A DBA receives an urgent call from someone who says they are a regional director traveling to a client meeting. The caller asks the DBA to reset the password on a production reporting login immediately and read the new password over the phone. What should the DBA do?

This is a classic social engineering pattern: an urgent request, a claim of authority and pressure to bypass normal process. The correct response is to follow the established identity verification procedure using an out-of-band channel that the DBA controls rather than one the caller supplies, for example calling back the number listed in the corporate directory, or requiring an approved service ticket, and then delivering any new credential through the approved secure method. Resetting because the caller knows the login name and the director's title accepts information that is often discoverable from organization charts, professional networking profiles or earlier phishing, so it verifies nothing. Sending the password to an email address the caller supplies hands the credential to whoever is on the line, since an attacker will simply provide an address they control. Asking for an employee ID and office location is knowledge-based checking with weak secrets; those details frequently appear on badges, signatures and documents and can be gathered in advance. Exam caveat: the defense against social engineering is procedure and verification, not judgment of how convincing the caller sounds. Operational check: confirm the help-desk and DBA procedures specify callback or ticket verification for credential resets, and that staff are trained to refuse requests that bypass it.