Exam 220-1002 topic 1 question 226 discussion

I would pick D more appropriate that a keylogger captured credentials via a Trojan Horse which could be the driver updated.

Bad question and answers to the question. What it may mean is all the computers received a Trojan Horse from downloading the driver update. The computers then became a botnet and credentials were sent out.

keylogger is correct

Why would a botnet compromise accounts and passwords? Keylogger is the only thing that has that capability, and was most likely installed in a fake driver that contained a trojan.

I pick D because it makes sense that a keylogger was disguised as a print driver

SOME PEOPLE ARE JUST HERE TO SET CONFUSION - JUSTIFY THE CORRECT ANSWERS OR STFU

D makes the most sense

Its because it's several user's accounts... so this is part of a botnet

"which explains the compromissed account?" refers to the current state of the accounts, I go for A. It doesn't ask what happened to the accounts. But I agree that the question could be asked in a better way. Because I have to assume they are part of a network, there is nothing mentioned about it.

What an awful question and answer options. If the driver contains a trojan then there are various possible ways to compromise data. Trojan should be the correct answer but... With CompTIA questioning style I would expect them to reference high outbound network traffic if the correct answer was botnet (as they do in another question) therefore I will say keylogger. Another reason I believe keylogger to be correct is that this attack is stealing credentials (the primary purpose of a keylogger) while the primary purpose of a botnet is siphoning computing resources usually to create DDoS attacks or other illicit purposes (such as additional resources for cracking or bitcoin mining).

"All" was the keyword. All of the computers became apart of the botnet?

Right and the antivirus definitions not being updated led to the supposed trojan horse with the possibility of a keylogger, which we don't even know if thats what really happened (keylogging). I will go with the antivirus, because it would prevent any of this, except for a zero-day attack, which is not a given possibility. It asks what explains the situation, not what kind of potential attack occurred. Follow CompTIA's bullshit logic pertaining to other questions, and you can see what is going on here. One thing we know for sure, this horse shit website is wrong again, as usual

This question is tricky. However, since keylogger needs users to type in in order for it to capture information, and in this case the username/passwords were compromised shortly after the update, and its not known if all users started using or typing in that soon. On the other hand, botnets are sometimes responsible for username/password compromise, so I think it is the possible answer.