nerdexam
GIAC

GCIA · Question #114

Adam works as a Security Administrator for Umbrella. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with…

The correct answer is C. The attack was social engineering and the firewall did not detect it. Adam used social engineering by luring employees to a webpage with an embedded keylogger, and the firewall could not detect it because the attack occurred through legitimate web traffic at the user layer.

Threat Intelligence & Network Security Monitoring

Question

Adam works as a Security Administrator for Umbrella. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a company's icon to mark the progress of the test. Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access. How was security compromised and how did the firewall respond?

Options

  • AThe attack was Cross Site Scripting and the firewall blocked it.
  • BSecurity was not compromised as the webpage was hosted internally.
  • CThe attack was social engineering and the firewall did not detect it.
  • DSecurity was compromised as keylogger is invisible for firewall.

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    85% (23)
  • D
    7% (2)

Why each option

Adam used social engineering by luring employees to a webpage with an embedded keylogger, and the firewall could not detect it because the attack occurred through legitimate web traffic at the user layer.

AThe attack was Cross Site Scripting and the firewall blocked it.

Cross-site scripting involves injecting malicious scripts into a trusted third-party website viewed by victims, which does not describe Adam hosting his own page with an embedded keylogger; furthermore, the firewall did not block the attack.

BSecurity was not compromised as the webpage was hosted internally.

Internal hosting does not prevent compromise - the keylogger still captured user keystrokes regardless of where the page was hosted, so security was demonstrably compromised.

CThe attack was social engineering and the firewall did not detect it.Correct

The attack is social engineering because Adam manipulated employees into visiting a deceptive webpage and interacting with malicious content - a keylogger - without using any network-level exploit. Firewalls inspect traffic based on ports, protocols, and IP addresses and have no visibility into the content of user interactions within a legitimate web session. Because the traffic appeared as normal HTTP browsing, the firewall had no signature or rule capable of detecting or blocking the embedded keylogger.

DSecurity was compromised as keylogger is invisible for firewall.

While it is true that keyloggers are not visible to firewalls, this answer is incomplete because it does not identify the root attack vector as social engineering, which is the primary reason the attack succeeded.

Concept tested: Social engineering attack and firewall detection limitations

Source: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks

Topics

#social engineering#keylogger#firewall evasion#insider threat

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIA Practice