Examkin

Question

Difficulty: HardSocial Engineering Attacks and Vectors

During a security review at a healthcare facility, security logs reveal that multiple remote clinical staff members received short message service (SMS) communications claiming to originate from the organization's IT department. The text messages asserted that an urgent system update required recipients to immediately click an enclosed link and re-authenticate to prevent loss of Electronic Health Record (EHR) system access. Which social engineering attack vector was executed, and which technical control provides the most robust protection against credential compromise resulting from this attack?

  1. Smishing; enforcing phishing-resistant Multi-Factor Authentication (MFA) using FIDO2/WebAuthn hardware keys.Answer
  2. B
    Spear phishing; configuring host-based firewall rules to restrict outbound communication ports on clinical devices.
  3. C
    Vishing; deploying network-based intrusion detection systems (NIDS) at the enterprise perimeter.
  4. D
    Watering hole attack; implementing DNS sinkholing to resolve malicious external domains to internal loopback addresses.

Answer

Smishing; enforcing phishing-resistant Multi-Factor Authentication (MFA) using FIDO2/WebAuthn hardware keys.
The scenario describes social engineering delivered via SMS text messages, which is the definition of smishing. The most effective technical mitigation against credential harvesting resulting from social engineering is phishing-resistant Multi-Factor Authentication (MFA), such as FIDO2/WebAuthn, because it cryptographically binds authentication requests to the official domain name, preventing successful authentication on rogue phishing sites.

Step-by-Step Solution

1
Analyze the attack delivery vector described in the scenario.
The communications were sent via SMS text messaging to mobile devices, which defines smishing (SMS phishing).
Identifying the medium (SMS vs. email vs. voice call vs. compromised website) distinguishes smishing from spear phishing, vishing, or watering hole attacks.
2
Identify the primary psychological and operational risk associated with the payload.
The text message relies on urgency and intimidation to trick users into submitting login credentials to a spoofed web portal.
Understanding the threat vector goal (credential harvesting) dictates selecting a technical mitigation that enforces authentication binding.
3
Evaluate technical mitigation controls for credential compromise.
Phishing-resistant MFA (such as FIDO2/WebAuthn hardware tokens) binds authentication to the specific legitimate origin domain, ensuring credentials and OTP codes cannot be relayed or captured by adversary-controlled phishing sites.
Standard SMS or push-notification MFA can be bypassed by adversary-in-the-middle (AITM) phishing kits, whereas FIDO2 cryptographic origin binding effectively eliminates credential theft.

Key Concept

Smishing Vectors and Phishing-Resistant MFA Controls
Estimated Time:1m 30s
Rate this question

Topics

Social Engineering Attacks and Vectors

More questions from this topic