N10-009 Question 270
Select 1Social engineering: Phishing, Dumpster diving, Shoulder surfing, TailgatingA network administrator notices that printed visitor logs, old network diagrams, and help desk notes with partial usernames are being thrown into an unlocked recycling bin outside the building. During the same week, an employee reports that an unfamiliar person entered the office by following closely behind staff through a badge-controlled door while carrying boxes. Which two social engineering attacks are most clearly represented in this scenario?
- A
Phishing and vishing
- B
Dumpster diving and tailgating
- C
Shoulder surfing and impersonation
- D
Whaling and dumpster diving
- E
Tailgating and shoulder surfing
Show answer and explanation
Correct answer: B
Explanation
This scenario combines two classic physical/social engineering risks: dumpster diving and tailgating. Dumpster diving occurs when attackers search improperly discarded materials for useful information such as diagrams, logs, usernames, phone lists, or procedural notes. Even partial information can support later attacks, including phishing, password guessing, or impersonation. Tailgating occurs when an unauthorized person enters a restricted area by following an authorized user through a secure entrance without using their own credentials. Network+ objectives commonly test recognition of these attack methods in realistic workplace situations. Best practices include using cross-cut shredding or secure document destruction bins for sensitive paper records, enforcing clean-desk and media disposal policies, training employees not to hold doors open for unknown individuals in secured areas, and requiring all visitors to be escorted and visibly badged. These controls align with standard physical security and security awareness guidance promoted in enterprise security programs and common industry frameworks.
- A. Incorrect.
Incorrect. Phishing and vishing are attacks that rely on fraudulent email, messages, or phone calls to trick users into revealing information or taking unsafe actions. The scenario describes exposed physical documents in a trash/recycling area and unauthorized physical entry through a secured door, not email or phone-based deception.
- B. Correct.
Correct. Dumpster diving is the practice of retrieving sensitive information from discarded materials such as visitor logs, notes, diagrams, or other documents that were not properly destroyed. Tailgating occurs when an unauthorized person gains physical access to a secure area by closely following an authorized employee through an access-controlled entrance. Both are directly described in the scenario.
- C. Incorrect.
Incorrect. Shoulder surfing involves observing someone enter credentials or view sensitive information, typically by looking over their shoulder or from a nearby vantage point. While impersonation can be involved in some physical intrusion attempts, the scenario specifically emphasizes following someone through a badge-protected door, which is tailgating, and collecting information from discarded materials, which is dumpster diving.
- D. Incorrect.
Incorrect. Whaling is a targeted form of phishing aimed at high-profile executives or senior leaders. The scenario does include dumpster diving, but there is no indication of a targeted email scam against executives. This option mixes one correct concept with one unrelated attack type.
- E. Incorrect.
Incorrect. Tailgating is present, but shoulder surfing is not. No one is described as observing a user type credentials, read confidential material on a screen, or enter information at a workstation. The discarded documents point to dumpster diving instead.