Yahoo declined to comment on details of its security practices, but said it routinely conducted drills to test and improve its cyber defenses and highlighted campaigns such as a “bug bounty” program in which it pays hackers to find security flaws and report them to the company.