Ethical Hacking Essentials Practice Test

What do you call an attacker who impersonates a system administrator to gather sensitive information?

1. Disgruntled employee

2. Compromised insider

3. Malicious outsider

4. Negligent insider

The correct answer is: Compromised insider

The correct term for an attacker who impersonates a system administrator to gather sensitive information is indeed "compromised insider." This classification refers to an individual within an organization, such as a current or former employee, who has authenticated access and chooses to misuse it. By impersonating a system administrator, this person exploits their understanding of the organization's systems and processes, allowing them to bypass security measures more easily than an outsider would. This scenario highlights the greatest threat from insiders since they often have legitimate access to sensitive information and networks, making detection of their malicious actions more difficult. Compromised insiders can leverage their knowledge of system operations, organizational hierarchy, and access privileges to gather data discreetly, posing significant risks to the organization's information security. In contrast, the other roles outlined—disgruntled employee, malicious outsider, and negligent insider—do not accurately capture the specific act of impersonation as described in the question. A disgruntled employee may wish to harm the organization but may not have the same tactical approach as impersonating an admin. A malicious outsider lacks the internal access and knowledge, whereas a negligent insider does not have the intent to deceive but rather fails to follow protocols or security measures, which differs fundamentally from the purposeful impersonation in question.