200-201 Question 74
Single answerA cybersecurity analyst is investigating two different attacks: one involves exploiting a zero-day vulnerability in a proprietary software application, and the other is a phishing attack targeting employees. Based on attack complexity, which statement is true?
- A
The phishing attack has higher attack complexity because it requires technical expertise to craft convincing emails.
- B
The zero-day exploit has higher attack complexity due to its reliance on an undiscovered vulnerability and advanced exploitation techniques.
- C
Both attacks have the same level of attack complexity because they require planning and execution.
- D
Attack complexity cannot be determined without knowing the success rate of the attacks.
Show answer and explanation
Correct answer: B
Explanation
Attack complexity refers to the level of skill, effort, and resources required to execute an attack. Phishing attacks generally have low complexity as they rely on social engineering rather than technical sophistication. In contrast, exploiting a zero-day vulnerability is considered highly complex due to the advanced technical skills and tools required to identify and exploit an unknown vulnerability effectively.
- A. Incorrect.
Phishing attacks typically have a low attack complexity, as they rely more on social engineering than technical expertise. While crafting a convincing email requires effort, it does not compare to the technical challenges of exploiting a zero-day vulnerability.
- B. Correct.
Exploiting a zero-day vulnerability is considered high complexity because it requires advanced technical knowledge, tools, and the ability to evade detection while targeting an unknown vulnerability.
- C. Incorrect.
This is incorrect because attack complexity varies depending on the technical requirements and effort needed to execute the attack. A phishing attack and a zero-day exploit do not have the same level of complexity.
- D. Incorrect.
This is incorrect because attack complexity can be assessed independently of the success rate. It is determined by the resources, technical expertise, and effort required to carry out the attack.