A caller tells the facilities clerk they are conducting an unannounced physical-security audit for the county and need today’s badge door codes "for the checklist." Which social-engineering technique is primarily in play?

Pretexting invents a fabricated scenario to justify requests for sensitive information or access. Claiming an unannounced physical-security audit and asking for today’s badge door codes "for the checklist" creates a believable bureaucratic story that pressures a facilities clerk to comply. The technique is psychological and process-oriented: the story does the work that malware or exploits would otherwise do.

SQL injection against a permit web application’s database layer is an input-handling vulnerability in software. No web form or database query manipulation appears in this call.

VM escape from a guest Wi-Fi portal virtual machine to the hypervisor is a virtualization isolation failure. The scenario is a human phone interaction, not a guest breaking out of a VM.

Cryptographic downgrade forcing a payment kiosk onto a weak legacy cipher is a crypto/protocol weakness. It has no relationship to collecting badge codes through a fake audit narrative.

Exam caveat: Pretexting is the crafted story; impersonation may accompany it; phishing/vishing/smishing name the delivery channel. A question that emphasizes the invented audit scenario is pointing at pretexting even if the channel is voice. Do not pick a technical vulnerability when the stem is purely social engineering.

Operational check for facilities: never release badge codes or physical access details based on inbound cold calls. Verify auditors through known county contacts, require appointments and credentials, and route unexpected "audit" requests to physical security leadership. Use rotating codes, visitor escorts, and logging so a single social-engineering success cannot silently unlock civic buildings.