ITPEC IP April 2020 Question 35

Encrypted communication against theft, limited password attempts against brute force — each measure has to answer how its attack actually works.

• •Password theft: a password sent in plain text can be read by eavesdropping on its way from the browser to the site. Sending it over encrypted communication (HTTPS, using TLS) leaves the eavesdropper nothing readable.
• •Brute force attack: the attacker tries candidate passwords one after another until one works. Limiting the number of attempts, by locking the account or delaying after several failures, stops the search long before it can succeed.

Answer (b)

Why not others:

• •(a) — encryption fits theft, but single sign-on only lets one login serve several systems; it does not limit guesses, and a guessed SSO password opens every system at once
• •(c) — a hard-to-guess password does not stop it being read in transit, and single sign-on does not stop brute force either
• •(d) — limiting attempts is right for brute force, but a hard-to-guess password does not prevent theft: an intercepted password works however complex it is

Key rule: Match the control to the attack path: eavesdropping is countered by encryption, repeated guessing by limiting attempts (account lockout), and guessing by a strong password only slows it down.

Security · AI-written, may contain errors