Why Is Telnet Credential Theft Most Likely via Packet Capture?

SY0-701 By islever Editorial Last updated

Short answer

B A packet capture tool was used to steal the password.

Question

A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in. Which of the following most likely occurred?
  1. A spraying attack was used to determine which credentials to use.
  2. A packet capture tool was used to steal the password. Correct Answer
  3. A remote-access Trojan was used to install the malware.
  4. A dictionary attack was used to log in as the server administrator.

Key Takeaways

The question tests knowledge of insecure protocols and sniffing attacks; the trap is distinguishing between credential interception (packet capture) and other attack types like brute-force or trojans.

This exam question tests understanding of Telnet's plaintext transmission vulnerability. The community consensus (100% vote for B) is that a packet capture tool was used to steal credentials, allowing unauthorized access to install malware.

Common mistake: A common mistake is choosing A (spraying) or D (dictionary) because they involve credential guessing, but the clue 'Telnet regularly used' points to interception, not guessing. Also, C (RAT) is incorrect because the malware installation method is separate from credential theft.

Expert Analysis

Why the Answer Is Correct

Telnet transmits all data, including usernames and passwords, in plaintext over the network. An attacker who can access the network traffic—via a packet capture tool or network sniffer—can easily extract these credentials. Since the administrator regularly used Telnet, the attacker likely captured the credentials during transmission, then used them to log in and install malicious software. This matches vote B and is directly supported by the community comments.

Why the Other Options Are Wrong

A spraying attack and D dictionary attack are both guessing-based techniques that do not require the victim to use Telnet, and they would have no advantage from plaintext traffic. C (remote-access Trojan) would involve installing malware that gives the attacker control, but the question specifically asks how the attacker obtained the administrator's credentials to install malware, not the method of installation. Therefore, B is the only option that directly leverages the Telnet weakness.

Community Comment Notes

Community comments repeatedly highlight that Telnet is unencrypted, making credential interception via packet capture the most logical conclusion. Comment [1] states: 'Telnet transmits data, including credentials, in plaintext, making it vulnerable to interception.' Comment [2] reinforces this by linking the use of Telnet to the attacker's ability to 'capture the login credentials using a packet sniffing tool.' These comments align with the core security principle: never use Telnet for sensitive logins; use SSH instead.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question mentions Telnet, FTP, or HTTP, immediately think 'plaintext transmission' and look for options involving sniffing or packet capture. In the exam, always correlate the protocol's lack of encryption with network-based credential theft, not guessing attacks or trojans.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. baronvon 👍 3 Answered B
    B. A packet capture tool was used to steal the password. Telnet transmits data, including credentials, in plaintext, making it vulnerable to interception. A packet capture tool could easily capture the login credentials being transmitted, allowing an attacker to gain unauthorized access to the server.
  2. pokii1992 👍 1
    B. A packet capture tool was used to steal the password. This is the most likely scenario given that the administrator regularly used Telnet, which transmits data in plain text. An attacker could easily capture the login credentials using a packet sniffing tool, then use those stolen credentials to install the malicious software on the server.
  3. FrozenCarrot 👍 1
    Telnet no encryption

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide