220-1102 Question 438
Single answerImpersonationAn employee calls the help desk and says they are the CEO, currently traveling, and locked out of email. The caller pressures the technician to reset the password immediately and to send the temporary password to a personal email address because their company phone is unavailable. The technician notices the caller is unusually urgent and refuses to follow the normal identity verification process. What is the BEST classification of this attack?
- A
Impersonation
- B
Tailgating
- C
Shoulder surfing
- D
Evil twin
Show answer and explanation
Correct answer: A
Explanation
The best answer is impersonation because the attacker is claiming to be a trusted individual in order to convince the technician to bypass standard security controls. In real support environments, attackers often use authority-based pretexts, urgency, and alternate contact methods to pressure staff into resetting passwords or disclosing credentials. A+ Core 2 expects technicians to recognize this as social engineering and to follow established identity verification procedures rather than making exceptions for status or urgency. This aligns with common security best practices such as verifying identity through approved methods, refusing to send credentials to unapproved destinations, and escalating suspicious requests according to company policy. Guidance from organizations such as NIST consistently emphasizes identity verification, least privilege, and adherence to documented procedures to reduce social engineering risk.
- A. Correct.
Correct. This is impersonation: the attacker pretends to be a specific trusted person, in this case the CEO, to manipulate the help desk into performing an action such as a password reset. The urgency, authority, and request to bypass verification are classic social engineering indicators.
- B. Incorrect.
Incorrect. Tailgating is a physical security attack in which an unauthorized person follows an authorized person into a restricted area. This scenario involves a phone-based social engineering attempt, not physical entry.
- C. Incorrect.
Incorrect. Shoulder surfing involves observing someone’s screen, keyboard, or paperwork to gather sensitive information such as passwords or account numbers. No visual observation is taking place here.
- D. Incorrect.
Incorrect. An evil twin is a fraudulent Wi-Fi access point made to look like a legitimate wireless network in order to intercept traffic or credentials. The scenario describes a caller pretending to be an executive, not a wireless attack.