A malicious actor is trying to access sensitive financial information from a company's database by intercepting and reusing log-in credentials. Which of the following attacks is the malicious actor…

The correct answer is B. On-path. Option B (On-path) is correct because the attacker is positioning themselves between the user and the server to intercept credentials in transit, then replaying those stolen credentials to impersonate the legitimate user - the defining characteristic of an on-path…

Submitted by luis.pe· Mar 6, 2026Threats, vulnerabilities, and mitigations

Question

A malicious actor is trying to access sensitive financial information from a company's database by intercepting and reusing log-in credentials. Which of the following attacks is the malicious actor attempting?

Options

ASQL injection
BOn-path
CBrute-force
DPassword spraying

How the community answered

(44 responses)

A
2% (1)
B
91% (40)
C
2% (1)
D
5% (2)

Explanation

Option B (On-path) is correct because the attacker is positioning themselves between the user and the server to intercept credentials in transit, then replaying those stolen credentials to impersonate the legitimate user - the defining characteristic of an on-path (man-in-the-middle) attack.

SQL injection (A) is wrong because it targets database queries with malicious code, not the login process itself. Brute-force (C) is wrong because it involves systematically guessing passwords until one works - no interception involved. Password spraying (D) is wrong because it tries a small set of common passwords across many accounts, relying on volume rather than interception.

Memory tip: Think "on the path" - the attacker plants themselves on the communication path between the victim and server, grabbing credentials as they pass through, then walking right in with them.

Topics

#On-path attack#Credential theft#Network interception

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice