CAS-002 · Question #602
A security administrator has been conducting a security assessment of Company XYZ for the past two weeks. All of the penetration tests and other assessments have revealed zero flaws in the systems…
The correct answer is C. Social engineering. When all technical assessments find no vulnerabilities but data breaches continue, social engineering targeting the human element is the most likely uninvestigated attack vector.
Question
A security administrator has been conducting a security assessment of Company XYZ for the past two weeks. All of the penetration tests and other assessments have revealed zero flaws in the systems at Company XYZ. However, Company XYZ reports that it has been the victim of numerous security incidents in the past six months. In each of these incidents, the criminals have managed to exfiltrate large volumes of data from the secure servers at the company. Which of the following techniques should the investigation team consider in the next phase of their assessment in hopes of uncovering the attack vector the criminals used?
Options
- AVulnerability assessment
- BCode review
- CSocial engineering
- DReverse engineering
How the community answered
(48 responses)- A4% (2)
- B25% (12)
- C63% (30)
- D8% (4)
Why each option
When all technical assessments find no vulnerabilities but data breaches continue, social engineering targeting the human element is the most likely uninvestigated attack vector.
A vulnerability assessment focuses on technical flaws in systems and software, which the prior two weeks of assessment already covered without finding issues.
Code review identifies software vulnerabilities in applications, but the scenario indicates the breaches are not being caused by exploitable code flaws.
Social engineering exploits human behavior rather than technical vulnerabilities, which explains why penetration tests and system assessments found no flaws. Attackers may have used phishing, pretexting, or physical access manipulation to gain credentials or insider assistance, bypassing all technical defenses. Testing for social engineering covers the human attack surface that traditional technical assessments do not evaluate.
Reverse engineering is used to analyze malware or proprietary software internals and is not an appropriate technique for identifying how attackers gained initial access to the organization.
Concept tested: Social engineering as uninvestigated human attack vector
Source: https://csrc.nist.gov/publications/detail/sp/800-115/final
Topics
Community Discussion
No community discussion yet for this question.