312-50 Question 224
Single answer▪ Social Engineering CountermeasuresA financial services company has seen several successful social engineering attempts in the past quarter. In one case, an attacker called the help desk pretending to be a traveling executive and convinced the analyst to reset the executive's password after answering basic HR-style questions found on social media. In another case, an employee opened a document from a spoofed vendor email because the message referenced a real ongoing project. The security team has budget to implement only one control set this quarter and wants the option that most directly reduces the risk of both attacks. Which countermeasure is the BEST choice?
- A
Deploy mandatory security awareness training with phishing simulations, and require out-of-band identity verification plus callback procedures for password resets and sensitive requests
- B
Block all external email attachments at the mail gateway and require executives to use longer passwords
- C
Publish a policy telling employees not to share company information on social media and rely on managers to enforce it informally
- D
Implement full-disk encryption on all employee laptops and require monthly password changes
Show answer and explanation
Correct answer: A
Explanation
The best answer is the combination of targeted security awareness and strong verification procedures for high-risk requests. Social engineering succeeds by exploiting people and business processes, so the most effective countermeasures combine user education with process controls. In this scenario, the help desk failed because it relied on weak knowledge-based verification, which attackers can often satisfy using public sources such as LinkedIn or company websites. Best practice is to require stronger identity proofing for password resets and privileged requests, such as callbacks to a verified number, manager approval, established verification codes, or other out-of-band methods. For the spoofed vendor email, awareness training and phishing simulation programs help users identify red flags such as domain spoofing, urgency, unexpected attachments, and requests tied to real projects. This aligns with common security guidance from organizations such as NIST, which emphasizes awareness and training programs and robust identity verification processes for account recovery and help-desk workflows. The other options either address only part of the problem or focus on controls that do not directly mitigate social engineering.
- A. Correct.
Correct. This option addresses both social engineering vectors in the scenario: user susceptibility to context-rich phishing emails and help-desk impersonation. Security awareness training with regular phishing simulations helps employees recognize spoofed emails, urgent pretexts, and malicious attachments. Out-of-band identity verification and callback procedures are standard countermeasures for vishing/help-desk scams because they do not rely on easily researched knowledge-based questions such as job title, manager name, or office location. This is the most direct and layered control set for reducing social engineering success across both cases.
- B. Incorrect.
Incorrect. Blocking all external attachments may reduce some phishing risk, but it is operationally disruptive and does not address impersonation of internal users to the help desk. Requiring longer passwords improves password strength, but it does not prevent fraudulent password resets if the reset process itself is weak. The misconception is assuming technical email restrictions and password complexity alone are sufficient against human-targeted attacks.
- C. Incorrect.
Incorrect. Limiting oversharing on social media can reduce information available for pretexting, but a policy by itself is weak without formal training, enforcement, and procedural controls. It also does not directly mitigate spoofed vendor emails or help-desk authentication failures. The misconception here is that reducing public information exposure alone will stop social engineering attempts that also exploit urgency, authority, and process gaps.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest if a device is lost or stolen, and monthly password changes are an older control with limited value against modern social engineering. Neither measure directly prevents an employee from trusting a spoofed email or a help-desk analyst from resetting a password for an impostor. This distractor reflects confusion between endpoint/data protection controls and social engineering countermeasures.