(ISC)2 Certified in Cybersecurity Practice Exam

True or False: In a Replay Attack, the attacker can see the encoded credentials.

1. True

2. False

The correct answer is: False

In a Replay Attack, the attacker captures and retransmits the data sent over the network, including any credentials that might be included in the communication. However, the critical aspect of this type of attack is that the attacker does not need to see or decode the credentials themselves in order to execute the attack. The attacker primarily relies on the intercepted data being sent again to bypass authentication mechanisms. In many cases, particularly when strong encryption is used, the credentials may indeed be encoded or encrypted, rendering them unreadable during the initial capture. The attacker simply captures the stream of data and replays it, exploiting the system's acceptance of previously valid authentication attempts without needing to decipher what was contained in that data. This understanding of how Replay Attacks function clarifies why the correct answer is that the statement is false; the attacker does not need to see the encoded credentials to carry out their strategy.