Ethical Hacking Essentials Practice Test

Which of the following is NOT considered a countermeasure against sniffing attacks?

1. Always use HTTPS for sensitive data

2. Implement firewall rules

3. Always use HTTP to protect usernames and passwords

4. Use strong encryption protocols

The correct answer is: Always use HTTP to protect usernames and passwords

Using HTTP to protect usernames and passwords is not a countermeasure against sniffing attacks because HTTP does not encrypt data transmitted over the network. When employing HTTP, any sensitive information, such as usernames and passwords, can be intercepted by an attacker using a packet sniffer, making it easy to read the unencrypted data. In contrast, using HTTPS establishes a secure, encrypted connection between the client and server, significantly reducing the risk of data interception. Implementing firewall rules can help control incoming and outgoing traffic and create barriers against unauthorized access, but they don't inherently encrypt the data being transmitted, hence they work in conjunction with other measures. Utilizing strong encryption protocols is essential for ensuring that even if data is intercepted, it remains unreadable to unauthorized users. Thus, these countermeasures are effective against sniffing attacks, while relying on HTTP is a vulnerability rather than a protective measure.