nerdexam
GIAC

GSLC · Question #255

John works as an IT Technician for PassGuide Inc. One morning, John receives an e-mail from the company's Manager asking him to provide his logon ID and password, but the company policy restricts user

The correct answer is A. Social engineering. Requesting credentials via email by impersonating an authority figure is a classic social engineering attack, manipulating human trust rather than exploiting a technical vulnerability.

Security Awareness & Training

Question

John works as an IT Technician for PassGuide Inc. One morning, John receives an e-mail from the company's Manager asking him to provide his logon ID and password, but the company policy restricts users from disclosing their logon IDs and passwords. Which type of possible attack is this?

Options

  • ASocial engineering
  • BDoS
  • CTrojan horse
  • DReplay attack

How the community answered

(49 responses)
  • A
    92% (45)
  • B
    2% (1)
  • C
    4% (2)
  • D
    2% (1)

Why each option

Requesting credentials via email by impersonating an authority figure is a classic social engineering attack, manipulating human trust rather than exploiting a technical vulnerability.

ASocial engineeringCorrect

Social engineering manipulates individuals into disclosing confidential information by exploiting trust, authority, or urgency without any technical exploit. In this scenario, the attacker impersonates a manager via email to trick John into revealing his logon credentials, which is a textbook phishing or pretexting social engineering technique.

BDoS

A Denial of Service attack overwhelms a system with traffic to make it unavailable - it does not involve tricking users into revealing credentials.

CTrojan horse

A Trojan horse is malware disguised as legitimate software that executes malicious code on a victim's machine, which is not what is described here.

DReplay attack

A replay attack involves capturing and retransmitting valid network authentication tokens or packets, not soliciting credentials through deceptive communication.

Concept tested: Social engineering and phishing via impersonation

Source: https://owasp.org/www-community/attacks/Social_Engineering

Topics

#social engineering#credential theft#phishing#security policy

Community Discussion

No community discussion yet for this question.

Full GSLC Practice