A penetration tester calls human resources and begins asking open-ended questions Which of the following social engineering techniques is the penetration tester using?

Interrogation implies a confrontational, direct line of questioning under some authority or pressure, which is not described here.

Elicitation involves drawing out sensitive information through guided, open-ended questions in a natural conversational context - a classic technique used against HR, receptionists, and help desk staff. The penetration tester is not overtly pretending to be someone else or sending written communications; they are using conversational prompts to get the target to voluntarily disclose information.

Impersonation requires the attacker to actively pose as another person or entity, which is not indicated in this scenario.

Spear phishing is a targeted phishing attack delivered via electronic communication such as email, not a live phone-based conversation.