In the context of security, a passive attack is defined as what?

• A. An attempt to disclose information without impacting resources
• B. An unauthorized access that alters system functionality
• C. A threat that affects system integrity
• D. A violation of confidentiality policies

Answer: (A)

A passive attack is characterized by efforts to gain unauthorized access to information without altering any resources or affecting system performance. The primary goal in this type of attack is to gather sensitive data, such as login credentials or confidential communications, while remaining undetected. Since passive attacks do not change the state of the system or the information being accessed, they are often harder to detect than active attacks, which involve modification or destruction of data.

The focus on information disclosure without resource impact is what clearly defines passive attacks in contrast to other types of attacks. Active attacks, for instance, might involve modifying data or disrupting service, which is not the case here. The other definitions provided relate to more aggressive or overt forms of threats to data confidentiality, integrity, and availability, making them unsuitable to describe the nature of passive attacks accurately.