MENU
A remote user tries to login to a secure network using Telnet, but accidently types in an invalid user name or password. Which responses would NOT be preferred by an experienced Security Manager? (multiple answer)
Suggested Answer: A, B
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
As little information as possible should be given about a failed login attempt. Invalid username or password is not desirable.
34 comments · newest first
TI
Tiffiny
10 months ago
"B is also not great, could confuse users."
EL
Eladia
10 months ago
"Totally agree, specific errors are better!"
MI
Michell
10 months ago
"C and D are too vague for security."
EL
Elvis
11 months ago
"I thought 'Access Denied' was standard?"
KI
Kimberely
11 months ago
"Really? I didn't know 'Authentication Failure' was a bad response."
AN
Annabelle
11 months ago
I feel like "Authentication Failure" is a safer choice, but I can't remember if it was mentioned as a preferred response in our study materials.
ST
Stephanie
11 months ago
"Access Denied" sounds like it could be a preferred response, but I recall a practice question where it was suggested to avoid giving clear reasons for failure.
JA
Jani
12 months ago
I think "Invalid Username" and "Invalid Password" might be too specific, but I'm not entirely sure if they are the worst options.
BR
Britt
12 months ago
I remember discussing how specific error messages can give away too much information to potential attackers.
SH
Sharmaine
12 months ago
This question is testing our understanding of best practices for handling failed login attempts. I'll apply what I've learned in class.
VA
Valentin
1 year ago
Okay, I've got a strategy - I'll eliminate the responses that are too specific and focus on the more general, secure options.
MI
Micaela
1 year ago
I'm a bit unsure about this one. I'll need to review my notes on secure authentication practices.
SH
Shad
1 year ago
I'm pretty confident I know the right answers here. Let me go through the options systematically.
BL
Blair
1 year ago
Hmm, this is a tricky one. I'll need to think carefully about the security implications of each response.
EI
Eileen
1 year ago
Ooh, tricky one! Gotta love those security managers, always keeping us on our toes. A and B are the clear winners here - let's not make it easy for the bad guys, eh?
NI
Nichelle
1 year ago
Ah, the age-old battle between security and user experience. Gotta find that sweet spot, you know? A and B are the way to go, no need to spill the beans.
MA
Maile
1 year ago
B) Invalid Password
ER
Erick
1 year ago
A) Invalid Username
LE
Leota
1 year ago
Haha, this is like a game of password guessing. The more info you give, the easier it is to crack the code. A and B all the way, keep 'em guessing!
PA
Pamela
1 year ago
E) Access Denied
IN
In
1 year ago
B) Invalid Password
FR
Freeman
1 year ago
A) Invalid Username
BR
Brittni
1 year ago
I'd go with A and B, keep it simple and vague. No need to give the attacker any clues about what went wrong. Security 101, folks!
SH
Sharita
1 year ago
B) Invalid Password
VA
Vallie
1 year ago
A) Invalid Username
SH
Sheron
1 year ago
B) Invalid Password
WH
Whitney
1 year ago
A) Invalid Username
FR
Freeman
1 year ago
I think option D) Login Attempt Failed would not be preferred either, as it gives away too much information about the login process.
AM
Amos
1 year ago
I agree with Noble. Option C) Authentication Failure would also not be preferred because it discloses too much information to potential attackers.
LE
Leslie
1 year ago
Oops, looks like they're trying to hack the system with those invalid login attempts. C, D, and E are way too specific - gotta keep those details under wraps!
AJ
Aja
1 year ago
C) Authentication Failure
LO
Loren
1 year ago
B) Invalid Password
NI
Nicolette
1 year ago
A) Invalid Username
NO
Noble
1 year ago
I think option A) Invalid Username would not be preferred by an experienced Security Manager because it reveals specific information about the error.