In which of the following Person-to-Person social engineering attacks does an attacker pretend to be an outside contractor, delivery person, etc., in order to gain physical access to the organization?

Question

Options

• AIn person attack
• BThird-party authorization attack
• CImpersonation attack
• DImportant user posing attack

• A
  7% (2)
• B
  11% (3)
• C
  78% (21)
• D
  4% (1)

Explanation

Impersonation (C) is correct because this attack specifically involves an attacker assuming a false identity - posing as a contractor, delivery driver, or service technician - to deceive staff into granting physical access. The deception hinges on wearing a believable costume or carrying convincing props to bypass physical security controls.

Why the distractors are wrong:

• A (In person attack) is too broad - it describes any face-to-face social engineering, not a specific technique involving disguise.
• B (Third-party authorization attack) involves falsely claiming someone with authority has given permission (name-dropping), not physically disguising oneself.
• D (Important user posing attack) refers to pretending to be an executive or privileged insider (like an IT admin), not an outside party like a contractor.

Memory tip: Think "impersonation = costume party" - the attacker wears a role (uniform, ID badge, clipboard) to blend in as an outsider who belongs there, like a fake FedEx driver walking past reception.

No community discussion yet for this question.