ITPEC FE Subject B April 2024 Question 17

Topic: Security Scenarios

From the answer group below, select the correct combination of answers to be inserted into A and B in the description.

An information systems company S has a guideline related to any issue for workers doing their daily job. The company has an information security team responsible for related issues and updates workers’ knowledge on information security.

One morning, a company worker who had just started his daily job and successfully signed into the company’s enterprise system received the following email:

From: Administration Department StaffTo: To whom it may concernSubject: Action Required: Please update your bank account information. This email has been sent to employees who failed to receive their paychecks because their bank account information is incorrect. Please use the link below to update your account information ASAP. Please complete the update by noon today to receive your next paycheck in time. Link: https://www.example.com/​company-s/​paycheck&param=xnt6a5mv9YeKK1

Soon, the worker realized that something wrong. He followed the guideline instead of clicking on the link in the email because he suspected this is a A attack, and it is typically conducted through B. He also informed the company’s information security team to deal with the issue.

A few days later, the worker received an email from the information security team leader. The email was to notify that the issue was resolved, thanking the worker for his responsibility in handling the case according to the guideline.

Answer group

OptionAB

Explanation

A: phishing, B: email directing someone to a spoofed web site — the email poses as an internal department and pushes the reader to a fake page to hand over bank details.

The warning signs in the email:

  • •a vague sender and recipient: "Administration Department Staff" writing "To whom it may concern"
  • •urgency with something at stake: update by noon to receive the next paycheck
  • •a request for sensitive financial data
  • •a link to www.example.com, outside company S's enterprise system, which the worker is already signed in to

Impersonating a trusted party to lure a victim into entering data on a fake site is phishing, and its usual vehicle is exactly this: an email whose link leads to a spoofed web site.

Answer (c)

Why not others:

  • •(a) and (b) — a man-in-the-middle attack intercepts or alters traffic between two parties who are really communicating; here the attacker simply sends a lure email
  • •(e) and (f) — SQL injection feeds crafted input to an application to change its database queries; it targets a server, not a person reading email
  • •(a) and (d) — nothing in the scenario involves a digital signature; the email fakes its sender and its link, not a signature
  • •(b) and (f) — what the worker recognised is where the link leads, a site outside company S, not a crafted request against the company's own server

Key rule: Phishing combines impersonation, urgency and a link to a look-alike site; check such a request through a known channel instead of the link, and report it.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.