().interrupt();
}
balance -= amount;
[Link](threadName + " SUCCESS. Remaining Balance: $" + balance);
} else {
[Link](threadName + " FAILED. Insufficient Funds! Balance: $" +
balance);
}
}
}

public class SynchronizationDemo {

public static void main(String[] args) {
BankAccount account = new BankAccount();

Runnable task = () -> {

[Link]([Link]().getName(), 700.0);
};

Thread t1 = new Thread(task, "User-ATM-1");

Thread t2 = new Thread(task, "User-Mobile-App");

[Link]();
[Link]();
}
}

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 18 of 22
 Q17. [10 Marks] What are Botnets? Explain the Command and Control (C2) topologies (Centralized vs
Peer-to-Peer). Discuss network-based and anomaly-based techniques for detecting botnet activity.

Comprehensive Solution:

A Botnet is a network of compromised computational endpoints (zombies) controlled remotely by an attacker.

C2 Architecture Analysis:

• Centralized Architectures (IRC/HTTP): Bots establish outbound connections to fixed C2 servers or dynamic
domains via Fast-Flux DNS. While latency is low and control is immediate, law enforcement can disrupt the botnet
by sinkholing the central IP domain.
• Peer-to-Peer (P2P) Architectures: Nodes act as both clients and servers. Command payloads propagate overlay
routing graphs (e.g., Storm, Kademlia). Taking down individual nodes fails to collapse the botnet network.

Detection Frameworks:

1. Flow-Based Traffic Analysis: Examining NetFlow metrics for high-volume periodic outbound beaconing,
synchronized IRC/HTTP requests across internal hosts, and high rate of failed DNS queries.
2. Machine Learning Anomalies: Training supervised models (Decision Trees, Random Forests) on packet header
characteristics (inter-arrival packet time, payload entropy, flow duration) to isolate botnet communications from
legitimate background traffic.

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 19 of 22
 Q18. [10 Marks] Describe the Least Significant Bit (LSB) image steganography technique. Write a
Java algorithm or pseudo-code to embed and extract binary payload data in an uncompressed BMP/
PNG image.

Technical Breakdown:

LSB steganography leverages spatial domain image processing. An RGB image stores 24 bits per pixel (8 bits Red, 8
bits Green, 8 bits Blue). The least significant bit (bit 0) represents a numerical weight of 2^0 = 1 in decimal. Modifying
bit 0 changes total luminance by at most 0.39%, rendering changes invisible.

// LSB Extraction Routine in Java

public class StegoDecoder {
public static String extractMessage(BufferedImage stegoImage, int messageLength) {
byte[] extractedBytes = new byte[messageLength];
int byteIdx = 0, bitIdx = 0;
byte currentByte = 0;

for (int y = 0; y < [Link]() && byteIdx < messageLength; y++) {

for (int x = 0; x < [Link]() && byteIdx < messageLength; x++) {
int rgb = [Link](x, y);
int red = (rgb >> 16) & 0xFF;

int lsb = red & 1;

currentByte = (byte) ((currentByte << 1) | lsb);
bitIdx++;

if (bitIdx == 8) {
extractedBytes[byteIdx] = currentByte;
byteIdx++;
bitIdx = 0;
currentByte = 0;
}
}
}
return new String(extractedBytes);
}
}

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 20 of 22
 Q19. [10 Marks] Explain Wireless Network Security Protocols (WEP, WPA2, WPA3). Describe the Evil
Twin attack scenario and detail enterprise countermeasures.

Comprehensive Wireless Analysis:

Wireless security evolved due to vulnerabilities in radio broadcast media. WEP relied on weak initialization vectors and
RC4 stream ciphers. WPA2 introduced AES-CCMP and 4-way handshakes, but remained vulnerable to dictionary
attacks and KRACK. WPA3 integrates SAE (Simultaneous Authentication of Equals) to provide forward secrecy and
resist offline dictionary attacks.

Evil Twin Attack Scenario:

An attacker sets up an Access Point broadcasting the exact SSID of a target corporate network. By sending forged
802.11 Deauthentication packets to legitimate clients, the attacker forces clients to disconnect and reconnect to the Evil
Twin AP, enabling Man-in-the-Middle (MitM) traffic interception.

Countermeasures: Deploying 802.1X EAP-TLS certificate authentication, dynamic VLAN assignment, and Wireless
Intrusion Prevention Systems (WIPS).

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 21 of 22
 UNIT X: EXAM QUICK REVISION SUMMARIES & FORMULA /
ARCHITECTURE SHEET
High-Yield Summary Tables, Code Pitfalls & Final Exam Strategy

10.1 Key Comparative Architecture Summary

Concept Key Feature 1 Key Feature 2 Common Exam Pitfall

Process vs Thread Process has dedicated Threads share heap within Confusing stack memory with
memory space same process shared heap

Synchronized vs Synchronized is implicit ReentrantLock allows Forgetting to release Lock in

Lock monitor lock tryLock() & fairness finally block

Byte vs Char Stream InputStream/OutputStream Reader/Writer (16-bit Using Byte streams for reading
(8-bit) Unicode) text encodings

WEP vs WPA3 RC4 with static key / 24-bit SAE Handshake with Assuming WPA2 is immune to
IV Forward Secrecy dictionary attacks

Symmetric vs AES / Fast / Single Key RSA / Slow / Key Pair Using RSA for large payload
Asymmetric video/file encryption

10.2 Final Examination Tips for AKTU High Marks

1. Structural Presentation: Always draw labeled block diagrams or state diagrams for 10-mark questions (e.g., Thread
Lifecycle, CIA Triad, Botnet Topology).
2. Code Syntax & Annotations: Write syntactically valid Java code snippets with @Override, explicit exception handling,
and inline comments explaining key logic.
3. Security Terminology: Precision matters—distinguish between Authentication (Who you are) and Authorization (What
you can do).

AKTU Semester Exam Guide | Advanced Java & Cyber Security Page 22 of 22