A city help-desk clerk resets a privileged password after a caller claims to be the CIO and cites an urgent council meeting. Enterprise Security shows no exploit payload, no C2 session, and no stolen token. Which term correctly classifies this attack?

In a city help-desk scenario, a caller impersonates the CIO, cites an urgent council meeting, and induces a privileged password reset while Enterprise Security shows no exploit payload, no C2 session, and no stolen token. The correct classification is social engineering: psychological manipulation that causes staff to take an unsafe civic action. Civic framing matters because municipal identity resets often begin with human pressure rather than a packet exploit, and the SOC must name the attack by the behavior that actually occurred.

Labeling the event a supply-chain attack that replaced a vendor library on the help-desk workstation fails by concept: supply-chain compromise alters software or firmware delivery, and no library swap is in evidence. Calling it a denial-of-service flood that exhausted the city's identity provider fails by concept: DoS damages availability of a service, whereas this case produced an unauthorized reset, not an outage. Inventing a command-and-control channel after a packet-level exploit of the clerk PC fails by concept: ES explicitly lacks payload, beacon, and token theft, so inventing host exploit and C2 contradicts the telemetry.

Exam caveat: SPLK-5001 objective 2.2 treats social engineering as its own attack term—do not force-fit a familiar malware or C2 notable when the only successful path was human manipulation of civic staff.

Operational check: Pull help-desk ticket, voice, and identity-provider reset logs for the CIO-claimed call, confirm the reset path and approvals, classify the incident as social engineering, and tighten call-back verification for privileged civic accounts before closing the case.