A Company's Bank Has Reported That Multiple Corporate Credit Cards

question 105

Multiple Choice

A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident investigation. An incident responder learns the following information: The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs. All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network. Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected. Which of the following is the MOST likely root cause?

• A) HTTPS sessions are being downgraded to insecure cipher suites
• B) The SSL inspection proxy is feeding events to a compromised SIEM
• C) The payment providers are insecurely processing credit card charges
• D) The adversary has not yet established a presence on the guest WiFi network

---

Definitions:

Queries

Instructions or expressions in databases and search engines used to extract specific information from a set of data.

Forms

Tools or templates in software that allow users to enter and submit information, often used for data entry, registrations, and surveys.

Back Up The Database

The process of creating a copy of data from a database to prevent data loss in case of system failure.

Secure Location

A place or storage area that is safeguarded against unauthorized access or cyber threats, often used for sensitive data.