In social engineering risk scenarios, how should a TA protect user access?

In social engineering risk scenarios, how should a TA protect user access?

• A. Rely only on strong passwords and ignore user education.
• B. Prohibit all external communications to users.
• C. Provide ongoing awareness training, implement multi-factor authentication, and enforce verification steps for sensitive actions.
• D. Grant access on first contact to reduce delays.

Answer: (C)

Protecting access in social engineering contexts requires layered defenses that address both people and technology. Ongoing awareness training helps users recognize phishing, pretexting, and other manipulation attempts, so they don’t disclose credentials or perform risky actions. Multi-factor authentication adds a second hurdle beyond password, meaning stolen credentials alone aren’t enough for access. Enforcing verification steps for sensitive actions creates an additional gate—whether through out-of-band checks or additional identity confirmation—so even if someone dupes a user, they still can’t complete a risky operation without proper verification. Relying only on strong passwords leaves the human element exposed to manipulation. Trying to block all external communications is neither practical nor desirable, since legitimate interactions are sometimes necessary and manageable with training and controls. Granting access immediately upon contact is precisely what attackers exploit; verification is essential before granting access.

Protecting access in social engineering contexts requires layered defenses that address both people and technology. Ongoing awareness training helps users recognize phishing, pretexting, and other manipulation attempts, so they don’t disclose credentials or perform risky actions. Multi-factor authentication adds a second hurdle beyond password, meaning stolen credentials alone aren’t enough for access. Enforcing verification steps for sensitive actions creates an additional gate—whether through out-of-band checks or additional identity confirmation—so even if someone dupes a user, they still can’t complete a risky operation without proper verification.

Relying only on strong passwords leaves the human element exposed to manipulation. Trying to block all external communications is neither practical nor desirable, since legitimate interactions are sometimes necessary and manageable with training and controls. Granting access immediately upon contact is precisely what attackers exploit; verification is essential before granting access.