Examkin

Soru

Zorluk: OrtaSocial Engineering Attacks and Vectors

A field technician working at a remote facility discovers several corporate-branded USB flash drives left on tables in the facility's cafeteria. Each drive is labeled with the text "Q3 Executive Compensation & Bonus Allocations - Confidential." Driven by curiosity, the technician plugs one of the drives into a corporate network workstation to view the contents, triggering an automatic payload execution that harvests local account credentials. Which type of social engineering attack vector did the threat actor utilize in this scenario?

  1. BaitingCevap
  2. B
    Watering hole attack
  3. C
    Pretexting
  4. D
    Tailgating

Cevap

Baiting is the social engineering vector utilized when an attacker leaves infected physical media in accessible locations, exploiting human curiosity to induce victims to insert the media into target systems.
Baiting involves leaving a malware-infected physical device (such as a USB drive) in a location where target users are likely to find it. The attacker relies on victim curiosity (heightened by enticing labels like confidential financial documents) to prompt them to connect the device to an enterprise computer.

Adım Adım Çözüm

1
Analyze the attack medium and delivery mechanism described in the scenario.
The attack relies on physical media (labeled USB flash drives) intentionally placed in a public/accessible employee area.
Identifying the medium (physical storage device vs. web browser vs. physical door) narrows down the social engineering category.
2
Evaluate the psychological psychological trigger exploited by the threat actor.
The label 'Q3 Executive Compensation' appeals directly to employee curiosity and greed.
Social engineering tactics manipulate specific human psychological factors; curiosity piqued by high-value labeled media is characteristic of baiting.
3
Match the attack indicators to the specific CompTIA Security+ social engineering taxonomy definition.
Leaving malicious hardware media for an unsuspecting victim to find and insert into a workstation defines a baiting attack.
Distinguishing baiting from watering hole or pretexting ensures accurate vector identification.

Anahtar Kavram

Baiting Attack Vector
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Social Engineering Attacks and Vectors

Bu konudan daha fazla soru