Social Engineering Response
A help desk technician receives a call from someone claiming to be a contractor whose MFA device was lost during travel. The caller knows the company org chart and asks for a new device enrollment. Which three responses are appropriate? Select three.
Quick Answer
The correct response is to report the interaction to the security team if the call seems suspicious, because bypassing identity verification for MFA device enrollment would undermine the very security that multi-factor authentication provides. The caller’s knowledge of the company org chart is a classic social engineering tactic—it does not prove identity, and a help desk technician must never skip verification steps based on such information. On the Security+ SY0-701 exam, this scenario tests your ability to recognize social engineering response protocols, specifically how to handle MFA device enrollment requests that lack proper authentication. A common trap is assuming that knowing internal details equals legitimacy, but the exam emphasizes that verification must be independent of the caller’s claims. Remember the mnemonic “Verify Before You Re-enroll”—never trust a request just because it sounds informed.
⚠ Common exam trap
Candidates often assume knowledge of internal details (like the org chart) is sufficient proof of identity, but social engineering attacks frequently exploit such information to bypass security controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Refuse to bypass identity verification requirements.
Bypassing identity verification for MFA device enrollment would undermine the security that MFA provides. The caller's knowledge of the org chart does not constitute proof of identity; social engineering attacks often leverage such information. Refusing to bypass verification ensures that only authorized users can enroll new MFA tokens, maintaining the integrity of the authentication process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Refuse to bypass identity verification requirements.
Why this is correct
Knowing internal names is not enough; identity checks must still follow the approved process.
- ✓
Use a known callback number or approved ticketing process to confirm identity.
Why this is correct
A trusted callback or ticket workflow reduces the chance of approving a fraudulent request.
- ✓
Report the interaction to the security team if the call seems suspicious.
Why this is correct
Reporting helps the organization spot social engineering patterns and warn other support staff.
- ✗
Read the current MFA reset code over the phone to speed up recovery.
Why it's wrong here
Sharing one-time codes defeats MFA protections and may enable account takeover.
- ✗
Enroll the new device immediately because the caller knows company names and roles.
Why it's wrong here
Insider-sounding details are a common pretexting tactic and do not prove identity.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An employee receives an email that says, 'This is the CEO. Buy gift cards now and reply with the codes before the meeting starts.' What should the employee do?
easy- A.Reply with the codes because the request appears urgent
- ✓ B.Verify the request through an approved channel and report the message
- C.Forward the email to coworkers so they can watch for similar messages
- D.Delete the email and ignore it without telling anyone
Why B: The email exhibits classic social engineering indicators—spoofed authority, urgency, and a request for non-standard financial transactions (gift cards). The employee must verify the request through an approved communication channel (e.g., a phone call to the CEO's known number) and report the message to the security team for incident response. This aligns with security policy for phishing and business email compromise (BEC) prevention, as per NIST SP 800-61 and organizational security awareness training.
Variation 2. An employee receives a text message claiming their email password expired and asks them to tap a link and confirm a one-time code. Which two responses are appropriate? Select two.
easy- ✓ A.Do not tap the link or share the one-time code
- ✓ B.Report the message through the company's approved security channel
- C.Reply to the sender and ask them to prove they are legitimate
- D.Enter the code to see whether the message is real
- E.Forward the text to coworkers so they can compare it
Why A: This message is a phishing attempt. Tapping the link or sharing the one-time code would allow an attacker to complete credential harvesting or MFA bypass. The appropriate responses are to avoid interacting with the link or code and to report the message through the company's approved security channel so the security team can investigate and respond.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.