312-50V12 · Question #292
An attacker can employ many methods to perform social engineering against unsuspecting employees, including scareware. What is the best example of a scareware attack?
The correct answer is C. A pop-up appears to a user stating, "Your computer may have been infected with spyware. Click. Scareware is a social engineering technique that uses fear-inducing messages to trick users into taking a harmful action, typically by falsely warning them of a security threat on their system.
Question
Options
- AA pop-up appears to a user stating, "You have won a free cruise! Click here to claim your prize!"
- BA banner appears to a user stating, "Your account has been locked. Click here to reset your
- CA pop-up appears to a user stating, "Your computer may have been infected with spyware. Click
- DA banner appears to a user stating, "Your Amazon order has been delayed. Click here to find out
How the community answered
(48 responses)- A2% (1)
- B6% (3)
- C90% (43)
- D2% (1)
Why each option
Scareware is a social engineering technique that uses fear-inducing messages to trick users into taking a harmful action, typically by falsely warning them of a security threat on their system.
This describes a prize or reward lure, which is a form of phishing or baiting that uses greed and excitement rather than fear as the psychological trigger.
This is an example of a credential harvesting or account-takeover phishing attack that mimics a legitimate account lockout notice, not a scareware attack based on security threat intimidation.
This is the quintessential scareware example because it uses a fabricated security threat - a fake spyware infection warning - to frighten the user into clicking a malicious link. Scareware specifically leverages fear of system compromise or data loss to manipulate victims, often leading them to download malware disguised as security software. The psychological trigger is urgency and fear related to the integrity of the user's own device.
This is a phishing lure that impersonates a trusted brand (Amazon) using a delivery pretext to induce clicks, relying on curiosity or concern about a purchase rather than fear of a security threat.
Concept tested: Identifying scareware as a social engineering method
Source: https://www.cisa.gov/news-events/news/recognizing-and-avoiding-email-scams
Topics
Community Discussion
No community discussion yet for this question.