Studyledge

Cyber Security and Digital Currency: Question 1

Syllabus 5.3

Multiple choice 1 mark

A national ticketing website's server logs show that, over three minutes, one customer account received 40 000 login attempts from the same computer, each attempt trying a different password taken from a list of commonly used passwords. No email, text message or phone call was sent to the account holder at any point.

Which cyber security threat does this log describe?

Choose an answer to check it, then compare with the worked solution below.
Show worked solution Hide worked solution

Worked solution

Step 1: Identify what each candidate threat requires

  • A DDoS attack floods a server or service with a huge volume of traffic, usually from many devices, aiming to make it unavailable. It is not about guessing one account’s password.
  • Data interception means secretly reading or capturing data as it travels across a network. It does not involve generating login attempts at all.
  • Social engineering relies on manipulating a person, for example through a fake message or phone call, into giving away information or access.
  • A brute-force attack is an automated attempt to gain access to an account by systematically trying many possible passwords until one succeeds.

Step 2: Match the log to the correct threat

The log shows one computer submitting 40 000 different password guesses against a single account in a short time, with no message, call or fake communication involved. This matches the definition of a brute-force attack exactly: automated, repeated password guessing aimed at one account, with no human being tricked and no flood of traffic aimed at the server’s availability.

Step 3: Rule out the distractors

  • Not a DDoS attack: the traffic is aimed at breaking into one account’s password, not at overwhelming the server so genuine users are locked out.
  • Not data interception: no data is being captured in transit; passwords are being generated and tried, not read from somewhere else.
  • Not social engineering: no person is contacted or deceived. The attack is entirely automated against the login system itself.

Final answer

The threat described is a brute-force attack, option B.