You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email…

Question

Options

• ASocial engineering
• BPiggybacking
• CTailgating
• DEavesdropping

• A
  92% (24)
• C
  4% (1)
• D
  4% (1)

Explanation

Explanation

Option A (Social Engineering) is correct because the entire attack chain relies on psychologically manipulating the receptionist into trusting a fraudulent email - by impersonating her boss (pretexting), gaining her cooperation, and exploiting that trust to deliver malware. Social engineering is defined as manipulating people rather than systems to gain unauthorized access, which precisely describes this scenario.

The distractors are wrong for these reasons:

• Piggybacking (B) involves gaining physical access to a restricted area with someone's knowledge and consent (e.g., someone holds a door open for you)
• Tailgating (C) is similar but done without the person's consent - sneaking through a secured door behind an authorized person; both B and C are physical intrusion techniques, not digital/psychological ones
• Eavesdropping (D) involves passively listening to communications (e.g., intercepting network traffic), not actively deceiving someone

Memory Tip: Think of social engineering as "hacking humans" - any time an attacker uses deception, impersonation, or manipulation of a person (rather than exploiting a technical vulnerability) to gain access, that's social engineering. If it involves a story, a trick, or a disguise to fool someone, choose Social Engineering.

No community discussion yet for this question.