Examkin

Question

Difficulty: HardSocial Engineering and Threat Types

A tier 1 helpdesk technician receives an urgent telephone call from an individual claiming to be an executive assistant from corporate headquarters. The caller explains that their supervisor is currently presenting at an off-site conference and urgently needs their multi-factor authentication (MFA) token reset to access financial reports. To establish trust, the caller references internal project codenames and recent organizational changes, leveraging high pressure to convince the technician to bypass standard identity verification protocols. Which of the following social engineering threat types is being executed in this scenario?

  1. PretextingAnswer
  2. B
    Spear phishing
  3. C
    Tailgating
  4. D
    Pharming

Answer

Pretexting is the correct social engineering attack vector because the attacker invented a scenario and persona to trick the technician into granting unauthorized access.
Pretexting occurs when an attacker constructs a fabricated story and impersonates a person in authority (such as an executive assistant) to build trust and persuade the target to violate standard security protocols. The presence of a detailed backstory, voice communication, and insistence on bypassing identity verification are classic indicators of a pretexting attack.

Step-by-Step Solution

1
Analyze the communication channel and attack method in the scenario.
The attack occurs via a voice phone call where an attacker uses a detailed fake identity and backstory.
Identifying the medium (voice phone call) and technique (crafted scenario) isolates the social engineering category.
2
Evaluate the specific tactics used (building trust with insider information, pressuring the technician to bypass procedures).
The attacker established a elaborate backstory (pretext) to convince the technician that bypassing verification was justified.
Pretexting specifically involves inventing a plausible scenario and fake authority role to manipulate victims into unauthorized actions.
3
Differentiate pretexting from digital or physical threat vectors like spear phishing, tailgating, and pharming.
Spear phishing relies on email, tailgating is physical entry, and pharming relies on DNS/traffic redirection.
Eliminating non-matching vectors confirms pretexting as the accurate classification.

Key Concept

Pretexting and Social Engineering Indicators
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic