Examkin

Question

Difficulty: HardSocial Engineering and Threat Types

A system administrator at a software development firm receives reports that remote employees received branded promotional USB flash drives in the mail labeled 'Q3 Firmware Update'. Simultaneously, physical security audit logs show an unauthorized individual entered the facility by presenting a fake service contractor badge and bringing coffee for the reception staff. Which of the following social engineering threat types are demonstrated in these scenarios? (Select TWO).

  1. BaitingAnswer
  2. ImpersonationAnswer
  3. C
    Watering hole attack
  4. D
    Shoulder surfing
  5. E
    Logic bomb

Answer

The threat vectors demonstrated are baiting (sending physical media lures to entice users) and impersonation (assuming a false identity to bypass security controls).
Baiting involves providing a physical medium (such as malicious USB flash drives disguised as updates) to trick victims into plugging it into their computers. Impersonation involves fraudulently creating a false identity (such as a fake contractor badge) to trick personnel into granting physical access.

Step-by-Step Solution

1
Analyze the mailed USB flash drive incident.
Recognize that sending physical hardware with enticing labels leverages curiosity to compromise systems, which defines baiting.
Baiting uses physical lures to trick users into executing malicious code.
2
Analyze the unauthorized facility access incident.
Recognize that using a fake contractor badge and bringing gifts to gain trust constitutes pretending to be an authorized entity.
Impersonation relies on assuming a fake persona to bypass physical access controls.

Key Concept

Identifying Social Engineering Vectors and Threat Types
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic