312-50 Question 50
Single answer▪ Footprinting through Social EngineeringYou are performing a CEH-authorized reconnaissance assessment for a company that has specifically allowed social engineering for information gathering, but not credential theft or malware delivery. The client wants to know whether employees can be manipulated into revealing details that would help an attacker map the internal environment for a later attack. Which action is the MOST appropriate example of footprinting through social engineering within the agreed scope?
- A
Call the help desk while posing as a new remote employee and ask which VPN client, MFA method, and password reset process the company uses
- B
Send a phishing email with a fake SSO login page to capture usernames and passwords for later validation
- C
Drop a USB drive labeled 'Executive Payroll' in the parking lot to see which host executes the payload
- D
Run an aggressive Nmap scan against the internal network to identify exposed services and operating systems
Show answer and explanation
Correct answer: A
Explanation
The best answer is the help-desk pretext call because footprinting through social engineering focuses on eliciting useful organizational, procedural, or technical information from people rather than directly exploiting systems. In real engagements, testers often use pretexting to learn about remote access methods, naming conventions, support workflows, badge procedures, vendor relationships, or security products in use. Those details can later support more targeted attacks, so they are valuable during reconnaissance. CEH material commonly distinguishes social engineering-based footprinting from technical scanning and from prohibited actions such as credential theft or malware deployment unless explicitly authorized. Best practice in professional engagements is to remain strictly within the rules of engagement, document the pretext, minimize risk, and avoid collecting credentials or causing operational impact when the objective is information gathering only.
- A. Correct.
Correct. This is a classic social engineering pretext used to gather organizational and technical details without stealing credentials or delivering malicious content. Asking the help desk about VPN software, MFA enrollment, and reset procedures helps an attacker footprint remote access workflows, support processes, and potential weak points. It aligns with the scenario because the engagement permits social engineering for information gathering only.
- B. Incorrect.
Incorrect. Although phishing is a common social engineering technique, this option attempts to capture usernames and passwords, which the scenario explicitly forbids. It goes beyond footprinting and enters credential harvesting, which is a different and higher-risk activity.
- C. Incorrect.
Incorrect. USB drop attacks are typically used to induce execution of code, malware delivery, or unauthorized system interaction. In this scenario, malware delivery is not allowed. Also, the objective is footprinting through social engineering, not testing endpoint execution behavior with physical media.
- D. Incorrect.
Incorrect. Nmap scanning is a technical footprinting and enumeration method, not social engineering. It may be valid in other phases of an assessment, but it does not meet the requirement to test whether employees can be manipulated into revealing information.