Phishing Exploit for User Credentials | CompTIA Security+ SY0-701
Which activity by an adversary is an example of an exploit that is attempting to gain user credentials?
Community Insight
The exam tests your ability to distinguish between technical exploits like port scanning and access-based exploits like credential harvesting via fake login pages.
This question identifies a specific adversarial activity aimed at stealing user credentials through social engineering and deceptive web portals, distinguishing it from reconnaissance or persistence techniques.
Learners often select 'Installing a backdoor' because it involves gaining access, but this is a persistence mechanism established after the initial breach, not the method of credential theft itself.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D describes a classic credential harvesting attack, typically executed via phishing. By sending an email with a link to a fictitious login page, the adversary tricks the user into voluntarily submitting their username and password. This directly fulfills the objective of "attempting to gain user credentials" by exploiting human psychology rather than just software vulnerabilities.Why the Other Options Are Wrong
Option A (Obtaining a directory listing) is a form of information disclosure or reconnaissance, used to gather intelligence about the server structure, not specifically to steal credentials. Option B (Installing a backdoor) is a persistence technique used to maintain access after a system has already been compromised; it does not inherently involve stealing credentials at that moment. Option C (Executing a remote port scan) is purely a reconnaissance activity to map network services and identify potential entry points, without any attempt to capture user data.Community Comment Notes
The community consensus strongly supports the phishing approach. As one commenter noted, this technique is described as "Credential Harvesting," where the adversary tricks a user into visiting a fake login page to steal their username and password. The comment highlights that this allows the attacker to "steal (gain) their credentials" effectively.Exam Strategy
When analyzing adversary activities, look for keywords indicating intent: 'scan' implies reconnaissance, 'backdoor' implies persistence, and 'login page' or 'email' often implies social engineering/credential theft. Always match the specific goal stated in the question (e.g., 'gain credentials') to the most direct method.
Frequently Asked Questions
Why is obtaining a directory listing not considered credential theft?
Directory listing reveals file structures and names, which is reconnaissance. It does not capture usernames or passwords directly.
What distinguishes a backdoor from a credential harvesting exploit?
A backdoor is installed to maintain persistent access after a breach. Credential harvesting is the initial method used to acquire the login details needed for that breach.