112-52 · Question #142
What is an effective countermeasure against pretexting?
The correct answer is A. Employee awareness training. Employee awareness training (A) is correct because pretexting is a social engineering attack where an attacker fabricates a scenario to manipulate people into divulging information or taking harmful actions - and the only effective defense against human manipulation is educating
Question
What is an effective countermeasure against pretexting?
Options
- AEmployee awareness training
- BUsing strong passwords
- CInstalling antivirus software
- DRegularly updating software
How the community answered
(47 responses)- A94% (44)
- C2% (1)
- D4% (2)
Explanation
Employee awareness training (A) is correct because pretexting is a social engineering attack where an attacker fabricates a scenario to manipulate people into divulging information or taking harmful actions - and the only effective defense against human manipulation is educating humans to recognize and resist it.
Strong passwords (B) protect against unauthorized access to accounts but do nothing when an employee willingly hands over information to a convincing impersonator. Antivirus software (C) detects malware and malicious code, not deceptive conversation. Regularly updating software (D) patches technical vulnerabilities, but pretexting exploits human psychology, not software flaws - no patch fixes gullibility.
Memory tip: Pretexting targets people, not systems - so the countermeasure must also target people. When you see "social engineering," think "training."
Topics
Community Discussion
6
Nina C.Jan 15, 2026The answer is A, employee awareness training, because pretexting is a social engineering attack that targets people, not systems, so teaching employees to recognize manipulation tactics and verify identities is the only control that actually addresses the threat. Technical options like antivirus or strong passwords do nothing when the attacker is just calling someone up and spinning a convincing story.
Marisol A.Dec 28, 2025Kept eyeing D, but pretexting is social engineering so A wins, training stops it cold.
Lena V.Jan 9, 2026D, updated software closes the exploits pretexters use to piggyback their way in.
Marisol A.Jan 10, 2026Lena, piggybacking is a physical access attack, not a software vulnerability, so patching systems does nothing to stop someone from walking through a door behind an authorized employee. A is correct because a mantrap (or similar physical access control) is the control that actually addresses tailgating by requiring each person to authenticate individually before the next door opens.
Orla P.Jan 14, 2026I kept going back and forth on this one but landed on B, because pretexting is ultimately about gaining unauthorized access to accounts or systems through a fabricated story, and if your passwords are strong and unique the attacker has nowhere to go even if they fool someone on the phone.
Nina C.Jan 15, 2026Orla, that reasoning makes sense on the surface, but pretexting does not have to target account credentials at all, so strong passwords would not stop an attacker who is just trying to extract sensitive information or manipulate someone into taking an action, which is why A is the better fit here.