What is a common tactic used in social engineering to obtain credentials?

What is a common tactic used in social engineering to obtain credentials?

• A. Baiting
• B. Quid pro quo
• C. Phishing
• D. Pretexting

Answer: (C)

The main idea being tested is how attackers trick people into giving up their login credentials. Phishing does this by sending messages that look like they’re from a trusted source—an email, text, or chat message—that urges you to click a link or enter your username and password on a fake login page. The lure often plays on urgency, fear, or a sense of legitimacy, so you’re more likely to act without double-checking. Once you enter credentials, the attacker can use them to access accounts, often across multiple sites if you reuse passwords. This method is the most common and scalable way criminals harvest credentials because a single phishing message can reach thousands of potential victims with relatively little effort, and it can be tailored to mimic banks, tech companies, or IT departments to seem plausible. Other social engineering techniques exist, but they’re different in how they extract information. Baiting relies on a physical or digital lure to tempt someone into taking actions that compromise security; quid pro quo offers something in return for information or access; pretexting builds a fabricated scenario to persuade the target to reveal sensitive details. While these can lead to credential exposure, phishing directly targets credentials at a high volume and with minimal interaction, making it the most effective and widespread method for credential theft. To defend against it, verify links and domains carefully, enable multi-factor authentication, and stay vigilant for typical phishing cues like mismatched sender addresses, generic greetings, or requests for urgent action.

The main idea being tested is how attackers trick people into giving up their login credentials. Phishing does this by sending messages that look like they’re from a trusted source—an email, text, or chat message—that urges you to click a link or enter your username and password on a fake login page. The lure often plays on urgency, fear, or a sense of legitimacy, so you’re more likely to act without double-checking. Once you enter credentials, the attacker can use them to access accounts, often across multiple sites if you reuse passwords. This method is the most common and scalable way criminals harvest credentials because a single phishing message can reach thousands of potential victims with relatively little effort, and it can be tailored to mimic banks, tech companies, or IT departments to seem plausible.

Other social engineering techniques exist, but they’re different in how they extract information. Baiting relies on a physical or digital lure to tempt someone into taking actions that compromise security; quid pro quo offers something in return for information or access; pretexting builds a fabricated scenario to persuade the target to reveal sensitive details. While these can lead to credential exposure, phishing directly targets credentials at a high volume and with minimal interaction, making it the most effective and widespread method for credential theft. To defend against it, verify links and domains carefully, enable multi-factor authentication, and stay vigilant for typical phishing cues like mismatched sender addresses, generic greetings, or requests for urgent action.