nerdexam
CompTIA

PT0-002 · Question #203

A private investigation firm is requesting a penetration test to determine the likelihood that attackers can gain access to mobile devices and then exfiltrate data from those devices. Which of the…

The correct answer is A. Send an SMS with a spoofed service number including a link to download a malicious application. To gain access to mobile devices and exfiltrate data via social engineering, sending a malicious application link via a spoofed SMS is the most effective method.

Attacks and Exploits

Question

A private investigation firm is requesting a penetration test to determine the likelihood that attackers can gain access to mobile devices and then exfiltrate data from those devices. Which of the following is a social-engineering method that, if successful, would MOST likely enable both objectives?

Options

  • ASend an SMS with a spoofed service number including a link to download a malicious application.
  • BExploit a vulnerability in the MDM and create a new account and device profile.
  • CPerform vishing on the IT help desk to gather a list of approved device IMEIs for masquerading.
  • DInfest a website that is often used by employees with malware targeted toward x86 architectures.

How the community answered

(30 responses)
  • A
    80% (24)
  • B
    10% (3)
  • C
    7% (2)
  • D
    3% (1)

Why each option

To gain access to mobile devices and exfiltrate data via social engineering, sending a malicious application link via a spoofed SMS is the most effective method.

ASend an SMS with a spoofed service number including a link to download a malicious application.Correct

Sending an SMS from a spoofed service number with a link to download a malicious application leverages social engineering to trick the user into installing malware. Once installed, the malicious application can gain control over the mobile device (access) and subsequently exfiltrate sensitive data, thereby accomplishing both objectives.

BExploit a vulnerability in the MDM and create a new account and device profile.

Exploiting a vulnerability in MDM to create accounts is a technical exploit, not a social-engineering method.

CPerform vishing on the IT help desk to gather a list of approved device IMEIs for masquerading.

Performing vishing to gather a list of device IMEIs is a social engineering reconnaissance technique, but it does not directly enable access to mobile devices or data exfiltration from them.

DInfest a website that is often used by employees with malware targeted toward x86 architectures.

Infesting a website with malware targeted toward x86 architectures is a technical attack primarily aimed at desktops/laptops (not mobile devices which typically use ARM) and is not strictly a social engineering method for mobile devices.

Concept tested: Mobile social engineering, smishing, malware delivery

Source: https://www.cisa.gov/news-events/news/new-cybersecurity-alert-cisa-and-fbi-warn-sms-phishing-and-smishing-attacks

Topics

#Social engineering#Mobile device security#Smishing#Malware delivery

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice