ITPEC IP October 2018 Question 37
Which of the following is a technique for taking advantage of psychological weaknesses or carelessness in order to improperly obtain confidential information?
Explanation
Social engineering — obtaining confidential information by exploiting people's psychology or carelessness rather than a technical flaw.
The attacker targets the person, not the system: phoning a user while posing as the help desk to ask for a password, reading a password over someone's shoulder as it is typed (shoulder surfing), or searching discarded papers for notes (trashing). No program is attacked, so firewalls and patches do not stop it; staff training and rules for verifying callers do.
Answer (c)
Why not others:
- •(a) DoS attack — floods a server with requests to stop its service; it attacks availability, not a person
- •(b) SQL injection — enters crafted SQL into an input field so the application runs unintended database commands
- •(d) Buffer overflow — sends data longer than a program's buffer so it overwrites memory and can run the attacker's code
Key rule: If the weak point being exploited is a human (trust, haste, carelessness), it is social engineering; if it is a program, it is a technical attack.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.