IPA IP 2023 Question 89
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問89, translated into English. ITPEC is based on the same exams.
Which of the following is an attack that does not use technical methods, such as impersonating an employee of a company to obtain an ID or a password, or obtaining confidential information from a wastebasket?
Explanation
Social engineering — gaining IDs, passwords or confidential information through people's trust and carelessness rather than through technology.
Both examples in the question target people, not systems: posing as an employee on the phone to make someone tell an ID and password, and searching wastebaskets for discarded documents (trashing). Shoulder surfing, reading a password over someone's shoulder, is another. Because no system flaw is used, the defence is staff training, rules for confirming a caller's identity, and shredding documents.
Answer (b)
Why not others:
- •(a) Zero-day attack — exploits a vulnerability before a fix (patch) is released; a technical attack
- •(c) Social media — services such as SNS where users post and share information; a medium, not an attack
- •(d) Trojan horse — malware disguised as useful software that carries out harmful actions once run; a technical attack
Key rule: If the attack works on a person's trust, haste or carelessness, without breaking into a system, it is social engineering.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.