ITPEC FE Subject B April 2025 Question 20
From the answer group below, select the correct combination of answers to be inserted into A and B in the description.
Company A recently experienced a security incident where confidential data were exfiltrated by a compromised employee account. Ms. T, a security analyst at Company A, investigated the compromised employee account and found that the password used by the employee's account involved in this breach was a complex password that met the company's password policy. However, the same password was used across several web services. Additionally, Ms. T investigated the login logs of Company A’s system and discovered 1,000 failed login attempts recorded within 3 hours before a successful login was recorded. These failed login logs included attempts to log in with different account IDs and password sets. These login attempts occurred from a county where Company A does not have an office. Company A has no employees who travel abroad.
To prevent future account compromise by the same attack pattern, Ms. T suggested that the system administrators of Company V implement A. Additionally, to quickly detect any account compromise, she suggested implementing a monitoring system to alert administrators of B.
Answer group
Explanation
A: Multi-Factor Authentication for all employee accounts, B: login attempts from locations where the account is not usually logged in — the password was strong but reused, so only a second factor stops it being replayed, and the attack came from an unusual country.
- •The attack: 1,000 failed logins in 3 hours, with different account ID and password pairs, then a success with a password that met the policy but was also used on other web services. This is credential stuffing: replaying ID and password pairs leaked from other services.
- •Blank A: the password was already complex, so its strength was not the weakness. MFA also requires something the attacker does not have, such as a one-time code or a token, so a correct leaked password alone no longer logs in.
- •Blank B: the logins came from a country where Company A has no office and no employees travel, so an alert on logins from a location unusual for the account flags exactly this compromise.
Answer (g)
Why not others:
- •(a), (b) and (c) — a more complex password policy changes nothing: the password was already complex, and a reused password is exposed however complex it is
- •(d), (e) and (f) — encrypting files on employees' computers does not stop a login; the attacker used a valid account, which sees the files decrypted
- •(b), (e) and (h) — 1,000 attempts in 3 hours, about 6 a minute, is not a traffic flood; that alert is aimed at denial-of-service attacks
- •(c), (f) and (i) — unpatched servers matter when a software flaw is exploited, but this attack used valid credentials
Key rule: A strong password is still exposed once it is reused elsewhere: MFA defeats credential stuffing, and alerts on logins from unusual locations detect it.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.