Which description best defines social engineering?

• A. A method for gaining unauthorized access to a computer system in which an attacker hides near the target to obtain sensitive information that they can use to facilitate their intended scheme
• B. A method for gaining unauthorized access to a computer system in which an attacker searches through large quantities of available data to find sensitive information that they can use to facilitate their intended scheme
• C. A method for gaining unauthorized access to a computer system in which an attacker deceives victims into disclosing personal information or convinces them to commit acts that facilitate the attacker's intended scheme
• D. A method for gaining unauthorized access to a computer system in which an attacker bypasses a system's security through the use of an undocumented operating system and network functions

Answer: (C)

Social engineering relies on manipulating people rather than breaking in through technical means. The attacker uses deception to get someone to disclose credentials or personal information, or to perform actions that enable the attack. That is exactly what the description highlights: tricking victims into sharing information or taking steps that support the attacker’s plan.

Other options describe non-human-focused tactics. One depicts approaching the target to observe or obtain information, which is about physical proximity and shoulder-surfing rather than deception. Another involves combing through data with tools to find sensitive information, a technically oriented information-gathering method. The last describes bypassing security with an undocumented operating system and network functions, which is a technical exploit rather than manipulating people.

Understanding social engineering helps emphasize the importance of verification, awareness training, and clear procedures to protect against human-driven breaches.