What method is used for credential harvesting?

SY0-701 By islever Editorial Last updated

Short answer

A Social engineering

Question

Which of the following would most likely be used by attackers to perform credential harvesting?
  1. Social engineering Correct Answer
  2. Supply chain compromise
  3. Third-party software
  4. Rainbow table

Key Takeaways

This question tests the ability to distinguish between acquiring credentials via human manipulation versus technical cracking, with the trap being confusing rainbow tables (cracking) with harvesting (collection).

Credential harvesting is the collection of user login credentials, typically through deceptive tactics. The community consensus identifies social engineering as the primary method attackers use to manipulate victims into revealing this sensitive information.

Common mistake: Selecting 'Rainbow table' is a common error because it relates to passwords, but it is a tool for cracking hashes, not for harvesting the credentials from users.

Expert Analysis

Why the Answer Is Correct

Social engineering is the correct answer because credential harvesting fundamentally relies on deceiving individuals to obtain their usernames and passwords. Attackers use tactics like phishing or vishing to trick users into voluntarily providing their credentials.

Why the Other Options Are Wrong

Supply chain compromise is a broader attack vector targeting vendors, not a direct method for harvesting user credentials. Third-party software refers to potential vulnerabilities or tools, not the act of harvesting itself. Rainbow tables are pre-computed tables used to reverse cryptographic hash functions to crack passwords, not to collect the raw credentials from a victim.

Community Comment Notes

Community comments strongly support Option A, citing the study guide glossary which defines credential harvesting as a social engineering technique. Users explicitly noted that while rainbow tables relate to passwords, they are for cracking, distinguishing them from the harvesting process described in the question.

Exam Strategy

When encountering questions about credential harvesting, immediately associate the concept with social engineering or phishing. Avoid technical tools like rainbow tables, which are used for cracking passwords after they have been stolen, not for the initial collection.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. chasingsummer 👍 7 Answered A
    Study Guide glossary: credential harvesting Social engineering techniques for gathering valid credentials to use to gain unauthorized access.
  2. 9149f41 👍 1 Answered A
    Social Engineering: for harvesting/collect the credentials Rainbow tables are primarily used for password cracking, not credential harvesting.
  3. 0ca8ee9 👍 1 Answered B
    Supply chain compromise

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide