Which Control Best Counters a Broad Range of Social Engineering Techniques?

312-50v12 By islever Editorial Last updated

Social Engineering

Short answer

D Organize regular employee awareness training so staff can recognize and resist social engineering manipulation.

Question

A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?
  1. Implement endpoint detection and response solution to oversee endpoint activities
  2. Set up a honeypot to attract potential attackers into a controlled environment for analysis
  3. Deploy more security personnel to physically monitor key points of access
  4. Organize regular employee awareness training regarding social engineering techniques and preventive measures Correct Answer

Key Takeaways

The question tests whether you can match a control to the human-centric nature of social engineering; the trap is choosing a technical monitoring tool (EDR, honeypot) because the scenario is already framed around existing technical defenses.

Social engineering attacks target human behavior, so a corporation already running signature-based IDS and network flow analysis still lacks the one control aimed at the human layer. This page confirms that regular employee awareness training is the correct next step and explains why the technical options fall short.

Common mistake: Picking the honeypot (B) or endpoint detection and response (A) because they sound more 'security-forward'; neither changes the fact that a phishing email, pretexting call or tailgating attempt succeeds only if an employee complies.

Expert Analysis

Why the Answer Is Correct

Social engineering exploits trust, authority and urgency rather than software flaws, so no IDS signature or flow baseline stops a convincing pretexting call. The scenario already states the organization runs a signature-based IDS for known payloads and network flow analysis for traffic leaving and entering, meaning the technical detection layer is covered. What remains unaddressed is the human layer, which is exactly what option D targets: recurring awareness training that teaches staff to verify requests, spot phishing lures and report suspicious contact. As athicalacker observed, these attacks "rely on manipulating human behavior rather than exploiting technical vulnerabilities", so awareness is the only option here that scales across the broad range of techniques named in the stem.

Why the Other Options Are Wrong

Option A, an EDR solution, hardens and monitors endpoints but has no bearing on a phone call to the help desk or an attacker walking in behind a badge-holder. Option B, a honeypot, is a detection and intelligence tool that lures attackers and records their tradecraft — useful research, but it neither prevents a staff member from being manipulated nor covers the corporation's whole workforce. Option C, more guards at key access points, addresses only physical intrusion and tailgating; it does nothing against phishing, vishing, smishing, pretexting or baiting, which dominate the social engineering landscape. Each of these is a narrow technical or physical countermeasure, while the question explicitly asks for a preventive measure against a broad range of techniques.

Community Comment Notes

All recorded votes on this item landed on D, and the reasoning in the visible comments is consistent: awareness training is singled out as the control that addresses manipulation of people rather than of systems. One learner simply restated the option text, which reflects how directly EC-Council frames the human-factor answer. Two other comments were removed contributions expressing doubt about the material rather than offering an alternative selection, so they carry no weight against the consensus here.

Official Reference

https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a stem lists technical controls already in place and then asks for the next step against social engineering, eliminate every answer that is another technical or physical sensor. EC-Council repeatedly scores awareness training as the primary preventive control for the human layer, so anchor on the option that changes employee behavior.

Frequently Asked Questions

Why isn't a honeypot the right preventive control against social engineering here?

A honeypot lures and analyzes attackers after they probe the network; it does not stop an employee from being tricked into revealing credentials or granting access.

Does EDR cover social engineering attacks like phishing or pretexting?

Only partially — EDR may catch malicious payloads on an endpoint, but it cannot prevent a user from authorizing a fraudulent wire transfer or disclosing information over the phone.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. athicalacker 👍 2 Answered D
    Regular employee awareness training is crucial in combating social engineering attacks because many of these attacks rely on manipulating human behavior rather than exploiting technical vulnerabilities.
  2. insaniunt 👍 2 Answered D
    D. Organize regular employee awareness training regarding social engineering techniques and preventive measures
  3. [Removed] 👍 1
    Im not certain about the reliability of that information
  4. [Removed] 👍 1
    Im unsure about the accuracy of this statement

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide