Match each enterprise security incident scenario on the left with the corresponding social engineering attack vector or technique on the right.
- An attacker leaves custom USB drives labeled 'Q3 Executive Salary Review' on tables in the corporate cafeteria to trick curious employees into plugging them into company workstations.Baiting
- An attacker fabricates a detailed persona as an external compliance auditor and calls human resources to request temporary administrative access credentials under the guise of an unannounced regulatory review.Pretexting
- An attacker intercepts communication between a firm and its regular supplier, replacing the supplier's legitimate wire transfer payment instructions with attacker-controlled bank details.Invoice Switching
- An attacker sends a highly targeted email directly to the Chief Executive Officer, referencing private board meeting topics to urgently demand a transfer of funds to avoid a fictitious regulatory fine.Whaling
Answer
The correct pairings match: (1) USB drives left in the cafeteria to Baiting; (2) Fictional compliance auditor identity requesting access to Pretexting; (3) Intercepting supplier wire payment details to Invoice Switching; and (4) Highly targeted email aimed at the CEO to Whaling.
Each attack vector is correctly identified by evaluating its delivery channel, target profile, and deception technique: Baiting uses physical curiosity triggers; Pretexting uses a crafted false persona; Invoice Switching alters legitimate transaction details; and Whaling specifically targets high-ranking executives.
Step-by-Step Solution
Key Concept
Social Engineering Attack Classification