312-39 · Question #54
In a large corporation, the HR department receives an urgent email from someone impersonating a high-level executive, requesting immediate transfer of sensitive employee data. The email includes an…
The correct answer is C. Social engineering attack. This is a social engineering attack because the adversary manipulated human trust and urgency to induce an unauthorized action: the transfer of sensitive employee data. The attacker used impersonation, authority pressure (executive pretext), and a controlled “verification”…
Question
In a large corporation, the HR department receives an urgent email from someone impersonating a high-level executive, requesting immediate transfer of sensitive employee data. The email includes an official-looking document and a phone number for verification. Feeling pressured, the HR manager calls the number and “confirms” the request, then transfers the data. Investigation later confirms the email was fraudulent and the executive had no knowledge of the request. What type of attack did the HR department face?
Options
- ACredential theft
- BWeb-based intrusion
- CSocial engineering attack
- DApplication exploit
How the community answered
(36 responses)- A6% (2)
- B3% (1)
- C89% (32)
- D3% (1)
Explanation
This is a social engineering attack because the adversary manipulated human trust and urgency to induce an unauthorized action: the transfer of sensitive employee data. The attacker used impersonation, authority pressure (executive pretext), and a controlled “verification” channel (the attacker’s phone number) to make the request appear legitimate. These are hallmark social engineering techniques, and in many organizations this is categorized under business email compromise (BEC) or executive impersonation fraud. Credential theft is not the primary outcome described; the attacker did not need passwords if they could convince HR to release data directly. Web-based intrusion and application exploit refer to technical exploitation of systems, which is not indicated. From a SOC response perspective, handling social engineering incidents includes immediate containment (stop further transfers, notify legal/HR, preserve email evidence), scoping who else received similar requests, and implementing process controls: out-of-band verification using known trusted channels, call-back procedures, dual approval for sensitive requests, and training to recognize urgency-based manipulation. Therefore, “Social engineering attack” is the correct classification.
Topics
Community Discussion
No community discussion yet for this question.