When an attacker tries to gain access to a system by tricking users into providing access information.

• A. Phishing
• B. Shoulder Surfing
• C. Social Engineering
• D. Brute Force

Answer: (C)

Social engineering is the manipulation of people to reveal confidential information or grant access, by exploiting trust, fear, or curiosity. The scenario describes an attacker trying to obtain credentials by convincing a user to share them, which is a classic example of manipulating the human element to bypass security controls. Phishing is a common tactic within social engineering that uses deceptive messages to trick someone into giving up credentials, but the broader idea here is the act of deceiving people to gain access, which makes social engineering the correct overarching concept. Shoulder surfing involves simply observing someone enter a password, which is not deception aimed at getting the information, and brute force relies on automated guessing rather than tricking a person.