Correct Answer: B
Scanning is definitively a very active attack. The attacker will make use of a
scanner to perform the attack, the scanner will send a very large quantity of packets to the
target in order to illicit responses that allows the attacker to find information about the
operating system, vulnerabilities, misconfiguration and more. The packets being sent are
sometimes attempting to identify if a known vulnerability exist on the remote hosts.
A passive attack is usually done in the footprinting phase of an attack. While doing your
passive reconnaissance you never send a single packet to the destination target. You
gather information from public databases such as the DNS servers, public information
through search engines, financial information from finance web sites, and technical
infomation from mailing list archive or job posting for example.
An attack can be active or passive.
An "active attack" attempts to alter system resources or affect their operation.
A "passive attack" attempts to learn or make use of information from the system but does
not affect system resources. (E.g., see: wiretapping.)
The following are all incorrect answers because they are all passive attacks:
Traffic Analysis - Is the process of intercepting and examining messages in order to deduce
information from patterns in communication. It can be performed even when the messages
are encrypted and cannot be decrypted. In general, the greater the number of messages
observed, or even intercepted and stored, the more can be inferred from the traffic. Traffic
analysis can be performed in the context of military intelligence or counter-intelligence, and
is a concern in computer security.
Eavesdropping - Eavesdropping is another security risk posed to networks. Because of the
way some networks are built, anything that gets sent out is broadcast to everyone. Under
normal circumstances, only the computer that the data was meant for will process that
information. However, hackers can set up programs on their computers called "sniffers"
that capture all data being broadcast over the network. By carefully examining the data,
hackers can often reconstruct real data that was never meant for them. Some of the most
damaging things that get sniffed include passwords and credit card information.
In the cryptographic context, Eavesdropping and sniffing data as it passes over a network are considered passive attacks because the attacker is not affecting the protocol, algorithm, key, message, or any parts of the encryption system. Passive attacks are hard to detect, so in most cases methods are put in place to try to prevent them rather than to detect and stop them. Altering messages, modifying system files, and masquerading as another individual are acts that are considered active attacks because the attacker is actually doing something instead of sitting back and gathering data. Passive attacks are usually used to gain information prior to carrying out an active attack."
Wiretapping - Wiretapping refers to listening in on electronic communications on telephones, computers, and other devices. Many governments use it as a law enforcement tool, and it is also used in fields like corporate espionage to gain access to privileged information. Depending on where in the world one is, wiretapping may be tightly controlled with laws that are designed to protect privacy rights, or it may be a widely accepted practice with little or no protections for citizens. Several advocacy organizations have been established to help civilians understand these laws in their areas, and to fight illegal wiretapping.
Reference(s) used for this question:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 6th Edition, Cryptography, Page 865 and http://en.wikipedia.org/wiki/Attack_%28computing%29 and http://www.wisegeek.com/what-is-wiretapping.htm and https://pangea.stanford.edu/computing/resources/network/security/risks.php and http://en.wikipedia.org/wiki/Traffic_analysis
