If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?

Question

Options

• AMapping to the IP address of the logged-in user.
• BFirst four letters of the username matching any valid corporate username.
• CUsing the same user's corporate username and password.
• DMarching any valid corporate username.

• A
  7% (1)
• C
  87% (13)
• D
  7% (1)

Explanation

The 'Domain Credential Filter' method for credential phishing prevention detects when a user submits their actual corporate username AND password on a web form. The firewall monitors HTTP/HTTPS POST requests and compares submitted credentials against valid credential pairs from the corporate directory. This is the most comprehensive method because it detects credential theft even if the attacker's phishing site uses a different domain. By contrast, 'IP-based user mapping' only checks if the submitted username matches the user mapped to that IP, which can miss cases where a different user's credentials are stolen.

No community discussion yet for this question.