5.1. Describe Security Threats to the End User, Perform Basic Investigation, and Escalate to the Appropriate Team. 100-140 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A user receives a phone call from someone claiming to be from the IT help desk, asking for their password to 'verify their account.' What type of attack is this?

   • APharming
   • BVishing
   • CShoulder surfing
   • DSmishing
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common characteristic of spam email?

   • AIt is always encrypted
   • BIt is sent from a trusted sender
   • CIt is sent in bulk to many recipients without their consent
   • DIt always contains a malicious attachment
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A user wants to improve their password practices across multiple online accounts. Which approach is most secure and practical?

   • AWrite passwords down in a notebook kept at their desk.
   • BUse a password manager to generate and store unique passwords for each account.
   • CChange passwords monthly to a new variation of the same base word.
   • DUse the same strong password for all accounts to remember it easily.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An attacker sends an email that appears to come from a trusted colleague, but the actual sender address is slightly altered (e.g., jane.doe@example.com vs. jane.doe@examle.com). What technique is being used?

   • ACaller ID spoofing
   • BEmail spoofing
   • CDNS spoofing
   • DIP spoofing
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A user receives an email that appears to be from the company's IT department, stating that their mailbox is over quota and they must click a link to 'verify their account' within 24 hours or lose access. The sender address is 'it-support@company-updates.net', and the email contains several spelling errors. The user is unsure whether to click the link. What should the user do first?

   • AReply to the email asking the sender to confirm their identity, then wait for a reply before clicking.
   • BForward the email to the IT help desk and ask them to verify its legitimacy before taking any action.
   • CClick the link and enter their credentials to avoid losing access, then report any issues to IT.
   • DDelete the email immediately and do not report it, since reporting might expose the user to further risk.
   Reveal Solution Discussion Select an answer first