問題文
In one case a message claims to come from the finance director and asks for a payment. In another, a caller claims to be from a supplier and asks a clerk to run a lookup on their behalf using the clerk's own access. Which distinction matters?
選択肢
- The request has to be made from inside the organization network, and both recorded cases require the attacker to already hold valid credentials.
- The first pretends to be someone with authority; the second borrows the authority of the person being asked.
- In both cases a person is again persuaded to act by someone who is not who they claim to be on the recorded call, so there is no meaningful distinction.
- The first borrows the authority of the recipient and the second impersonates a person with authority, because a request for a payment can only be executed by the recipient using the recipient's own approval rights and the impersonation therefore lies in the second case where an external identity is claimed.