Which of the following types of attacks cannot be prevented by technical measures only?

A ping flood is a volumetric DoS attack that can be mitigated technically using rate limiting, ICMP filtering at firewalls, and upstream traffic scrubbing.

Brute force attacks are countered effectively by technical measures such as account lockout policies, multi-factor authentication, and login rate limiting.

Smurf DoS attacks exploit IP-directed broadcasts and spoofed ICMP packets, and can be technically prevented by disabling directed broadcasts on routers and filtering ICMP at network perimeters.

Social engineering exploits human trust and psychology rather than software or network vulnerabilities, so firewalls, IDS/IPS, and encryption cannot stop a user from being manipulated into revealing credentials or granting unauthorized access. Effective defense requires a layered approach combining security awareness training, organizational policies, and a security-conscious culture. No purely technical control can eliminate the human element that social engineering specifically targets.