220-1102 Practice Question: A technician is investigating a data breach and…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Tailgating

  Why it's wrong here

  Tailgating, also known as piggybacking, is a social engineering technique where an unauthorized individual gains entry to a restricted area by closely following an authorized person through a controlled access point, such as a door requiring a badge or keycard. This method exploits human courtesy or inattention, as the authorized person may hold the door open without verifying the second individual's credentials. It is a direct physical intrusion, distinct from retrieving discarded information.

• ✗

  Shoulder surfing

  Why it's wrong here

  Shoulder surfing is a direct observation technique used to obtain sensitive information, such as PINs, passwords, or credit card numbers, by looking over someone's shoulder while they are actively inputting data or viewing confidential documents. This attack relies on physical proximity and visual access to a target's screen, keyboard, or physical papers, making it a real-time information acquisition method rather than a search of discarded items.

• ✓

  Dumpster diving

  Why this is correct

  Dumpster diving is a social engineering and physical security vulnerability exploitation technique where an attacker sifts through an organization's or individual's discarded trash to find sensitive information. This can include anything from financial statements, employee records, network diagrams, or even sticky notes with passwords, all of which could be used to facilitate further attacks or breaches. It directly involves the recovery of improperly disposed physical documents or media.

• ✗

  Phishing

  Why it's wrong here

  Phishing is a cyberattack method that employs deceptive electronic communications, typically emails or text messages, to trick individuals into revealing sensitive information like usernames, passwords, and credit card details, or to download malicious software. Attackers impersonate trustworthy entities to create a sense of urgency or legitimacy, aiming to manipulate recipients into performing actions that compromise their security, entirely within the digital realm.

Go deeper

Related to this question