Threats, Vulnerabilities, and Mitigations

An employee at a corporate office scans their access badge to open a secured entrance door. Immediately after, an unidentified individual without a badge walks inside right behind the employee before the door closes. Which of the following social engineering attacks is best demonstrated in this scenario?

An employee attempting to navigate to an external vendor portal mistypes the domain name in the web browser address bar and is redirected to a fraudulent site designed to mimic the authentic login screen. Which of the following attack vectors is demonstrated in this scenario?

Match each social engineering principle of influence on the left with its corresponding enterprise attack scenario description on the right.

An organization's security team detects an unauthorized login to a corporate account. Incident analysis reveals that the compromised employee received an SMS notification on their mobile device claiming to be from the IT helpdesk, warning that their account access would be revoked unless verified immediately via a provided URL. The link directed the user to a fraudulent authentication portal where their credentials were captured. Which social engineering attack vector initiated this security incident?

A field technician working at a remote facility discovers several corporate-branded USB flash drives left on tables in the facility's cafeteria. Each drive is labeled with the text "Q3 Executive Compensation & Bonus Allocations - Confidential." Driven by curiosity, the technician plugs one of the drives into a corporate network workstation to view the contents, triggering an automatic payload execution that harvests local account credentials. Which type of social engineering attack vector did the threat actor utilize in this scenario?

A receptionist at an enterprise regional office receives a phone call from an individual claiming to be a technician from the building management company. The caller states that an urgent HVAC emergency requires immediate physical access to the server room key box and asks the receptionist to read the emergency access PIN code over the phone. The caller provides fake ticket numbers and references real facility manager names to build credibility. Which of the following social engineering techniques did the attacker primarily execute in this scenario?

Match each social engineering attack vector or influence principle on the left with the enterprise incident scenario on the right that best demonstrates its execution.

An accounts payable specialist receives an urgent email that appears to originate from the organization's Chief Financial Officer (CFO). The message references an undisclosed legal settlement and directs the specialist to immediately wire $45,000 to an external account, explicitly instructing them to bypass normal dual-authorization procedures to meet a strict deadline. Investigation reveals the message originated from an external domain registered to mimic the enterprise domain by substituting the letter 'o' with the number '0'. Which of the following attack types is best described in this scenario?

An organization's security operations center (SOC) detects an incident where an employee received a text message on their mobile phone containing an urgent link to verify their corporate single sign-on (SSO) credentials on a fraudulent domain. Shortly after, an unknown attacker calls the IT helpdesk, posing as the employee and using previously gathered personal details to request an account recovery passcode. Which of the following social engineering vectors were directly utilized in this attack scenario? (Select TWO.)

During a routine audit, an incident response team discovers that multiple remote employees entered their domain credentials into a web page that visually duplicated the organization's authentic single sign-on (SSO) portal. Investigation reveals that the domain name used in the attack was registered by an external third party and contained a single transposed letter relative to the official enterprise URL. Which social engineering attack vector was directly executed in this scenario?