Which Control Best Counters a Broad Range of Social Engineering Techniques?
A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can match a control to the human-centric nature of social engineering; the trap is choosing a technical monitoring tool (EDR, honeypot) because the scenario is already framed around existing technical defenses.
Social engineering attacks target human behavior, so a corporation already running signature-based IDS and network flow analysis still lacks the one control aimed at the human layer. This page confirms that regular employee awareness training is the correct next step and explains why the technical options fall short.
Picking the honeypot (B) or endpoint detection and response (A) because they sound more 'security-forward'; neither changes the fact that a phishing email, pretexting call or tailgating attempt succeeds only if an employee complies.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Social engineering exploits trust, authority and urgency rather than software flaws, so no IDS signature or flow baseline stops a convincing pretexting call. The scenario already states the organization runs a signature-based IDS for known payloads and network flow analysis for traffic leaving and entering, meaning the technical detection layer is covered. What remains unaddressed is the human layer, which is exactly what option D targets: recurring awareness training that teaches staff to verify requests, spot phishing lures and report suspicious contact. As athicalacker observed, these attacks "rely on manipulating human behavior rather than exploiting technical vulnerabilities", so awareness is the only option here that scales across the broad range of techniques named in the stem.Why the Other Options Are Wrong
Option A, an EDR solution, hardens and monitors endpoints but has no bearing on a phone call to the help desk or an attacker walking in behind a badge-holder. Option B, a honeypot, is a detection and intelligence tool that lures attackers and records their tradecraft — useful research, but it neither prevents a staff member from being manipulated nor covers the corporation's whole workforce. Option C, more guards at key access points, addresses only physical intrusion and tailgating; it does nothing against phishing, vishing, smishing, pretexting or baiting, which dominate the social engineering landscape. Each of these is a narrow technical or physical countermeasure, while the question explicitly asks for a preventive measure against a broad range of techniques.Community Comment Notes
All recorded votes on this item landed on D, and the reasoning in the visible comments is consistent: awareness training is singled out as the control that addresses manipulation of people rather than of systems. One learner simply restated the option text, which reflects how directly EC-Council frames the human-factor answer. Two other comments were removed contributions expressing doubt about the material rather than offering an alternative selection, so they carry no weight against the consensus here.Official Reference
Exam Strategy
When a stem lists technical controls already in place and then asks for the next step against social engineering, eliminate every answer that is another technical or physical sensor. EC-Council repeatedly scores awareness training as the primary preventive control for the human layer, so anchor on the option that changes employee behavior.
Frequently Asked Questions
Why isn't a honeypot the right preventive control against social engineering here?
A honeypot lures and analyzes attackers after they probe the network; it does not stop an employee from being tricked into revealing credentials or granting access.
Does EDR cover social engineering attacks like phishing or pretexting?
Only partially — EDR may catch malicious payloads on an endpoint, but it cannot prevent a user from authorizing a fraudulent wire transfer or disclosing information over the phone.