A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily…

Question

Options

• AMandate all employees take security awareness training
• BImplement two-factor authentication for remote access
• CInstall an intrusion prevention system
• DIncrease password complexity requirements
• EInstall a security information event monitoring solution.
• FPrevent members of the IT department from interactively logging in as administrators
• GUpgrade the cipher suite used for the VPN solution

• A
  61% (14)
• C
  4% (1)
• E
  22% (5)
• F
  13% (3)

Explanation

In this scenario, the tester should recommend that the client increase their password complexity requirements since the tester was able to crack them by using a dictionary attack. The tester should also recommend that all employees take security awareness training, since it was a member of the IT department who gave up pertinent information when the tester used a phishing technique. The tester should also recommend upgrading the cipher suite that is used for the VPN solution. A cipher suite is a THIS WARMUP IS ABOUT BEING EXTREME

No community discussion yet for this question.