A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.
Most employees clocked in and out while they were Inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while Inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.
Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following Is the most likely reason for this compromise?

Question

A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.

Most employees clocked in and out while they were Inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while Inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.

Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following Is the most likely reason for this compromise?

Yassin Benjajji · Accepted Answer

A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.

Yassin Benjajji · Answer

A brute-force attack was used against the time-keeping website to scan for common passwords.

Yassin Benjajji · Answer

The internal DNS servers were poisoned and were redirecting acmetimkeeping.com to malicious domain that intercepted the credentials and then passed them through to the real site

Yassin Benjajji · Answer

ARP poisoning affected the machines in the building and caused the kiosks lo send a copy of all the submitted credentials to a machine. machine.

Question list

List of questions

Question 1

(5)

Question 2

(5)

Question 3

(3)

Question 4

(3)

Question 5

(5)

Question 6

(4)

Question 7

(1)

Question 8

(4)

Question 9

(4)

Question 10

(4)

Related questions

Question 253 - SY0-701 discussion

Suggested answer: B

0 comments