Examkin

Question

Difficulty: MediumSocial Engineering and Threat Types

A security technician is investigating a series of compromised user credentials in the accounting department. The investigation reveals that affected employees attempted to navigate to the corporate vendor portal at `vendorportal.com`, but accidentally mistyped the web address as `venderportal.com`. The misspelled website presented an identical mirrored login interface that captured the employees' domain credentials. Which of the following social engineering attack types best describes this threat?

  1. TyposquattingAnswer
  2. B
    Spear phishing
  3. C
    Watering hole attack
  4. D
    Pretexting

Answer

Typosquatting
Typosquatting (also known as URL hijacking) is a form of social engineering where an attacker registers domain names that are common misspellings of legitimate websites. When users accidentally mistype the URL, they are directed to a malicious site designed to steal credentials or deliver malware.

Step-by-Step Solution

1
Analyze the attack mechanism presented in the scenario.
The attack relies on users accidentally making typing errors when entering a legitimate domain URL (`vendorportal.com` vs `venderportal.com`).
Identifying how the victim arrived at the malicious site determines the vector.
2
Evaluate the delivery method against social engineering threat classifications.
Registering common mistyped variants of popular or corporate domain names to host fake credential-harvesting sites is known as typosquatting or URL hijacking.
Matching the characteristic behavior to standard CompTIA threat definitions isolates the correct term.

Key Concept

Typosquatting (URL Hijacking)
Estimated Time:1m 0s
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic