Which social engineering activity is described as part of the penetration test?

Which social engineering activity is described as part of the penetration test?

• A. Tailgating
• B. Phishing
• C. Baiting
• D. Quid pro quo

Answer: (B)

Phishing is the social engineering technique most commonly described as part of a penetration test because it directly targets how people interact with digital communications to access systems. In this approach, testers craft believable emails or messages that appear legitimate and entice recipients to reveal credentials, click a malicious link, or visit a fake login page. This simulates a real attacker’s favored path into an organization, revealing weaknesses in users’ awareness, email defenses, and authentication controls. The goal is to measure how susceptible the workforce is and to validate defenses like training, phishing detection, and multi-factor authentication. Other options are valid social engineering methods, but they focus on different angles. Tailgating targets physical access by following an authorized person into a restricted area. Baiting involves leaving a tempting physical item or download to lure a victim. Quid pro quo offers a service or benefit in exchange for information. While these can be part of broader assessments, phishing best represents how a penetration tester typically emulates a cyber attacker’s workflow and tests awareness across digital channels.

Phishing is the social engineering technique most commonly described as part of a penetration test because it directly targets how people interact with digital communications to access systems. In this approach, testers craft believable emails or messages that appear legitimate and entice recipients to reveal credentials, click a malicious link, or visit a fake login page. This simulates a real attacker’s favored path into an organization, revealing weaknesses in users’ awareness, email defenses, and authentication controls. The goal is to measure how susceptible the workforce is and to validate defenses like training, phishing detection, and multi-factor authentication.

Other options are valid social engineering methods, but they focus on different angles. Tailgating targets physical access by following an authorized person into a restricted area. Baiting involves leaving a tempting physical item or download to lure a victim. Quid pro quo offers a service or benefit in exchange for information. While these can be part of broader assessments, phishing best represents how a penetration tester typically emulates a cyber attacker’s workflow and tests awareness across digital channels.