GSLC · Question #493
A helpdesk technician received a phone call from an administrator at a remote branch office. The administrator claimed to have forgotten the password for the root account on UNIX servers and asked…
The correct answer is B. Social Engineering attack. A social engineering attack manipulates people through psychological tactics to obtain sensitive information rather than exploiting technical vulnerabilities.
Question
A helpdesk technician received a phone call from an administrator at a remote branch office. The administrator claimed to have forgotten the password for the root account on UNIX servers and asked for it. Although the technician didn't know any administrator at the branch office, the guy sounded really friendly and since he knew the root password himself, he supplied the caller with the password. What type of attack has just occurred?
Options
- AReplay attack
- BSocial Engineering attack
- CBrute Force attack
- DWar dialing attack
How the community answered
(57 responses)- B95% (54)
- C2% (1)
- D4% (2)
Why each option
A social engineering attack manipulates people through psychological tactics to obtain sensitive information rather than exploiting technical vulnerabilities.
A replay attack involves capturing valid network authentication data and retransmitting it to gain unauthorized access, not manipulating a person over a phone call.
Social engineering exploits human trust, authority, or friendliness to bypass security controls without any technical exploitation. The attacker impersonated a legitimate administrator and used a friendly demeanor to persuade the technician to voluntarily disclose the root password. The attack succeeded entirely through psychological manipulation, which is the defining characteristic of social engineering.
A brute force attack systematically attempts all possible password combinations using automated tools until the correct one is found, requiring no human interaction.
War dialing involves automatically scanning ranges of phone numbers to discover modems or systems connected to phone lines, not deceiving individuals into revealing credentials.
Concept tested: Social engineering via phone-based impersonation
Source: https://csrc.nist.gov/glossary/term/social_engineering
Topics
Community Discussion
No community discussion yet for this question.