312-50 Question 213
Single answer▪ Social Engineering TechniquesDuring an authorized social engineering assessment, a security team wants to evaluate whether employees will disclose internal information over the phone without proper verification. The tester plans to call the finance department while pretending to be a new help desk technician and ask employees to confirm their usernames and the VPN portal URL because of an alleged "mailbox migration issue." Which social engineering technique does this scenario BEST represent?
- A
Pretexting
- B
Tailgating
- C
Shoulder surfing
- D
Dumpster diving
Show answer and explanation
Correct answer: A
Explanation
The best answer is Pretexting because the tester is using a fabricated identity and believable business justification to manipulate employees into disclosing internal information. In CEH and real-world security practice, pretexting commonly occurs through phone calls, emails, or in-person conversations where the attacker impersonates IT staff, vendors, executives, or auditors. This differs from phishing, which is typically message-based and broad in distribution, and from physical techniques such as tailgating or observational techniques such as shoulder surfing. Security awareness guidance from organizations such as NIST emphasizes verification of identity, callback procedures, and limiting disclosure of internal information to validated personnel, which directly addresses this type of attack.
- A. Correct.
Correct. Pretexting is a social engineering technique in which the attacker creates a believable fabricated scenario or identity to persuade the target to disclose information or perform an action. In this case, the caller invents a role as a new help desk technician and a plausible technical issue to gain trust and extract internal details. This is a classic pretext because the success depends on the credibility of the story rather than on technical exploitation.
- B. Incorrect.
Incorrect. Tailgating involves physically following an authorized person into a restricted area without proper authentication, such as entering a secure office behind an employee who badges in. The scenario describes a phone-based deception, not unauthorized physical access.
- C. Incorrect.
Incorrect. Shoulder surfing refers to observing sensitive information by looking over someone's shoulder or from a nearby vantage point, such as watching a user type a password. The scenario does not involve visual observation; it relies on verbal manipulation over the phone.
- D. Incorrect.
Incorrect. Dumpster diving is the practice of searching discarded materials for useful information, such as organizational charts, phone lists, or documents containing sensitive data. Although dumpster diving can support social engineering by providing background information, it is not the primary technique being used in this call scenario.