Use of a smart card to authenticate remote servers remains MOST susceptible to which of the following attacks?

The correct answer is A. Malicious code on the local system. While a smart card protects the private key from being extracted (the key never leaves the card), the local system that processes the authentication can still be compromised. Malware on the local machine (e.g., a Trojan or keylogger) can intercept the PIN used to unlock the…

Threats, vulnerabilities, and mitigations

Question

Options

AMalicious code on the local system
BShoulder surfing
CBrute force certificate cracking
DDistributed dictionary attacks

How the community answered

(27 responses)

A
70% (19)
B
7% (2)
C
4% (1)
D
19% (5)

Explanation

While a smart card protects the private key from being extracted (the key never leaves the card), the local system that processes the authentication can still be compromised. Malware on the local machine (e.g., a Trojan or keylogger) can intercept the PIN used to unlock the smart card, capture session tokens after authentication, or perform a man-in-the-browser attack - all without needing to extract the key from the card itself. Shoulder surfing (B) is a minor risk mitigated by physical awareness. Brute force certificate cracking (C) is computationally infeasible against modern certificates. Distributed dictionary attacks (D) target passwords, not smart card-based authentication.

Topics

#smart card#malicious code#authentication attacks#endpoint security

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice