Which hacking method involves forging the from address so that replies go to an unintended audience?
Answer(s): B
Definition of Spoofing:Spoofing involves forging the "from" address in communications (e.g., emails) so that replies or interactions are misdirected.Attackers use this method to impersonate trusted entities, steal sensitive information, or redirect responses to malicious actors.Impact of Spoofing:Misleads recipients into sharing sensitive information.Often used in phishing and social engineering attacks.Incorrect Options Analysis:A . Packet tampering: Involves altering data packets during transmission.C . Spyware: Refers to software that secretly monitors user activity.D . Hoaxes: Refers to false warnings or scams, not address forgery.and Documents of Information Technology Management:"Email Security and Spoofing Prevention" (NIST Cybersecurity Framework).ITIL Security Management Practices (Axelos).
An attacker uses a guest account to exploit a weakness that enables the attacker to change access rights and alter user account information. Which type of attack is described?
Answer(s): C
Definition of Elevation of Privilege Attack:This attack occurs when an attacker exploits vulnerabilities in systems to escalate their permissions beyond what they are authorized for, gaining access to sensitive data or control over the system.Example in the Scenario:The attacker uses a guest account, a low-privilege account, to exploit a system weakness and escalate their privileges, altering user account information.Incorrect Options Analysis:A . Packet tampering: Involves altering data packets, not access rights.B . Spoofing: Involves impersonation, not privilege escalation.D . Hoaxing: Refers to deceptive scams, unrelated to access rights.and Documents of Information Technology Management:"Cybersecurity Vulnerabilities and Exploits" (CIS Controls).ITIL Risk Management Framework (Axelos).
Which pair of terms describes an add-on that purports to serve a useful function while transmitting user data and displaying pop-up boxes without the user's knowledge or permission?
Answer(s): D
Definition of Adware and Spyware:Adware: Software that displays unwanted advertisements.Spyware: Software that covertly collects user data without consent.The combination of adware and spyware often masquerades as a legitimate add-on but operates maliciously.Key Characteristics:Adware displays pop-up advertisements, while spyware transmits user data to external parties.Both operate without the user's permission or knowledge.Incorrect Options Analysis:A . Downtime and uptime: Relates to system availability, not malicious software.B . Hackers and viruses: Refers to broader cybersecurity threats, not specific software.C . Ethics and cost: Unrelated to malicious software behavior.and Documents of Information Technology Management:"Adware and Spyware: Detection and Prevention" (SANS Institute).ITIL Information Security Practices (Axelos).
What is an example of a knowledge factor used for authentication?
Understanding Knowledge Factors:Knowledge factors are something the user knows and are commonly used for authentication.Examples include passwords, PINs, and security questions.Why Other Options Are Incorrect:Option A (ID card): This is a possession factor (something you have).Option C (Security token): A security token is also a possession factor.Option D (Fingerprint): This is a biometric factor (something you are).NIST Authentication Guidelines (SP 800-63)"Multi-Factor Authentication Best Practices" Gartner
What is a method for confirming users' identities?
Defining Authentication:Authentication is the process of verifying a user's identity to ensure they are who they claim to be.This is commonly achieved through knowledge factors (passwords), possession factors (tokens), or biometric factors (fingerprints).Why Other Options Are Incorrect:Option A (Information secrecy): Focuses on protecting data, not identity confirmation.Option B (Public key encryption): A method of encryption, not directly tied to user identity verification.Option D (Authorization): Deals with granting access to resources after authentication."Authentication and Identity Management" NISTAuthentication Processes Overview ISO 27001
Post your Comments and Discuss WGU Information-Technology-Management exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Information-Technology-Management content, but please register or login to continue.