312-50 Question 208
Single answer▪ Social Engineering ConceptsDuring an authorized social engineering assessment, a company allows phishing tests against employees but prohibits collecting real credentials or causing service disruption. You want to evaluate whether employees will submit sensitive information after clicking a realistic email lure that appears to come from the internal IT help desk. Which approach is the MOST appropriate for meeting the objective while staying within the engagement rules?
- A
Send a spoofed IT password-reset email that links to a cloned login page, record only whether users attempted to submit the form, and immediately display a training message instead of capturing the actual password
- B
Call employees while impersonating the CIO and pressure them to disclose their current VPN password so you can verify whether multifactor authentication blocks unauthorized access
- C
Send a mass email with a malicious attachment that installs a remote access tool, then use the host access to verify whether the user stores sensitive data locally
- D
Create a fake single sign-on portal and store all usernames and passwords in an encrypted database for later analysis, since encrypted storage avoids harm
Show answer and explanation
Correct answer: A
Explanation
The best answer is the controlled phishing simulation that measures user behavior without collecting actual credentials. In a CEH context, social engineering assessments must remain within the rules of engagement, scope, and authorization. A realistic but safe phishing exercise often uses a cloned page that logs only non-sensitive events such as link clicks, attempted submissions, or entered placeholder values, followed by immediate user education. This approach supports the assessment goal while minimizing legal, operational, and ethical risk. Best practices in security awareness testing and penetration testing scoping emphasize explicit authorization, least-impact methods, and avoiding unnecessary collection of sensitive data. Options that request real passwords or deploy malware exceed the stated constraints and would be inappropriate even if technically feasible.
- A. Correct.
Correct. This approach directly tests susceptibility to a phishing pretext and willingness to submit sensitive information, while honoring the rule not to collect real credentials. Recording the submission attempt or using placeholder capture logic is a common, controlled method in authorized awareness assessments. Displaying an immediate educational landing page also aligns with standard phishing simulation best practices.
- B. Incorrect.
Incorrect. This is vishing/social pressure rather than the email-based phishing scenario being requested, and it explicitly asks for the user's real VPN password. That violates the stated restriction against collecting real credentials, even if the tester claims it is for validation.
- C. Incorrect.
Incorrect. Delivering a malicious attachment that installs a remote access tool exceeds the stated objective and introduces unnecessary risk and potential disruption. It moves from social engineering awareness testing into malware deployment and endpoint compromise, which is not justified by the engagement constraints.
- D. Incorrect.
Incorrect. Although the portal is relevant to phishing, storing real usernames and passwords still violates the rule prohibiting collection of real credentials. Encrypting the database does not change the fact that the engagement scope disallowed credential capture in the first place.