ITPEC FE Subject B April 2025 Question 20

The scenario describes a breach where an employee's password — though complex — was reused across multiple web services. Attackers obtained it externally and launched credential stuffing: 1,000 failed login attempts with different account ID/password pairs from a foreign country where the company has no presence.

Blank A — Multi-Factor Authentication (MFA):
- The password already met complexity requirements, so strengthening the password policy would not help
- The root cause was password reuse across services — the credential leaked from another site
- MFA adds a second authentication factor (e.g., OTP, hardware token), making stolen passwords alone insufficient
- File encryption addresses data-at-rest protection, not authentication

Blank B — login attempts from locations where the account is not usually logged in:
- Attacks came from a foreign country where the company has no office and no traveling employees
- Monitoring for geographically anomalous logins directly addresses this pattern
- "Overwhelmed network traffic" relates to DDoS detection, not credential stuffing
- "Unpatched servers" relates to vulnerability management, not login-based attacks

Why not others:
- (a, b, c) "More complex password policy" doesn't prevent credential stuffing — the password was already complex; it was reused, not weak
- (d) Correct B, but file encryption doesn't prevent unauthorized login
- (e, f) File encryption is irrelevant to authentication; B options also miss the mark
- (h) MFA is correct for A, but "overwhelmed network traffic" detects DDoS, not credential stuffing
- (i) MFA is correct for A, but "unpatched servers" is about vulnerability management

Key rule: When a password is strong but reused, the fix is MFA (not stronger passwords), and geographic login anomaly detection catches attacks from unusual locations.

AI-generated — may contain errors