312-50 Question 221
Single answer▪ Identity TheftDuring an authorized assessment, a retail company asks you to evaluate whether its staff can detect identity-theft-driven social engineering. You review a recent incident in which several employees received emails claiming to be from the HR benefits portal, directing them to a look-alike website. Employees who entered their corporate email, password, date of birth, and home address were then contacted by an attacker who used those details to answer help-desk verification questions and request a password reset. Which control would have been the MOST effective at reducing the attacker's ability to use the stolen personal information to take over employee accounts?
- A
Require multi-factor authentication for password resets and prohibit help-desk identity verification based solely on easily obtainable personal data
- B
Block all external email messages containing links to websites that resemble the HR portal
- C
Encrypt employee personal information stored in the HR database with AES-256
- D
Increase password complexity requirements from 8 to 14 characters for all employee accounts
Show answer and explanation
Correct answer: A
Explanation
This scenario combines phishing, identity theft, and account recovery abuse. The critical issue is not only that employees disclosed personally identifiable information (PII), but that the organization relied on static, easily stolen knowledge-based verification during help-desk password resets. In real environments, date of birth, address, and similar data should be considered low-assurance identifiers because they can be obtained from phishing, prior breaches, public records, or social media. Best practice is to harden recovery workflows with MFA, approved out-of-band verification methods, identity proofing procedures, and strict help-desk reset policies. This is consistent with modern guidance from organizations such as NIST, which discourages reliance on weak knowledge-based authentication and emphasizes stronger authentication and identity proofing for account recovery. From a CEH perspective, the candidate should recognize how identity theft enables social engineering and privilege abuse when operational processes trust stolen personal information.
- A. Correct.
Correct. The scenario shows identity theft being used to bypass weak identity proofing at the help desk. Personal details such as date of birth and home address are commonly exposed through phishing, breaches, or open sources and should not be treated as strong proof of identity. Requiring multi-factor authentication (MFA) for password resets or using stronger out-of-band verification directly addresses the account takeover path described. This aligns with common security guidance that knowledge-based authentication using static personal information is weak and that reset workflows must be hardened.
- B. Incorrect.
Incorrect. Filtering or blocking suspicious emails can reduce phishing exposure, but 'all external email messages containing links that resemble the HR portal' is not a reliable or sufficient control. Attackers can change domains and lure users through other channels. Also, this does not address the second failure in the scenario: the help desk accepted easily stolen personal data for identity verification. A candidate might choose this because phishing was the initial delivery mechanism, but the question asks what most effectively reduces the attacker's ability to use stolen identity information for takeover.
- C. Incorrect.
Incorrect. Encrypting stored HR data is a valuable control for protecting data at rest, especially against unauthorized access to backend systems. However, in this scenario the attacker harvested the data directly from employees through a phishing site, not by stealing it from the HR database. Database encryption would not stop the attacker from using information voluntarily entered by users on a fraudulent page. This is a plausible distractor because it sounds like a strong privacy control, but it does not mitigate the described attack path.
- D. Incorrect.
Incorrect. Stronger passwords can help resist guessing and some credential attacks, but they do not meaningfully stop an attacker who can trigger a password reset by impersonating the employee with stolen personal data. The weakness exploited here is poor identity verification during account recovery, not insufficient password length. A candidate might pick this due to general password-hardening best practices, but it is not the most effective control for this scenario.