ITPEC IP April 2023 Question 42
ITPEC IP April 2023 — Question 42 of 100
The problem is password reuse: the same IDs and passwords were set on both websites. A password-list or credential-stuffing attack takes credentials leaked from one service and automatically tries them on other services. It succeeds when users reuse the same login combination across sites.
Answer (b)
Why not others:
- (a) unencrypted transmission can expose credentials in transit, but it does not explain reuse of a list leaked from another site
- (c) limited character variety makes guessing easier but is not the defining weakness exploited by credential stuffing
- (d) short passwords are vulnerable to guessing or brute force, again not specifically to reuse of leaked credentials
Key rule: Use a unique password for every service so compromise of one site cannot unlock accounts elsewhere.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.