What is a description of a social engineering attack?

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

Drag and drop the type of evidence from the left onto the description of that evidence on the right.