SY0-701 Question #259: Real Exam Question with Answer & Explanation

Question

A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected. Most employees clocked in and out while they were Inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while Inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions. Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following Is the most likely reason for this compromise?

Options

• AA brute-force attack was used against the time-keeping website to scan for common passwords.
• BA malicious actor compromised the time-keeping website with malicious code using an unpatched
• CThe internal DNS servers were poisoned and were redirecting acmetimkeeping.com to malicious
• DARP poisoning affected the machines in the building and caused the kiosks lo send a copy of all