Which one is not a countermeasure that do not work?

security by obscurity

penetrate$-$and$-$patch

programmers are so smart

different test for different faults

What is the main characteristic of a time$-$of$-$check to time$-$of$-$use $($TOCTTOU$)$ flaw?

It leads to confidentiality and integrity failures.

It exploits the delay between the check and use of access rights.

It occurs when access to an object is not universally checked.

It involves changing the order of instructions and procedures in concurrent execution.