IPA FE Subject A sample Question 30
A question IPA Japan published in 基本情報技術者試験 科目A サンプル問題 問30, translated into English. ITPEC is based on the same exams.
An illicit act of obtaining passwords or confidential information from people inside an organization by pretending that there is an emergency is classified as which of the following?
Explanation
Social engineering — the attacker deceives a person rather than breaking into a system, using a faked emergency to make an insider hand over passwords or secrets.
Social engineering obtains information by exploiting human trust, haste or carelessness instead of technical weaknesses. A typical case is a phone call claiming to be from a manager or the IT department: “the system is down and I need your password right now”. The pressure of the supposed emergency makes the victim skip the usual checks. Other forms are shoulder surfing and searching through rubbish (trashing).
Answer (a)
Why not others:
- •(b) — a Trojan horse is malware disguised as a useful program, which does harm once it is run; it is software, not deceiving a person by talk
- •(c) — a stepping-stone attack takes over a third party's computer and attacks other targets from it, hiding the real attacker
- •(d) — a brute force attack tries every possible password against a system mechanically, with no human contact
Key rule: If the attack works by tricking a person (impersonation, a false emergency, peeking, trashing), it is social engineering; countermeasures are procedures and staff training, such as never giving out a password over the phone.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.