Why Is Telnet Credential Theft Most Likely via Packet Capture?
A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in. Which of the following most likely occurred?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of insecure protocols and sniffing attacks; the trap is distinguishing between credential interception (packet capture) and other attack types like brute-force or trojans.
This exam question tests understanding of Telnet's plaintext transmission vulnerability. The community consensus (100% vote for B) is that a packet capture tool was used to steal credentials, allowing unauthorized access to install malware.
A common mistake is choosing A (spraying) or D (dictionary) because they involve credential guessing, but the clue 'Telnet regularly used' points to interception, not guessing. Also, C (RAT) is incorrect because the malware installation method is separate from credential theft.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Telnet transmits all data, including usernames and passwords, in plaintext over the network. An attacker who can access the network traffic—via a packet capture tool or network sniffer—can easily extract these credentials. Since the administrator regularly used Telnet, the attacker likely captured the credentials during transmission, then used them to log in and install malicious software. This matches vote B and is directly supported by the community comments.
Why the Other Options Are Wrong
A spraying attack and D dictionary attack are both guessing-based techniques that do not require the victim to use Telnet, and they would have no advantage from plaintext traffic. C (remote-access Trojan) would involve installing malware that gives the attacker control, but the question specifically asks how the attacker obtained the administrator's credentials to install malware, not the method of installation. Therefore, B is the only option that directly leverages the Telnet weakness.
Community Comment Notes
Community comments repeatedly highlight that Telnet is unencrypted, making credential interception via packet capture the most logical conclusion. Comment [1] states: 'Telnet transmits data, including credentials, in plaintext, making it vulnerable to interception.' Comment [2] reinforces this by linking the use of Telnet to the attacker's ability to 'capture the login credentials using a packet sniffing tool.' These comments align with the core security principle: never use Telnet for sensitive logins; use SSH instead.
Official Reference
Exam Strategy
When a question mentions Telnet, FTP, or HTTP, immediately think 'plaintext transmission' and look for options involving sniffing or packet capture. In the exam, always correlate the protocol's lack of encryption with network-based credential theft, not guessing attacks or trojans.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →