EC-Council Certified Security Specialist (ECSS) Practice Test

Social engineering exploits human behavior rather than technical flaws. The form that fits this category best is human-based social engineering, which relies on direct interaction with people—such as impersonation, pretexting, or creating believable scenarios to coax someone into revealing a password or granting access. The attacker uses psychology—trust, authority, urgency—to override security awareness in a person. The other options describe how an attack is delivered or what it targets (machines, devices, or communications), rather than the core tactic of manipulating a person directly. Phishing, while it uses deception, is typically viewed as a channel-based technique that delivers social-engineering tricks electronically rather than the interpersonal manipulation itself.