A county clerk tabletop maps social-engineering attack surfaces for civic centers. Which set best represents common surfaces to inventory?
Select an answer to reveal the explanation.
Short Explanation
Clerks get hit by phone stories, inbox lures, someone sliding in behind a badge, and fake help-desk resets. Crypto ciphers and PLC ladders are other domains—not the SE surface map.
Full Explanation
When a county clerk tabletop inventories social-engineering attack surfaces for civic centers, the practical set is phone, email, physical tailgating at civic centers, and help-desk impersonation. Those channels dominate how clerks and front-of-house staff are influenced: vishing, phishing, piggybacking through controlled doors, and fake IT reset calls. Mapping those surfaces drives realistic controls—call-back procedures, email authentication and reporting, door discipline, and help-desk identity verification.
Limiting the inventory to only encrypted VPN tunnels and disk encryption settings mistakes cryptography hygiene for social-engineering surfaces. Only OT PLC ladder logic and historian databases addresses industrial control content, not clerk-facing SE. Only TLS cipher suites on public websites is a transport-security concern, not the human attack surface the tabletop is scoping.
Exam caveat: domain boundaries matter. SE surface inventories are about human-influence channels; crypto and OT items belong to other control domains unless the scenario explicitly bridges them.
Operational check: produce a civic-center SE surface register listing phone, email, physical entry, and help desk; assign owners and test procedures to each; avoid stuffing unrelated TLS/OT checklist items into the SE tabletop scope.