Examkin

Question

Difficulty: MediumSocial Engineering and Threat Types

An IT technician is investigating a security incident on a graphic designer's workstation. The designer reports that while visiting a popular, reputable industry news forum they browse daily, a malicious script executed in the background and attempted to steal their corporate login credentials. Forensic analysis confirms that attackers compromised the third-party website specifically to target users in the graphic design sector. Which of the following social engineering attacks occurred in this scenario?

  1. A
    Spear phishing
  2. Watering hole attackAnswer
  3. C
    Pretexting
  4. D
    Typosquatting

Answer

Watering hole attack
A watering hole attack specifically targets a group of users by identifying and infecting a legitimate, trusted website that the group frequently visits. The attacker waits for the targets to visit the compromised site to execute malicious code or harvest credentials.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario.
The attacker compromised a legitimate, frequently visited industry website rather than directly contacting the user.
Identifying the medium of attack helps distinguish web-based social engineering from direct communications.
2
Evaluate the intent and target group.
The attack specifically aimed at users within a particular industry sector who regularly visit that resource.
Targeting a specific demographic through a common resource site is the defining characteristic of a watering hole attack.
3
Map the observed behavior to standard CompTIA threat classifications.
Compromising a gathering site frequented by target victims matches the definition of a watering hole attack.
This confirms the correct social engineering classification.

Key Concept

Watering Hole Attack
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic