What type of WLAN attack could cost an employee their job because logs point directly to the employee whenever a hacker gains access to the employee's domain login information and causes havoc on the network?

What type of WLAN attack could cost an employee their job because logs point directly to the employee whenever a hacker gains access to the employee's domain login information and causes havoc on the network?

• A. Active attack
• B. Passive attack
• C. Interception attack
• D. Replay attack

Answer: (B)

Focus on how the attack is identified in logs and what the attacker actually does with credentials. A passive attack is about gaining access or gathering information without directly altering traffic or disrupting services in a way you can clearly trace to new, fresh activity. In this scenario, the hacker obtains the employee’s domain login information and then operates within the network in a way that the logs show under that employee’s account. The defining clue is that the activity is attributed to a legitimate user’s credentials rather than producing obvious, in-transit changes or new injected traffic. So even though havoc is described, the observable trace is the use of the employee’s identity, which aligns with a credential-based intrusion that’s tracked as a passive-type scenario in this context. The other types don’t fit as well. An active attack would be seen through direct manipulation or disruption of data or services, not just login misuse tracked to an employee. An interception attack focuses on capturing data in transit, not necessarily on whose account is used to access resources. A replay attack would involve reusing captured messages to impersonate someone, with specific evidence of repeated transmissions, rather than simply showing the employee’s login being used to cause disruption.

Focus on how the attack is identified in logs and what the attacker actually does with credentials. A passive attack is about gaining access or gathering information without directly altering traffic or disrupting services in a way you can clearly trace to new, fresh activity. In this scenario, the hacker obtains the employee’s domain login information and then operates within the network in a way that the logs show under that employee’s account. The defining clue is that the activity is attributed to a legitimate user’s credentials rather than producing obvious, in-transit changes or new injected traffic. So even though havoc is described, the observable trace is the use of the employee’s identity, which aligns with a credential-based intrusion that’s tracked as a passive-type scenario in this context.

The other types don’t fit as well. An active attack would be seen through direct manipulation or disruption of data or services, not just login misuse tracked to an employee. An interception attack focuses on capturing data in transit, not necessarily on whose account is used to access resources. A replay attack would involve reusing captured messages to impersonate someone, with specific evidence of repeated transmissions, rather than simply showing the employee’s login being used to cause disruption.