100-140 Question 355
Select 3A caller claiming to be a senior manager contacts the help desk and requests immediate access to an internal system due to an 'urgent business need.' The caller provides some basic personal details, such as their name and job title, which match public company records. As a help desk technician, what should you do to handle this situation appropriately?
- A
Verify the caller's identity through established internal procedures before granting access.
- B
Immediately grant access since the caller's job title suggests they hold a senior position.
- C
Politely decline the request and report the incident to your supervisor or security team.
- D
Ask detailed questions about the urgency of the request to assess its legitimacy.
- E
Request additional verification, such as a confirmation email from their company account, before proceeding.
Show answer and explanation
Correct answers: A, C, E
Explanation
Help desk technicians are prime targets for social engineering attacks because they often handle sensitive access requests. Verifying the caller's identity, escalating suspicious requests, and requiring additional verification are essential steps to protect the organization from potential security breaches. Granting access without proper verification can expose the organization to unauthorized access and potential data breaches.
- A. Correct.
Verifying the caller's identity through established procedures is a critical step in preventing unauthorized access and mitigating social engineering attacks.
- B. Incorrect.
Granting immediate access without verification is risky and against best practices, as job titles can easily be fabricated or misused.
- C. Correct.
Declining the request and escalating the incident to a supervisor or security team ensures that the situation is handled appropriately and minimizes potential security risks.
- D. Incorrect.
While asking about the urgency of the request might provide additional context, it is not a reliable method to verify the authenticity of the caller.
- E. Correct.
Requesting additional verification, such as an email confirmation, ensures there is a record of the request and adds another layer of security.