CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A brute-force attack on a password

  Why it's wrong here

  A brute-force attack is a systematic, automated attempt to guess a password or encryption key by trying every possible combination until the correct one is found. This method relies on computational power to interact directly with a system's authentication mechanism, rather than manipulating human behavior. It is a purely technical attack focused on overcoming cryptographic or authentication controls through exhaustive trial and error.

• ✗

  SQL injection on a web application

  Why it's wrong here

  SQL injection is a code injection technique that exploits vulnerabilities in web applications to execute malicious SQL statements. Attackers insert specially crafted input into data entry fields, which then manipulates the backend database queries, potentially leading to unauthorized data access, modification, or deletion. This is a technical vulnerability exploitation, not a social engineering tactic that relies on human deception.

• ✗

  A DDoS attack on a server

  Why it's wrong here

  A Distributed Denial of Service (DDoS) attack overwhelms a target server, service, or network with a flood of internet traffic from multiple compromised computer systems. The primary goal is to disrupt legitimate users' access to online services by exhausting the target's resources, such as bandwidth or processing capacity. This is a network-level technical attack focused on availability, not on deceiving individuals to gain information or access.

• ✓

  A phishing email requesting credentials

  Why this is correct

  A phishing email requesting credentials is a classic example of social engineering, where an attacker attempts to trick an individual into divulging sensitive information, such as usernames and passwords. These emails often impersonate trusted entities, creating a sense of urgency or fear to manipulate the recipient into clicking a malicious link or entering credentials on a fake website. The success of phishing relies entirely on human psychological manipulation and deception, rather than exploiting technical vulnerabilities directly.

Go deeper

Related to this question