nerdexam
GIAC

GSLC · Question #493

A helpdesk technician received a phone call from an administrator at a remote branch office. The administrator claimed to have forgotten the password for the root account on UNIX servers and asked…

The correct answer is B. Social Engineering attack. A social engineering attack manipulates people through psychological tactics to obtain sensitive information rather than exploiting technical vulnerabilities.

Security Awareness & Training

Question

A helpdesk technician received a phone call from an administrator at a remote branch office. The administrator claimed to have forgotten the password for the root account on UNIX servers and asked for it. Although the technician didn't know any administrator at the branch office, the guy sounded really friendly and since he knew the root password himself, he supplied the caller with the password. What type of attack has just occurred?

Options

  • AReplay attack
  • BSocial Engineering attack
  • CBrute Force attack
  • DWar dialing attack

How the community answered

(57 responses)
  • B
    95% (54)
  • C
    2% (1)
  • D
    4% (2)

Why each option

A social engineering attack manipulates people through psychological tactics to obtain sensitive information rather than exploiting technical vulnerabilities.

AReplay attack

A replay attack involves capturing valid network authentication data and retransmitting it to gain unauthorized access, not manipulating a person over a phone call.

BSocial Engineering attackCorrect

Social engineering exploits human trust, authority, or friendliness to bypass security controls without any technical exploitation. The attacker impersonated a legitimate administrator and used a friendly demeanor to persuade the technician to voluntarily disclose the root password. The attack succeeded entirely through psychological manipulation, which is the defining characteristic of social engineering.

CBrute Force attack

A brute force attack systematically attempts all possible password combinations using automated tools until the correct one is found, requiring no human interaction.

DWar dialing attack

War dialing involves automatically scanning ranges of phone numbers to discover modems or systems connected to phone lines, not deceiving individuals into revealing credentials.

Concept tested: Social engineering via phone-based impersonation

Source: https://csrc.nist.gov/glossary/term/social_engineering

Topics

#social engineering#vishing#password security#identity verification

Community Discussion

No community discussion yet for this question.

Full GSLC Practice