100-140 Question 354
Single answerA help desk technician receives a call from someone claiming to be a senior manager who urgently needs their account password reset to access critical files. The caller pressures the technician by stating that the company will suffer significant losses without immediate access. What should the technician do in this situation?
- A
Reset the password immediately to help the senior manager avoid losses.
- B
Request the caller to send an email from their company email account for verification.
- C
Escalate the request to a supervisor or follow the organization's established policy.
- D
Ask the caller for personal details like date of birth or employee ID to confirm their identity.
Show answer and explanation
Correct answer: C
Explanation
Help desk technicians are prime targets for social engineering attacks. Attackers often use tactics like urgency and authority to manipulate technicians into bypassing security protocols. In this scenario, following the organization's established policy or escalating the request ensures that proper verification steps are taken before proceeding, which significantly reduces the risk of unauthorized access.
- A. Incorrect.
Resetting the password immediately without verifying the caller's identity violates security protocols and leaves the organization vulnerable to social engineering attacks.
- B. Incorrect.
Requesting an email from the caller's company account could add a layer of verification, but it is not sufficient on its own. Sophisticated attackers may spoof emails, making this verification method unreliable.
- C. Correct.
Escalating the request to a supervisor or following organizational policy ensures that the proper security protocols are adhered to, reducing the risk of falling victim to a social engineering attack.
- D. Incorrect.
Asking for personal details like date of birth or employee ID might seem like a verification step but could provide sensitive information to an attacker if they are not already verified.