PT0-001 · Question #53
An email sent from the Chief Executive Officer (CEO) to the Chief Financial Officer (CFO) states a wire transfer is needed to pay a new vendor. Neither is aware of the vendor, and the CEO denies…
The correct answer is B. Principle of authority. This attack is a Business Email Compromise (BEC) where an attacker spoofed the CEO's email to pressure the CFO into authorizing a fraudulent wire transfer. The attacker exploited the CEO's organizational authority to bypass skepticism.
Question
An email sent from the Chief Executive Officer (CEO) to the Chief Financial Officer (CFO) states a wire transfer is needed to pay a new vendor. Neither is aware of the vendor, and the CEO denies ever sending the email. Which of the following types of motivation was used in this attack?
Options
- APrinciple of fear
- BPrinciple of authority
- CPrinciple of scarcity
- DPrinciple of likeness
- EPrinciple of social proof
How the community answered
(61 responses)- A7% (4)
- B89% (54)
- C2% (1)
- E3% (2)
Why each option
This attack is a Business Email Compromise (BEC) where an attacker spoofed the CEO's email to pressure the CFO into authorizing a fraudulent wire transfer. The attacker exploited the CEO's organizational authority to bypass skepticism.
The principle of fear involves threatening negative consequences to coerce action; this attack used the CEO's title and position, not a threat of harm or punishment.
The attacker impersonated the CEO, a high-ranking executive, to issue a directive to the CFO. This exploitation of hierarchical authority causes the target to comply without independently verifying the request, making the principle of authority the defining social engineering technique used in this attack.
The principle of scarcity creates urgency by implying limited time or availability; no such scarcity tactic is described in the scenario.
The principle of likeness exploits trust built through perceived shared interests or relationships; the attacker used positional authority, not manufactured similarity.
The principle of social proof relies on implying that many others are taking an action to influence the target; there is no indication that technique was used here.
Concept tested: Social engineering - principle of authority in BEC
Source: https://csrc.nist.gov/glossary/term/social_engineering
Topics
Community Discussion
No community discussion yet for this question.