200-201 Question 71
Single answerA financial institution reports that an attacker gained unauthorized access to its internal systems by exploiting a vulnerability in an employee's email client. The attacker used this access to install malware that exfiltrated sensitive customer data. Which attack vector did the attacker use in this scenario?
- A
Phishing email with a malicious link
- B
Zero-day exploit in the financial software
- C
Brute force attack on the company's web application
- D
Physical access to the company's data center
Show answer and explanation
Correct answer: A
Explanation
The attacker used a phishing email with a malicious link to exploit a vulnerability in an employee's email client. Phishing emails are a common attack vector for gaining initial access to a target's systems. The other options describe different attack vectors but do not align with the details provided in the scenario.
- A. Correct.
Phishing emails are a common attack vector where attackers trick users into clicking malicious links or opening infected attachments. This matches the scenario described as the attacker exploited a vulnerability in an email client.
- B. Incorrect.
Zero-day exploits target unpatched vulnerabilities in software. While this is a valid attack vector, it does not match the email-based exploitation described in the scenario.
- C. Incorrect.
Brute force attacks involve systematically guessing login credentials. There is no mention of credential guessing or web application breaches in the given scenario.
- D. Incorrect.
Physical access involves an attacker gaining direct access to hardware or systems on-site. The scenario discusses email-based exploitation, not physical intrusion.