The correct answer is B. Social Engineering because the attacker’s primary method is manipulating people—not exploiting a technical vulnerability—to obtain information that can enable initial access. In CEH-aligned security concepts, social engineering is defined by the use of deception, impersonation, and psychological influence to persuade victims to reveal sensitive information, perform actions, or bypass normal security procedures. Here, the ethical hacker “poses as a recruiter” on a professional networking site, which is a classic impersonation / pretexting approach. The goal is to build credibility and trust so employees voluntarily disclose internal details that should not be shared externally.
The information gathered—“internal software and VPN setup”—is exactly the sort of intelligence attackers seek during reconnaissance and pre-attack planning. VPN details, remote access workflows, authentication methods, and internal tooling can be used to craft highly convincing phishing messages, identify weak points (such as outdated clients or exposed portals), or target specific employees and administrators. In a real intrusion, this social engineering-driven intelligence collection often precedes credential harvesting, password spraying, MFA fatigue attempts, or tailored malware delivery.
Why the other options are less correct: System and Network Attacks refer to direct technical exploitation such as scanning, sniffing, or attacking services and protocols; the scenario contains none of that. Information Leakage describes the condition where sensitive data is exposed (for example, public documents, misconfigured repositories, error messages), but the scenario focuses on active interpersonal manipulation to extract information. Corporate Espionage is a broader motive/category describing theft of trade secrets, often by competitors or nation-state actors; while social engineering can be used in espionage, the question asks about the method of information gathering, which is clearly social engineering.
Therefore, the threat method demonstrated is social engineering (pretexting/impersonation via a recruiter persona).
