PT0-002 Question #336: Real Exam Question with Answer & Explanation

Question

A penetration tester is attempting to get more people from a target company to download and run an executable. Which of the following would be the MOST effective way for the tester to achieve this objective?

Options

• ADropping USB flash drives around the company campus with the file on it
• BAttaching the file in a phishing SMS that warns users to execute the file or they will be locked out
• CSending a pretext email from the IT department before sending the download instructions later
• DSaving the file in a common folder with a name that encourages people to click it

Explanation

The most effective way for the tester to achieve this objective is to send a pretext email from the IT department before sending the download instructions later. A pretext email is an email that uses deception or impersonation to trick users into believing that it is from a legitimate source or authority, such as the IT department. A pretext email can be used to establish trust or rapport with the users, and then persuade them to perform an action or provide information that benefits the attacker. In this case, the tester can send a pretext email from the IT department that informs users about an important update or maintenance task that requires them to download and run an executable file later. The tester can then send another email with the download instructions and attach or link to the malicious executable file. The users may be more likely to follow these instructions if they have received a prior email from the IT department that prepared them for this

No community discussion yet for this question.