Which of the following types of attacks cannot be prevented by technical measures only?

Social engineering attacks - such as phishing calls, pretexting, and impersonation - target human behavior and decision-making rather than system weaknesses. Technical controls cannot prevent an employee from voluntarily revealing credentials to a convincing attacker; prevention requires ongoing security awareness training, organizational policies, and a security-conscious culture.

Smurf DoS attacks can be mitigated technically by configuring routers to block IP-directed broadcast packets and by rate-limiting ICMP traffic.

Brute force attacks can be effectively countered with technical measures such as account lockout policies, multi-factor authentication, and rate limiting.

Ping flood attacks are a volumetric DoS technique that can be mitigated using technical controls like ICMP rate limiting, firewall rules, and upstream traffic filtering.