GIAC Foundational Cybersecurity Technologies Practice Test

What is a Credential Harvesting Attack?

1. An attack that relies on an attacker cloning a site and hosting it to have a user logging into and stealing their credentials

2. Where an attacker uses social engineering to view a person's password and username

3. Where the attacker collects and sells usernames on the Dark Web

4. None of the above

The correct answer is: An attack that relies on an attacker cloning a site and hosting it to have a user logging into and stealing their credentials

A Credential Harvesting Attack is primarily characterized by the method of creating a cloned version of a legitimate website. This approach lures unsuspecting users into entering their login credentials, which the attacker then collects. The cloned site is often designed to look almost identical to the original, which exploits the user's trust. This method capitalizes on the user’s inability to differentiate between the genuine site and the counterfeit, which makes it highly effective. The attacker typically employs various tactics, such as phishing emails or direct messaging, to direct victims to the fraudulent site, facilitating the theft of credentials without the victims realizing they have been deceived. The other options describe different methods of obtaining credentials or user information but do not accurately convey the specific mechanism of a Credential Harvesting Attack. For instance, social engineering techniques can involve various forms of deception, but they don't necessarily revolve around cloning websites specifically. Similarly, simply collecting usernames for sale on the Dark Web lacks the direct interaction with users that is central to credential harvesting through fraudulent sites. Thus, the focus on site cloning and user interaction is what distinguishes a Credential Harvesting Attack as accurately described.