Free 312-50V13 Web TestEngine Demo

Q31 Single choice

In a discreet operations room overlooking the financial district in Boston, Massachusetts, red-team leader Rebecca Kline was executing an advanced insider-threat simulation for a prominent investment bank. The team had already confirmed that the organization used strong cryptographic controls to protect highly sensitive client portfolios and transaction records. Instead of targeting the encryption algorithm itself, the simulated attackers shifted their focus toward the individual responsible for managing the master decryption keys.

Through a carefully orchestrated campaign involving psychological pressure and leverage obtained from the target's personal circumstances, the attackers successfully compelled the key custodian to disclose the critical passphrase. This allowed full access to the protected data without breaking the underlying cryptographic mechanism.

What type of cryptographic attack is demonstrated in this scenario?

A
Adaptive chosen-plaintext attack
B
Rubber-hose attack
C
Chosen-key attack
D
Dictionary attack
E
B A rubber-hose attack obtains cryptographic secrets by applying coercion, intimidation, blackmail, or physical or psychological pressure to a person who knows the password or controls the key. The defining point is that the attacker does not defeat the cipher mathematically. Instead, the human key custodian becomes the attack surface. The disclosure of the master passphrase under pressure therefore makes option B the precise classification.
An adaptive chosen-plaintext attack is a technical cryptanalytic method in which an attacker selects plaintexts, examines their ciphertexts, and chooses subsequent plaintexts based on earlier results. A chosen-key attack analyzes how a cryptographic system behaves under attacker-selected keys or relationships between keys. Neither involves coercing a person. A dictionary attack automatically tests likely passwords against an authentication or encryption mechanism and likewise does not fit the scenario.
CEH v13 treats human weaknesses, key-management procedures, and administrative safeguards as essential components of cryptographic security. Strong algorithms cannot protect information when the corresponding key is disclosed. Appropriate countermeasures include split knowledge, dual control, separation of duties, hardware security modules, short-lived operational keys, and procedures that prevent one individual from possessing unrestricted access to critical decryption material.

312-50V13 Web TestEngine demo