During a security audit, a company discovers that an unauthorized individual gained access to employee accounts by pretending to be IT support over the phone. Which type of attack is this?

Rationale

Social engineering is the type of attack described in the scenario.

Social engineering exploits human psychology to manipulate individuals into divulging confidential information. In this case, the unauthorized individual impersonated IT support, leveraging trust to gain access to employee accounts.

A (SQL injection) YOUR ANSWER

SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting malicious SQL queries. This attack targets databases directly rather than manipulating individuals, making it irrelevant to the scenario involving phone impersonation.

B (Social engineering) CORRECT

Social engineering encompasses tactics where attackers deceive individuals into providing sensitive information or access. The scenario clearly illustrates this tactic, as the attacker pretended to be IT support, using deception to gain trust and unauthorized access to accounts.

C (Brute-force) YOUR ANSWER

A brute-force attack involves systematically trying all possible combinations to guess passwords or encryption keys. This method relies on computational power rather than psychological manipulation, distinguishing it from the scenario where the attacker used impersonation over the phone.

D (Man-in-the-middle) YOUR ANSWER

A man-in-the-middle attack occurs when an attacker intercepts communication between two parties, often to eavesdrop or alter messages. This attack does not apply to the scenario, which focuses on direct impersonation and manipulation rather than intercepting communications.

Conclusion

The scenario exemplifies social engineering, where the attacker impersonated IT support to deceive employees into granting access to their accounts. Unlike other attack methods such as SQL injection, brute-force, or man-in-the-middle, social engineering specifically targets the human element, highlighting the importance of awareness and training to mitigate such risks in security protocols.

During a security audit, a company discovers that an unauthorized individual gained access to employee accounts by pretending to be IT support over the phone. Which type of attack is this?

Social engineering is the type of attack described in the scenario.

Related Questions

Related Quizzes

How familiar were you with this question?

Report an Issue

Rate this Practice Test