ITPEC FE Subject B April 2025 Question 17
From the answer group below, select the correct combination of answers to be inserted into A and B in the description.
Recently, an e-commerce company X was cyber-attacked by an attacker. Mr. Y, the security team leader at the company, is investigating the incident and considering future countermeasures. The following is the summary of the incident:
The first half of the attack: An attacker visited company X's website to collect valuable information and knew the name of a senior worker of the IT department who was only responsible for system administration. One day, a receptionist for Company X received a phone call from a man with a fantastic voice. He asked some personal questions about the senior IT guy, Mr. Z. The caller skillfully manipulated the receptionist into giving him personal information about the IT guy. The caller was the attacker who got helpful information for further attacks on the company's server.
The second half of the attack: After that, the attacker dug into social sites and other resources to get additional information about Mr. Z and the servers of Company X, and then he created a password file based on Mr. Z's information and a file with the company server's IP address list. Then, the attacker remotely attacked a server of the company using the password list and an IP address of the server.
Mr. Y implemented two measures as future countermeasures for a similar attack. The measure for the first half of the attack is A. The other for the second half is B.
Answer group
Explanation
A: education for the employees against social engineering, B: account lock for consecutive incorrect password attempts — the first half fooled a person and the second half guessed a password, and each measure must stop its step.
- •First half: the attacker phoned the receptionist and talked them into revealing personal information about Mr. Z. Nothing technical was broken: this is social engineering, and the defence is training staff to recognise such pretexts and to verify callers before disclosing anything.
- •Second half: with a password list built from Mr. Z's details, the attacker tried passwords against a server remotely, a dictionary-style guessing attack. Locking the account after a few consecutive failures stops the list from being worked through.
Answer (e)
Why not others:
- •(a), (b) and (c) — abolishing telephones is impractical for a company and does not remove the weakness: the same manipulation works by email, chat or in person
- •(g), (h) and (i) — blocking IP addresses from the website targets the reconnaissance visit, but the website is public, a new address evades a block list, and the phone call is untouched
- •(a), (d) and (g) — HTTPS protects web traffic in transit; the guessed passwords would succeed just as well over an encrypted connection
- •(c), (f) and (i) — banning social networking does not remove information already posted or found in other resources, and leaves the server open to guessing
Key rule: Match each countermeasure to the step it breaks: attacks on people need awareness training, and online password guessing needs account lockout or rate limiting.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.