During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?
Pretexting is a social engineering tactic where an attacker invents a fabricated scenario or identity to manipulate a target into divulging information or granting access. Enforcing strict visitor check-in and verification procedures directly counters pretexting by requiring visitors to present valid identification and verifying their stated purpose against official records or scheduled appointments. This process, often combined with requiring escorts for all visitors, prevents unauthorized individuals from gaining physical access under false pretenses.
Why this answer
The attacker used a fabricated identity (fake ID and clipboard) to create a false scenario—pretending to be a fire inspector—which is the hallmark of pretexting. The best mitigation is to enforce visitor check-in and verification procedures, such as requiring government-issued ID validation and escort policies, to prevent unauthorized access based on fabricated roles.
Exam trap
CompTIA often tests the distinction between pretexting and tailgating, where candidates confuse impersonation with simply following someone through a door; the trap here is that the fake ID and clipboard clearly indicate a fabricated identity (pretexting), not physical piggybacking.
How to eliminate wrong answers
Option A is wrong because tailgating involves an unauthorized person following an authorized person through a secured door without consent, not using a fake identity or pretext. Option B is wrong because phishing is a digital attack using fraudulent emails or messages to steal credentials, not an in-person impersonation with a fake ID. Option D is wrong because baiting involves offering something enticing (e.g., a free USB drive) to trick a victim into installing malware, not impersonating an authority figure to gain physical access.