A potentially misleading answer

Question

Dear team,

I would like to argue if the answer to the test question provided at the end of the "Describe basic cybersecurity threats, attacks, and mitigations" module is correct. The question states: "Which type of attack employs malicious websites or browser extensions to get users to download malicious software on their devices, or change a user's browser settings, providing an entry point to the wider system or network.".

The provided correct answer is "Browser."

However, "browser" is not an attack type and description of the situation might be just a specific case of a social engineering, which is indicated as another option to answer. Thank you!

This question is related to the following Learning Module

Answer 1

Hi Paulius Petretis,

We appreciate your engagement with us on the Microsoft Q&A forum.

Thank you for your inquiry regarding the test question in the "Describe basic cybersecurity threats, attacks, and mitigations" module.

The question inquired about a scenario involving malicious websites or browser extensions that prompt users to download harmful software or alter browser settings, potentially creating a pathway to compromise wider systems or networks. The correct answer provided is "Browser."

Upon reviewing your feedback, we understand your concern regarding the classification of "Browser" as an attack type. Allow us to provide further clarity:

The term "Browser" in this context refers to a category of attacks that exploit vulnerabilities within web browsers or their extensions. While social engineering can indeed play a role in enticing users to interact with these malicious elements, the primary focus of the question is on the technical exploitation of browser weaknesses.

To elaborate:

• Social engineering involves manipulating user trust to perform actions that benefit the attacker, such as visiting compromised websites.
• Browser-based attacks/Browser attacks specifically target vulnerabilities in browsers or their extensions to gain unauthorized access to devices or networks.

In essence, the question highlights the method by which attackers exploit technical flaws in browsers, rather than the initial social engineering tactic used to lure users to malicious sites.

Therefore, "Browser" can be considered the most appropriate answer because it focuses on the technical method used to compromise the system.

We hope this explanation clarifies the distinction and addresses your concerns.

Should you encounter any issues, please do not hesitate to contact us, and we will be pleased to assist you further.

If you find this response helpful, your acknowledgment by clicking the "Upvote" and "Accept Answer" buttons would be greatly appreciated.