Examkin

Soru

Zorluk: OrtaSocial Engineering and Threat Types

During a security incident investigation, an IT support technician discovers that several employees in the finance department had their credentials compromised. Log analysis reveals that none of the affected employees received fraudulent emails or suspicious direct phone calls. Instead, all compromised users had routinely visited a highly specialized, trusted third-party regulatory news website that attackers secretly compromised to inject malicious credential-harvesting code. Which of the following threat types BEST describes this attack?

  1. Watering hole attackCevap
  2. B
    Spear phishing
  3. C
    Pretexting
  4. D
    Typosquatting

Cevap

Watering hole attack
The correct answer identifies a watering hole attack. In a watering hole attack, an attacker identifies and compromises a specific, trusted website frequented by employees of a targeted organization or group. When the targets visit the legitimate site, malicious scripts capture credentials or infect their systems.

Adım Adım Çözüm

1
Analyze the attack vector described in the scenario
Identify that the attack succeeded by compromising a legitimate, frequently visited third-party website rather than sending direct messages or emails.
Understanding the delivery mechanism distinguishes web-based passive compromise from active direct outreach.
2
Evaluate the target demographic of the attack
Note that the attack targeted a specific group of employees (the finance department) via a site relevant to their profession.
Watering hole attacks specifically target resources trusted and regularly accessed by a particular organization or department.
3
Select the threat classification matching site compromise for targeted group infection
Confirm that a watering hole attack accurately defines compromising a site frequented by a target group.
Watering hole strategy mirrors predators waiting at a natural water source where prey routinely gathers.

Anahtar Kavram

Watering Hole Attack Identification
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Social Engineering and Threat Types

Bu konudan daha fazla soru