200-201 Question 47
Single answerA cybersecurity analyst is investigating a reported incident where an attacker successfully exploited a known vulnerability in a web application to gain unauthorized access to sensitive data. Which of the following best describes the actions the attacker likely performed during the exploitation phase of this attack?
- A
The attacker scanned the target network to identify vulnerabilities in the web application.
- B
The attacker crafted a malicious payload to manipulate the vulnerable application and execute unintended actions.
- C
The attacker used a phishing email to trick an employee into providing login credentials.
- D
The attacker patched the vulnerable application to prevent other attackers from exploiting it.
Show answer and explanation
Correct answer: B
Explanation
The exploitation phase occurs when an attacker leverages a specific vulnerability to execute an attack. In this scenario, the attacker likely crafted and delivered a malicious payload designed to exploit the known vulnerability in the web application, enabling unauthorized actions such as accessing sensitive data.
- A. Incorrect.
Scanning the target network to identify vulnerabilities is part of the reconnaissance phase, not the exploitation phase.
- B. Correct.
Crafting a malicious payload to manipulate the vulnerable application aligns with the exploitation phase, as it involves taking advantage of a specific weakness to achieve the intended malicious goal.
- C. Incorrect.
Using a phishing email is a form of social engineering and falls under the delivery or reconnaissance phase, not exploitation.
- D. Incorrect.
Patching the application would not be an action performed by an attacker during exploitation; it is typically a defensive action taken by the organization to remediate vulnerabilities.