An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Shoulder surfing, because the attacker is watching the screen from nearby.

Shoulder surfing requires physically observing information, usually over someone's shoulder, rather than sending a deceptive email.

Tailgating, because the attacker is trying to enter a secure area physically.

Tailgating involves following someone into a restricted physical space, not sending an email request for a secret code.

DDoS, because the message is designed to overwhelm the mailbox server.

A distributed denial-of-service attack floods a service with traffic; it does not rely on impersonation or secret-code theft.

What does this SY0-701 question test?

OSPF neighbours must agree on key parameters.

What is the correct answer to this question?

The correct answer is: Pretexting, because the attacker is using a fake identity and story to gain trust. — This is pretexting. The attacker creates a false scenario and impersonates a trusted support role to convince the target to reveal sensitive information. One-time verification codes should never be shared with someone who contacts you unexpectedly, even if the request sounds technical or urgent. Recognizing the fake story behind the request is the key security skill here. Why others are wrong: Tailgating and shoulder surfing are physical attacks, not email-based deception. DDoS is a service-disruption attack and does not involve social manipulation for credentials or codes. The scenario depends on a fabricated identity and story, which is the hallmark of pretexting.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.