100-160 Question 17
Select 2A company’s cybersecurity team discovers that multiple employees have been receiving phishing emails designed to look like official communication from the IT department. These emails trick users into clicking on malicious links that steal their login credentials. Which common threats or vulnerabilities does this scenario demonstrate?
- A
Social engineering
- B
Phishing
- C
Zero-day vulnerabilities
- D
Weak password policies
- E
Man-in-the-middle attacks
Show answer and explanation
Correct answers: A, B
Explanation
The scenario describes a phishing attack, which is a form of social engineering. Phishing attacks aim to deceive users into revealing sensitive information, such as login credentials, through fraudulent communications. While other vulnerabilities like weak passwords or zero-day exploits exist, they are not relevant to this specific case.
- A. Correct.
Social engineering involves manipulating individuals to divulge confidential information or perform actions that compromise security, which is evident in this scenario where users are tricked into clicking malicious links.
- B. Correct.
Phishing is a specific type of social engineering attack where fraudulent emails, calls, or messages are used to steal sensitive information such as login credentials. The scenario explicitly describes phishing emails.
- C. Incorrect.
Zero-day vulnerabilities refer to previously unknown software flaws that attackers exploit before the vendor has released a fix. This is not mentioned in the scenario.
- D. Incorrect.
Weak password policies involve inadequate rules for password creation, such as short or easily guessable passwords. While weak passwords can exacerbate issues, the scenario focuses on phishing attacks, not password strength.
- E. Incorrect.
Man-in-the-middle attacks involve intercepting communication between two parties to steal or alter data. This scenario does not involve interception but rather email-based deception.